# JupiterOne Documentation

> JupiterOne is a security and asset intelligence platform. This documentation covers the platform, API references, J1QL, the data model, and integrations.

Source: /

# JupiterOne Documentation

JupiterOne provides continuous monitoring to surface problems impacting critical assets and infrastructure. Secure your attack surface with continuous asset discovery and attack path analysis. Reduce risk, triage incidents, and prioritize vulnerability findings with greater clarity and 85% fewer SecOps resources.

## Get Started

Start configuring your JupiterOne workspace:

[

![](/icons/illustrations/shuttle.svg)![](/icons/illustrations/shuttle.svg)

Assets

Start importing your assets and devices to build out your environment.





](/features/assets/ingesting-assets.md)[

![](/icons/illustrations/puzzle.svg)![](/icons/illustrations/puzzle.svg)

Integrations

Learn more about configuring integrations within your JupiterOne workspace.





](/integrations.md)[

![](/icons/illustrations/orbit.svg)![](/icons/illustrations/orbit.svg)

J1QL

Explore J1QL and querying your data to gain a deeper understanding about your security posture.





](/j1ql.md)[

![](/icons/illustrations/cloud-upload.svg)![](/icons/illustrations/cloud-upload.svg)

API Reference

Interface with JupiterOne's API to programmatically to streamline workflows and tool management.





](/reference.md)

### Join the Community

JupiterOne is used to secure hundreds of organizations. Team up with others in the JupiterOne community using the following resources:

-   [Slack:](https://join.slack.com/t/askj1/shared_invite/zt-9b0a2htx-m8PmSWMbkjqCzF2dIZiabw) A great place for asking questions and sharing ideas.
-   [Twitter:](https://twitter.com/jupiterone) Where we post updates and share content from the JupiterOne community.
-   [GitHub:](https://github.com/jupiterone) JupiterOne ❤️'s Open Source Software!

---

Source: /api/alert-rules

# Alert rules API

An **alert rule** runs one or more J1QL queries on a schedule, evaluates the results against a filter, and runs a configured set of actions when the filter matches. Actions can create alerts, send email or Slack, open Jira tickets, call webhooks, publish to AWS messaging services, and more.

This page covers two things:

-   [**API operations**](#api-operations) — the GraphQL mutations and queries for managing rules programmatically.
-   [**Rule definition reference**](#rule-definition-reference) — the full schema of a rule's body: properties, operations, every action type, the templating language, parameters, and filtering.

Rule [exemptions](#exemptions), which exclude individual entities from a rule's results, are covered under API operations.

For the conceptual product overview, see [Alerts and rules](/features/insights-and-alerts/alerts.md).

## API operations

### List alert instances

Returns the active, inactive, or dismissed alerts produced by your rules.

```graphql
  query ListAlertInstances(
    $alertStatus: AlertStatus
    $limit: Int
    $cursor: String
  ) {
    listAlertInstances(
      alertStatus: $alertStatus
      limit: $limit
      cursor: $cursor
    ) {
      instances {
        id
        accountId
        ruleId
        level
        status
        lastUpdatedOn
        lastEvaluationBeginOn
        lastEvaluationEndOn
        createdOn
        dismissedOn
        lastEvaluationResult {
          rawDataDescriptors {
            recordCount
          }
        }
        questionRuleInstance {
          id
          name
          description
          question {
            queries {
              query
              name
            }
          }
        }
      }
      pageInfo {
        endCursor
        hasNextPage
      }
    }
  }
```

**Variables**:

Filtering for ACTIVE Alerts:

```json
{
  "alertStatus": "ACTIVE"
}
```

Filtering for INACTIVE Alerts:

```json
{
  "alertStatus": "INACTIVE"
}
```

Filtering for DISMISSED Alerts:

```json
{
  "alertStatus": "DISMISSED"
}
```

To apply a limit to the number of results returned, pass a limit variable:

```json
{
  "limit": 10
}
```

To paginate through the results, pass the `endCursor` received in the response as the `cursor` variable in the request. If `endCursor` is `null` then there are no more results to retrieve.

### Create an inline alert rule from J1QL

This operation was formerly named `createQuestionRuleInstance`. That name is now deprecated, and you should update all usages.

```graphql
mutation CreateInlineQuestionRuleInstance(
  $instance: CreateInlineQuestionRuleInstanceInput!
) {
  createInlineQuestionRuleInstance(instance: $instance) {
    id
    name
    description
    version
    pollingInterval
    question {
      queries {
        query
        version
      }
    }
    operations {
      when
      actions
    }
    outputs
  }
}
```

**Variables**:

```json
{
  "instance": {
    "name": "unencrypted-prod-data",
    "description": "Data stores in production tagged critical and unencrypted",
    "version": "v1",
    "pollingInterval": "ONE_DAY",
    "outputs": ["alertLevel"],
    "operations": [
      {
        "when": {
          "type": "FILTER",
          "version": 1,
          "condition": [
            "AND",
            ["queries.unencryptedCriticalData.total", "!=", 0]
          ]
        },
        "actions": [
          {
            "type": "SET_PROPERTY",
            "targetProperty": "alertLevel",
            "targetValue": "CRITICAL"
          },
          {
            "type": "CREATE_ALERT"
          }
        ]
      }
    ],
    "question": {
      "queries": [
        {
          "query": "Find DataStore with (production=true or tag.Production=true) and classification='critical' and encrypted!=true as d return d.tag.AccountName as Account, d.displayName as UnencryptedDataStores, d._type as Type, d.encrypted as Encrypted",
          "version": "v1",
          "name": "unencryptedCriticalData"
        }
      ]
    }
  }
}
```

Note that the recommended interval for query based alert rules (aka a `question`) is `ONE_DAY`. \\

Supported intervals for enterprise customers are: `DISABLED`, `THIRTY_MINUTES`, `ONE_HOUR`, `FOUR_HOURS`, `EIGHT_HOURS`, `TWELVE_HOURS`, `ONE_DAY`, and `ONE_WEEK`.

Free accounts only have access to the `ONE_WEEK` interval by default, but any upgrades to Compliance, Security, or Integrations will provide access to the `ONE_DAY` polling interval too.

### Update an inline alert rule

This operation was formerly named `updateQuestionRuleInstance`. That name is now deprecated, and you should update all usages.

```graphql
mutation UpdateInlineQuestionRuleInstance(
  $instance: UpdateInlineQuestionRuleInstanceInput!
) {
  updateInlineQuestionRuleInstance(instance: $instance) {
    id
    name
    description
    version
    pollingInterval
    question {
      queries {
        query
        version
      }
    }
    operations {
      when
      actions
    }
    outputs
  }
}
```

**Variables**:

```json
{
  "instance": {
    "id": "b1c0f75d-770d-432a-95f5-6f59b4239c72",
    "name": "unencrypted-prod-data",
    "description": "Data stores in production tagged critical and unencrypted",
    "version": "v1",
    "pollingInterval": "ONE_DAY",
    "outputs": ["alertLevel"],
    "operations": [
      {
        "when": {
          "type": "FILTER",
          "version": 1,
          "condition": [
            "AND",
            ["queries.unencryptedCriticalData.total", "!=", 0]
          ]
        },
        "actions": [
          {
            "type": "SET_PROPERTY",
            "targetProperty": "alertLevel",
            "targetValue": "CRITICAL"
          },
          {
            "type": "CREATE_ALERT"
          }
        ]
      }
    ],
    "question": {
      "queries": [
        {
          "query": "Find DataStore with (production=true or tag.Production=true) and classification='critical' and encrypted!=true as d return d.tag.AccountName as Account, d.displayName as UnencryptedDataStores, d._type as Type, d.encrypted as Encrypted",
          "version": "v1",
          "name": "unencryptedCriticalData"
        }
      ]
    }
  }
}
```

Note that the only difference for `update` is the `"id"` property associated with the rule instance. You can modify all settings of a rule instance.

### Create an alert rule by referencing a saved question

```graphql
mutation CreateReferencedQuestionRuleInstance(
  $instance: CreateReferencedQuestionRuleInstanceInput!
) {
  createReferencedQuestionRuleInstance(instance: $instance) {
    id
    name
    description
    version
    pollingInterval
    questionId
    questionName
    operations {
      when
      actions
    }
    outputs
  }
}
```

**Variables**:

```json
{
  "instance": {
    "name": "unencrypted-prod-data",
    "description": "Data stores in production tagged critical and unencrypted",
    "version": "v1",
    "pollingInterval": "ONE_DAY",
    "outputs": ["alertLevel"],
    "operations": [
      {
        "when": {
          "type": "FILTER",
          "version": 1,
          "condition": [
            "AND",
            ["queries.unencryptedCriticalData.total", "!=", 0]
          ]
        },
        "actions": [
          {
            "type": "SET_PROPERTY",
            "targetProperty": "alertLevel",
            "targetValue": "CRITICAL"
          },
          {
            "type": "CREATE_ALERT"
          }
        ]
      }
    ],
    "questionId": "uuid-of-saved-question",
    "questionName": "name-of-saved-question" // either questionId or questionName must be specified
  }
}
```

Note that you must specify either `questionName` or `questionId` in the `instance` for creation.

If you specify both, they must refer to the same question. After the rule is saved, subsequent requests will return both `questionId` and `questionName`.

### Update an alert rule with a referenced question

```graphql
mutation UpdateReferencedQuestionRuleInstance(
  $instance: UpdateReferencedQuestionRuleInstanceInput!
) {
  updateReferencedQuestionRuleInstance(instance: $instance) {
    id
    name
    description
    version
    pollingInterval
    questionId
    questionName
    operations {
      when
      actions
    }
    outputs
  }
}
```

**Variables**:

```json
{
  "instance": {
    "id": "b1c0f75d-770d-432a-95f5-6f59b4239c72",
    "name": "unencrypted-prod-data",
    "description": "Data stores in production tagged critical and unencrypted",
    "version": "v1",
    "pollingInterval": "ONE_DAY",
    "outputs": ["alertLevel"],
    "operations": [
      {
        "when": {
          "type": "FILTER",
          "version": 1,
          "condition": [
            "AND",
            ["queries.unencryptedCriticalData.total", "!=", 0]
          ]
        },
        "actions": [
          {
            "type": "SET_PROPERTY",
            "targetProperty": "alertLevel",
            "targetValue": "CRITICAL"
          },
          {
            "type": "CREATE_ALERT"
          }
        ]
      }
    ],
    "questionId": "uuid-of-saved-question",
    "questionName": "name-of-saved-question"
  }
}
```

Note that the only difference in `update` is the `"id"` property associated with the rule instance. You can modify any of the settings of a rule instance. Updates are not required to specify `questionId` or `questionName`, but you can specify either for `update`, and if you specify both they must refer to the same saved question.

### Delete an alert rule

You can use this operation to delete any rule instance, regardless of whether it uses an inline question or a referenced question.

```graphql
mutation DeleteRuleInstance($id: ID!) {
  deleteRuleInstance(id: $id) {
    id
  }
}
```

**Variables**:

```json
{
  "id": "b1c0f75d-770d-432a-95f5-6f59b4239c72"
}
```

> **NOTE**
> 
> Deleting an alert rule this way does **not** dismiss active alerts already triggered by this rule. It is recommended that you **Disable** the rule from the Rules page instead of deleting one.

### Trigger an alert rule on demand

```graphql
mutation EvaluateRuleInstance($id: ID!) {
  evaluateRuleInstance(id: $id) {
    outputs {
      name
      value
    }
  }
}
```

**Variables**:

```json
{
  "id": "b1c0f75d-770d-432a-95f5-6f59b4239c72"
}
```

### Exemptions

EARLY ACCESS

An **exemption** excludes one entity from a rule's results, so it is left out of the totals the rule's condition is evaluated against and triggers none of the rule's actions. For what exemptions do and which rules can accept them, see [Exemptions](/features/insights-and-alerts/rule-exemptions.md).

Exemptions are not managed by the JupiterOne Terraform provider.

#### Check whether results can be exempted

Ask this before offering an exempt action. Exemptability is a property of **the evaluation whose rows you hold**, not of the rule alone, so `evaluatedRuleVersion` is required: pass the stored result's `collectionOwnerVersion`, which is the rule version that produced those rows.

```graphql
query RuleExemptionEligibility($ruleId: ID!, $evaluatedRuleVersion: Int!) {
  ruleExemptionEligibility(
    ruleId: $ruleId
    evaluatedRuleVersion: $evaluatedRuleVersion
  ) {
    eligible
    reason
    message
    ruleSupported
    evaluationSupported
    queriesMatch
  }
}
```

**Variables**:

```json
{
  "ruleId": "b1c0f75d-770d-432a-95f5-6f59b4239c72",
  "evaluatedRuleVersion": 14
}
```

| Field | Description |
| --- | --- |
| `eligible` | True only when the rule accepts exemptions **and** these results came from the queries it runs now. |
| `reason` | An `ExemptionUnsupportedReason`. Null when eligible. |
| `message` | Display-ready explanation, suitable for showing to a user as-is. Null when eligible. |
| `ruleSupported` | Whether the rule's current queries can accept an exemption at all. |
| `evaluationSupported` | Whether the queries that produced these results could be exempted. |
| `queriesMatch` | Whether those are the same queries. Compared by query text, so renaming, retagging, or rescheduling a rule does not invalidate its results. For a rule that references a saved question, only the question id is compared. |

`eligible: false` with `ruleSupported: false` means the rule can never accept exemptions in its current shape. `eligible: false` with `ruleSupported: true` and `queriesMatch: false` means the rule is fine but these particular results are stale—re-run the rule and exempt from the new results.

`reason: NOT_AVAILABLE` means exemptions are not enabled for the account. Treat it as "the feature is absent" rather than as a refusal.

#### Exempt entities from a rule's results

One call files one decision: the justification, reason, and expiry are shared across every entity in the request, and every row written carries the returned `groupId`.

```graphql
mutation CreateRuleExemptions($input: CreateRuleExemptionsInput!) {
  createRuleExemptions(input: $input) {
    groupId
    exemptions {
      ruleId
      entityId
      entityDisplayName
      justification
      reason
      expiresOn
      status
      createdBy
      createdOn
    }
  }
}
```

**Variables**:

```json
{
  "input": {
    "ruleId": "b1c0f75d-770d-432a-95f5-6f59b4239c72",
    "entities": [
      {
        "entityId": "5f9d1e2c-8a3b-4c7d-9e1f-2a3b4c5d6e7f",
        "entityKey": "arn:aws:ec2:us-east-1:123456789012:instance/i-0abc123",
        "entityScope": "d4e5f6a7-b8c9-4d0e-1f2a-3b4c5d6e7f80",
        "entityType": "aws_instance",
        "entityDisplayName": "bastion-prod-1"
      }
    ],
    "justification": "Bastion host is managed outside this policy; risk accepted by the platform team.",
    "reason": "RISK_ACCEPTED",
    "expiresOn": 1798761600000
  }
}
```

| Input field | Description |
| --- | --- |
| `ruleId` | The rule the entities are exempted from. |
| `entities` | Up to 100 entities per request, and a rule may hold at most 100 unexpired exemptions in total. Only `entityId` is matched when results are filtered; the other fields are stored as diagnostic detail and are worth supplying, because they are what makes an exemption identifiable after the entity is gone. |
| `justification` | Required, and must not be empty. |
| `reason` | `RISK_ACCEPTED`, `NOT_APPLICABLE`, `FALSE_POSITIVE`, or `COMPENSATING_CONTROL`. |
| `expiresOn` | Optional. Epoch milliseconds, and must be in the future. Omit for an exemption that never expires. |

`entityId` is the graph entity `_id`.

Re-exempting an entity replaces its previous exemption rather than creating a second one, so it does not count again toward the rule's total.

A rule may hold at most **100 unexpired exemptions**. A request that would take it past that is refused, and the error reports how many the rule already has and how many the request would add. Expired exemptions do not count toward the limit, so a rule that has cycled through short-lived exemptions does not run out of room with nothing actually exempt.

The mutation is refused when the rule's current queries cannot accept exemptions, and the error carries the same `message` that `ruleExemptionEligibility` returns. That refusal is judged from the rule's current queries only—it cannot detect that the entity ids you supplied came from a superseded query, so check eligibility for the evaluation you chose them from first.

Exemptions take effect on the rule's **next scheduled evaluation**. Nothing is re-evaluated when the mutation returns.

#### Revoke exemptions

Revoke by `groupId` (the whole decision), by `entityIds`, or by both, which revokes the intersection. At least one selector is required—revoking a rule's entire set in one call is not supported.

```graphql
mutation RevokeRuleExemptions($ruleId: ID!, $groupId: ID, $entityIds: [ID!]) {
  revokeRuleExemptions(
    ruleId: $ruleId
    groupId: $groupId
    entityIds: $entityIds
  ) {
    revokedCount
  }
}
```

**Variables**:

```json
{
  "ruleId": "b1c0f75d-770d-432a-95f5-6f59b4239c72",
  "groupId": "9c8b7a65-4321-4fed-cba9-876543210fed"
}
```

Revocation works regardless of whether the rule still accepts new exemptions, so a rule that has been edited into an unsupported shape can always have its exemptions cleared. Up to 100 entity ids per request.

#### Read a rule's exemptions

```graphql
query RuleExemptions($id: ID!, $limit: Int, $cursor: String) {
  questionRuleInstance(id: $id) {
    exemptions(limit: $limit, cursor: $cursor, includeExpired: true) {
      items {
        groupId
        entityId
        entityKey
        entityScope
        entityType
        entityDisplayName
        justification
        reason
        expiresOn
        status
        createdBy
        createdOn
      }
      pageInfo {
        endCursor
        hasNextPage
      }
    }
  }
}
```

**Variables**:

```json
{
  "id": "b1c0f75d-770d-432a-95f5-6f59b4239c72",
  "limit": 100
}
```

`includeExpired` defaults to true, so an expired exemption stays visible instead of disappearing.

> **NOTE**
> 
> When `includeExpired` is false, a page can come back with fewer items than `limit` while more still exist. Follow `endCursor` until `hasNextPage` is false rather than stopping on a short page.

`status` is derived when you read it and is never stored:

| Status | Meaning |
| --- | --- |
| `ACTIVE` | In effect. |
| `EXPIRED` | Past its `expiresOn`. It no longer applies, but it is retained so that a rule that started alerting again is explainable. |
| `ORPHANED` | The entity it covers no longer exists, so the exemption no longer applies to anything. See [the limitations](/features/insights-and-alerts/rule-exemptions.md#limitations-to-plan-around) for what causes this. |

`createdBy` is the caller that filed the exemption: a user name, an email address, or `token:<tokenId>` for an API token.

#### Download the included or exempted result set

`ruleEvaluationQueryResultsCSV` takes a `resultSet` argument. `INCLUDED` (the default) is the entities the evaluation counted; `EXEMPTED` is the entities it held back.

```graphql
query RuleEvaluationQueryResultsCSV(
  $rawDataKey: String!
  $resultSet: RuleEvaluationQueryResultSet
) {
  ruleEvaluationQueryResultsCSV(rawDataKey: $rawDataKey, resultSet: $resultSet) {
    csvKey
    status
  }
}
```

**Variables**:

```json
{
  "rawDataKey": "<rawDataKey from the evaluation's rawDataDescriptors>",
  "resultSet": "EXEMPTED"
}
```

Both sets come from the one stored result object for that evaluation, so the exempted set reflects what that particular run held back. Revoking an exemption later does not rewrite it.

#### Exemption reference

`ExemptionReason`, supplied when creating an exemption:

| Value | Shown in the product as |
| --- | --- |
| `RISK_ACCEPTED` | Risk accepted |
| `NOT_APPLICABLE` | Not applicable |
| `FALSE_POSITIVE` | False positive |
| `COMPENSATING_CONTROL` | Compensating control |

`ExemptionUnsupportedReason`, returned by `ruleExemptionEligibility` and carried by a refused `createRuleExemptions`. Render `message` rather than mapping these to your own wording, so what you show cannot drift from what the API enforces.

| Value | What it means |
| --- | --- |
| `NOT_AVAILABLE` | Exemptions are not enabled for this account. Says nothing about the rule. |
| `NO_QUERIES` | The rule has no query to exempt entities from. |
| `QUESTION_UNAVAILABLE` | The rule's saved question could not be loaded. |
| `QUERY_NOT_PARSEABLE` | The rule's query could not be read. |
| `AGGREGATED_QUERY` | The query aggregates, so its rows are counts and summaries. |
| `DISTINCT_QUERY` | The query uses `FIND UNIQUE`, so its rows are deduplicated values. |
| `TREE_RESULTS` | The query returns a graph, so it has no result rows. |
| `NO_RETURNED_ENTITIES` | The query's `RETURN` names only values, so its rows carry no entity identity. |
| `QUERY_CHANGED_SINCE_EVALUATION` | The rule's query changed after this evaluation ran. Re-run the rule and exempt from its current results. |
| `EVALUATED_VERSION_UNAVAILABLE` | The rule version that produced these results can no longer be read. |

The first four groups describe the rule's own queries and are reported by `ruleSupported: false`. The last two describe the stored evaluation rather than the rule, and can only come from `ruleExemptionEligibility`.

## Rule definition reference

A rule uses the results of one or more queries to execute one or more actions. You can author the rule body in the JupiterOne UI, or pass it directly into the [API operations](#api-operations) above.

### Configuring a rule

1.  Navigate to the JupiterOne Rules page ([https://apps.us.jupiterone.io/rules](https://apps.us.jupiterone.io/rules))
2.  Click **New rule**
3.  Click **Advanced editor (JSON)** to open the advanced rule editor.

JSON Example:

```json
{
  "name": "unencrypted-critical-data-stores",
  "description": "Unencrypted data store with classification label of 'critical' or 'sensitive' or 'confidential' or 'restricted'",
  "version": 1,
  "specVersion": 1,
  "pollingInterval": "ONE_DAY",
  "question": {
    "queries": [
      {
        "name": "query0",
        "query": "Find DataStore with classification=('critical' or 'sensitive' or 'confidential' or 'restricted') and encrypted!=true",
        "version": "v1"
      }
    ]
  },
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "condition": "{{queries.query0.total > 0}}"
      },
      "actions": [
        {
          "type": "CREATE_ALERT"
        }
      ]
    }
  ],
  "outputs": ["queries.query0.total", "alertLevel"]
}
```

You can also configure rules to include deleted data in the results. For example:

```json
  // ...
  "question": {
    "queries": [
      {
        "name": "query0",
        "query": "Find DataStore with classification='critical' and encrypted=false as d return d.tag.AccountName as Account, d.displayName as UnencryptedDataStores, d._type as Type, d.encrypted as Encrypted",
        "version": "v1",
        "includeDeleted": true
      },
      {
        "name": "query1",
        "query": "...",
        "version": "v1",
        "includeDeleted": false
      },
      {
        "name": "query2",
        "query": "...",
        "version": "v1"
      }
    ]
  },
  // ...
}
```

### Rule properties

| Property | Type | Description |
| --- | --- | --- |
| `id` | `string` | Auto-generated, globally unique ID of each rule. |
| `version` | `number` | Current version of the rule. Incremented each time the rule is updated. |
| `name` | `string` | Name of the rule, which is unique to each account. |
| `description` | `string` | Optional description of the rule. |
| `specVersion` | `number` | Rule evaluation version in the case of breaking changes. This should always be `1`. |
| `pollingInterval` | `PollingInterval` | Optional frequency of automated rule evaluation. Defaults to `ONE_DAY`. |
| `question` | `Question` | Contains properties related to queries used in the rule evaluation. |
| `questionId` | `string` | A known unique ID for a question in the question library. |
| `operations` | `RuleOperation[]` | Actions that are executed when a corresponding condition is met. |
| `templates` | `object` | Optional key/value pairs of template name to template. |
| `outputs` | `string[]` | Names of properties that can be used throughout the rule evaluation process and will be included in each record of a rule evaluation (for example, `queries.query0.total`). |
| `notifyOnFailure` | `boolean` | Will send a notification to stakeholders (account admins, assigned users) if the rule query or any of its actions does not succeed. This property defaults to true if not provided when creating a rule. |
| `triggerActionsOnNewEntitiesOnly` | `boolean` | Will only trigger actions to be run when entities that did not exist during the previous rule evaluation appear in the question results. This property defaults to true if not provided when creating a rule. |

#### PollingInterval

Enumeration of the scheduled frequencies on which rules will automatically be evaluated. Possible values are `DISABLED`, `THIRTY_MINUTES`, `ONE_HOUR`, `FOUR_HOURS`, `EIGHT_HOURS`, `TWELVE_HOURS`, `ONE_DAY`, and `ONE_WEEK`.

### Question and queries

#### Question

A `Question` contains a collection of named queries that should be executed during the rule evaluation process and whose responses can be used in any `RuleOperation`.

| Property | Type | Description |
| --- | --- | --- |
| `queries` | `QuestionQuery[]` | The collection of queries that are used during the rule evaluation. |

#### QuestionQuery

A named query that should be executed during the rule evaluation process and whose responses can be used in any `RuleOperation`.

| Property | Type | Description |
| --- | --- | --- |
| `name` | `string` | Optional name to assign the query that will be used when referencing query data in `RuleOperation`s. If not provided, the query name is automatically assigned based on the index in the `queries` array (for example, `query0`, `query1`). |
| `query` | `string` | JupiterOne query to execute. |
| `version` | `string` | JupiterOne query language execution version (for example, `v1`). |
| `includeDeleted` | `boolean` | Whether deleted data should be considered for the specific query (defaults to `false`). |

### Operations

A `RuleOperation` is a single `condition` and series of `action`s that are executed when the `condition` is met.

| Property | Type | Description |
| --- | --- | --- |
| `when` | `RuleOperationCondition|RuleOperationCondition[]` | Type of conditional used to determine whether the associated actions should be executed. |
| `actions` | `RuleOperationAction[]` | Actions that should be executed when the `when` conditions have been met. |

#### RuleOperationCondition

The condition that determines whether the associated actions should be executed. The type of `RuleOperationCondition` is determined using the `type` property.

##### FilterRuleOperationCondition

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation condition type: `FILTER`. |
| `condition` | `string` | Template condition (for example, `{{queries.query0.total > 0}}`). |

### Actions

Action that is executed when a corresponding condition is met. The type of `RuleOperationAction` is determined using the `type` property.

#### `SET_PROPERTY`

> Includes a property that can be used in rule evaluation input.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: \`SET\_PROPERTY. |
| `targetProperty` | `string` | Property to include in the evaluation input. |
| `targetValue` | \`number | string |

Example:

```json
{
  "type": "SET_PROPERTY",
  "targetProperty": "alertLevel",
  "targetValue": "CRITICAL"
}
```

#### `CREATE_ALERT`

> Creates a JupiterOne alert that is visible in J1 Alerts.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `CREATE_ALERT` |

Example:

```json
{
  "type": "CREATE_ALERT"
}
```

#### `TAG_ENTITIES`

> Adds queryable tag values to result entities. With a value of `null`, the tag will be removed.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `TAG_ENTITIES` . |
| `entities` | `obj[]` | Array of result entities with J1 metadata. Generally a direct reference to a query result set, e.g. `{{queries.query0.data}}` |
| `tags` | `obj[]` | Array of objects containing `name` and `value` properties specifying tags to add. The `value` can be any JSON primitive. |

Note:

> Depending on result count, tags may take up to 10 minutes after rule evaluation completes to be available for query.

Example:

```json
{
  "type": "TAG_ENTITIES",
  "entities": "{{queries.query0.data}}",
  "tags": [ { "name": "myTag", "value":"tag-value" } ]
}
```

#### `SEND_EMAIL`

> Sends an email to a list of recipients with details related to alerts that are created during the rule evaluation.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `SEND_EMAIL`. |
| `recipients` | `string[]` | Email addresses of the recipients of this alert. |
| `body` | `string` | Optional additional body information of the email. |

Example:

```json
{
  "type": "SEND_EMAIL",
  "body": "Number of items above threshold: {{queries.query0.total}}",
  "recipients": ["recipient@example.com"]
}
```

#### `CREATE_JIRA_TICKET`

> Creates a Jira ticket using a specific JupiterOne Jira integration configuration.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `CREATE_JIRA_TICKET.` |
| `integrationInstanceId` | `string` | The `id` of the JupiterOne Jira integration that should be used to create the ticket. |
| `entityClass` | `string` | The `class` of the new ticket entity that should be created in JupiterOne. (for example,`Vulnerability`) |
| `project` | `string` | The unique Jira project ID that the ticket is created in. |
| `summary` | `string` | Summary of the Jira ticket. Used as the ticket title. |
| `issueType` | `string` | The Jira issue type (for example, `Task`). |
| `additionalFields` | `object` | Optional additional fields that are passed directly to the Jira API. (see table below for details) |
| `createOnlyFields` | `array` | Optional list of top-level `additionalFields` keys set when the ticket is created and never rewritten. Use it for computed values, such as a due date, that must not shift on later runs. (see [computed additional fields](#computed-additional-fields)) |
| `updateContentOnChanges` | `boolean` | Optional (default `false`). When `true`, later runs update the ticket already created for this rule instead of creating a new one. |
| `autoResolve` | `boolean` | Optional (default `false`). When `true`, the ticket created for this rule is transitioned to `resolvedStatus` once the query returns no matching results. |
| `resolvedStatus` | `string` | The Jira status the ticket is transitioned to when `autoResolve` is `true` (for example, `Closed`). Required for auto-resolve to take effect. |

> **Note**: By default (when both `updateContentOnChanges` and `autoResolve` are `false`) this action creates a **new** Jira ticket on every run that matches results. Set either flag to have JupiterOne reuse the ticket it already created for the rule instead of creating duplicates.

##### Jira description field

The `description` field can have a raw string value or be passed as depicted in these examples as Jira [ADF](https://developer.atlassian.com/cloud/jira/platform/apis/document/structure/). **NOTE**: string in either the `text` or `description` keys supports markdown syntax.

##### Computed additional fields

`additionalFields` values support the full [rule evaluation templating language](#rule-evaluation-templating-language), including [custom transforms](#custom-templating-transforms), at any depth. This is how a mandatory date field is filled relative to each ticket instead of being hardcoded to a date that was current when the rule was written:

```json
{
  "type": "CREATE_JIRA_TICKET",
  "integrationInstanceId": "<JIRA_INTEGRATION_INSTANCE_ID>",
  "entityClass": "Vulnerability",
  "project": "81198",
  "summary": "Ticket summary",
  "issueType": "Task",
  "updateContentOnChanges": true,
  "additionalFields": {
    "custom_date": "{{ evaluationBeginOn | dateAdd(90, 'days') | formatDate('YYYY-MM-DD') }}"
  },
  "createOnlyFields": ["custom_date"]
}
```

`evaluationBeginOn` is the timestamp of the run that creates the ticket — see [evaluation reference variables](#evaluation-reference-variables) — and [`dateAdd`](#dateaddamount-number-unit-string) and [`formatDate`](#formatdateformat-string-timezone-string) shift and format it.

Whenever `updateContentOnChanges` is `true`, list computed fields in `createOnlyFields`. That flag re-sends every `additionalFields` value to the existing ticket on each run, so a value derived from the evaluation time is rewritten every time: a due date 90 days out would move 90 days further out on every run and never come due. Naming the field in `createOnlyFields` fixes its value at the moment the ticket was created, while the description keeps updating.

**`autoResolve` on its own needs `createOnlyFields` too.** With `updateContentOnChanges` off, the ticket is matched each run by a fingerprint that includes the rendered `additionalFields`. A computed value changes it every run, so the action stops recognizing the ticket it opened last time — leaving that one unresolved and opening another. Create-only fields are left out of the fingerprint.

**Freezing every field stops updates.** With nothing left to send, no update is made — and the description is an `additionalFields` key, so freezing everything freezes it too.

**Create-only values are never back-filled.** Adding a field to the list later does not write it to a ticket that already exists.

> **Note**: with neither `updateContentOnChanges` nor `autoResolve` set, every matching run creates a **new** ticket (see the note above), and each of those tickets gets a date computed from its own run. If you want a single ticket whose date is fixed when it is created, set `updateContentOnChanges` and name the field in `createOnlyFields`.

##### Other / custom additional fields

Fields passed into `additionalFields` will be passed directly to the Jira API and as such should match the required input format of each field type. This table outlines some of the common field types and their value formats. Please use the [Official Jira Rest API](https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-issue-fields/) for more information.

| Field Type Label | Schema Type | Input Format | Example |
| --- | --- | --- | --- |
| Text | textfield | String value | `"Value of Field"` |
| Number | number | Number value | `2` |
| Date | date | `YYYY-MM-DD` string | `"2026-10-30"` |
| DateTime | datetime | ISO 8601 string with numeric offset | `"2026-10-30T00:00:00.000+0000"` |
| Select | select | Object with value key | `{ "value": "Select Option Label"}` |
| MultiSelect | multiselect | Array of string values | `["Option 1", "Option 2"]` |
| MultiCheckBoxes | multicheckboxes | Array of Objects with value keys | `[{ "value": "Option 1" }, { "value": "Option 2"}]` |
| UserPicker | userpicker | Object with accountId | `{ "accountId": "userInternalId" }` |
| MultiUserPicker | multiuserpicker | Array of Objects with accountId keys | `[{ "accountId": "user1InternalId" }, { "accountId": "user2InternalId"}]` |

Example:

```json
{
  "type": "CREATE_JIRA_TICKET",
  "integrationInstanceId": "<JIRA_INTEGRATION_INSTANCE_ID>",
  "entityClass": "Vulnerability",
  "project": "81198",
  "summary": "Ticket summary",
  "issueType": "Task",
  "additionalFields": {
    "custom_text": "field_value",
    "custom_number": 2,
    "custom_select": {
      "value": "Select Option Label"
    },
    "custom_multi_select": ["Option 1", "Option 2"],
    "custom_multi_checkboxes": [
      {
        "value": "Option 1"
      },
      {
        "value": "Option 2"
      }
    ],
    "custom_user_picker": {
      "accountId": "usersInternalId"
    },
    "custom_multi_user_picker": [
      {
        "accountId": "user1InternalId"
      },
      {
        "accountId": "user2InternalId"
      }
    ],
    "description": {
      "type": "doc",
      "version": 1,
      "content": [
        {
          "type": "paragraph",
          "content": [
            {
              "type": "text",
              "text": "Jira description here! **Full Markdown Supported Text**"
            }
          ]
        }
      ]
    }
  }
}
```

#### `FOR_EACH_ITEM`

> Runs a set of actions for each item in a list. This list can be query results, or a composed list of items.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `FOR_EACH_ITEM`. |
| `itemRef` | `string` | Optional name of the item reference to use in the templates. Defaults to `item` |
| `items` | `string` | The list of items to iterate over. Can be a template (see example). |
| `actions` | `array` | The actions to run for each item. |

Examples:

```json
// will call POST https://example.com with the body { "name": "John Doe", "webLink": "https://apps.<region>.jupiterone.io/asset/reference/link" }
// for each user in the query results, e.g. `Find User`
{
  "type": "FOR_EACH_ITEM",
  "itemRef": "user",
  "items": "{{queries.query0.data}}",
  "actions": [
    {
      "type": "WEBHOOK",
      "method": "POST",
      "url": "https://example.com",
      "body": {
        "name": "{{user.properties.name}}",
        "webLink": "{{user.properties.webLink}}"
      },
    }
  ]
}
```

> **NOTE**
> 
> NOTE: If your query includes traversals and a `RETURN` statement (i.e. `Find User that USES Device as d RETURN d.name`), you must alias the returned properties to use them inside the body of the action.

**Updated query:** `Find User that USES Device as d RETURN d.name as deviceName`

```json

{
  "type": "FOR_EACH_ITEM",
  "itemRef": "device",
  "items": "{{queries.query0.data}}",
  "actions": [
   {
      "type": "WEBHOOK",
      "method": "POST",
      "url": "https://example.com",
      "body": {
        "name": "{{device.deviceName}}"
      }
    }
  ]
}
```

#### `JUPITERONE_QUERY`

> Runs a JupiterOne query and stores the results on the `queries` template parameter with a given `name`. It is recommended that you only use this action within a `FOR_EACH_ITEM` action. Including it in normal `operations` actions is not recommended, as you can retrieve results you want with the normal `question` queries.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `JUPITERONE_QUERY`. |
| `query` | `string` | The JupiterOne query to run. |
| `name` | `string` | The name of the query result to store. |

Example:

```json
//
{
  "type": "FOR_EACH_ITEM",
  "itemRef": "user",
  "items": "{{queries.query0.data}}",
  "actions": [
    // JUPITERONE_QUERY actions always run first in order to enable the use of the results in the templates
    // of other actions in a FOR_EACH_ITEM action
    {
      "type": "JUPITERONE_QUERY",
      "query": "Find Account with email='{{user.properties.email}}'",
      "name": "accountsOwnedByUserQuery"
    },
    {
      "type": "WEBHOOK",
      "method": "POST",
      "url": "https://example.com",
      "body": {
        "name": "{{user.properties.displayName}}",
        "accounts": "{{queries.accountsOwnedByUserQuery.data | mapProperty('displayName')}}"
      }
    }
  ]
}
```

#### `SEND_SLACK_MESSAGE`

> Sends a Slack message to a given Slack webhook URL.

| Property | Type | Description |
| --- | --- | --- |
| `integrationInstanceId` | `string` | The `id` of the JupiterOne Jira integration used to create the ticket. |
| `type` | `string` | Rule operation action type: `SEND_SLACK_MESSAGE`. |
| `channels` | `string` | A string or list of strings beginning with a `#` to denote Slack channels to send to. |
| `webhookUrl` | `string` | Webhook URL for the account/channel that this message should be delivered to. |
| `severity` | `string` | Optional severity of this alert that determined the color of the message shown in Slack. |

**NOTE**: By default, the color of the alert in Slack is derived from the value of the `alertLevel` that is created in a `SET_PROPERTY` action. You can override the color of the alert using the `severity` property.

Example:

After you have configured the integration, copy the integration ID from the integration instance page, which looks similar to `d1549f40-b9fd-447a-bec5-4360c9ca7e8c`.

Configure a rule with the `SEND_SLACK_MESSAGE` action and specify the `integrationInstanceId` with the unique identifier of the integration and `channels` denoting the destinations. The following is an example alert rule configuration with the `SEND_SLACK_MESSAGE` action:

**NOTE**: For the JupiterOne Slack bot to deliver messages to a private Slack channel, the JupiterOne Slack bot must be a member of that private channel.

```json
{
  "id": "83136d41-23d0-415c-8726-84363d5a8a30",
  "name": "acm-cert-expiry",
  "description": null,
  "version": 1,
  "specVersion": 1,
  "notifyOnFailure": null,
  "triggerActionsOnNewEntitiesOnly": null,
  "pollingInterval": "ONE_DAY",
  "templates": {},
  "outputs": [
    "alertLevel"
  ],
  "question": {
    "queries": [
      {
        "query": "Find aws_acm_certificate with inUse = true and expiresOn > date.now and expiresOn < date.now + 30days",
        "name": "query0",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "questionId": null,
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "specVersion": 1,
        "condition": [
          "AND",
          [
            "queries.query0.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "targetValue": "CRITICAL",
          "id": "e1d40781-831f-43bf-b813-b28b6f2218ef",
          "type": "SET_PROPERTY",
          "targetProperty": "alertLevel"
        },
        {
          "type": "CREATE_ALERT",
          "id": "a3a32646-db5c-4c18-89be-c02798cd84c4"
        },
        {
          "integrationInstanceId": "8d677b84-c32e-45d3-9b46-902912a00304",
          "id": "c1a3a9bc-7c4f-4eba-afff-528f9cbd2ff1",
          "type": "SEND_SLACK_MESSAGE",
          "body": "*Affected Items:* \n\n- {{queries.query0.data|mapProperty('displayName')|join('\n- ')}}",
          "channels": []
        }
      ]
    }
  ],
  "state": null,
  "tags": []
}
```

#### `WEBHOOK`

> Sends an HTTP request to a given endpoint.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `WEBHOOK` |
| `endpoint` | `string` | Webhook endpoint to send the request to. |
| `method` | `string` | HTTP method to use when making the request Allowed values: `POST`, `PUT`, `GET`, `HEAD`, `PATCH`, `DELETE`. |
| `body` | `object` | Optional body data to include in the request. Can only be used with `POST`, `PUT`, and `PATCH`. |
| `headers` | `object` | Optional HTTP headers to include in the request. |

##### Webhook reference variables

You can reference the following variables via a template pattern (such as _{{alertLevel}}_) inside the webhook action:

| Property | Type | Description |
| --- | --- | --- |
| `alertLevel` | `string` | Level of severity of the rule. |
| `alertRuleName` | `string` | Name of the alert rule. |
| `alertRuleId` | `string` | Identifier for the alert in the J1 platform. |
| `alertRuleDescription` | `string` | Description saved in the rule. |

Example:

```json
{
  "type": "WEBHOOK",
  "method": "POST",
  "body": {
    "myApiPayload": " {{alertLevel}} alert has been triggered: {{alertRuleName}} "
  },
  "headers": {
    "Authorization": "Bearer abc123"
  }
}
```

##### Tines trigger

If you opt to use a Tines alert action when you create a rule, J1 creates a webhook with the Tines URL you provided and pushes the data to that endpoint. You can use any of the [Tines APIs](https://www.tines.com/api/actions/create) to configure the webhook action.

#### `PUBLISH_SNS_MESSAGE`

> Publishes a message to the specified SNS topic.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `PUBLISH_SNS_MESSAGE`. |
| `integrationInstanceId` | `string` | The ID of the AWS integration instance to use. The integration role must have `sns:Publish` permission. |
| `topicArn` | `string` | The ARN of the SNS topic to publish the message to. |
| `data` | `object` | User-provided data to include in the message. See [Operation Templating](#operation-templating) for details on using variable data. |

Example:

```json
{
  "type": "PUBLISH_SNS_MESSAGE",
  "integrationInstanceId": "<AWS_INTEGRATION_INSTANCE_ID>",
  "topicArn": "arn:aws:sns:<REGION>:arn:aws:sns:<ACCOUNT_ID>:<SNS_TOPIC_NAME>",
  "data": {
    "query0Data": "{{queries.query0.data}}",
    "anotherCustomProperty": true
  }
}
```

```text
!!! Note:
```

`data` is stringified in the payload. For example:

```js
{
  Sns: {
    Message: '{"data":{"query0Data": ..., "anotherCustomProperty": true}}';
  }
}
```

#### `SEND_SQS_MESSAGE`

> Publishes a message to the specified SQS queue.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `SEND_SQS_MESSAGE`. |
| `integrationInstanceId` | `string` | The ID of the AWS integration instance to use. The integration role must have `sqs:SendMessage` permission. |
| `queueUrl` | `string` | The URL of the SQS queue to publish the message to. |
| `data` | `object` | User-provided data to include in the message. See [Operation Templating](#operation-templating) for details on using variable data. |

Example:

```json
{
  "type": "SEND_SQS_MESSAGE",
  "integrationInstanceId": "<AWS_INTEGRATION_INSTANCE_ID>",
  "queueUrl": "https://sqs.<REGION>.amazonaws.com/<ACCOUNT_ID>/<SQS_QUEUE_NAME>",
  "data": {
    "query0Data": "{{queries.query0.data}}",
    "anotherCustomProperty": true
  }
}
```

!!! warning `data` is stringified in the payload. For example:

```js
{
  body: '{"data":{"query0Data": ..., "anotherCustomProperty": true}}';
}
```

#### `SEND_TO_S3`

> Uploads data to an AWS S3 bucket.

| Property | Type | Description |
| --- | --- | --- |
| `type` | `string` | Rule operation action type: `SEND_TO_S3`. |
| `integrationInstanceId` | `string` | The ID of the AWS integration instance to use. The integration role must have `s3:PutObject` permission. |
| `bucket` | `string` | The name of the bucket to upload the data to. |
| `region` | `string` | The region in which the S3 bucket is located. |
| `data` | `object` | User-provided data to include in the message. See [Operation Templating](#operation-templating) for details on using variable data. |

**NOTE**: The data will be a `json` file with a filename of `${ruleId}_${evaluationTimestampMilliseconds}.json`. This may look like `83136d41-23d0-415c-8726-84363d5a8a30_1631619200000.json`.

Example:

```json
{
  "type": "SEND_TO_S3",
  "integrationInstanceId": "<AWS_INTEGRATION_INSTANCE_ID>",
  "bucket": "s3-bucket-name",
  "region": "us-east-1",
  "data": {
    "description": "**Affected Items:**\n\n* {{queries.query0.data|mapProperty('displayName')|join('\n* ')}}"
  }
}
```

### Patterns

#### Multiple queries in a single rule

You can pass multiple queries into an alert rule that allows each query to output its results into the same, single alert.

> Note the `when` condition in the example below will invoke actions if either query returns results.

This example shows multiple queries sending out an email alert to multiple recipients:

```json
{
  "name": "Multiple Queries in a Rule",
  "description": "",
  "version": 1,
  "specVersion": 1,
  "pollingInterval": "ONE_WEEK",
  "templates": {
    "tempMap": "Project: {{item.Project}}, ProjectFindings: {{item.ProjectFindings}}, RepoFindings: {{item.RepoFindings}}"
  },
  "outputs": [
    "alertLevel"
  ],
  "question": {
    "queries": [
      {
        "name": "query0",
        "query": "Find CodeRepo THAT RELATES TO Project with repoName!=undefined as p THAT HAS Finding as f RETURN p.repoName as Project, count(f) as ProjectFindings",
        "version": "v1",
        "includeDeleted": false
      },
      {
        "name": "query1",
        "query": "Find Project with repoName!=undefined THAT RELATES TO CodeRepo as p THAT HAS Finding as f RETURN p.displayName as Project, count(f) as RepoFindings",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "specVersion": 1,
        "condition": [
          "OR",
          [
            "queries.query0.total",
            ">",
            0
          ],
          [
            "queries.query1.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "targetValue": "INFO",
          "type": "SET_PROPERTY",
          "targetProperty": "alertLevel"
        },
        {
          "type": "CREATE_ALERT"
        },
        {
          "type": "SEND_EMAIL",
          "body": "Affected Items: <br><br>* {{ queries.query0.data  | mapTemplate('tempMap') | join('<br>* ') }} / <br>* {{ queries.query1.data | mapTemplate('tempMap') | join('<br>* ') }}",
          "recipients": [
            "person1@example.com",
            "person2@example.com",
            "person3@example.com"
          ]
        }
      ]
    }
  ],
  "tags": []
}
```

This example shows multiple queries sending results to Jira to create a single Jira issue:

```json
{
  "name": "Multiple Queries in a Rule to Jira Example",
  "description": "Multiple queries can be composed into a Jira Alert",
  "version": 1,
  "specVersion": 1,
  "pollingInterval": "ONE_DAY",
  "templates": {
    "projectInfo": "Project: {{item.Project}}, ProjectFindings: {{item.ProjectFindings}}, RepoFindings: {{item.RepoFindings}}"
  },
  "outputs": [
    "alertLevel"
  ],
  "question": {
    "queries": [
      {
        "name": "query0",
        "query": "Find CodeRepo THAT RELATES TO Project with repoName!=undefined as p THAT HAS Finding as f RETURN p.repoName as Project, count(f) as ProjectFindings",
        "version": "v1",
        "includeDeleted": false
      },
      {
        "name": "query1",
        "query": "Find Project with repoName!=undefined THAT RELATES TO CodeRepo as p THAT HAS Finding as f RETURN p.displayName as Project, count(f) as RepoFindings",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "specVersion": 1,
        "condition": [
          "OR",
          [
            "queries.query0.total",
            ">",
            0
          ],
          [
            "queries.query1.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "targetValue": "INFO",
          "type": "SET_PROPERTY",
          "targetProperty": "alertLevel"
        },
        {
          "type": "CREATE_ALERT"
        },
        {
          "summary": ": {{queries.query0.total}}",
          "issueType": "Task",
          "entityClass": "Finding",
          "integrationInstanceId": "<JIRA_INTEGRATION_INSTANCE_ID>",
          "additionalFields": {
            "description": {
              "type": "doc",
              "version": 1,
              "content": [
                {
                  "type": "paragraph",
                  "content": [
                    {
                      "type": "text",
                      "text": "{{alertWebLink}}\n\n**Affected Items:**\n\n* {{ queries.query0.data | mapTemplate('projectInfo') | join('\n* ') }} \n\n***************\n\n {{ queries.query1.data | mapTemplate('projectInfo') | join('\n* ') }}"
                    }
                  ]
                }
              ]
            }
          },
          "project": "CT",
          "type": "CREATE_JIRA_TICKET"
        }
      ]
    }
  ],
  "tags": []
}
```

#### One Jira ticket per query result with `FOR_EACH_ITEM`

If your query returns multiple results, you can run a second query using the results of the first query to create a Jira ticket for each item in the first query results. You do this by [editing the advanced JSON of the alert rule](#configuring-a-rule) to use the `FOR_EACH_ITEM` action type.

It is not recommended that you use this action type if your results sizes are very large. This example limits the number of possible Jira tickets created to a maximum of 100, and sends an email when the limit is exceeded. Additionally, the "Test" and "Preview" buttons will not include query data in them at this time.

> **NOTE**
> 
> For accessing values within result iterations:
> 
> Properties referenced by `{{obj.properties.displayName}}`
> 
> Tags referenced by `{{obj.properties['tag.AccountName']}}`
> 
> Metadata values referenced by `{{obj.entity._type}}`

For example:

```json
{
  "name": "Unencrypted critical data stores",
  "description": "",
  "specVersion": 1,
  "pollingInterval": "ONE_WEEK",
  "question": {
    "queries": [
      {
        "name": "query0",
        "query": "Find DataStore with classification='critical' and encrypted=false",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "specVersion": 1,
        "condition": ["AND", ["queries.query0.total", ">", 0], ["queries.query0.total", "<=", 100]]
      },
      "actions": [
        {
          "type": "SET_PROPERTY",
          "targetValue": "CRITICAL",
          "targetProperty": "alertLevel"
        },
        {
          "type": "CREATE_ALERT"
        },
        {
          "itemRef": "obj",
          "type": "FOR_EACH_ITEM",
          "items": "{{queries.query0.data}}",
          "actions": [
            {
              "type": "CREATE_JIRA_TICKET",
              "summary": "{{alertRuleDescription}}",
              "issueType": "",
              "entityClass": "{{ obj.entity._type | join(',') }}",
              "integrationInstanceId": "{{ obj.entity._integrationInstanceId }}",
              "additionalFields": {
                "description": {
                  "type": "doc",
                  "version": 1,
                  "content": [
                    {
                      "type": "paragraph",
                      "content": [
                        {
                          "type": "text",
                          "text": "{{alertWebLink}}\n\n**Affected Items:**\n\n* {{obj.properties.webLink}}"
                        }
                      ]
                    }
                  ]
                }
              },
              "project": "{{param.MySpecialProject}}"
            }
          ]
        }
      ]
    }, {
      "when": {
        "type": "FILTER",
        "specVersion": 1,
        "condition": ["queries.query0.total", ">", 100]
      },
      "actions": [
        {
          "type": "SET_PROPERTY",
          "targetValue": "CRITICAL",
          "targetProperty": "alertLevel"
        },
        {
          "type": "CREATE_ALERT"
        },
        {
          "type": "SEND_EMAIL",
          "body": "The alert rule {{alertRuleName}} has {{queries.query0.total}} results. Please review the results in the JupiterOne app: {{alertWebLink}}.",
          "recipients": ["emergency@example.com"]
        }
      ]
    }
  ],
  "outputs": ["alertLevel"],
  "templates": {}
}
```

### Operation templating

You can use templates inside any property under the `operations` property on a rule. The templates can contain a JavaScript-like syntax that automatically have input variables injected for usage.

For example, `FilterRuleOperationCondition`s are often used with rules as the condition for whether rule actions should be executed. You can use query response data inside of the rule conditions:

```js
{
  "operations": [
    {
      "when": {
        "type": "FILTER",
        // Use the `.total` property from query named `query0`.
        "condition": "{{queries.query0.total > 0}}"
      },
      "actions": [
        {
          "type": "CREATE_ALERT"
        }
      ]
    }
  ]
}
```

You can use data from query results inside of rule operations by referencing the `query.query0.data` property and custom templating transforms. For example:

```js
{
  "name": "lambda-function-settings-check-runtime-nodejs610",
  "description": "Node.js 6.10 is end of life (EOL) and should no longer be used.",
  "specVersion": 1,
  "pollingInterval": "ONE_DAY",
  "templates": {
    // The email template that we will use later
    "emailBody": "({{itemIndex+1}} of {{itemCount}}) [{{item.account}}] Function Name: {{item.functionName}}<br>"
  },
  "question": {
    "queries": [
      {
        "name": "query0",
        "query": "Find aws_lambda_function with runtime='nodejs6.10' as f return f.name as functionName, f.version as version, f.tag.AccountName as account, f.tag.Project as project order by account",
        "version": "v1"
      }
    ]
  },
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "specVersion": 1,
        "condition": "{{queries.query0.total > 0}}"
      },
      "actions": [
        {
          "targetValue": "HIGH",
          "type": "SET_PROPERTY",
          "targetProperty": "alertLevel"
        },
        {
          "type": "CREATE_ALERT"
        },
        {
          "type": "SEND_EMAIL",
          // Reference the `query0` data and include it in a template
          "body": "Affected Functions: <br><br>{{ queries.query0.data | mapTemplate('emailBody') | join(' ') }}",
          "recipients": ["person1@example.com"]
        }
      ]
    }
  ],
  "outputs": ["queries.query0.total", "alertLevel"]
}
```

### Rule evaluation templating language

You can create a template in any `RuleOperation` using the `{{...}}` syntax. Inside the `{{...}}` is a JavaScript-like language that allows for powerful rule evaluation functionality. Additionally, if the template contains exactly one expression and nothing else, the original type of the computed value is preserved. If multiple expressions are used, the entire value is casted to a string.

The following is an example where the type `boolean` is preserved because there is only a single expression:

```text
{{true}}
```

The following is an example where the entire value would be cast to a string because it contains multiple expressions:

```text
{{age + 10}} is my age and my name is {{firstName + " " + lastName}}
```

All templating expressions support references to [account parameters](#parameters-in-rules):

```text
My name is {{param.myFirstName}} and I am {{age}}
```

#### Query reference variables

Every query the rule ran is on the `queries` object under its own name, carrying both the rows the rule counted and the rows an exemption held back:

| Variable | Type | Description |
| --- | --- | --- |
| `queries.<name>.data` | `object[]` | The rows the query returned, after any [exemptions](/features/insights-and-alerts/rule-exemptions.md) are removed. |
| `queries.<name>.total` | `number` | How many rows `data` holds. |
| `queries.<name>.exemptions` | `object[]` | The rows this query matched that an exemption withheld, shaped like the rows in `data`. |
| `queries.<name>.exemptionsTotal` | `number` | How many rows an exemption withheld. |

`<name>` is the query's own `name` from `question.queries`, so a rule whose query is named `query0` references `queries.query0.data`.

Both exemption variables are **absent rather than empty** on a rule with nothing exempt, and an absent variable does not render as blank. Anywhere it sits inside surrounding text, it renders the literal word `undefined`:

```text
Held back by an exemption: {{queries.query0.exemptionsTotal}}
```

renders as `Held back by an exemption: undefined`.

An expression on its own, with no surrounding text, instead evaluates to `undefined` itself, under the same single-expression rule that preserves a computed value's type.

Append `|| 0` for a count that always renders a number:

```text
Held back by an exemption: {{queries.query0.exemptionsTotal || 0}}
```

renders as `Held back by an exemption: 0`.

A list needs no such guard: [`mapProperty`](#mappropertyproperties-string) returns an empty array when its input is not an array, and joining an empty array gives an empty string, so the line renders empty:

```text
{{queries.query0.exemptions|mapProperty('displayName')|join(', ')}}
```

#### Evaluation reference variables

Alongside query data and account parameters, every operation template can reference the following:

| Variable | Type | Description |
| --- | --- | --- |
| `evaluationBeginOn` | `number` | Unix timestamp in milliseconds for when the evaluation started. Pair it with [`dateAdd`](#dateaddamount-number-unit-string) and [`formatDate`](#formatdateformat-string-timezone-string) to compute a date relative to the run. |
| `alertRuleId` | `string` | Identifier of the rule being evaluated. |
| `alertRuleName` | `string` | Name of the rule being evaluated. |
| `alertRuleDescription` | `string` | Description saved on the rule. |
| `alertWebLink` | `string` | Link to the alert raised by this evaluation. Only present when the rule raises one. |

#### Unary operators

| Operation | Symbol |
| --- | --- |
| Negate | `!` |

#### Binary operators

| Operation | Symbol | | ---------------- | :----: | --- | --- | | Add, Concat | `+` | | Subtract | `-` | | Multiply | `*` | | Divide | `/` | | Divide and floor | `//` | | Modulus | `%` | | Power of | `^` | | Logical AND | `&&` | | Logical OR | `| |` |

#### Comparisons

| Comparison | Symbol |
| --- | --- |
| Equal | `==` |
| Not equal | `!=` |
| Greater than | `>` |
| Greater than or equal | `>=` |
| Less than | `<` |
| Less than or equal | `<=` |
| Element in array or string | `in` |

#### Ternary operator

| Expression | Result |
| --- | --- |
| `"" ? "Full" : "Empty"` | Empty |
| `"foo" in "foobar" ? "Yes" : "No"` | Yes |
| `{agent: "Archer"}.agent ?: "Kane"` | Archer |

#### Native types

| Type | Examples |
| --- | --- |
| Booleans | `true`, `false` |
| Strings | `"Hello \"user\""`, `'Hey there!'` |
| Numerics | `6`, `-7.2`, `5`, `-3.14159` |
| Objects | `{hello: "world!"}` |
| Arrays | `['hello', 'world!']` |

#### Groups

Grouping operations with parentheses:

| Expression | Result |
| --- | --- |
| `(83 + 1) / 2` | 42 |
| \`1 < 3 && (4 > 2 |  |

### Custom templating transforms

Some custom transforms are exposed in the rule templating language. These are functions that perform actions on an input, and can be chained together to accomplish some powerful actions.

#### `mapTemplate(templateName: string)`

`mapTemplate` is separates and reuses templates inside of a rule. The transform expects a single array and the first argument should be a string whose value matches a template in rule `templates` object.

The `mapTemplate` transform exposes additional input variable to the template:

| Property | Type | Description |
| --- | --- | --- |
| `item` | `any` | The individual item of this iteration. |
| `itemCount` | `number` | The total count of items in the array. |
| `itemIndex` | `number` | The index of the current `item` in the array |

!!! note The properties that are accessible on the `item` property are pulled from the `properties` object and the `entity` object if the `item` matches the schema for an entity.

Example operation:

```json
{
  "type": "SEND_EMAIL",
  // Reference the `query0` data and include it in a template
  "body": "{{ queries.query0.data | mapTemplate('emailBody') | join(' ') }}",
  "recipients": ["person1@example.com"]
}
```

Example `templates`:

```json
{
  "emailBody": "({{itemIndex+1}} of {{itemCount}}) [{{item.account}}] Function Name: {{item.somePropertyOnItem}}<br>"
}
```

#### `mapProperty(...properties: string)`

Allows for mapping individual properties from an array. You can supply a single or multiple properties. The properties that are accessible are pulled from the `properties` object and the `entity` object if the `item` matches the schema for an entity. If the array that is being evaluated with `mapProperty` matches the schema of an entity, the rule evaluator attempts to pull properties passed to `mapProperty` from the entity properties.

Example query data:

```json
{
  "query": "FIND Person",
  "data": [
    {
      "id": "",
      "entity": {
        "_createdOn": 1234
        // ...
      },
      "properties": {
        "firstName": "Jon"
        // ...
      }
    },
    {
      "id": "",
      "entity": {
        "_createdOn": 12345
        // ...
      },
      "properties": {
        "firstName": "Jane"
        // ...
      }
    }
  ]
}
```

This is an example of accessing `properties` data using `mapProperty` and the above data:

```json
{
  "type": "SEND_EMAIL",
  // This would return: `Jon,Jane`
  "body": "{{ queries.query0.data | mapProperty('firstName') | join}}",
  "recipients": ["person1@example.com"]
}
```

This is an example accessing `entity` data using `mapProperty` and the above data:

```json
{
  "type": "SEND_EMAIL",
  // This would return: `1234,12345`
  "body": "{{ queries.query0.data | mapProperty('_createdOn') | join}}",
  "recipients": ["person1@example.com"]
}
```

#### `merge(...data: array)`

Allows for merging 1 or more arrays together to create a new array of the combined results. This transform does not perform any deduplication; all elements of the input arrays are present in the output. This is usually used to combine the results of two or more J1QL queries into a common set of query results.

Example query configuration:

```json
{
  "queries": [
    {
      "query": "Find User with name ~=\"first.last\" as a RETURN a.displayName as DisplayName",
      "name": "query0",
      "version": "v1",
      "includeDeleted": false
    },
    {
      "query": "Find User with name ~=\"firstLast\" as b RETURN b.displayName as DisplayName",
      "name": "query1",
      "version": "v1",
      "includeDeleted": false
    }
  ]
}
```

This is an example of merging the results of these two queries together, and getting the number of deduplicated total results.

```json
{
  "type": "SEND_EMAIL",
  "body": "Total Query Results: {{ queries.query0.data | merge(queries.query1.data) | uniquePropertyValues('displayName') | length}}",
  "recipients": ["person1@example.com"]
}
```

#### `join(separator?: string)`

This function is similar to the `Array.prototype.join` function in JavaScript. It returns a new string by concatenating all of the elements in an array. If the `separator`argument is not passed to `join`, the array elements are separated by a comma, by default.

This transform is often used with `mapTemplate` or `mapProperty`.

Example:

```json
{
  "type": "SEND_EMAIL",
  "body": "{{ queries.query0.data | mapTemplate('emailBody') | join(' ') }}",
  "recipients": ["person1@example.com"]
}
```

Example of default if no `separator` is passed to `join`:

```json
{
  "type": "SEND_EMAIL",
  "body": "{{ queries.query0.data | mapTemplate('emailBody') | join }}",
  "recipients": ["person1@example.com"]
}
```

#### `uniquePropertyValues(propertyName: string)`

Creates a set of unique values for the given property name. The transform will pull all properties from the `entity` and `properties` sub-properties to the top level to try to access the passed in `propertyName`.

Example query data:

```json
{
  "query": "FIND Person",
  "data": [
    {
      "id": "1",
      "entity": {
        "_createdOn": 1234
        // ...
      },
      "properties": {
        "firstName": "Jon"
        // ...
      }
    },
    {
      "id": "2",
      "entity": {
        "_createdOn": 12345
        // ...
      },
      "properties": {
        "firstName": "Jane"
        // ...
      }
    },
    {
      "id": "3",
      "entity": {
        "_createdOn": 5555
        // ...
      },
      "properties": {
        "firstName": "Jon"
        // ...
      }
    },
  ]
}
```

This is an example of accessing deduplicating a property of an array of entities:

```json
{
  "type": "SEND_EMAIL",
  // This would return: ["Jon","Jane"]
  "body": "{{ queries.query0.data | uniquePropertyValues('firstName') }}",
  "recipients": ["person1@example.com"]
}
```

#### `length`

Returns the number of items in an array. This transform takes no arguments, and the templating language does not accept empty parentheses — write `| length`, not `| length()`.

Example:

```json
{
  "type": "SEND_EMAIL",
  "body": "{{ queries.query0.data | length }} people were found.",
  "recipients": ["person1@example.com"]
}
```

`length` is most useful at the end of a chain, to count what the transforms before it produced:

```json
{
  "type": "SEND_EMAIL",
  // The number of distinct first names across both queries
  "body": "Unique names: {{ queries.query0.data | merge(queries.query1.data) | uniquePropertyValues('firstName') | length }}",
  "recipients": ["person1@example.com"]
}
```

If the value piped into `length` is not an array — because a transform earlier in the chain produced no value, for example — `length` returns `0` rather than failing the render.

#### `capitalize`

Upper-cases the first character of a string and leaves the rest of it as it is. This transform takes no arguments, and, as with `length`, the templating language does not accept empty parentheses — write `| capitalize`, not `| capitalize()`.

Because only the first character changes, `capitalize` is for making a lower-case value read as a sentence rather than for normalizing casing throughout a value: `high` becomes `High`, `high severity` becomes `High severity`, and `HIGH` is unchanged.

This transform is often used inside a `mapTemplate` template, where each `item` property is a single value:

```json
{
  "type": "SEND_EMAIL",
  "body": "{{ queries.query0.data | mapTemplate('findingLine') | join(' ') }}",
  "recipients": ["person1@example.com"]
}
```

Example `templates`:

```json
{
  "findingLine": "{{item.displayName}} — {{item.severity | capitalize}} severity<br>"
}
```

Any value that is not a string, including an array, passes through `capitalize` unchanged.

#### `dateAdd(amount: number, unit?: string)`

Shifts a timestamp by a calendar amount and returns an ISO 8601 string.

The input may be Unix milliseconds, Unix milliseconds inside a string, or an ISO 8601 string, so it works with `evaluationBeginOn` as well as with date properties read from query data.

`amount` is required and may be negative to shift backwards. `unit` defaults to `days` and accepts `hours`, `days`, `weeks`, `months` and `years`, singular or plural. These are calendar units — weekends and holidays are not skipped.

Because the result is ISO 8601, it can be piped into `formatDate` to produce whatever format the destination field wants — most often `YYYY-MM-DD` for a Jira Date field:

```js
// evaluationBeginOn = 1785542400000, which is 2026-08-01T00:00:00.000Z

{{ evaluationBeginOn | dateAdd(90, 'days') }}
// 2026-10-30T00:00:00.000Z

{{ evaluationBeginOn | dateAdd(-30, 'days') }}
// 2026-07-02T00:00:00.000Z

{{ evaluationBeginOn | dateAdd(3, 'months') }}
// 2026-11-01T00:00:00.000Z
```

If the input is missing or is not a date, the transform produces no value and the field is left out of the request rather than being sent as an invalid date.

#### `formatDate(format?: string, timeZone?: string)`

Formats a timestamp, accepting the same inputs as `dateAdd`.

Jira has two distinct date field types, and they want different formats — see [other / custom additional fields](#other--custom-additional-fields):

-   A **Date** field (schema type `date`) wants `YYYY-MM-DD`. This is `format`'s default, so `formatDate` with no arguments produces it.
-   A **DateTime** field (schema type `datetime`) wants ISO 8601 with a numeric offset, which is `YYYY-MM-DDTHH:mm:ss.SSSZZ`.

Format tokens follow [Day.js](https://day.js.org/docs/en/display/format).

`timeZone` defaults to `UTC` and accepts an IANA time zone name. Rule evaluations run on a schedule with no user in context, so there is no time zone to infer — pass one explicitly if a UTC date is not what you want. Note that this changes which calendar day you get, not just the clock time.

```js
// evaluationBeginOn = 1785542400000, which is 2026-08-01T00:00:00.000Z

{{ evaluationBeginOn | formatDate('YYYY-MM-DD') }}
// 2026-08-01 — for a Date field

{{ evaluationBeginOn | formatDate('YYYY-MM-DDTHH:mm:ss.SSSZZ') }}
// 2026-08-01T00:00:00.000+0000 — for a DateTime field

{{ evaluationBeginOn | formatDate('YYYY-MM-DD', 'America/New_York') }}
// 2026-07-31 — still the previous day in New York
```

As with `dateAdd`, a missing or non-date input produces no value.

#### `queryDataDifference(renderDataProperty: string)`

Returns the items that one query found and another did not — the set difference between two sets of query results. Use it to report what is new since an earlier run, or which items a broad query found that a narrower one did not.

Unlike the other transforms, `queryDataDifference` operates on an array of two arrays, so the value piped into it has to be written as an array literal. No single path in the render data produces this shape:

```js
{{ [queries.query0.data, queries.query1.data] | queryDataDifference('newItems') }}
```

The first list is subtracted from the second, so the example above returns the items in `query1` that are not in `query0`.

Items are matched on `_id`, falling back to `_key` when the results carry no `_id`. Either key is read from the top level of an item or from its `entity` sub-object, so both raw and entity-shaped query data work. Which of the two keys is used is decided once, from the first item of the first non-empty list, and is then applied to every item — so both queries need to return the same shape of data. An item that carries none of these keys fails the render with `"_id" or "_key" is required`.

The `renderDataProperty` argument is required. Alongside returning the difference, the transform stores it in the render data under that name, so the rest of the rule can reference the same result without repeating the transform:

```json
{
  "type": "SEND_EMAIL",
  "body": "{{ [queries.query0.data, queries.query1.data] | queryDataDifference('newFindings') | length }} new findings: {{ newFindings | mapProperty('displayName') | join(', ') }}",
  "recipients": ["person1@example.com"]
}
```

#### Common templating examples

Filling a mandatory Jira Date field with a deadline relative to the run that creates the ticket

```js
// In your rule action's additionalFields
{{ evaluationBeginOn | dateAdd(90, 'days') | formatDate('YYYY-MM-DD') }}

// Will display something like:
// 2026-10-30

// For a DateTime field instead, ask for that format:
{{ evaluationBeginOn | dateAdd(90, 'days') | formatDate('YYYY-MM-DDTHH:mm:ss.SSSZZ') }}

// 2026-10-30T00:00:00.000+0000
```

Merging multiple query results to generate a unique set of values for a given property printed on a new line

```js
{{ queries.query0.data | merge(queries.query1.data) | uniquePropertyValues('firstName') | join('\n') }}

// Will display something like:
//
// firstName1
// firstName2
// ...
```

Using a template to display multiple properties from a set of query results

```js
// In the templates definition
{
  "myTemplateName": "Property1: {{item.propertyName1}} - Property2: {{item.propertyName2}}"
}

// In your rule action
{{ queries.query0.data | mapProperty('propertyName1', 'propertyName2') | mapTemplate('myTemplateName') | join('\n') }}

// Will display something like:

// Property1: value1 - Property2 - value2
// Property1: value3 - Property2 - value4
// ...
```

Filtering a set of query results to a specific name and using a template for extra propoerties

```js
// In the templates definition
{
  "myTemplateName": "Property1: {{item.name}} - Property2: {{item.id}}"
}

// In your rule action
{{ queries.query0.data[.name == 'repository1'] | mapProperty('name', 'id') | mapTemplate('myTemplateName') | join('\n') }}

// Will display something like:

// repository1 - anIdForEntity1
// repository1 - anIdForEntity2
// repository1 - anIdForEntity3
// ...
```

### Filtering collections

Collections, or arrays of objects, can be filtered by including a filter expression in brackets. Properties of each collection can be referenced by prefixing them with a leading dot. The result will be an array of the objects for which the filter expression resulted in a truthy value.

Example context:

```js
{
  employees: [
    {first: 'Sterling', last: 'Archer', age: 36},
    {first: 'Malory', last: 'Archer', age: 75},
    {first: 'Lana', last: 'Kane', age: 33},
    {first: 'Cyril', last: 'Figgis', age: 45},
    {first: 'Cheryl', last: 'Tunt', age: 28}
  ],
  retireAge: 62
}
```

| Expression | Result |
| --- | --- |
| `employees[.first == 'Sterling']` | `[{first: 'Sterling', last: 'Archer', age: 36}]` |
| `employees[.last == 'Tu' + 'nt'].first` | `Cheryl` |
| `employees[.age >= 30 && .age < 40]` | `[{first: 'Sterling', last: 'Archer', age: 36},{first: 'Lana', last: 'Kane', age: 33}]` |
| `employees[.age >= 30 && .age < 40][.age < 35]` | `[{first: 'Lana', last: 'Kane', age: 33}]` |
| `employees[.age >= retireAge].first` | `Malory` |

### Parameters in rules

Rules support reference to parameter values stored at the account-level. These parameters simplify the task of referencing long, sensitive, or widely reused values in rules or queries. For example, the following action trigger is nearly identical to [the slack webhook](#send_slack_message) example:

```json
{
  "type": "WEBHOOK",
  "method": "POST",
  "body": {
    "name": "Jon"
  },
  "headers": {
    "Authorization": "Bearer {{param.SlackAuthToken}}"
  }
}
```

This showcases a primary use case of parameter storage: a value that is long, not human-readable, and may represent a sensitive value which should not be leaked in the configuration.

`param.SlackAuthToken` invokes a parameter stored at the account level, which is referenced when the rule is evaluated. These parameters are always referenced with the preceding token `param.`. The subsequent string (without special characters) identifies the name of a parameter.

Parameters are supported anywhere that [Operation Templating](#operation-templating) is supported, and the value of a parameter can be any type of [native type](#native-types) with the **exclusion of objects**, which support comparison _against_ parameters but cannot be the contents of a parameter. Additionally, parameters can store lists of native types, and template expressions can invoke parameter lists similarly to examples above. For example, [using the email example](#send_email), we can parameterize the recipient list:

```json
{
  "type": "SEND_EMAIL",
  "body": "{{ queries.query0.data | mapTemplate('emailBody') | join(' ') }}",
  // a stored list of email strings:
  "recipients": "{{param.alertEmailRecipientList}}"
}
```

For more info on JupiterOne parameters, [reference the documentation](/features/admin/parameters.md).

---

Source: /api/authentication

# Authentication

The JupiterOne APIs use a Bearer Token for authentication. Include the API key in the header as a Bearer Token. You also need to include `JupiterOne-Account` as a header parameter. You can find the `Jupiterone-Account` value in your account settings by going to [https://apps.us.jupiterone.io/settings/account-management](https://apps.us.jupiterone.io/settings/account-management) and finding your Account ID.

## API Keys

API keys enable users to use the J1 APIs in queries and with integrations. You can enable the use of API keys for a group of users and create API keys for your organization account. This can be done both through our GraphQL public API and the JupiterOne dashboard.

## Create API Keys Using the GraphQL API

You can use GraphQL queries to create account-level API keys.

**To create an account-level API key**, enter:

```text
POST `https://graphql.us.jupiterone.io/`
```

```graphql
mutation CreateToken($token: TokenInput!) {
  createToken(token: $token) {
    token
    id
    name
    category
    policy
    revoked
    createdAt
    expiresAt
    __typename
  }
}
```

Response

```json
{
  "variables": {
    "token": {
      "name": "Token Name",
      "category": "tags",
      "policy": "{\n\t\"permissions\": [{\n\t\t\"effect\":\"ALLOW\",\n\t\t\"actions\":[\"dashboard:View\" ],\n\t\t\"resources\": [ \"dashboard:123456\" ]\n\t}]\n}"
    }
  }
}
```

> **NOTE**
> 
> Wildcards are not supported for account-level API tokens.

The `policy` variable is a JSON object formatted as follows:

```json
{
  "permissions": [
    {
      "effect": "ALLOW",
      "actions": ["dashboard:View"],
      "resources": ["dashboard:123456"]
    }
  ]
}
```

The effect parameter is ether `ALLOW` or `DENY` and is case-sensitive. Currently, JupiterOne only supports fully-qualified actions and resources or the wildcard `*`.

**Supported actions include:**

```text
"compliance:GetStandard",
"compliance:GetSummary",
"dashboard:View",
"persister:GetEntityRawData",
"persister:Synchronize",
"query:GetAccountEntity",
"query:ReadGraphData",
"settings:GetSettings",
"parameters:GetParameter",
"parameters:GetParameterList",
"parameters:SetParameter",
"parameters:DeleteParameter"

"*" // All actions
```

**Supported resources include:**

```text
"account:<resourceId>",
"api:<resourceId>",
"compliance-standard:<resourceId>",
"dashboard:<resourceId>",
"entity:<resourceId>",
"integration:<resourceId>",
"powerup:<resourceId>",
"settings-category:<resourceId>",
"parameter:<resourceId>"

"*" // All resources
```

The action `query:ReadGraphData` may be constrained by a condition. For the policy to allow access to a graph object, that graph object must have the properties specified in the condition and those properties must have the values specified in the condition. These J1QL Query Policies must include `effect: "ALLOW"`; `actions: ["ReadGraphData"]` (or `actions: ["*"]`); and `resources: ["*"]`. In addition, their `conditions` block must contain an object of the `stringEquals` comparison. For example, this policy only allows its user to query for graph objects that have the property `_type` equal to `github_repo`:

```json
{
  "permissions": [
    {
      "effect": "ALLOW",
      "actions": ["query:ReadGraphData"],
      "resources": ["*"],
      "condition": {
        "stringEquals": {
          "_type": "github_repo"
        }
      }
    }
  ]
}
```

### Revoke Account-Level API Keys

To revoke an account-level key, enter:

```text
POST `https://graphql.us.jupiterone.io/`
```

```graphql
mutation RevokeToken($id: String!) {
  revokeToken(id: $id) {
    token
    id
    name
    category
    policy
    revoked
    createdAt
    expiresAt
    __typename
  }
}
```

Response

```json
{
  "variables": {
    "id": "<tokenId>"
  }
}
```

## Creating API Keys within the dashboard

In addition to creating API keys via our GraphQL API, they can be created within the dashboard as outlined below.

> **NOTE**
> 
> You must have the Administrator permission to enable API key access.

### Enable User-Level API Key Access

Before creating Account-level API keys, it will be necessary to to enable API key access for a group of users:

1.  Go to **Settings > Users & Access**.
2.  Select the group for whom you want to enable API access.
3.  Select **API Key Management**.

An API key icon appears in the My Profile view for each user in the group that has API key access.

#### Create Account-Level API Keys

You can manage user-level keys in the Account Management page. You must have administrator permissions to make changes to account-level API keys.

To generate a new API key or manage existing API keys:

1.  Log in to the account you want to manage.
2.  Go to **Settings > Account Management**.
3.  In the left panel, click the **key icon**. ​
4.  In the User API Keys page, click **Add**.
5.  In the API Keys modal, enter the name of the key and the number of days before it expires, and click **Create**.

To revoke an API key, in the User API Keys page, go to the key you want to revoke and click the **trash icon**.

#### API Key Permissions Policy

You must set a permission policy in JSON for account-level API keys, similar to an IAM policy in AWS. The following is an example of a full control policy:

```json
{
  "permissions": [
    {
      "effect": "ALLOW",
      "actions": [
        "*"
       ],
      "resources": [
         "*"
      ]
    }
  ]
}
```

J1 supports the creation of `*` policies that permit all actions or resources:

```json
{
  "permissions": [ 
    {
      "effect": "ALLOW", 
      "actions": [
        "*"
       ],
      "resources": [
         "*"
      ]
    } 
  ] 
} 
```

```json
{
  "permissions": [ 
    {
      "effect": "ALLOW", 
      "actions": [
        "query:ReadGraphData"
       ],
      "resources": [
         "*"
      ]
    } 
  ] 
} 
```

```json
{
  "permissions": [ 
    {
      "effect": "ALLOW", 
      "actions": [
        "*"
       ],
      "resources": [
         "*"
      ]
    },
    {
      "effect": "DENY", /// Deny only ReadGraphData
      "actions": [
        "query:ReadGraphData"
      ],
      "resources": [
        "*"
      ]
    }
  ] 
} 
```

## Create Integration API Keys

Integration API keys can only be used to synchronize data within a particular integration's scope and cannot be used to read the graph or perform any other action in the system. This can be useful for local development and running the integration in your own infrastructure.

You must have administrator permissions to be able to create keys and the selected integration must have at least one configuration.

To create an Integration API key:

1.  From the top navigation of the J1 Search homepage, select **Integrations**.
2.  Select the integration and then the instance for which you want to create an API key.
3.  Select the **API Keys** tab and then click **New API Key**.
4.  When prompted, click **Create** again to confirm your action.

The key is now available for you to use to synchronize data in this integrations.

To delete the API key at any time, click **Revoke**.

---

Source: /api/entity-mutations

# Entity mutations

### Create Entity

This mutation creates a JupiterOne entity with the given specifications. This mutation requires three parameters (with two optional parameters):

-   `entityKey`: A string that gives the key value for the entity so that this entity can be referenced later.
-   `entityType`: A string that gives the type of the entity being created.
-   `entityClass`: A string that gives the class of the entity being created.
-   Optional Parameters
    -   `timestamp`:
    -   `properties`: A `JSON` list that gives specific properties that the entity will have.

```graphql
mutation CreateEntity (
  $entityKey: String!
  $entityType: String!
  $entityClass: [String!]!
  $timestamp: Long
  $properties: JSON
) {
  createEntity (
    entityKey: $entityKey,
    entityType: $entityType,
    entityClass: $entityClass,
    timestamp: $timestamp,
    properties: $properties
  ) {
    entity {
      _id
      ...
    }
    vertex {
      id,
      entity {
        _id
        ...
      }
      properties
    }
  }
}
```

**Variables**:

```json
{
  "entityKey": "<an entity key>",
  "entityType": "<an entity type>",
  "entityClass": "<an entity class>",
  "timestamp": 1529329792552,
  "properties": {
    // Custom properties on the Entity
    ...
  }
}
```

### Creating entities and a relationship between them

> The following mutations utilize a J1Client.

```graphql
const CREATE_ENTITY = gql`
  mutation createEntity (
    $entityKey: String!
    $entityType: String!
    $entityClass: [String!]!
    $timestamp: Long
    $properties: JSON
  ) {
    createEntity(
      entityKey: $entityKey
      entityType: $entityType
      entityClass: $entityClass
      properties: $properties
    ) {
  .
  .
  .
  }`;

const CREATE_RELATIONSHIP = gql`
  mutation CreateRelationship (
    $relationshipKey: String!
    $relationshipType: String!
    $relationshipClass: String!
    $fromEntityId: String!
    $toEntityId: String!
  ) {
    createRelationship (
      relationshipKey: $relationshipKey
      relationshipType: $relationshipType
      relationshipClass: $relationshipClass
      fromEntityId: $fromEntityId
      toEntityId: $toEntityId
    ) {
    .
    .
    .
  }`;


const entity1 = await j1Client.mutate({
  mutation: CREATE_ENTITY,
  variable: {
    entityKey: 'Example Key',
    entityType: 'ExampleType',
    entityClass: 'ExampleClass',
    properties: {
      'tag.key': 'tagvalue'
    }
  }
});

const entity2 = await j1Client.mutate({
  mutation CREATE_ENTITY,
  variable: {
    entityKey: 'Other Example Key',
    entityType: 'OtherType',
    entityClass: 'OtherClass',
    properties: {
      'tag.key': 'tag'
    }
  }
});

const relationship = await j1Client.mutate({
  mutation: CREATE_RELATIONSHIP,
  variable: {
    relationshipKey: entity1._key + ' |uses| ' + entity2._key,
    relationshipClass: 'entity_uses_entity',
    relationshipType: 'USES',
    toEntityId: entity2._id,
    toEntityKey: entity1._id,
  }
});
```

### Updating Entity

This mutation updates an already existing entity (does not create an entity). You cannot change the `entityKey`, `entityClass`, or `entityType`. This mutation requires one parameter (with two optional parameters):

-   `entityId`: A string specific to the entity that finds the entity.
-   Optional Parameters:
    -   `timestamp`:
    -   `properties`: A `JSON` list of properties to be changed.

```graphql
mutation UpdateEntity (
  $entityId: String!
  $timestamp: Long
  $properties: JSON
) {
  updateEntity (
    entityId: $entityId,
    timestamp: $timestamp,
    properties: $properties
  ) {
    entity {
      _id
      ...
    }
    vertex {
      id,
      entity {
        _id
        ...
      }
      properties
    }
  }
}
```

**Variables**:

```json
{
  "entityId": "<an entity Id (entity._id)>",
  "timestamp": 1529329792552,
  "properties": {
    // Custom properties to get updated
    ...
  }
}
```

#### Property persistence

Properties set with `updateEntity` **persist across future syncs of the source integration**. If you set `criticality = "tier-1"` on a GitHub repository entity, the value remains on the entity after every subsequent GitHub integration sync — you do not need to re-apply it. If the integration's own data later asserts a different value for the same property, your `updateEntity` value continues to win until you explicitly clear it.

This makes `updateEntity` the right tool for one-off persistent edits on entities owned by a managed integration — for example, tagging a single repository with a criticality tier or pinning a custom unification key on two specific hosts.

#### When to use `updateEntity` vs sync modes

| You want to… | Use |
| --- | --- |
| Set a property on **one entity** (or a handful, scripted one at a time) and have it survive every future integration sync. | `updateEntity` |
| Set a property on **a batch of up to 10,000 entities** under a stable scope, managed together, and have those values survive every future integration sync. | [`OVERRIDE`](/api/sync-jobs/override.md) sync mode |
| Refresh a property frequently on managed-integration entities, and you accept that each integration sync resets the value. | [`PATCH`](/api/sync-jobs/patch.md) sync mode |
| Add or remove entities and relationships in a dataset you fully own. | [`DIFF`](/api/sync-jobs/diff.md) sync mode |

If both an `OVERRIDE` sync job and an `updateEntity` mutation set the same property on the same entity, the value that **most recently changed** takes precedence. See [OVERRIDE vs the entity mutation API](/api/sync-jobs/override.md#override-vs-the-entity-mutation-api) for details.

Alert rule tags also take precedence. If an alert rule tags a property, `updateEntity` does not change that property on the entity: the request still succeeds and your value is recorded, but the rule's value stays in effect until no rule tags that property. This is evaluated per property, so the other properties in the same request are applied normally.

### Deleting Entity

This mutation deletes an existing entity. This mutation requires one parameter (with one optional parameter):

-   `entityId`: A string specific to the entity that finds the entity.
-   Optional Parameters:
    -   `timestamp`
    -   `hardDelete` - this flag completely removes all information related to the entity and is not recoverable.

```graphql
mutation DeleteEntity (
  $entityId: String!
  $timestamp: Long
) {
  deleteEntity (
    entityId: $entityId,
    timestamp: $timestamp,
  ) {
    entity {
      _id
      ...
    }
    vertex {
      id,
      entity {
        _id
        ...
      }
      properties
    }
  }
}
```

**Variables**:

```json
{
  "entityId": "<an entity Id (entity._id)>",
  "timestamp": 1529329792552
}
```

---

Source: /api/entity-raw-data

# Entity raw data

Raw data is the unmodified payload a source system returned to an integration for an entity. Use the `entityRawDataV2` GraphQL query to retrieve the raw data for a single entity.

`entityRawDataV2` replaces `entityRawDataLegacy`, which is deprecated. See [Migrate from entityRawDataLegacy](#migrate-from-entityrawdatalegacy).

## Prerequisites

-   An API key and your account ID. See [Authentication](/api/authentication.md).
-   A user or API key with permission to read graph data, such as **Read Graph Data**.

Send requests to the JupiterOne GraphQL endpoint, `https://graphql.us.jupiterone.io/`, with the `Authorization: Bearer <api-key>` and `JupiterOne-Account: <account-id>` headers. The query reads only from the account in the `JupiterOne-Account` header.

## Query

```graphql
query EntityRawData($entityId: ID!, $address: EntityIngestionAddress!) {
  entityRawDataV2(entityId: $entityId, address: $address) {
    entityId
    status
    message
    collectedAt
    payload {
      name
      contentType
      data
    }
  }
}
```

### Arguments

| Argument | Type | Description |
| --- | --- | --- |
| `entityId` | `ID!` | The entity's `_id`. The response echoes this value back. |
| `address` | `EntityIngestionAddress!` | Where the entity was ingested from. JupiterOne uses the address to find the payload. |

`EntityIngestionAddress` has four required fields. Each field is a metadata property on the entity:

| Field | Type | Entity property |
| --- | --- | --- |
| `source` | `String!` | `_source`, for example `integration-managed` |
| `integrationInstanceId` | `String!` | `_integrationInstanceId` |
| `entityKey` | `String!` | `_key` |
| `entityType` | `String!` | `_type` |

`entityType` is required because `_key` is unique only within a `_type`.

### Get the address values

If you already have the entity, read the address values from its properties. Otherwise, return them with a J1QL query:

```j1ql
FIND aws_instance
  RETURN aws_instance._id, aws_instance._source, aws_instance._integrationInstanceId,
         aws_instance._key, aws_instance._type
```

**Example variables:**

```json
{
  "entityId": "<entity _id>",
  "address": {
    "source": "integration-managed",
    "integrationInstanceId": "<entity _integrationInstanceId>",
    "entityKey": "<entity _key>",
    "entityType": "aws_instance"
  }
}
```

## Response

| Field | Type | Description |
| --- | --- | --- |
| `entityId` | `ID!` | The `entityId` you passed in. |
| `status` | `RawDataStatus!` | `AVAILABLE` or `NOT_AVAILABLE_OR_EXPIRED`. |
| `payload` | `[RawDataEntry!]!` | The raw data entries. Empty unless `status` is `AVAILABLE`. |
| `message` | `String` | A human-readable explanation. Set only when `status` is `NOT_AVAILABLE_OR_EXPIRED`. |
| `collectedAt` | `String` | ISO 8601 start time of the sync job the payload came from. Set only when `status` is `AVAILABLE`. |

Each `RawDataEntry` has these fields:

| Field | Type | Description |
| --- | --- | --- |
| `name` | `String!` | The name the integration gave the raw data entry. An entity can have more than one entry. |
| `contentType` | `String!` | The content type of `data`, for example `application/json`. |
| `data` | `JSON` | The payload as the source system returned it. |

**Example response:**

```json
{
  "data": {
    "entityRawDataV2": {
      "entityId": "<entity _id>",
      "status": "AVAILABLE",
      "message": null,
      "collectedAt": "2026-10-21T14:02:11.000Z",
      "payload": [
        {
          "name": "default",
          "contentType": "application/json",
          "data": { "InstanceId": "i-0abc123def4567890", "State": { "Name": "running" } }
        }
      ]
    }
  }
}
```

## When raw data is not available

When there is no raw data for an entity, the query returns `status: NOT_AVAILABLE_OR_EXPIRED`, an empty `payload`, and a `message`. It does not return an error. Check `status` before you read `payload`.

Raw data is retained for **7 days** from the sync job that uploaded it, and comes from the integration's most recent run. Raw data is not available in these cases:

-   The integration has not run in more than 7 days, for example because it is disabled.
-   The entity was not included in the integration's most recent run.
-   The entity was not created by an integration. This includes entities created through the [Sync API](/api/sync-jobs/overview.md) (`_source: api`) and entities JupiterOne creates.
-   The integration did not upload raw data for the entity.

The entity and its properties are unaffected in every case. See [What's new in Asset Data](/features/assets/whats-new-in-asset-data.md#raw-data-covers-your-recent-syncs) for more detail.

> **INFO**
> 
> Raw data is a record of what a source system sent, not a store of record. If you need a durable copy of a source payload, export it or retain it at the source.

## Retrieve raw data in bulk

`entityRawDataV2` returns one entity per request. To retrieve raw data for many entities:

1.  Run a J1QL query that returns `_id`, `_source`, `_integrationInstanceId`, `_key`, and `_type` for the entities you need. See [Entity and relationship queries](/api/entity-relationship-queries.md).
2.  Call `entityRawDataV2` once for each entity, using the values from step 1.

Because you supply the address, JupiterOne does not have to look it up, so `entityRawDataV2` is faster per entity than `entityRawDataLegacy`. Requests count toward your [rate limits](/api/rate-limiting.md).

## Migrate from entityRawDataLegacy

> **WARNING**
> 
> `entityRawDataLegacy` is deprecated. It continues to return raw data, but new and updated code should use `entityRawDataV2`.

`entityRawDataLegacy` takes only the entity ID. JupiterOne must look up where the entity was ingested from before it can fetch the raw data, which makes each request slower than `entityRawDataV2`. Both queries return the same raw data and follow the same 7-day retention.

To migrate:

1.  Add `_source`, `_integrationInstanceId`, `_key`, and `_type` to the J1QL queries that return the entities you fetch raw data for.
2.  Replace the `entityRawDataLegacy` call with `entityRawDataV2`, and pass those values in `address`.
3.  Replace the union fragments in your selection set with plain fields. `entityRawDataLegacy` returns `payload` as a union of `RawDataJSONEntityLegacy` and `RawDataTextEntityLegacy`. `entityRawDataV2` returns a list of `RawDataEntry` objects.
4.  Check `status` instead of checking for an empty `payload`.

**Before:**

```graphql
query EntityRawData($entityId: String!, $source: String!) {
  entityRawDataLegacy(entityId: $entityId, source: $source) {
    entityId
    payload {
      ... on RawDataJSONEntityLegacy {
        name
        contentType
        data
      }
      ... on RawDataTextEntityLegacy {
        name
        contentType
        data
      }
    }
  }
}
```

**After:**

```graphql
query EntityRawData($entityId: ID!, $address: EntityIngestionAddress!) {
  entityRawDataV2(entityId: $entityId, address: $address) {
    entityId
    status
    message
    collectedAt
    payload {
      name
      contentType
      data
    }
  }
}
```

> **NOTE**
> 
> The `fetch_entity_raw_data` method in the [Python client](/api/python-client.md) uses `entityRawDataLegacy`.

## Related topics

-   [Authentication](/api/authentication.md)
-   [Entity and relationship queries](/api/entity-relationship-queries.md)
-   [Rate limiting](/api/rate-limiting.md)
-   [What's new in Asset Data](/features/assets/whats-new-in-asset-data.md)
-   [Working with properties](/features/assets/working-with-properties.md)

---

Source: /api/entity-relationship-queries

# Entity and relationship queries

This query will allow you to run J1QL queries for fetching data. The GraphQL resolver requires that one parameter is provided:

-   `query`: A J1QL query string that describes what data to return

Optionally, additional parameters can be provided:

-   `variables`: A `JSON` map of values to be used as parameters for the query
-   `cursor`: A token that can be exchanged to fetch the next page of information.
-   `includeDeleted`: When set to `true`, recently deleted information will be included in the results.
-   `deferredResponse`: This option allows for a deferred response to be returned. When a deferred response is returned, a `url` pointing the state of the query is provided. API consumers should poll the status of the deferred query by requesting the given `url` until the `status` property of the returned JSON document has a value of `COMPLETED` (see example below). Upon completion of the query, the `url` will provide a link to the query results. The results contain the same `type`, `data`, and `cursor` fields that the non-deferred GraphQL response would contain. Allowed values are `DISABLED` and `FORCE`.
-   `flags`:
    -   `computedProperties`: When set to `true`, vertices will be tagged with additional information to indicate if there are noteworthy traits that are worth surfacing.
    -   `rowMetadata`: When set to `true`, table results will return metadata about the requested objects under a `_meta` property.
    -   `variableResultSize`: When set to `true` the API will return the largest result size possible. Without this flag, the result size will be limited to 250 rows. This flag is recommended for use in cases where a larger result size is preferable and an indeterminate/variable number of return results is acceptable.
-   `scopeFilters`: An array of `JSON` map of filters that define the desired vertex. They have precedence over filters supplied in the query.

When working with additional variables, keep in mind some of the following considerations:

-   `variableResultSize` can increase the rate of your pagination flow because the API will return the largest number of rows possible per request. The exact number of rows returned will not always be the same, but will be larger than the default -- hence the name, _variable_ result size.
    
-   When paging through data, it is _highly_ recommended that cursors are leveraged instead of adding `limit` and `skip` clauses to queries.
    
-   Be sure to include `cursor` in the GraphQL response if you need to paginate through the results. The returned `cursor` will be `null` if there are no more pages available.
    
-   Queries that may take longer than 30 seconds should use the `FORCE` option for `deferredResponse` to avoid request timeouts. You should only use the `DISABLED` option when testing a simple query. It is _highly_ recommended that all automated processes use the the `FORCE` option when issuing J1QL queries.
    

**Example GraphQL query:**

```graphql
query J1QL($query: String!, $variables: JSON, $cursor: String, $scopeFilters: [JSON!], $flags: QueryV1Flags) {
  queryV1(query: $query, variables: $variables, cursor: $cursor, scopeFilters: $scopeFilters, flags: $flags) {
    type
    data
    cursor
  }
}
```

**Example variables:**

```json
{
  "query": "find Person with _type=${type} return Person.name",
  "variables": {
    "type": "employee"
  },
  "cursor": "eyJjYWNoZUtleSI6IjFlNDg3MT...",
  "scopeFilters": [
    {
      "org": "engineering"
    }
  ],
  "flags": {
    "computedProperties": true
  }
}
```

**Example `queryV1` resolver result:**

```json
{
  "type": "table",
  "data": [{ "Person.name": "Mochi" }],
  "cursor": "eyJjYWNoZUtleSI6IjFlNDg3MT..."
}
```

**Example GraphQL query with deferred responses:**

```graphql
query J1QL(
  $query: String!
  $variables: JSON
  $cursor: String
  $deferredResponse: DeferredResponseOption
) {
  queryV1(
    query: $query
    variables: $variables
    deferredResponse: $deferredResponse
    cursor: $cursor
  ) {
    type
    url
  }
}
```

**Example variables:**

```json
{
  "query": "find Person with _type=${type}",
  "deferredResponse": "FORCE",
  "variables": {
    "type": "employee"
  },
  "cursor": "eyJjYWNoZUtleSI6IjFlNDg3MT..."
}
```

**Example `queryV1` resolver result when using a deferred response:**

```json
{
  "type": "deferred",
  "url": "https://example.com/state.json"
}
```

**Example state responses:**

```json
{
  "status": "IN_PROGRESS",
  "correlationId": "912788f1-e0c7-43bd-b853-455c0031be8a"
}
```

```json
{
  "status": "COMPLETED",
  "url": "https://example.com/results.json",
  "correlationId": "912788f1-e0c7-43bd-b853-455c0031be8a"
}
```

### Retrieving a Single Vertex by ID

This query fetches a vertex and its properties by its ID. The query requires one of two parameters:

-   `id`: The ID as a string
-   `filters`: A set of filters that define the desired vertex.

The example below contains all of the currently available filters.

> **NOTE**
> 
> Only one of the variables (`id` or `filters`) is required. Specifying both is allowed but unnecessary unless you want to assert that a vertex with the specified `id` exists _and_ has specific entity properties.

```graphql
query VertexQuery($id: String!, $filters: VertexFilters) {
  vertex(id: $id, filters: $filters) {
    id
    entity {
      _id
      _key
      _type
      _accountId
      _integrationName
      _integrationDefinitionId
      _integrationInstanceId
      _version
      _createdOn
      _beginOn
      _endOn
      _deleted
      displayName
    }
    properties
  }
}
```

**Variables**:

```json
{
  "id": "<a vertex id>",
  "filters": {
    "_id": "<an entity id>",
    "_key": "<an entity key>",
    "_type": ["<a entity type>"],
    "_class": ["<a entity class>"]
  }
}
```

### Fetching Neighbors of a Vertex

The `Vertex` type allows you to retrieve vertex and edge neighbors up to a certain depth using the `neighbors` field. The return type of the `neighbors` resolver is the same as that of a graph query. This query requires two parameters:

-   `id`: The ID of the vertex as a string
-   `depth`: An integer specifying how many "levels" deep the query will go to look for neighbors.

```graphql
query VertexQuery($id: String!, $depth: Int) {
  vertex(id: $id) {
    id
    entity {
      displayName
    }
    neighbors(depth: $depth) {
      vertices {
        id
        entity {
          displayName
        }
      }
      edges {
        id
        relationship {
          displayName
        }
      }
    }
  }
}
```

**Variables**:

The depth that is supplied must be a value between 1 and 5 (inclusive).

```json
{
  "id": "<a vertex id>",
  "depth": 5
}
```

### Retrieving an Edge by ID

This query allows you to fetch an edge, its properties, and the relationship it describes by its ID or label and filters. The query requires one or two of three parameters:

-   `id`: The ID as a string.
-   `label`: The label displayed on the edge.
-   `filters`: A set of filters that define the desired vertex.

Only one of the variables (`id`, `label`, or `filters`) is required. Specifying `label` and `filters` with `id` is allowed but somewhat redundant unless you want to assert that a vertex with the specified `id` exists _and_ has the specific label and properties.

The example below contains all of the currently available filters.

```graphql
query VertexQuery($id: String!) {
  edge(id: $id, label: $id, filters: $id) {
    id
    relationship {
      _id
      _key
      _type
      _accountId
      _integrationName
      _integrationDefinitionId
      _integrationInstanceId
      _version
      _createdOn
      _beginOn
      _endOn
      _deleted
      _fromEntityKey
      _toEntityKey
      displayName
    }
    properties
  }
}
```

**Variables**:

```json
{
  "id": "<an edge id>",
  "label": "<edge label>",
  "filters": {
    "_id": "<a relationship id>",
    "_key": "<a relationship key>",
    "_type": "<a relationship type>",
    "_class": "<a relationship class>"
  }
}
```

### Fetching the Count of Entities Via a \_type and/or \_class

This query allows you to fetch the count of entities. The `_id`, `_key`, `_type`, or `_class` fields can be supplied as filters. This query only counts the latest versions of entities matching the filter criteria. This query requires two parameters:

-   `filters`: A set of vertex filters that describe the entities that are to be returned.
-   `filterType`: A `FilterType` (`AND` or `OR`).

If `OR` is specified as the filter type, any entity that has any class in the filter will be included in the count. By default, the query uses `AND`, which only includes entities that have _all_ of the specified classes in the count.

This resolver uses the `JSON` scalar as the return type:

```graphql
query testQuery($filters: VertexFilters, $filterType: FilterType) {
  entityCount(filters: $filters, filterType: $filterType)
}
```

Use field aliases to request the counts of multiple different entities:

```graphql
query testQuery {
  Users: entityCount(filters: { _class: ["User"] }, filterType: "AND")
  Repos: entityCount(filters: { _class: ["CodeRepo"] }, filterType: "OR")
}
```

**Example result**:

```json
{
  "User": 40,
  "CodeRepo": 153
}
```

### Fetching the Count of All Types and Classes

This query returns the entity counts for all types and classes. The following resolver uses the `JSON` scalar as the return type:

```graphql
query testQuery {
  allEntityCounts
}
```

**Example result**:

```json
{
  "typeCounts": {
    "iam_user": 12,
    "iam_managed_policy": 10,
    "iam_role_policy": 10
  },
  "classCounts": {
    "User": 12,
    "AccessPolicy": 20
  }
}
```

### Fetching the Count of All Types With a Set of Classes

The query below returns all types that have the specified classes. The query requires two parameters:

-   `classes`: An array of strings detailing which classes should be returned.
-   `filterType`: A `FilterType` (`AND` or `OR`).

If `OR` is specified as the filter type, any entity that has any class in the filter will be included in the count. By default, the query uses `AND`, which only includes entities that have _all_ of the specified classes in the count.

This resolver uses the `JSON` scalar as the return type:

```graphql
query testQuery ($classes: [String], $filterType: FilterType) {
  typeCounts (classes: $classes, filterType: $filterType)
}
```

**Example result**:

```json
{
  "iam_user": 12,
  "iam_managed_policy": 10,
  "iam_role_policy": 10
}
```

### Listing Entities Via a \_type and/or \_class

For fetching entities with specified filters. The `_id`, `_key`, `_type` and `_class` fields can be included in a J1QL query request.

This query has a deferred response flow and needs to be completed in three parts.

---

Source: /api/iam-operations

# IAM API

> **NOTE**
> 
> `accessAdmin` permission is required for all IAM operations.

**Endpoint:**

```text
POST https://graphql.us.jupiterone.io/
```

**Headers:**

```plain
Content-Type: application/json
Accept: application/json
JupiterOne-Account: {Account_ID}
Authorization: Bearer {API_Key}
```

### Get IAM groups

**Query: iamGroups**

Retrieves all account `groups` within the query limit.

-   `limit`: (required) max number of records to return
-   `cursor`: (optional) continuation token

```graphql
query Query($limit: Int!, $cursor: String) {
  iamGroups(limit: $limit, cursor: $cursor) {
    items {
      id
      name
      description
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

**API Samples**

Sample (S1): `iamGroups`

(S1): Request

```json
{
  "limit": 5
}
```

(S1): Response

```json
{
  "data": {
    "iamGroups": {
      "items": [
        {
          "id": "12c2d370-89ef-4280-970b-d520ca1837be",
          "name": "Users",
          "description": ""
        },
        {
          "id": "dd354c7a-1b9b-4579-ac5e-873fe3b2c851",
          "name": "Administrators",
          "description": "Admin users"
        }
      ],
      "pageInfo": {
        "endCursor": "eyJhY2NvdW50I...",
        "hasNextPage": true
      }
    }
  }
}
```

### Get Users of IAM group

**Query: iamGroupUsers**

Retrieves all group members of the specified `group` (by `id`) within the query limit.

-   `groupId`: (required) unique group identifier
-   `limit`: (required) max number of records to return
-   `cursor`: (optional) continuation token
    
    > Note: The item.`id` property in the response is the JupiterOne `uid`.
    

```graphql
query Query($groupId: String!, $limit: Int!, $cursor: String) {
  iamGroupUsers(groupId: $groupId, limit: $limit, cursor: $cursor) {
    items {
      id
      email
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

**API Samples**

Sample (S1): `iamGroupUsers`

(S1): Request

```json
{
  "groupId": "22c2d370-89ef-4280-970b-d520ca1837be",
  "limit": 5
}
```

(S1): Response

```json
{
  "data": {
    "iamGroupUsers": {
      "items": [
        {
          "id": "222xxx222_abc",
          "email": "abc@mycompany.com"
        },
        {
          "id": "222xxx222_def@mycompany.com",
          "email": "def@mycompany.com"
        }
      ],
      "pageInfo": {
        "endCursor": "eyJ1c2VyIjoiaj...",
        "hasNextPage": true
      }
    }
  }
}
```

### Add IAM User to Group

**Mutation: addIamUserToGroupByEmail**

Adds a `user` to a `group` using the specified email and group ID.

-   `groupId`: (required)
-   `userEmail`: (required)

```graphql
mutation Mutation($groupId: String!, $userEmail: String!) {
  addIamUserToGroupByEmail(groupId: $groupId, userEmail: $userEmail) {
    success
  }
}
```

**API Samples**

Sample (S1): `addIamUserToGroupByEmail`

(S1): Request

```json
{
  "groupId": "22c2d370-89ef-4280-970b-d520ca1837be",
  "userEmail": "abc@mycompany.com"
}
```

(S1): Response

```json
{
  "data": {
    "addIamUserToGroupByEmail": {
      "success": true
    }
  }
}
```

### Remove IAM user from group

**Mutation: removeIamUserFromGroupByEmail**

Removes a `user` from a `group` using the specified email and group ID.

-   `groupId`: (required)
-   `userEmail`: (required)

```graphql
mutation Mutation($groupId: String!, $userEmail: String!) {
  removeIamUserFromGroupByEmail(groupId: $groupId, userEmail: $userEmail) {
    success
  }
}
```

**API Samples**

Sample (S1): `removeIamUserFromGroupByEmail`

(S1): Request

```json
{
  "groupId": "22c2d370-89ef-4280-970b-d520ca1837be",
  "userEmail": "xyz@mycompany.com"
}
```

(S1): Response

```json
{
  "data": {
    "removeIamUserFromGroupByEmail": {
      "success": true
    }
  }
}
```

### Create IAM Group

**Mutation: `createIamGroup`**

Creates a new `group` with a specified `name` and optionally: `description`, `queryPolicy`, and/or `abacPermissions`.

-   `name`: (required) must be unique to all other groups.
-   `description`: (optional)
-   `abacPermissions`: (optional)
-   `queryPolicy`: (optional)

```graphql
mutation Mutation(
  $name: String!
  $description: String
  $abacPermissions: [String!]
  $queryPolicy: [JSON!]
) {
  createIamGroup(
    name: $name
    description: $description
    abacPermissions: $abacPermissions
    queryPolicy: $queryPolicy
  ) {
    id
    name
    description
  }
}
```

**API Type Definitions**

**queryPolicy**

Description: Group Query Policies define query access for members of a particular group. Setting this property via the IAM API will **overwrite** any existing queryPolicy for the given group. If updating this property, _always_ define the full `queryPolicy` to enforce.

Type: list of `JSON` objects with primitive values or an array or primitive values.

```typescript
type queryPolicy = [JSON!];
type JSON = {
  [key: string]: string | number | boolean || (string | number | boolean)[];
}
```

queryPolicy

**abacPermissions**

ABAC permissions define application access for members of a perticular group. Setting this property via the IAM API will **overwrite** any existing permissions for the given group. If updating this property, _always_ define the full list of `permissions` that should be granted.

Type: list of valid `permission` strings (see table below).

```typescript
type abacPermissions = [permission!]
type permission = string // must be a valid permission string
```

**Permission Strings: READ-ONLY**

| DISPLAY NAME (J1 APP) | ACCESS | PERMISSION |
| --- | --- | --- |
| _All Apps And Resources_ | READ | `fullReadAccess` |
| _Shared: Questions_ | READ | `readQuestions` |
| _GraphData_ | READ | `readGraph` |
| _Home Page_ | READ | `accessLanding` |
| _Assets_ | READ | `accessAssets` |
| _Policies_ | READ | `accessPolicies` |
| _Compliance_ | READ | `accessCompliance` |
| _Alerts_ | READ | `accessRules` |
| _GraphViewer_ | READ | `accessGalaxy` |
| _Insights_ | READ | `accessInsights` |
| _Integrations_ | READ | `accessIntegrations` |
| _Endpoint Compliance_ | READ | `accessEndpointCompliance` |
| _Vulnerabilities_ | READ | `accessVulnerabilities` |

**Permission Strings: ADMIN**

| DISPLAY NAME (J1 APP) | ACCESS | PERMISSION |
| --- | --- | --- |
| _All Apps And Resources_ | ADMIN | `accessAdmin` |
| _Shared: Questions_ | ADMIN | `writeQuestions` |
| _GraphData_ | ADMIN | `writeGraph` |
| _Home Page_ | ADMIN | `adminLanding` |
| _Assets_ | ADMIN | `adminAssets` |
| _Policies_ | ADMIN | `adminPolicies` |
| _Compliance_ | ADMIN | `adminCompliance` |
| _Alerts_ | ADMIN | `adminRules` |
| _GraphViewer_ | ADMIN | `adminGalaxy` |
| _Insights_ | ADMIN | `adminInsights` |
| _Integrations_ | ADMIN | `adminIntegrations` |
| _Endpoint Compliance_ | ADMIN | `adminEndpointCompliance` |
| _Vulnerabilities_ | ADMIN | `adminVulnerabilities` |
| _ENABLE API KEY ACCESS_ | \* | `apiKeyUser` |

**API Samples**

Sample (S1): `createIamGroup`

(S1): Request

```json
{
  "name": "Users"
}
```

(S1): Response

```json
{
  "data": {
    "createIamGroup": {
      "id": "90909-11ef-4280-970b-4444ca1837be",
      "name": "Users"
    }
  }
}
```

Sample (S2): `createIamGroup`

(S2): Request

```json
{
  "name": "UsersX",
  "description": "A group for X users"
}
```

(S2): Response

```json
{
  "data": {
    "createIamGroup": {
      "id": "11c2d370-89ef-4280-970b-d520ca1837be",
      "name": "UsersX",
      "description": "A group for X users"
    }
  }
}
```

Sample (S3): `createIamGroup`

(S3): Request

```json
{
  "name": "Support",
  "description": "A group for support users",
  "queryPolicy": [
    {
      "_type": ["aws_ecr_image", "bitbucket_pullrequest"]
    }
  ]
}
```

(S3): Response

```json
{
  "data": {
    "createIamGroup": {
      "id": "23434-454-45656-65656-4564564565",
      "name": "Support",
      "description": "A group for support users"
    }
  }
}
```

Sample (S4): `createIamGroup`

(S4): Request

```json
{
  "name": "Admins",
  "queryPolicy": [
    {
      "_type": "aws_ecs_task_definition",
      "_class": "Account"
    },
    {
      "_type": "aws_ecr_image"
    }
  ]
}
```

(S4): Response

```json
{
  "data": {
    "createIamGroup": {
      "id": "87787-6787-678678-778-6786786",
      "name": "Admins"
    }
  }
}
```

**Access All Actions and Resources**

You can use an API token to access all actions and resources

### Update IAM Group

**Mutation: `updateIamGroup`**

Updates a `group`'s properties: `name`, `description`, `queryPolicy`, and/or `abacPermissions`.

-   `id`: (required) must tie to an existing group.
-   `name`: (optional) must be unique to all other groups.
-   `description`: (optional)
-   `abacPermissions`: (optional)
-   `queryPolicy`: (optional)

```graphql
mutation Mutation(
  $id: String!
  $name: String
  $description: String
  $abacPermissions: [String!]
  $queryPolicy: [JSON!]
) {
  updateIamGroup(
    id: $id
    name: $name
    description: $description
    abacPermissions: $abacPermissions
    queryPolicy: $queryPolicy
  ) {
    id
    name
    description
  }
}
```

**API Type Definitions**

**queryPolicy**

Description: Group Query Policies define query access for members of a particular group. Setting this property via the IAM API will **overwrite** any existing queryPolicy for the given group. If updating this property, _always_ define the full `queryPolicy` to enforce.

Type: list of `JSON` objects with primitive values or an array or primitive values.

```typescript
type queryPolicy = [JSON!];
type JSON = {
  [key: string]: string | number | boolean || (string | number | boolean)[];
}
```

**abacPermissions**

Description: ABAC permissions define application access for members of a perticular group. Setting this property via the IAM API will **overwrite** any existing permissions for the given group. If updating this property, _always_ define the full list of `permissions` that should be granted.

Type: list of valid `permission` strings (see table below).

```typescript
type abacPermissions = [permission!];
type permission = string; // must be a valid permission string
```

**Permission Strings: READ-ONLY**

| DISPLAY NAME (J1 APP) | ACCESS | PERMISSION |
| --- | --- | --- |
| _All Apps And Resources_ | READ | `fullReadAccess` |
| _Shared: Questions_ | READ | `readQuestions` |
| _GraphData_ | READ | `readGraph` |
| _Home Page_ | READ | `accessLanding` |
| _Assets_ | READ | `accessAssets` |
| _Policies_ | READ | `accessPolicies` |
| _Compliance_ | READ | `accessCompliance` |
| _Alerts_ | READ | `accessRules` |
| _GraphViewer_ | READ | `accessGalaxy` |
| _Insights_ | READ | `accessInsights` |
| _Integrations_ | READ | `accessIntegrations` |
| _Endpoint Compliance_ | READ | `accessEndpointCompliance` |
| _Vulnerabilities_ | READ | `accessVulnerabilities` |

**Permission Strings: ADMIN**

| DISPLAY NAME (J1 APP) | ACCESS | PERMISSION |
| --- | --- | --- |
| _All Apps And Resources_ | ADMIN | `accessAdmin` |
| _Shared: Questions_ | ADMIN | `writeQuestions` |
| _GraphData_ | ADMIN | `writeGraph` |
| _Home Page_ | ADMIN | `adminLanding` |
| _Assets_ | ADMIN | `adminAssets` |
| _Policies_ | ADMIN | `adminPolicies` |
| _Compliance_ | ADMIN | `adminCompliance` |
| _Alerts_ | ADMIN | `adminRules` |
| _GraphViewer_ | ADMIN | `adminGalaxy` |
| _Insights_ | ADMIN | `adminInsights` |
| _Integrations_ | ADMIN | `adminIntegrations` |
| _Endpoint Compliance_ | ADMIN | `adminEndpointCompliance` |
| _Vulnerabilities_ | ADMIN | `adminVulnerabilities` |
| _ENABLED API KEY ACCESS_ | \* | `apiKeyUser` |

**API Samples**

Sample (S1): `updateIamGroup`

(S1): Request

```json
{
  "id": "90909-11ef-4280-970b-4444ca1837be",
  "name": "Users"
}
```

(S1): Response

```json
{
  "data": {
    "updateIamGroup": {
      "id": "90909-11ef-4280-970b-4444ca1837be",
      "name": "Users",
      "description": "original description.."
    }
  }
}
```

Sample (S2): `updateIamGroup`

(S2): Request

```json
{
  "id": "90909-11ef-4280-970b-4444ca",
  "name": "UsersX",
  "description": "A group for X users"
}
```

(S2): Response

```json
{
  "data": {
    "updateIamGroup": {
      "id": "90909-11ef-4280-970b-4444ca",
      "name": "UsersX",
      "description": "A group for X users"
    }
  }
}
```

Sample (S3): `updateIamGroup`

(S3): Request

```json
{
  "id": "90909-11ef-4280-970b-4444ca",
  "abacPermissions": ["accessPolicies", "writeQuestions", "accessGalaxy"],
  "queryPolicy": [
    {
      "_type": "aws_ecs_task_definition"
    }
  ]
}
```

(S3): Response

```json
{
  "data": {
    "updateIamGroup": {
      "id": "90909-11ef-4280-970b-4444ca",
      "name": "UsersX",
      "description": "A group for X users"
    }
  }
}
```

Sample (S4): `updateIamGroup`

(S4): Request

```json
{
  "id": "90909-11ef-4280-970b-4444ca",
  "description": "allow account class",
  "queryPolicy": [
    {
      "_type": "aws_ecs_task_definition",
      "_class": "Account"
    },
    {
      "_integrationType": ["whitehat"]
    }
  ]
}
```

(S4): Response

```json
{
  "data": {
    "updateIamGroup": {
      "id": "90909-11ef-4280-970b-4444ca",
      "name": "UsersX",
      "description": "allow account class"
    }
  }
}
```

### Set RBAC Permissions

Resource permissions are used to manage access to the following resources: integrations, dashboards, and rules. You can set resource permissions for a user group by using the following gql mutation:

**Mutation: `setResourcePermission`**

Creates/updates a resource permission for a `group`

-   `subjectType`: (required) Currently only supports `group` for user group
-   `subjectId`: (required) The id of the user group
-   `resourceArea`: (required) `dashboard`, `integration`, or `rule`
-   `resourceType`: (required) `*`, `resource_group`, `dashboard`, `integration`, or `rule`
-   `resourceId`: (required) The id of the resource or `*`
-   `canCreate`: (required)
-   `canRead`: (required) Must be true if `canCreate`, `canUpdate` or `canDelete` are true
-   `canUpdate`: (required)
-   `canDelete`: (required)

```graphql
mutation SetResourcePermission(
  $subjectType: String!
  $subjectId: String!
  $resourceArea: String!
  $resourceType: String!
  $resourceId: String!
  $canCreate: Boolean!
  $canRead: Boolean!
  $canUpdate: Boolean!
  $canDelete: Boolean!
) {
  setResourcePermission(
    input: {
      subjectType: $subjectType
      subjectId: $subjectId
      resourceArea: $resourceArea
      resourceType: $resourceType
      resourceId: $resourceId
      canCreate: $canCreate
      canRead: $canRead
      canUpdate: $canUpdate
      canDelete: $canDelete
    }
  ) {
    subjectType
    subjectId
    resourceArea
    resourceType
    resourceId
    canCreate
    canRead
    canUpdate
    canDelete
  }
}
```

---

Source: /api/integrations-operations

# Integrations API

### Scheduling Integration Jobs

Use the `pollingIntervalCronExpression` to set an `hour` or `dayOfWeek` value for an integration configuration to run.

#### Set the Hour

When using the `ONE_DAY` polling interval, you can pass an optional `pollingIntervalCronExpression` to specify a time of day for the integration to execute.

The following configuration sets an integration to execute daily between 00:00 and 01:00 UTC.

```graphql
{
  "pollingInterval": "ONE_DAY",
  "pollingIntervalCronExpression": { "hour": 0 }
}
```

`pollingIntervalCronExpression.hour` accepts an integer between 0 and 23.

#### Set the Day of the Week

When using the `ONE_WEEK` polling interval, you can pass an optional `pollingIntervalCronExpression` to specify both a `dayOfWeek` and `hour` for the integration to execute.

The following configuration sets an integration to execute weekly on Sunday between 00:00 and 01:00 UTC.

```graphql
{
  "pollingInterval": "ONE_WEEK",
  "pollingIntervalCronExpression": { "hour": 0, "dayOfWeek": 0 }
}
```

`pollingIntervalCronExpression.dayOfWeek` accepts an integer between 0 (Sunday) and 6 (Saturday).

#### Example Mutation

This is an example of a GraphQL mutation that updates the hour and day of the week for a specific configuration of an integration in JupiterOne:

```graphql
mutation integrationInstance(
  $id: String!
  $pollingIntervalCronExpression: IntegrationPollingIntervalCronExpressionInput
) {
  updateIntegrationInstance(
    id: $id
    update: { pollingIntervalCronExpression: $pollingIntervalCronExpression }
  ) {
    id
    name
    pollingInterval
    pollingIntervalCronExpression {
      hour
      dayOfWeek
    }
  }
}
```

Variables for the mutation:

```graphql
{
  "id": "00000000-0000-0000-0000-000000000000",
  "pollingIntervalCronExpression": {
    "hour": 0,
    "dayOfWeek": 0
  }
}
```

Variables:

`id`: the `id` of the configuration for which you want to update the hour and/or day of week. This ID is visible in each integration configuration in your account. To find the ID in your JupiterOne account, go to **Settings > Integration > {integration name} > {configuration name}** > value in the ID field.

`hour`: an integer between 0 and 23 that represents the hour of the day in UTC when you want the integration to run.

`dayofWeek`: an integer between 0 and 6 that represents the day of the week Sunday through Saturday on which you want the integration to run.

#### Example Query

This is an example of a GraphQL query that returns the current values in the `hour` and `dayOfWeek` parameters for a specific integration configuration:

```graphql
query integrationInstance($id: String!) {
  integrationInstance(id: $id) {
    id
    name
    pollingInterval
    pollingIntervalCronExpression {
      hour
      dayOfWeek
    }
  }
}
```

Variable for the query:

```graphql
{
  "id": "00000000-0000-0000-0000-000000000000"
}
```

Variables:

`id`: the `id` of the configuration for which you want to update the hour and/or day of week. This ID is visible in each integration configuration in your account. To find the ID in your JupiterOne account go to **Settings > Integration > {integration name} > {configuration name} >** value in the ID field.

### Finding an Integration Definition Based on a Type

For an end-customer guide to authoring custom integrations, see [Integration Development](/integrations/development/overview.md).

This query returns an Integration Definition. This query requires an Integration Type.

```graphql
query testQuery($integrationType: String!) {
  findIntegrationDefinition(integrationType: $integrationType) {
    id
    name
    type
    title
    integrationType
    integrationClass
    configFields {
      key
      displayName
      description
    }
  }
}
```

### Getting an Integration Definition with an ID

This query returns a Integration Definition. This query requires an ID.

```graphql
query getIntegrationDefinition($id: String) {
  integrationDefinition(id: $id) {
    id
    name
    type
    title
  }
}
```

### List Integration Definitions

This query returns a list of all Integration Definitions.

```graphql
query testQuery {
  integrationDefinitions {
    definitions {
      id
      name
      type
      title
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

### List Integration Jobs

This query returns a list of Integration Jobs for a given Integration Instance.

```graphql
query testQuery (
  $integrationInstanceId: String!
  $cursor: String
  $size: Int
) {
  integrationJobs(
    integrationInstanceId: $integrationInstanceId
    cursor: $cursor
    size: $size
  ) {
    jobs {
      id
      createDate
      integrationInstanceId
      status
      errorsOccurred
      endDate
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

### Integration Job Health

This section has been moved [here](/integrations/instance-management.md#instance-job-statues).

## Trigger an Integration Job via API

The following values are required in order to trigger an integration job via API: `API_KEY` - An API Key must be configured before leveraging the JupiterOne API. Review [Enable API Key Access](/api/authentication.md) for a guide in creating a JupiterOne API Key.

`ACCOUNT_ID` - This value is the unique ID of your JupiterOne Account, found in Settings under Account Management.

`INTEGRATION_INSTANCE_ID` - This value is the ID of the specific integration instance that will be triggered, found in Settings under Integrations and then selecting the specific integration that has been configured (Integrations - Configurations - Settings).

**Sample request:**

Endpoint:

```text
POST https://graphql.us.jupiterone.io
```

Headers:

```json
{
  "Content-Type": "application/json",
  "Accept": "application/json",
  "JupiterOne-Account": "{Account_ID}",
  "Authorization": "Bearer {API_Key}"
}
```

Body:

```graphql
{
  mutation Invoke {
    invokeIntegrationInstance(id: INTEGRATION_INSTANCE_ID) {
      success
    }
  }
}
```

## Retrieve JupiterOne Audit Events via API

User events in your JupiterOne account are logged and can be accessed via API.

**Sample request:**

Endpoint:

```text
POST https://graphql.us.jupiterone.io
```

Headers:

```json
{
  "Content-Type": "application/json",
  "JupiterOne-Account": "{Account_ID}",
  "Authorization": "Bearer {API_Key}"
}
```

Body:

```graphql
query Query($limit: Int, $cursor: String, $startTimestamp: Long, $endTimestamp: Long) {
  getAuditEventsForAccount(
    limit: $limit
    cursor: $cursor
    startTimestamp: $startTimestamp
    endTimestamp: $endTimestamp
  ) {
    items {
      id
      resourceType
      resourceId
      category
      timestamp
      performedByUserId
      data
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

---

Source: /api/nodejs-client

# JupiterOne Node.js Client

The [`@jupiterone/jupiterone-client-nodejs`](https://www.npmjs.com/package/@jupiterone/jupiterone-client-nodejs) package is a Node.js wrapper for the JupiterOne API. It also installs the `j1` command-line tool, which runs J1QL queries and creates, updates, or deletes entities, relationships, alert rules, and questions from JSON or YAML input files.

> **NOTE**
> 
> This is an experimental project and is subject to change. The source code and changelog are on [GitHub](https://github.com/JupiterOne/jupiterone-client-nodejs).

## Requirements

-   Node.js 22 or later. Version 3.0.0 of the client dropped support for Node.js 18 and 20.
-   A JupiterOne API key. See [Authentication](/api/authentication.md) to create one.
-   Your JupiterOne account ID, found in [Account Management](/features/admin/admin-settings.md#account-management).

## Installation

To install the client in the current project:

```bash
npm install @jupiterone/jupiterone-client-nodejs
```

To install the client and the `j1` CLI globally:

```bash
npm install -g @jupiterone/jupiterone-client-nodejs
```

## Using the Node.js client

```js
const { JupiterOneClient } = require('@jupiterone/jupiterone-client-nodejs');

async function main() {
  const j1Client = await new JupiterOneClient({
    account: 'my-account-id',
    accessToken: process.env.J1_API_TOKEN,
    apiBaseUrl: 'https://api.us.jupiterone.io', // Optional
  }).init();

  const results = await j1Client.queryV1('FIND jupiterone_account');

  const integrationInstance = await j1Client.integrationInstances.get(
    'my-integration-instance-id',
  );
}

main().catch((err) => {
  console.error(err);
  process.exitCode = 1;
});
```

`apiBaseUrl` defaults to `https://api.us.jupiterone.io`. Accounts hosted in the EU region use `https://api.eu.jupiterone.io`.

Beyond queries, the client exposes methods for entities and relationships (`createEntity`, `updateEntity`, `deleteEntity`, `createRelationship`), alert rules (`mutateAlertRule`), questions (`createQuestion`, `updateQuestion`, `deleteQuestion`), integration definitions and instances (`integrationDefinitions.list`, `integrationInstances.list`, `get`, `create`, `update`, `delete`), and [sync jobs](/api/sync-jobs/overview.md) (`startSyncJob`, `uploadGraphObjectsForSyncJob`, `finalizeSyncJob`, `abortSyncJob`, `bulkUpload`, `bulkDelete`).

### Query options

`queryV1` pages through results with cursors and returns all of them. The second argument accepts Apollo Client query options, which is useful when you need to change how the cache behaves. Inside an async function:

```js
const options = {
  fetchPolicy: 'network-only',
};

const results = await j1Client.queryV1('FIND jupiterone_account', options);
```

See the Apollo Client documentation on [fetch policies](https://www.apollographql.com/docs/react/data/queries/#setting-a-fetch-policy) for the available values.

## Using the j1 CLI

```bash
$ j1 --help
Usage: j1 [options]

Options:
  -v, --version             output the version number
  -a, --account <name>      JupiterOne account name.
  -u, --user <email>        JupiterOne user email.
  -k, --key <apiToken>      JupiterOne API access token.
  -q, --query <j1ql>        Execute a query.
  -o, --operation <action>  Supported operations:
                            create,update,upsert,delete,bulk-delete,provision-alert-rule-pack
  -e, --entity              Specifies entity operations.
  -r, --relationship        Specifies relationship operations.
  -l, --alert               Specifies alert rule operations.
  -w, --question            Specifies question operations. A question is
                            answered by one or more queries.
  -f, --input-file <dir>    Input JSON file. Or the filename of the alert rule
                            pack.
  --hard-delete             Optionally force hard deletion of entities (default
                            is soft delete).
  --delete-duplicates       Optionally force deletion of duplicate entities
                            with identical keys.
  --output-file <file>      Writes query result to specified output file, or
                            results.json by default (default: "results.json")
  --api-base-url <url>      Optionally specify base URL to use during
                            execution. (defaults to
                            `https://api.us.jupiterone.io`)
  -h, --help                display help for command
```

Every command needs:

-   `-a` with your JupiterOne account ID. The value is sent as the `JupiterOne-Account` header, so use the account ID even though the help text says "account name".
-   An API key, passed with `-k` or set in the `J1_API_TOKEN` environment variable.

> **CAUTION**
> 
> The `-u` (user email) option is a leftover from the old username and password login, which the client no longer supports. Always authenticate with an API key.

Input files can be JSON (`.json`) or YAML (`.yml` or `.yaml`). YAML files are parsed with the YAML 1.2 schema.

## Examples

The examples below assume your API key is set in the `J1_API_TOKEN` environment variable. Otherwise, add `-k <api-key>` to each command.

### Run a J1QL query

```bash
$ j1 -a my-account-id -q 'Find jupiterone_account'
Validating inputs... OK
Authenticating with JupiterOne... OK
[
  {
    "id": "06ab12cd-a402-406c-8582-abcdef001122",
    "entity": {
      "_beginOn": 1553777431867,
      "_createdOn": 1553366320704,
      "_deleted": false,
      "displayName": "YCO, Inc.",
      "_type": [
        "jupiterone_account"
      ],
      "_key": "1a2b3c4d-44ce-4a2f-8cd8-99dd88cc77bb",
      "_accountId": "my-account-id",
      "_source": "api",
      "_id": "1a2b3c4d-44ce-4a2f-8cd8-99dd88cc77bb",
      "_class": [
        "Account"
      ],
      "_version": 6
    },
    "properties": {
      "emailDomain": "yourcompany.com",
      "phoneNumber": "877-555-4321",
      "webURL": "https://yourcompany.com/",
      "name": "YCO"
    }
  }
]
Done!
```

Query results are also written to `results.json` in the current directory. Use `--output-file` to choose a different file.

### Create, update, or delete entities from an input file

```bash
$ j1 -a my-account-id -o create --entity -f ./entities.json
Validating inputs... OK
Authenticating with JupiterOne... OK
created 2 entities:
[
  "12345678-fe34-44ee-b3b0-abcdef123456",
  "12345678-e75f-40d6-858e-123456abcdef"
]
Done!
```

The operations behave as follows:

-   `create` creates every entity in the file.
-   `update` updates entities identified by `entityId`, or by `entityKey` when no `entityId` is given. Entities whose key is not found, or matches more than one entity, are skipped.
-   `upsert` works like `update`, but creates the entity when its key is not found.
-   `delete` soft-deletes entities identified by `entityId` or `entityKey`. Add `--hard-delete` to delete them permanently, and `--delete-duplicates` to delete every entity that shares the same key.

The input file contains a single entity or an array of entities. For example:

```json
[
  {
    "entityId": "12345678-fe34-44ee-b3b0-abcdef123456",
    "entityKey": "test:entity:1",
    "entityType": "generic_resource",
    "entityClass": "Resource",
    "properties": {
      "name": "Test Entity Resource 1",
      "displayName": "TER1"
    }
  },
  {
    "entityId": "12345678-e75f-40d6-858e-123456abcdef",
    "entityKey": "test:entity:3",
    "entityType": "generic_resource",
    "entityClass": "Resource",
    "properties": {
      "name": "Test Entity Resource 2",
      "displayName": "TER2"
    }
  }
]
```

`entityId` is ignored by `create`. For the other operations, provide `entityId` or `entityKey`.

### Create relationships from an input file

```bash
j1 -a my-account-id -o create --relationship -f ./relationships.json
```

Each relationship in the file has `relationshipKey`, `relationshipType`, `relationshipClass`, `fromEntityId`, `toEntityId`, and optional `properties`. The CLI can create relationships but not update them.

### Create or update alert rules from an input file

```bash
$ j1 -a my-account-id -o create --alert -f ./alerts.json
Validating inputs... OK
Authenticating with JupiterOne... OK
Created 1 alert rules:
[
  {
    "id": "<uuid>",
    "name": "unencrypted-prod-data"
  }
].
Done!
```

The input file contains one alert rule instance or an array of them. The following is an example of a single alert rule instance:

```json
{
  "instance": {
    "name": "unencrypted-prod-data",
    "description": "Data stores in production tagged critical and unencrypted",
    "specVersion": 1,
    "pollingInterval": "ONE_DAY",
    "outputs": ["alertLevel"],
    "operations": [
      {
        "when": {
          "type": "FILTER",
          "specVersion": 1,
          "condition": [
            "AND",
            ["queries.unencryptedCriticalData.total", "!=", 0]
          ]
        },
        "actions": [
          {
            "type": "SET_PROPERTY",
            "targetProperty": "alertLevel",
            "targetValue": "CRITICAL"
          },
          {
            "type": "CREATE_ALERT"
          }
        ]
      }
    ],
    "question": {
      "queries": [
        {
          "query": "Find DataStore with (production=true or tag.Production=true) and classification='critical' and encrypted!=true as d return d.tag.AccountName as Account, d.displayName as UnencryptedDataStores, d._type as Type, d.encrypted as Encrypted",
          "version": "v1",
          "name": "unencryptedCriticalData"
        }
      ]
    }
  }
}
```

To update an alert rule, add `"id": "<uuid>"` to the instance and use `-o update`. `create` skips instances that already have an `id`.

### Create, update, or delete questions from an input file

```bash
j1 -a my-account-id -o create --question -f ./questions.json
```

`create` creates questions without an `id` and updates questions that have one. `update` and `delete` require an `id` and skip questions without one.

### Bulk delete

```bash
j1 -a my-account-id -q 'Find SomeDataClass with someProp="some value" as e return e._id as _id'
j1 -a my-account-id -o bulk-delete --entity -f ./results.json
```

The first command runs a J1QL query and saves the results to `results.json`. The second command reads `results.json` and deletes all of the entities in it through a sync job. Entities that an integration manages are created again on that integration's next run, so bulk delete is best suited to data you uploaded yourself.

Bulk delete reads the `_id` field at the top level of each object in the input file, so the query must return `_id` as shown above. The output of a plain `Find` query nests `_id` under `entity` and will not delete anything. Use `--relationship` instead of `--entity` to bulk delete relationships, with an input file of objects that each have the relationship's `_id`.

### Provision alert rules from a rule pack

The following command provisions the alert rules in the `aws-config` rule pack from the [`jupiterone-alert-rules`](https://github.com/JupiterOne/jupiterone-alert-rules) project:

```bash
j1 -a my-account-id -o provision-alert-rule-pack --alert -f aws-config
```

The CLI looks up rule packs by name in `node_modules/@jupiterone/jupiterone-alert-rules/rule-packs/` under the current directory, so run it from a project where the client is installed locally. You can also provision your own rule pack by passing the full path to its JSON file:

```bash
j1 -a my-account-id -o provision-alert-rule-pack --alert -f path/to/your/rule-pack.json
```

---

Source: /api/python-client

# JupiterOne Python SDK

[![Python 3.6](https://img.shields.io/badge/python-3.6-blue.svg)](https://www.python.org/downloads/release/python-360/) [![Python 3.7](https://img.shields.io/badge/python-3.7-blue.svg)](https://www.python.org/downloads/release/python-370/)

A Python library for the [JupiterOne API](https://docs.jupiterone.io/reference).

## Installation

Requires Python 3.6+

`pip install jupiterone`

## Usage

##### Create a new client:

```python
from jupiterone import JupiterOneClient

j1 = JupiterOneClient(
    account='<yourAccountId>',
    token='<yourApiToken>',
    url='https://graphql.us.jupiterone.io',
    sync_url='https://api.us.jupiterone.io'
)
```

## Regional or Custom Tenant Support

For users with J1 accounts in the EU region for example, the 'url' parameter will need to be updated to "[https://graphql.eu.jupiterone.io](https://graphql.eu.jupiterone.io)" and the 'sync\_url' parameter will need to be updated to "[https://api.eu.jupiterone.io](https://api.eu.jupiterone.io)".

If no 'url' parameter is passed, the default of "[https://graphql.us.jupiterone.io](https://graphql.us.jupiterone.io)" is used, and if no 'sync\_url' parameter is passed, the default of "[https://api.us.jupiterone.io](https://api.us.jupiterone.io)" is used.

## Method Examples:

### \*See the examples/examples.py for full usage example documentation

##### Execute a query:

```python
QUERY = 'FIND Host'
query_result = j1.query_v1(QUERY)

# Including deleted entities
query_result = j1.query_v1(QUERY, include_deleted=True)

# Tree query
QUERY = 'FIND Host RETURN TREE'
query_result = j1.query_v1(QUERY)

# Using cursor graphQL variable to return full set of paginated results
QUERY = "FIND (Device | Person)"
cursor_query_r = j1._cursor_query(QUERY)
```

##### Create an entity:

Note that the CreateEntity mutation behaves like an upsert, so a non-existent entity will be created or an existing entity will be updated.

```python
properties = {
    'myProperty': 'myValue',
    'tag.myTagProperty': 'value_will_be_a_tag'
}

entity = j1.create_entity(
   entity_key='my-unique-key',
   entity_type='my_type',
   entity_class='MyClass',
   properties=properties,
   timestamp=int(time.time()) * 1000 # Optional, defaults to current datetime
)
print(entity['entity'])
```

#### Update an existing entity:

Only send in properties you want to add or update, other existing properties will not be modified.

```python
properties = {
    'newProperty': 'newPropertyValue'
}

j1.update_entity(
    entity_id='<id-of-entity-to-update>',
    properties=properties
)
```

#### Delete an entity:

```python
j1.delete_entity(entity_id='<id-of-entity-to-delete>')
```

##### Create a relationship

```python
j1.create_relationship(
    relationship_key='this_entity_relates_to_that_entity',
    relationship_type='my_relationship_type',
    relationship_class='MYRELATIONSHIP',
    from_entity_id='<id-of-source-entity>',
    to_entity_id='<id-of-destination-entity>'
)
```

##### Delete a relationship

```python
j1.delete_relationship(relationship_id='<id-of-relationship-to-delete>')
```

##### Fetch Graph Entity Properties

```python
j1.fetch_all_entity_properties()
```

##### Fetch Graph Entity Tags

```python
j1.fetch_all_entity_tags()
```

##### Fetch Entity Raw Data

```python
j1.fetch_entity_raw_data(entity_id='<id-of-entity>')
```

> **INFO**
> 
> Raw data is retrieved on demand from the sync job that produced it, and is retained for **7 days** from that sync. An entity whose integration has not run in more than 7 days, or that was not included in its integration's most recent run, reports raw data as unavailable — the entity and its properties are unaffected. Retrieval reads from the ingestion pipeline rather than the graph, so expect modestly longer per-entity times when fetching in bulk. See [What's new in Asset Data](/features/assets/whats-new-in-asset-data.md).
> 
> `fetch_entity_raw_data` uses the deprecated `entityRawDataLegacy` GraphQL query. For bulk retrieval, call the faster `entityRawDataV2` query directly. See [Entity raw data](/api/entity-raw-data.md).

##### Create Integration Instance

```python
j1.create_integration_instance(
    instance_name="Integration Name", 
    instance_description="Description Text")
```

##### Start Synchronization Job

```python
j1.start_sync_job(instance_id='<id-of-integration-instance>')
```

##### Upload Batch of Entities

```python
entities_payload = [
    {
      "_key": "1",
      "_type": "pythonclient",
      "_class": "API",
      "displayName": "pythonclient1",
      "propertyName": "value"
    },
    {
      "_key": "2",
      "_type": "pythonclient",
      "_class": "API",
      "displayName": "pythonclient2",
      "propertyName": "value"
    },
    {
      "_key": "3",
      "_type": "pythonclient",
      "_class": "API",
      "displayName": "pythonclient3",
      "propertyName": "value"
    }
]

j1.upload_entities_batch_json(instance_job_id='<id-of-integration-sync-job>',
                              entities_list=entities_payload)
```

##### Upload Batch of Relationships

```python
relationships_payload = [
    {
      "_key": "1:2",
      "_class": "EXTENDS",
      "_type": "pythonclient_extends_pythonclient",
      "_fromEntityKey": "1",
      "_toEntityKey": "2",
      "relationshipProperty": "value"
    },
    {
      "_key": "2:3",
      "_class": "EXTENDS",
      "_type": "pythonclient_extends_pythonclient",
      "_fromEntityKey": "2",
      "_toEntityKey": "3",
      "relationshipProperty": "value"
    }
]

j1.upload_relationships_batch_json(instance_job_id='<id-of-integration-sync-job>',
                                   relationships_list=relationships_payload)
```

##### Upload Batch of Entities and Relationships

```python
combined_payload = {
    "entities": [
    {
      "_key": "4",
      "_type": "pythonclient",
      "_class": "API",
      "displayName": "pythonclient4",
      "propertyName": "value"
    },
    {
      "_key": "5",
      "_type": "pythonclient",
      "_class": "API",
      "displayName": "pythonclient5",
      "propertyName": "value"
    },
    {
      "_key": "6",
      "_type": "pythonclient",
      "_class": "API",
      "displayName": "pythonclient6",
      "propertyName": "value"
    }
],
    "relationships": [
    {
      "_key": "4:5",
      "_class": "EXTENDS",
      "_type": "pythonclient_extends_pythonclient",
      "_fromEntityKey": "4",
      "_toEntityKey": "5",
      "relationshipProperty": "value"
    },
    {
      "_key": "5:6",
      "_class": "EXTENDS",
      "_type": "pythonclient_extends_pythonclient",
      "_fromEntityKey": "5",
      "_toEntityKey": "6",
      "relationshipProperty": "value"
    }
]
}

j1.upload_combined_batch_json(instance_job_id='<id-of-integration-sync-job>',
                              combined_payload=combined_payload)
```

##### Finalize Synchronization Job

```python
j1.finalize_sync_job(instance_job_id='<id-of-integration-sync-job>')
```

##### Fetch Integration Instance Jobs

```python

j1.fetch_integration_jobs(instance_id='<id-of-integration-instance>')
```

##### Fetch Integration Instance Job Events

```python
j1.fetch_integration_job_events(instance_id='<id-of-integration-instance>',
                                instance_job_id='<id-of-integration-instance-job>')
```

##### Create SmartClass

```python
j1.create_smartclass(smartclass_name='SmartClassName',
                     smartclass_description='SmartClass Description Text')
```

##### Create SmartClass Query

```python
j1.create_smartclass_query(smartclass_id='<id-of-smartclass>',
                           query='<J1QL-query-to-be-added>',
                           query_description='Query Description Text')
```

##### Run SmartClass Evaluation

```python
j1.evaluate_smartclass(smartclass_id='<id-of-smartclass>')
```

##### Get SmartClass Details

```python
j1.get_smartclass_details(smartclass_id='<id-of-smartclass>')
```

##### Generate J1QL from Natural Language Prompt

```python
j1.generate_j1ql(natural_language_prompt='<natural-language-input-text>')
```

##### List Alert Rules

```python
j1.list_alert_rules()
```

##### Get Alert Rule Details

```python
j1.get_alert_rule_details(rule_id='<id-of-alert-rule>')
```

##### Create Alert Rule

```python
# polling_interval can be DISABLED, THIRTY_MINUTES, ONE_HOUR, FOUR_HOURS, EIGHT_HOURS, TWELVE_HOURS, ONE_DAY, or ONE_WEEK
# severity can be INFO, LOW, MEDIUM, HIGH, or CRITICAL

j1.create_alert_rule(name="create_alert_rule-name",
                     description="create_alert_rule-description",
                     tags=['tag1', 'tag2'],
                     polling_interval="DISABLED",
                     severity="INFO",
                     j1ql="find jupiterone_user")
```

##### Create Alert Rule with Action Config

```python

webhook_action_config = {
            "type": "WEBHOOK",
            "endpoint": "https://webhook.domain.here/endpoint",
            "headers": {
              "Authorization": "Bearer <SECRET>",
            },
            "method": "POST",
            "body": {
              "queryData": "{{queries.query0.data}}"
            }
}

tag_entities_action_config = {
            "type": "TAG_ENTITIES",
            "entities": "{{queries.query0.data}}",
            "tags": [
              {
                "name": "tagKey",
                "value": "tagValue"
              }
            ]
}

j1.create_alert_rule(name="create_alert_rule-name",
                    description="create_alert_rule-description",
                    tags=['tag1', 'tag2'],
                    polling_interval="DISABLED",
                    severity="INFO",
                    j1ql="find jupiterone_user",
                    action_configs=webhook_action_config)
```

##### Delete Alert Rule

```python

j1.delete_alert_rule(rule_id='<id-of-alert-rule')
```

##### Update Alert Rule

```python

# polling_interval can be DISABLED, THIRTY_MINUTES, ONE_HOUR, FOUR_HOURS, EIGHT_HOURS, TWELVE_HOURS, ONE_DAY, or ONE_WEEK
# tag_op can be OVERWRITE or APPEND
# severity can be INFO, LOW, MEDIUM, HIGH, or CRITICAL
# action_configs_op can be OVERWRITE or APPEND

alert_rule_config_alert = [
    {
        "type": "CREATE_ALERT"
    }
]

alert_rule_config_tag = [
    {
        "type": "TAG_ENTITIES",
        "entities": "{{queries.query0.data}}",
        "tags": [
            {
                "name": "tagName",
                "value": "tagValue"
            }
        ]
    }
]

alert_rule_config_webhook = [
    {
        "type": "WEBHOOK",
        "endpoint": "https://webhook.example",
        "headers": {
            "Authorization": "Bearer <TOKEN>"
        },
        "method": "POST",
        "body": {
            "queryData": "{{queries.query0.data}}"
        }
    }
]

alert_rule_config_multiple = [
    {
        "type": "WEBHOOK",
        "endpoint": "https://webhook.example",
        "headers": {
            "Authorization": "Bearer <TOKEN>"
        },
        "method": "POST",
        "body": {
            "queryData": "{{queries.query0.data}}"
        }
    },
    {
        "type": "TAG_ENTITIES",
        "entities": "{{queries.query0.data}}",
        "tags": [
            {
                "name": "tagName",
                "value": "tagValue"
            }
        ]
    }
]

j1.update_alert_rule(rule_id="<id-of-alert-rule>",
                     name="Updated Alert Rule Name",
                     description="Updated Alert Rule Description",
                     j1ql="find jupiterone_user",
                     polling_interval="ONE_WEEK",
                     tags=['tag1', 'tag2', 'tag3'],
                     tag_op="OVERWRITE",
                     severity="INFO",
                     action_configs=alert_rule_config_tag,
                     action_configs_op="OVERWRITE")

j1.update_alert_rule(rule_id='<id-of-alert-rule>',
                     tags=['newTag1', 'newTag1'],
                     tag_op="OVERWRITE")

j1.update_alert_rule(rule_id='<id-of-alert-rule>',
                     tags=['additionalTag1', 'additionalTag2'],
                     tag_op="APPEND")
```

##### Evaluate Alert Rule

```python

j1.evaluate_alert_rule(rule_id='<id-of-alert-rule>')
```

##### Get Compliance Framework Item

```python

j1.get_compliance_framework_item_details(item_id="<id-of-item>")
```

##### List Alert Rule Evaluation Results

```python

j1.list_alert_rule_evaluation_results(rule_id="<id-of-rule>")
```

##### Fetch Evaluation Result Download URL

```python

j1.fetch_evaluation_result_download_url(raw_data_key="RULE_EVALUATION/<id-of-evaluation>/query0.json")
```

##### Fetch Evaluation Result Download URL

```python

j1.fetch_evaluation_result_download_url(raw_data_key="RULE_EVALUATION/<id-of-evaluation>/query0.json")
```

##### Fetch Downloaded Evaluation Results

```python

j1.fetch_downloaded_evaluation_results(download_url="https://download.us.jupiterone.io/<id-of-rule>/RULE_EVALUATION/<id-of-evaluation>/<epoch>/query0.json?token=<TOKEN>&Expires=<epoch>")
```

##### Get Integration Definition Details

```python

# examples: 'aws', 'azure', 'google_cloud'

j1.get_integration_definition_details(integration_type="<integration-type>")
```

##### Fetch Integration Instances

```python

j1.fetch_integration_instances(definition_id="<id-of-definition>")
```

##### Fetch Integration Instance Details

```python

j1.get_integration_instance_details(instance_id="<id-of-integration-instance>")
```

##### Get Account Parameter Details

```python

j1.get_parameter_details(name="ParameterName")
```

##### List Account Parameters

```python

j1.list_account_parameters()
```

##### Create or Update Acount Parameter

```python

j1.create_update_parameter(name="ParameterName", value="stored_value", secret=False)
```

---

Source: /api/questions-operations

# Questions API

### Create a Question

```graphql
mutation CreateQuestion($question: CreateQuestionInput!) {
  createQuestion(question: $question) {
    id
    title
    description
    queries {
      name
      query
      version
      resultsAre
    }
    variables {
      name
      required
      default
    }
    compliance {
      standard
      requirements
    }
    accountId
    integrationDefinitionId
  }
}
```

**Variables**:

```json
{
  "question": {
    "title": "What are my production data stores and their encryption status?",
    "tags": ["SecOps"],
    "description": "Returns a list of all production entities.",
    "queries": [
      {
        "name": "prod-datastores-encrypted",
        "query": "Find * with tag.Production=true and encrypted=true",
        "resultsAre": "GOOD"
      },
      {
        "name": "prod-datastores-unencrypted",
        "query": "Find * with tag.Production=true and encrypted!=true",
        "resultsAre": "BAD"
      }
    ],
    "compliance": [
      {
        "standard": "NIST CSF",
        "requirements": ["ID.AM-1"]
      }
    ]
  }
}
```

> **NOTE**
> 
> The `name` field is optional; `name` is recommended to be a single word without special characters, and `resultsAre` with values `GOOD`, `BAD`, and `UNKNOWN` are used to determine gaps/issues and to perform continuous compliance assessment. `INFORMATIVE` is the default value.

### Update a question

```graphql
mutation UpdateQuestion($id: ID!, $update: QuestionUpdate!) {
  updateQuestion(id: $id, update: $update) {
    id
    title
    description
    queries {
      name
      query
      version
      resultsAre
    }
    variables {
      name
      required
      default
    }
    compliance {
      standard
      requirements
    }
    accountId
    integrationDefinitionId
  }
}
```

**Variables**:

```json
{
  "id": "sj3j9f0j2ndlsj300swdjfjs",
  "update": {
    "title": "What are my production data stores and their encryption status?",
    "tags": ["SecOps"],
    "description": "Returns a list of all production entities.",
    "queries": [
      {
        "name": "prod-datastores-encrypted",
        "query": "Find * with tag.Production=true and encrypted=true",
        "resultsAre": "GOOD"
      },
      {
        "name": "prod-datastores-unencrypted",
        "query": "Find * with tag.Production=true and encrypted!=true",
        "resultsAre": "BAD"
      }
    ],
    "compliance": [
      {
        "standard": "NIST CSF",
        "requirements": ["ID.AM-1"]
      }
    ]
  }
}
```

> **NOTE**
> 
> That the only difference here for `update` is the `"id"` property associated with the question.

### Delete a question

```graphql
  mutation DeleteQuestion($id: ID!) {
    deleteQuestion(id: $id) {
      id
      title
      description
      queries {
        query
        name
        version
      }
      variables {
        name
        required
        default
      }
      tags
      accountId
      integrationDefinitionId
    }
  }
```

**Variables**:

```json
{
  "id": "slj3098s03j-i2ojd0j2-sjkkdjf"
}
```

### Search for questions

```graphql
query GetQuestions($searchQuery: String) {
	questions (searchQuery: $searchQuery) {
		questions {
			id
			name
			description
		}
	}
}
```

**Variables**:

```json
{
  "searchQuery": "encrypted"
}
```

### Evaluate a question:

```graphql
query EvaluateQuestion($id: ID!) {
	evaluateQuestion (id: $id) {
		answerText
		outputs {name, value}
	}
}
```

**Variables**:

```json
{
  "id": <some string>
}
```

---

Source: /api/rate-limiting

# GraphQL API Rate Limiting

> Rate limiting is a technique to limit network traffic to avoid exhausting system resources.

Rate limits are described in terms of tokens and the token-replenishment rate. Various actions performed using the JupiterOne public API deplete tokens and tokens are replenished at a predictable rate. If there are insufficient tokens to perform an action, then you receive a _rate exceeded_ (`429` HTTP response code) error. The rate limits are only when actions are performed using the public API. Scheduled or background activity (compliance report evaluation, rule evaluation, and so on) does not deplete tokens.

> **INFO**
> 
> Requests made through the [JupiterOne MCP Server](/integrations/jupiterone-mcp-server.md) count against the same API rate limits described below.

JupiterOne has public API rate limits for GraphQL API mutations/queries. The rate-limited APIs return the following headers to control request back-off and throttling:

-   **RateLimit-Limit**: The quota of the currently most-limited bucket, such as the maximum quota of the bucket with the fewest remaining, concatenated with the quota and time window (in seconds) of each applicable bucket. For example, 1000, 10000; window=60, 1000; window=60.
    
-   **RateLimit-Remaining**: Whichever bucket is the closest to being full. This is the maximum number of invocations minus the number that are currently counted against the limit. This means it is the largest amount of further invocations that could be executed without being rejected by rate-limiting at the moment of the request.
    
-   **RateLimit-Reset**: If no further invocations were made against any limits, this is the number of seconds remaining until **all** buckets that apply against the invocation would be entirely emptied. This means it is the greatest amount among all times-to-empty for applicable limits.
    
-   **RateLimit-Requested**: This is a custom header specified because of the concurrency model of GraphQL and the way J1 counts multiple invocations from a single GraphQL request. This response header is an integer that returns the number of invocations that were counted in the request, regardless of whether the request was served or dropped due to quotas.
    

##### Example 1

In this use case:

-   An account is permitted 10,000 invocations per 60 seconds.
-   In the last 60 seconds, there have been 9,900 invocations in the account.
-   A token is permitted 1,000 invocations per 60 seconds.
-   In the last 60 seconds, there have been 800 invocations using the token.
-   A new request using the token that would be counted as 50 invocations is now being processed.

The number of tentative invocations to be counted is added as RateLimit-Requested: RateLimit-Requested: 50

The request should be permitted, since pre-request the account limit has 100 remaining and the token limit has 200 remaining. After the request, the account limit has 50 remaining and the token limit has 150 remaining. Since the account limit is closer, it is used for RateLimit-Remaining and RateLimit-Limit headers:

```text
RateLimit-Remaining: 50
RateLimit-Limit: 10000, 1000;window=60, 10000;window=60
```

Supposing no other requests come in, it will take 9950/(10000/60) == 59.7 seconds for the account limit to clear, and it will take the token limit 800/(1000/60) == 48 seconds to clear. JupiterOne returns the greater number, rounded strictly _up_, i.e., `Math.ceil` (see IETF proposal – sub-second precision is disallowed).

```text
RateLimit-Reset: 60
```

##### Example 2

In this use case:

-   An account is permitted 10,000 invocations per 60 seconds.
-   In the last 60 seconds, there have been 9,900 invocations in the account.
-   A token is permitted 1,000 invocations per 60 seconds.
-   In the last 60 seconds, there have been 995 invocations using the token.
-   A new request using the token that would be counted as 50 invocations is now being processed.

The number of tentative invocations to be counted is added as RateLimit-Requested: RateLimit-Requested: 50

Because the token bucket has insufficient remaining invocations, the request should be dropped. Since the entire request is dropped, J1 does not count these invocations against the quota and, therefore, JupiterOne uses the pre-request numbers for the `Remaining` and `Limit` headers. The currently limiting bucket is the token bucket, which has 5 invocations remaining. The consumer can see that their request received `429` because 50 > 5:

```text
RateLimit-Remaining: 5
RateLimit-Limit: 1000, 1000;window=60, 10000;window=60
```

Supposing no other requests come in, it will take 9900/(10000/60) == 59.4 seconds for the account limit to clear, and it will take the token limit 995/(1000/60) == 59.7 seconds to clear. J1 returns the greater number, rounded strictly _up_, i.e. `Math.ceil` (see IETF proposal – sub-second precision is disallowed).

```text
RateLimit-Reset: 60
```

## GraphQL API Rate Limiting

Each GraphQL request can contain multiple mutations/queries and each individual mutation/query utilizes one _token_. To avoid a single end-user/client from depleting all tokens and impairing other clients, we apply hierarchical rate limiting at the _client level_ and _account level_. The client limit is configured to have a lower number of max tokens to better support fairness across multiple clients within a single account.

Each unique authenticated session or API token/key is considered to be a single client. It is possible for the same user to log in multiple times in different web browsers and each of these sessions is considered a unique client. Furthermore, if multiple API tokens are being used to send requests, then each API token is considered a unique client.

#### Account Rate Limit for GraphQL Mutations/Queries

-   2000 tokens per 2-minute period
    -   At any given time, there are a maximum of 2000 available tokens, which is the burst limit across the entire organization account.
    -   It takes two minutes to fully replenish 2000 tokens.
    -   JupiterOne discards mutations/queries when the rate exceeds 2000 tokens per 2-minute period.
    -   **Average rate allowed:** 16.67 GraphQL mutations/queries per second.
    -   **Configurable:** JupiterOne can adjust this rate limit on your behalf. Contact your J1 administrator.

#### Client Rate Limit for GraphQL Mutations/Queries

The default rate limit is `1000 tokens per 1-minute period`.

-   At any given time, there are a maximum of 1000 available tokens, which is the burst limit per client.
-   It takes 1 minute to fully replenish 1000 tokens.
-   JupiterOne discards invocations when the rate exceeds 1000 tokens per 1-minute period.
-   **Average rate allowed:** 16.67 GraphQL mutations/queries per second.
-   **Configurable:** An API token creator can adjust the rate limit when creating a token.

## J1QL Query Rate Limiting

J1QL queries executed via the [JupiterOne public API](#) are rate-limited separately from GraphQL API invocations covered previously in this article. Each J1QL query consumes one request token. All queries executed via the JupiterOne public API count towards the rate limit. This count includes user-initiated application queries (such as search and J1 Insights) _and_ queries via the JupiterOne public API. You should incorporate retry with backoff in response to rate-limiting responses from the JupiterOne API.

#### **Account Rate Limit for J1QL Queries**

-   Default limit: 120 tokens/120 seconds
-   Enterprise limit (available on request): 60 tokens/60 seconds
-   Enterprise customers are eligible for a rate limit increase up to 120 tokens/60 seconds, subject to usage analysis and approval. Contact your J1 TSE to request an increase.

---

Source: /api/relationship-mutations

# Relationship mutations

## Create Relationship

```graphql
mutation CreateRelationship (
  $relationshipKey: String!
  $relationshipType: String!
  $relationshipClass: String!
  $fromEntityId: String!
  $toEntityId: String!
  $timestamp: Long
  $properties: JSON
) {
  createRelationship (
    relationshipKey: $relationshipKey,
    relationshipType: $relationshipType,
    relationshipClass: $relationshipClass,
    fromEntityId: $fromEntityId,
    toEntityId: $toEntityId,
    timestamp: $timestamp,
    properties: $properties
  ) {
    relationship {
      _id
      ...
    }
    edge {
      id
      toVertexId
      fromVertexId
      relationship {
        _id
        ...
      }
      properties
    }
  }
}
```

**Variables**:

```json
{
  "relationshipKey": "<a relationship key>",
  "relationshipType": "<a relationship type>",
  "relationshipClass": "<a relationship class>",
  "fromEntityId": "<the _id of the from entity>",
  "toEntityId": "<the _id of the to entity>",
  "timestamp": 1529329792552,
  "properties": {
    // Custom properties on the relationship
    ...
  }
}
```

## Update Relationship

```graphql
mutation UpdateRelationship (
  $relationshipId: String!
  $fromEntityId: String!
  $toEntityId: String!
  $timestamp: Long
  $properties: JSON
) {
  updateRelationship (
    relationshipId: $relationshipId,
    fromEntityId: $fromEntityId,
    toEntityId: $toEntityId,
    timestamp: $timestamp,
    properties: $properties
  ) {
    relationship {
      _id
      ...
    }
    edge {
      id
      toVertexId
      fromVertexId
      relationship {
        _id
        ...
      }
      properties
    }
  }
}
```

**Variables**:

```json
{
  "relationshipId": "<a relationship Id (relationship._id)>",
  "fromEntityId": "<the _id of the from entity>",
  "toEntityId": "<the _id of the to entity>",
  "timestamp": 1529329792552,
  "properties": {
    // Custom properties to update on the relationship
    ...
  }
}
```

## Delete Relationship

```graphql
mutation DeleteRelationship (
  $relationshipId: String!
  $fromEntityId: String!
  $toEntityId: String!
  $timestamp: Long
  $hardDelete: Boolean
) {
  deleteRelationship (
    relationshipId: $relationshipId,
    fromEntityId: $fromEntityId,
    toEntityId: $toEntityId,
    timestamp: $timestamp,
    hardDelete: $hardDelete
  ) {
    relationship {
      _id
      ...
    }
    edge {
      id
      toVertexId
      fromVertexId
      relationship {
        _id
        ...
      }
      properties
    }
  }
}
```

**Variables**:

```json
{
  "relationshipId": "<a relationship Id (relationship._id)>",
  "fromEntityId": "<the _id of the from entity (optional)>",
  "toEntityId": "<the _id of the to entity (optional)>",
  "timestamp": 1529329792552,
  "hardDelete": true
}
```

> **CAUTION**
> 
> `hardDelete` is a flag that completely removes all information related to the relationship in a way that is not recoverable.

---

Source: /api/sync-jobs/api-reference

# Sync jobs API reference

This page is the endpoint-by-endpoint reference for the sync jobs API. For a conceptual introduction, the lifecycle, and how to choose between modes, start with the [overview](/api/sync-jobs/overview.md). For mode-specific guidance, see [DIFF](/api/sync-jobs/diff.md), [PATCH](/api/sync-jobs/patch.md), [PUT](/api/sync-jobs/put.md), [CROSS\_SCOPE](/api/sync-jobs/cross-scope.md), and [OVERRIDE](/api/sync-jobs/override.md).

All sync job endpoints are mounted under `/persister/synchronization/jobs`.

## Authentication

Every request needs:

-   `Authorization: Bearer <api-key>`
-   `jupiterone-account: <account-id>`

See [Authentication](/api/authentication.md) for setup.

## Request body properties

The `start` endpoint accepts these top-level properties:

`source`

-   `api` for ad-hoc data uploaded by you.
-   `integration-external` for custom integrations. For setting up a custom integration that uses this source, see [Integration Development](/integrations/development/overview.md).

`scope`

-   Any string. Used to group everything in this sync job for the purposes of comparison on finalize.
-   Required when `syncMode` is `DIFF`.
-   Can only be used when `source` is `api`.

`syncMode`

-   `DIFF` (default): replaces the full dataset in scope. See [DIFF](/api/sync-jobs/diff.md).
-   `PATCH`: updates existing entities only; never creates or deletes. See [PATCH](/api/sync-jobs/patch.md).
-   `PUT`: creates and updates entities; never deletes. Enabled per account — see [PUT](/api/sync-jobs/put.md). Only available to `integration-managed` and `integration-external` sources.
-   `CROSS_SCOPE`: relationships between entities in different scopes. See [CROSS\_SCOPE](/api/sync-jobs/cross-scope.md).
-   `OVERRIDE`: pins property values on managed-integration entities. See [OVERRIDE](/api/sync-jobs/override.md).

`integrationInstanceId`

-   Required when referencing a custom integration (when `source` is `integration-external`).

### Request flags

`ignoreDuplicates`

-   Instructs the system not to throw an error if there are graph objects with duplicate keys. The latest object wins.

> **INFO**
> 
> The `CREATE_OR_UPDATE` mode is deprecated and no longer functions.

## Validation

The synchronization API performs comprehensive validation on all uploaded data. The required fields depend on the sync mode; see each mode's page for the full list.

### Property constraints

Custom properties:

-   Cannot start with underscore (`_`) — these are reserved for system properties.
-   Must be one of: `string`, `boolean`, `number`, `null`, or a homogenous array of one of those types.

Invalid values:

-   Mixed-type arrays (e.g., `["string", 123, true]`).
-   Nested objects (except `_rawData`).
-   `undefined`.

### Mapped relationships

Mapped relationships (used when one of the related entities isn't directly known) require:

-   `_key`, `_type`, `_class`.
-   `_mapping` object with:
    -   `sourceEntityKey` — required, the key of the source entity.
    -   `targetFilterKeys` — required, array of arrays for filtering target entities.
    -   `targetEntity` — required, object describing the target entity.
    -   `skipTargetCreation` — optional boolean.
    -   `relationshipDirection` — optional, `"FORWARD"` or `"REVERSE"`.

### Upload size constraints

Each upload request must contain at least one entity or one relationship. Both arrays can be present in the same request (mode permitting).

### Common validation errors

| Error | Cause | Fix |
| --- | --- | --- |
| `Missing JupiterOne-Account header` | Required header not provided. | Include `jupiterone-account`. |
| `/entities/0/_key is required` | Missing required field. | Add `_key` (required by DIFF). |
| `/entities/0 (entity key: "key-1") has invalid property name '_internal'` | Property name starts with `_`. | Rename without the leading underscore. |
| `/entities/0/_class (entity key: "key-1") has invalid type. Valid types are string or array of strings.` | Invalid `_class` type. | Use a string or array of strings. |
| `/entities/0/_key: maximum length exceeded` | Field exceeds character limit. | Shorten `_key` to ≤ 7000 characters. |
| `Relationships are not allowed in PATCH jobs` | Relationships uploaded in PATCH mode. | Use [DIFF](/api/sync-jobs/diff.md) or [CROSS\_SCOPE](/api/sync-jobs/cross-scope.md). |
| `Relationship uploads are not allowed for OVERRIDE sync jobs` | Relationships uploaded in OVERRIDE mode. | OVERRIDE only accepts entities. |
| `OVERRIDE sync jobs are limited to 10000 entities per job` | Per-job entity cap exceeded. | Split across multiple sync jobs. |
| `OVERRIDE sync mode is not enabled for this account` | Account not on the OVERRIDE allowlist. | Contact JupiterOne support. |
| `PUT sync mode is not enabled for this account` | Account not on the PUT allowlist. | Contact JupiterOne support — see [Requesting access](/api/sync-jobs/put.md#requesting-access). |
| `entities must have minimum 1 item` | Empty entities array. | Include at least one entity, or omit the array. |

## Endpoints

### Start a synchronization job

```text
POST /persister/synchronization/jobs
```

Request:

```json
{
  "source": "api",
  "syncMode": "DIFF",
  "scope": "my-sync-job"
}
```

Or with a custom integration source:

```json
{
  "source": "integration-managed",
  "integrationInstanceId": "5465397d-8491-4a12-806a-04792839abe3"
}
```

Response:

```json
{
  "job": {
    "source": "api",
    "scope": "my-sync-job",
    "id": "f445397d-8491-4a12-806a-04792839abe3",
    "status": "AWAITING_UPLOADS",
    "startTimestamp": 1586915139427,
    "numEntitiesUploaded": 0,
    "numRelationshipsUploaded": 0,
    "numMappedRelationshipsUploaded": 0
  }
}
```

### Get status of a synchronization job

```text
GET /persister/synchronization/jobs/{jobId}
```

Response:

```json
{
  "job": {
    "source": "api",
    "scope": "my-sync-job",
    "id": "f445397d-8491-4a12-806a-04792839abe3",
    "status": "AWAITING_UPLOADS",
    "startTimestamp": 1586915139427,
    "numEntitiesUploaded": 0,
    "numRelationshipsUploaded": 0,
    "numMappedRelationshipsUploaded": 0
  }
}
```

The response carries running counters of the data uploaded so far in this job: total entities, total relationships, and total mapped relationships. After [finalize](#finalize-a-synchronization-job) completes, these are the final totals applied to the graph.

### Upload a batch of entities and/or relationships

The upload endpoints accept `application/json` only. Send the body with `Content-Type: application/json`. Requests may be `gzip`\- or `brotli`\-compressed.

```text
POST /persister/synchronization/jobs/{jobId}/upload
```

```json
{
  "entities": [
    {
      "_key": "1",
      "_class": "DataStore",
      "_type": "fake_entity",
      "displayName": "my_datastore"
    },
    {
      "_key": "2",
      "_class": "Database",
      "_type": "fake_entity",
      "displayName": "my_database"
    }
  ],
  "relationships": [
    {
      "_key": "a",
      "_type": "fake_relationship",
      "_class": "IS",
      "_fromEntityKey": "1",
      "_toEntityKey": "2"
    }
  ]
}
```

### Upload entities only

```text
POST /persister/synchronization/jobs/{jobId}/entities
```

```json
{
  "entities": [
    { "_key": "1", "_type": "fake_entity" }
  ]
}
```

### Upload relationships only

```text
POST /persister/synchronization/jobs/{jobId}/relationships
```

```json
{
  "relationships": [
    {
      "_key": "a",
      "_type": "fake_relationship",
      "_class": "HAS",
      "_fromEntityKey": "1",
      "_toEntityKey": "2"
    }
  ]
}
```

### Finalize a synchronization job

```text
POST /persister/synchronization/jobs/{jobId}/finalize
```

Finalize is asynchronous. The response confirms the job has entered finalization; it does not wait for the graph to be updated.

```json
{
  "job": {
    "id": "f445397d-8491-4a12-806a-04792839abe3",
    "status": "FINALIZE_PENDING"
  }
}
```

Poll [get status](#get-status-of-a-synchronization-job) until `status` is `FINISHED` (or terminal: `ABORTED`, `FAILED`, `ERROR`).

## See also

-   [Sync jobs overview](/api/sync-jobs/overview.md) — concepts and decision guide.
-   [DIFF](/api/sync-jobs/diff.md), [PATCH](/api/sync-jobs/patch.md), [PUT](/api/sync-jobs/put.md), [CROSS\_SCOPE](/api/sync-jobs/cross-scope.md), [OVERRIDE](/api/sync-jobs/override.md) — per-mode guidance and scenarios.
-   [Creating relationships between entities](/features/assets/relationships-across-scopes.md).

---

Source: /api/sync-jobs/cross-scope

# CROSS\_SCOPE sync mode

`CROSS_SCOPE` exists to solve one specific problem: connecting entities that live in different scopes. Each managed integration owns its own scope, so a relationship between, say, an Okta user and a Jamf laptop can't be created by either integration on its own — neither side owns both the from and to entities.

`CROSS_SCOPE` is the bridge. It accepts only relationships, requires you to label both the from and to entities with their respective scopes, and never creates or deletes entities.

## When to use CROSS\_SCOPE

-   Both the from and to entities of the relationship already exist in the graph, sourced from different integrations or sync jobs.
-   You only need to create relationships, not entities.
-   The relationships can change over time, and you want a single sync job that owns them.

If the entities in question are in the same scope, use [`DIFF`](/api/sync-jobs/diff.md) or [`PATCH`](/api/sync-jobs/patch.md). If you also need to create entities, use the appropriate mode for the scope that owns them and let `CROSS_SCOPE` handle the cross-cutting edges separately.

## Example use cases

### Okta users to Jamf laptops

You want to ask "show me every laptop assigned to a member of the SRE Okta group." Okta produces `User` entities in the Okta scope; Jamf produces `Device` entities in the Jamf scope. Neither integration produces the `OWNS` edge between them.

-   **Scope**: `okta-jamf-ownership`
-   **Mode**: `CROSS_SCOPE`
-   **Why CROSS\_SCOPE**: The relationship spans two integrations. You own the mapping (probably from a separate inventory system), so you push only the edges.

```json
POST /persister/synchronization/jobs
{
  "source": "api",
  "syncMode": "CROSS_SCOPE",
  "scope": "okta-jamf-ownership"
}
```

POST /persister/synchronization/jobs/{jobId}/upload

```json
{
  "relationships": [
    {
      "_key": "okta-user:alice|owns|jamf-device:laptop-001",
      "_type": "user_owns_device",
      "_class": "OWNS",
      "_fromEntityKey": "okta-user:alice",
      "_toEntityKey": "jamf-device:laptop-001",
      "_fromEntityScope": "okta-instance-id",
      "_toEntityScope": "jamf-instance-id"
    }
  ]
}
```

### GitHub repositories to deployed AWS resources

You want to query "for this S3 bucket, which repository deploys it?" The AWS integration produces the bucket. The GitHub integration produces the repo. Your CI/CD metadata maps deployments to repos.

-   **Scope**: `repo-deployment-edges`
-   **Mode**: `CROSS_SCOPE`
-   **Why CROSS\_SCOPE**: The from and to entities come from different integrations. The mapping changes when teams move services between repos, so you re-run this sync job whenever your deployment manifests change.

### IAM roles to the applications that assume them

You want to track which applications (modeled in your custom CMDB scope) assume which AWS IAM roles (in the AWS scope). This drives blast-radius queries during incident response.

-   **Scope**: `app-iam-assumption`
-   **Mode**: `CROSS_SCOPE`

## Restrictions

-   **Entities are rejected.** CROSS\_SCOPE only accepts relationships. The from and to entities must already exist in the graph from another sync job or integration.
-   **The related entities must live outside the sync job's scope.** Neither `_fromEntityScope` nor `_toEntityScope` may equal the sync job's `scope`. The two entity scopes can equal each other (for example, two entities from the same AWS integration linked by an external mapping) — the constraint is only that neither may match the CROSS\_SCOPE job's own scope. If both entities belong to the sync job's scope, write that relationship from the sync job that owns the scope instead.
-   **`source` must be `api`.**

## Required relationship fields

In addition to the standard relationship fields, CROSS\_SCOPE relationships need:

| Property | Type | Description |
| --- | --- | --- |
| `_fromEntityScope` | `string` | Scope identifier of the source entity. For managed integrations, this is the `_integrationInstanceId`. |
| `_toEntityScope` | `string` | Scope identifier of the target entity. |

The from and to entities can be referenced by either `_fromEntityKey`/`_toEntityKey` or `_fromEntityId`/`_toEntityId` — whichever you have available.

## Example: CROSS\_SCOPE sync job

POST /persister/synchronization/jobs

```json
{
  "source": "api",
  "syncMode": "CROSS_SCOPE",
  "scope": "repo-deployment-edges"
}
```

POST /persister/synchronization/jobs/{jobId}/upload

```json
{
  "relationships": [
    {
      "_key": "github-repo:platform-api|deploys|s3-bucket:platform-assets",
      "_type": "repo_deploys_bucket",
      "_class": "DEPLOYS",
      "_fromEntityKey": "github-repo:platform-api",
      "_toEntityKey": "s3-bucket:platform-assets",
      "_fromEntityScope": "github-instance-id",
      "_toEntityScope": "aws-instance-id"
    }
  ]
}
```

```text
POST /persister/synchronization/jobs/{jobId}/finalize
```

## Operational notes

-   **The entities must exist at finalize time.** If either entity is missing or has been soft-deleted, the relationship is not created.
-   **CROSS\_SCOPE behaves like DIFF for its own scope.** Relationships you previously created in this scope and don't include in the new upload are deleted. Use a stable scope so your edge set reconciles cleanly.
-   **One CROSS\_SCOPE job per logical mapping.** Putting unrelated cross-scope edge sets in the same scope mixes their lifecycles.

## Common errors

| Error | Cause | Fix |
| --- | --- | --- |
| Entities cannot be uploaded in CROSS\_SCOPE mode | Tried to upload entities. | Create entities in their owning scope; use CROSS\_SCOPE only for edges. |
| Same-scope relationships rejected | `_fromEntityScope` equals `_toEntityScope`. | Use the owning scope's sync job for these edges. |
| Relationship missing after finalize | An entity referenced by the relationship did not exist (or was soft-deleted). | Confirm both entities are in the graph; check their `_id`/`_key` and scope. |

See the [API reference](/api/sync-jobs/api-reference.md) for the complete error table.

---

Source: /api/sync-jobs/diff

# DIFF sync mode

`DIFF` is the default sync mode. On finalize, the persister treats your upload as the complete state of the scope: anything that existed in the scope last time and is missing from this upload is deleted.

This is the right mode when you control the source of truth and want missing rows to mean "this no longer exists." It is the wrong mode when you only want to add or update part of the data — for that, see [`PATCH`](/api/sync-jobs/patch.md) for partial updates in your own scope, or [`OVERRIDE`](/api/sync-jobs/override.md) for persistent partial updates on managed-integration entities.

## When to use DIFF

-   You own the full dataset and re-upload it on a schedule.
-   You want stale entities to disappear automatically when they fall off the source.
-   Both entities and relationships are in scope.
-   You can include the entire dataset in a single sync job (chunked across multiple uploads, but one finalize).

## Example use cases

### Nightly vulnerability scanner output

Your team runs an internal vulnerability scanner every night and pushes the findings into JupiterOne so analysts can pivot from finding to affected asset in J1QL.

-   **Scope**: `internal-vuln-scanner`
-   **Mode**: `DIFF`
-   **Why DIFF**: When a finding is remediated and stops appearing in the report, you want it gone from the graph automatically — no janitorial PATCH-and-delete needed.

```json
POST /persister/synchronization/jobs
{
  "source": "api",
  "syncMode": "DIFF",
  "scope": "internal-vuln-scanner"
}
```

Each entity is a finding; relationships connect findings to the assets they affect.

### Mirroring an internal CMDB

You maintain a system of record outside JupiterOne — say, an internal asset CMDB — and want it reflected as graph entities so your queries can join CMDB context to integration-sourced data.

-   **Scope**: `cmdb-assets`
-   **Mode**: `DIFF`
-   **Why DIFF**: Decommissioned assets disappear from the CMDB, and you want them to disappear from the graph the same day.

### HRIS mirror for `Person` entities

You sync your HRIS so departures, role changes, and new hires flow into the graph as `Person` entities.

-   **Scope**: `hris-people`
-   **Mode**: `DIFF`
-   **Why DIFF**: When someone leaves, the next sync drops them from the upload and the graph reconciles cleanly.

## Required entity fields

Every entity in a `DIFF` upload needs:

-   `_key` — unique within the scope.
-   `_type` — your entity type, in `snake_case`.
-   `_class` — JupiterOne class (string or array of strings, max 5 items).

## Required relationship fields

Standard relationships:

-   `_key`, `_type`, `_class`, `_fromEntityKey`, `_toEntityKey`.

Mapped relationships (for connecting to entities you don't own in this scope) require `_mapping` instead of `_fromEntityKey`/`_toEntityKey`. See the [API reference](/api/sync-jobs/api-reference.md) for the mapped-relationship shape.

> **NOTE**
> 
> `DIFF` is the only sync mode that writes mapped relationships to the graph. `PATCH`, `CROSS_SCOPE`, and `OVERRIDE` ignore mapped relationships in the upload payload.

> **WARNING**
> 
> In `DIFF` mode, do **not** use `_fromEntityId` or `_toEntityId` to point at entities outside the scope. Those fields are rejected by `DIFF`. Use mapped relationships, or switch to [`CROSS_SCOPE`](/api/sync-jobs/cross-scope.md) if you only need cross-scope edges.

## Example: full DIFF sync job

POST /persister/synchronization/jobs

```json
{
  "source": "api",
  "syncMode": "DIFF",
  "scope": "internal-vuln-scanner"
}
```

Response:

```json
{
  "job": {
    "id": "f445397d-8491-4a12-806a-04792839abe3",
    "scope": "internal-vuln-scanner",
    "status": "AWAITING_UPLOADS",
    "numEntitiesUploaded": 0
  }
}
```

Upload entities and relationships in one call:

POST /persister/synchronization/jobs/{jobId}/upload

```json
{
  "entities": [
    {
      "_key": "finding:CVE-2025-1234:host-42",
      "_type": "vuln_finding",
      "_class": "Finding",
      "severity": "high",
      "cve": "CVE-2025-1234"
    },
    {
      "_key": "host:host-42",
      "_type": "internal_host",
      "_class": "Host",
      "displayName": "host-42"
    }
  ],
  "relationships": [
    {
      "_key": "finding:CVE-2025-1234:host-42|affects|host:host-42",
      "_type": "finding_affects_host",
      "_class": "AFFECTS",
      "_fromEntityKey": "finding:CVE-2025-1234:host-42",
      "_toEntityKey": "host:host-42"
    }
  ]
}
```

Finalize:

```text
POST /persister/synchronization/jobs/{jobId}/finalize
```

After finalize, anything previously in `internal-vuln-scanner` that wasn't in this upload is deleted.

## Operational notes

-   **Always include the full dataset.** A partial DIFF upload deletes everything you left out.
-   **Stable `_key`s matter.** If your `_key` strategy changes between runs, every entity will look new (created + deleted) and downstream queries will see churn.
-   **Chunk across uploads, finalize once.** A single sync job can accept many upload calls before finalize. Use this to handle large datasets without holding the whole payload in memory.
-   **For partial updates, use [`PATCH`](/api/sync-jobs/patch.md) instead.** PATCH is designed for cases where you don't have the full dataset.

## Common errors

| Error | Cause | Fix |
| --- | --- | --- |
| `/entities/0/_key is required` | Missing `_key` in DIFF upload. | Add `_key` (DIFF requires it). |
| `Relationships are not allowed in PATCH jobs` | You meant to use DIFF but started a PATCH job. | Start a DIFF job. |
| Unintended deletions after a small upload | Partial dataset uploaded to the same scope. | Always include the full dataset, or split into multiple scopes. |

See the [API reference](/api/sync-jobs/api-reference.md) for the complete error table.

---

Source: /api/sync-jobs/override

# OVERRIDE sync mode

`OVERRIDE` is the answer to a recurring frustration: a managed integration owns an entity, you set a custom property on that entity, and the next time the integration runs, your property gets wiped out.

`OVERRIDE` fixes that. When you push an `OVERRIDE` for a property on an entity, JupiterOne records the override and reapplies it after every subsequent integration sync. Your value sticks.

> **WARNING**
> 
> OVERRIDE is a powerful tool — it lets you pin custom values onto entities owned by a managed integration so those values survive every future integration sync. That's exactly what makes it useful, and it's also why it's worth using deliberately.
> 
> Once you set a property with OVERRIDE, the source integration won't reconcile or correct it for you, so you become the source of truth for that value. That matters most when overrides touch properties that drive security decisions — things like `riskLevel`, `complianceTier`, or `publicAccessApproved` — because what you set is what alert rules, queries, and the people responding to them will see. A stale or incorrect override can quietly hide the integration's real view and lead to missed alerts or a misleading picture of risk.
> 
> This is why we gate access to OVERRIDE. Contact JupiterOne support to request access for your account.

## When to use OVERRIDE

-   The entity is managed by an integration (you can see `_integrationInstanceId` on it).
-   You want a custom property to persist across that integration's future runs.
-   You only need to set entity properties — relationships are not allowed.
-   You are working with up to 10,000 entities per sync job. Larger updates need to be split.

If the entity isn't owned by an integration, or you don't need persistence across integration runs, [`PATCH`](/api/sync-jobs/patch.md) is simpler.

## Example use cases

### Criticality tiers on managed repositories

Your platform team labels every GitHub repo with a `criticality` tier (`tier-1`, `tier-2`, `tier-3`) used by your incident response runbook. The labels live in an internal spreadsheet, not GitHub topics.

-   **Scope**: `repo-criticality`
-   **Mode**: `OVERRIDE`
-   **Why OVERRIDE**: GitHub doesn't store this attribute, so the GitHub integration never produces it — but it also re-syncs the entity completely each run, which would clear a property set with PATCH. OVERRIDE makes the criticality stick.

### Compliance scope on managed devices

Your compliance team determines which laptops are in scope for SOC 2 evidence collection. The Jamf integration provides device entities; your team pushes `complianceScope: "soc2"` onto the relevant subset.

-   **Scope**: `device-compliance-scope`
-   **Mode**: `OVERRIDE`

## Restrictions

-   **Entity-only.** Relationships are rejected with `Relationship uploads are not allowed for OVERRIDE sync jobs`.
-   **`_id` is required on every entity.** The entity must already exist; entries whose `_id` does not match a current entity are silently skipped on finalize.
-   **10,000 entities maximum per sync job.** Larger updates need to be split into separate sync jobs (different scopes).
-   **`source` must be `api`.**
-   **New sync mode.** OVERRIDE is in early release. Contact JupiterOne support to enable it for your account.

## Required entity fields

| Property | Type | Description |
| --- | --- | --- |
| `_id` | `string` | **Required.** The JupiterOne `_id` of the existing entity to override. Entries with no matching entity are silently skipped. |

Any custom property keys (those without a leading `_`) included alongside `_id` are applied as overrides. Properties starting with `_` are reserved for system metadata and ignored.

## Updating and removing overrides

Overrides are tracked per `(entity, scope)` pair. To change what's overridden:

-   **Update values for an entity**: re-upload the entity with the new property values to the same scope. Properties not included in the new upload are removed from that scope's overrides on that entity.
-   **Stop overriding a specific entity**: re-upload the scope without that entity included. Its overrides for that scope are dropped on the next finalize.
-   **Clear all overrides for a scope**: start a new `OVERRIDE` sync job with the same scope, finalize without uploading any entities. Every override registered in that scope is removed.
-   **Restore the integration's value immediately**: after clearing the override, re-run the source integration. The next integration sync writes its own value.

## Precedence when multiple scopes override the same property

Two `OVERRIDE` sync jobs in different scopes can target the same entity. The rule is **the override that most recently changed the value wins, per property**:

-   If scope `A` (created Monday) overrides `criticality` on entity `X`, and scope `B` (created Tuesday) also overrides `criticality` on entity `X`, the value from scope `B` takes effect — it is the more recent override. Scope `A`'s value is recorded but does not apply for that property while `B`'s override exists.
-   This is evaluated **per property**, not per scope. If scope `B` overrides a _different_ property on the same entity (say, `owner`), each property is resolved independently — `B` wins `criticality`, and whichever scope most recently changed `owner` wins that one.
-   If the winning scope's override is removed, the property falls back to the **next most recent** remaining override for that property, and only when no scope overrides it at all does it return to the integration's value.

This behavior is deliberate: the override that most recently changed a property takes effect immediately rather than being silently blocked by an older scope. To take over a property, change its value in another scope; to hand it back, remove the override that currently wins.

> **NOTE**
> 
> Prior to this change, precedence was **oldest scope wins** — the first scope to override a property held it until removed, and later overrides were silently ignored. That could leave a stale scope pinning a value no live override could update. Precedence is now recency-based. If you relied on the old rule, review scopes that override the same property on the same entity.

### Example: newest override wins

Repository `X` is managed by the GitHub integration. Two teams each run an `OVERRIDE` scope that sets `criticality` on it.

| Step | Action | `criticality` on `X` | Why |
| --- | --- | --- | --- |
| 1 | GitHub integration syncs `X`; no override yet | _(integration value)_ | Nothing overrides `criticality`. |
| 2 | Scope `repo-criticality` overrides `criticality = tier-3` | `tier-3` | Only override present. |
| 3 | Scope `ir-priority` overrides `criticality = tier-1` | **`tier-1`** | `ir-priority` changed the value more recently, so it wins. |
| 4 | GitHub integration syncs `X` again | `tier-1` | Overrides are re-applied after every sync; the newest still wins. |
| 5 | `ir-priority` removes its override (re-finalize without `X`) | `tier-3` | Falls back to the next most recent remaining override — `repo-criticality`. |
| 6 | `repo-criticality` removes its override too | _(integration value)_ | No scope overrides `criticality`; it returns to what GitHub provides. |

The key point is step 3: the newer scope takes the property immediately — under the old oldest-wins rule, `repo-criticality` (step 2) would have kept `tier-3` and `ir-priority` would have been ignored. Steps 5–6 show the reverse on removal: the property falls back through remaining overrides by recency, and only returns to the integration value when nothing overrides it.

## OVERRIDE vs the entity mutation API

The GraphQL [`updateEntity`](/api/entity-mutations.md#updating-entity) mutation also sets properties that persist across managed-integration syncs. The two tools are complementary, not interchangeable:

-   **`OVERRIDE`** is a sync job. You group up to 10,000 entities under a `scope`, push them in one batch, and finalize. The scope is the unit of management — you update or remove the whole set together.
-   **`updateEntity`** is a single-entity mutation over GraphQL. It's the right tool for "I just need to set `criticality = tier-1` on this one repository" or scripts that walk a small list of entities. There's no scope and no finalize step.

If both an `OVERRIDE` sync job and an `updateEntity` call have set the same property on the same entity, the one that **most recently changed the value** takes precedence — they are resolved by recency, the same way two OVERRIDE scopes are. Removing the winner restores the other channel's value, and removing both restores the integration's value.

> **NOTE**
> 
> This changed alongside the precedence rule above. Previously the `OVERRIDE`\-supplied value always took precedence over `updateEntity`. Overrides applied by a **tagging rule** are a separate case and still outrank both `OVERRIDE` sync jobs and `updateEntity` regardless of recency.

In practice, pick one channel per property to avoid surprises. Use `OVERRIDE` when you have a list and want it managed as a unit; use `updateEntity` when you don't.

## Edge case: PATCH followed by OVERRIDE

If a `PATCH` sync job previously set the same property on an entity, and you later create an `OVERRIDE` for that property and then remove the override, the value visible immediately after removal may be the old PATCH value rather than the integration's value. The next managed-integration run reconciles this and restores the integration's value.

In practice, this rarely matters — but if you're switching a property from PATCH to OVERRIDE management, expect a brief window after override removal where the property shows the PATCH value.

## Example: full OVERRIDE sync job

POST /persister/synchronization/jobs

```json
{
  "source": "api",
  "syncMode": "OVERRIDE",
  "scope": "repo-criticality"
}
```

POST /persister/synchronization/jobs/{jobId}/upload

```json
{
  "entities": [
    {
      "_id": "b75aad77-89eb-5ce6-939c-86322517af6b",
      "criticality": "tier-1"
    },
    {
      "_id": "da1c53ef-a543-5daa-8206-37e652c795cf",
      "criticality": "tier-2"
    }
  ]
}
```

```text
POST /persister/synchronization/jobs/{jobId}/finalize
```

After finalize, the two repositories carry the `criticality` property, and they will continue to do so after every GitHub integration sync.

## Operational notes

-   **Find a target entity's `_id` with J1QL.** For example: `FIND github_repo WITH name='platform-api' RETURN _id`.
-   **Reuse stable scopes.** Treat each scope as a long-lived label for one logical override set (`repo-criticality`, not `override-2026-04-28`). Reusing the scope is how you update or remove overrides cleanly.
-   **OVERRIDE does not create entities.** If `_id` doesn't match an existing entity, that row is silently skipped — no error, no creation.
-   **Custom property names cannot start with `_`.** Those are reserved for system metadata.

## Common errors

| Error | Cause | Fix |
| --- | --- | --- |
| `OVERRIDE sync mode is not enabled for this account` | Account is not on the allowlist. | Contact JupiterOne support to request access. |
| `Relationship uploads are not allowed for OVERRIDE sync jobs` | Uploaded relationships to an OVERRIDE job. | OVERRIDE only accepts entities. |
| `OVERRIDE sync jobs are limited to 10000 entities per job` | Upload exceeds the per-job entity cap. | Split across multiple sync jobs. |
| Entity property not visible after finalize | `_id` did not match any existing entity. | Confirm the `_id` exists; OVERRIDE silently skips unknown `_id`s. |

See the [API reference](/api/sync-jobs/api-reference.md) for the complete error table.

---

Source: /api/sync-jobs/overview

# Overview

Sync jobs are how data enters JupiterOne from the API. Whether you are pushing a nightly inventory from an internal CMDB, layering risk scores onto entities owned by a managed integration, connecting assets that live in different integrations, or pinning a custom value so it survives the next integration run — each of those flows is a sync job.

A sync job groups a batch of changes under a `scope`, runs a comparison against the existing data in that scope when finalized, and applies the result to the graph. The behavior of that comparison depends on the sync mode you pick.

## The five sync modes

| Mode | What finalize does | Entities | Relationships | Typical use |
| --- | --- | --- | --- | --- |
| [`DIFF`](/api/sync-jobs/diff.md) | Replaces the full dataset in scope. Anything not in the upload is deleted. | yes | yes | Full inventory refresh from a custom source. |
| [`PATCH`](/api/sync-jobs/patch.md) | Updates properties on existing entities. Nothing is created or deleted. | yes (existing only) | no | Enriching existing entities with extra properties. |
| [`PUT`](/api/sync-jobs/put.md) | Creates and updates entities. Nothing is deleted. Requires enablement per account. | yes | yes | Sources that only expose part of the dataset, such as a rolling window. |
| [`CROSS_SCOPE`](/api/sync-jobs/cross-scope.md) | Adds/updates relationships whose from and to entities live in different scopes. | no | yes | Linking assets across integrations. |
| [`OVERRIDE`](/api/sync-jobs/override.md) | Pins property values on managed-integration entities so they persist across future integration syncs. | yes (existing only) | no | Preserving customer-applied values that an integration would otherwise overwrite. |

## Choose a mode

Use the questions below in order. The first "yes" picks your mode.

1.  **Are you setting custom values on entities that a managed integration owns, and you need those values to survive the next integration run?**
    -   For a batch of entities under a stable scope → [`OVERRIDE`](/api/sync-jobs/override.md)
    -   For one entity (or a handful of entities, scripted one at a time) → use the [`updateEntity`](/api/entity-mutations.md#updating-entity) GraphQL mutation instead — it's a per-entity persistent edit, no sync job needed.
2.  **Are you only creating relationships between entities that live in different scopes (different integrations or different sources)?** → [`CROSS_SCOPE`](/api/sync-jobs/cross-scope.md)
3.  **Do you want to add or update properties on existing entities without ever deleting anything, and you accept that the next managed-integration sync will reset the values?** → [`PATCH`](/api/sync-jobs/patch.md)
4.  **Can your source only give you part of the dataset — a rolling window, an event feed, one slice per run — so that missing records don't mean "deleted"?** → [`PUT`](/api/sync-jobs/put.md) (enabled per account; see [Requesting access](/api/sync-jobs/put.md#requesting-access))
5.  **Are you the source of truth for this set of data and want the upload to fully replace what was there last time?** → [`DIFF`](/api/sync-jobs/diff.md)

> **TIP**
> 
> Sync jobs are batch-oriented: one scope, one finalize, many entities. The GraphQL [`updateEntity`](/api/entity-mutations.md#updating-entity) mutation is per-entity and gives you the same persistence guarantee as `OVERRIDE` for individual edits. Reach for it when you don't need a scope to manage a set together.

## Lifecycle of a sync job

Every sync job, regardless of mode, follows the same shape:

1.  **Start** — `POST /persister/synchronization/jobs` creates the job and returns an ID. The job begins in `AWAITING_UPLOADS`.
2.  **Upload** — One or more upload calls push entities and/or relationships into the job. The persister tracks counters as data arrives but does not yet apply changes to the graph.
3.  **Finalize** — `POST /persister/synchronization/jobs/{id}/finalize` triggers the comparison. The persister reads the new state, compares it against existing data in the scope, and applies creates, updates, and (depending on the mode) deletes.
4.  **Poll** — `GET /persister/synchronization/jobs/{id}` returns status. In AWS environments, finalize is asynchronous: status moves through `FINALIZE_PENDING` to `FINISHED`.

See the [API reference](/api/sync-jobs/api-reference.md) for endpoints and payloads.

## Scopes

A `scope` is a string label that groups everything in a sync job together for the purposes of comparison. Two sync jobs with the same `scope` and the same mode operate on the same logical dataset — the second finalize sees the first job's results as "the previous state."

A few rules of thumb:

-   Use a stable, descriptive `scope` for each pipeline you own (`vuln-scanner-nightly`, not `upload-2026-04-28`). If your scope name changes between runs, the previous data won't be reconciled and may linger.
-   Choose a `scope` granularity that matches how you want deletions to behave. A single scope across all of your custom data means dropping a row from your source removes it from the graph everywhere.
-   For [`CROSS_SCOPE`](/api/sync-jobs/cross-scope.md) and [`OVERRIDE`](/api/sync-jobs/override.md), `scope` works the same way but the mode-specific pages cover the wrinkles.

## Use case map

A handful of common patterns, with the mode each one calls for:

| Scenario | Mode |
| --- | --- |
| Push the output of an internal vulnerability scanner so stale findings disappear when they no longer appear in the report. | [`DIFF`](/api/sync-jobs/diff.md) |
| Mirror an HRIS into the graph as `Person` entities, deleting people who left the company. | [`DIFF`](/api/sync-jobs/diff.md) |
| Ingest from a source API that only returns the last seven days of records, so anything older must not be treated as deleted. | [`PUT`](/api/sync-jobs/put.md) |
| Push an append-only event feed in batches, where each batch is new data rather than a full snapshot. | [`PUT`](/api/sync-jobs/put.md) |
| Refresh a `lastErrorCount` on managed-integration entities every five minutes between hourly integration syncs (accepting that each integration sync resets the value). | [`PATCH`](/api/sync-jobs/patch.md) |
| Update a `lastGoogleLoginAt` property hourly on `Person` entities you already pushed via a custom HRIS DIFF. | [`PATCH`](/api/sync-jobs/patch.md) |
| Connect Okta `User` entities to the laptops they own in Jamf so you can query "show me every laptop assigned to a member of the SRE group." | [`CROSS_SCOPE`](/api/sync-jobs/cross-scope.md) |
| Link GitHub repositories to the AWS resources they deploy, where the integrations don't already produce that relationship. | [`CROSS_SCOPE`](/api/sync-jobs/cross-scope.md) |
| Tag a managed Jamf device with `complianceScope: "soc2"` so the value survives every Jamf integration run. | [`OVERRIDE`](/api/sync-jobs/override.md) |
| Set a `criticality` value on a managed GitHub repository entity so it stays put even after the GitHub integration re-syncs. | [`OVERRIDE`](/api/sync-jobs/override.md) for a batch; [`updateEntity`](/api/entity-mutations.md#updating-entity) for a single repository. |
| Pin a one-off custom property on a single managed entity (e.g. `betaForceDeviceUnificationKey` on two specific hosts) so the value survives every managed integration sync. | [`updateEntity`](/api/entity-mutations.md#updating-entity) |

## Validation, limits, and errors

Validation rules and error messages are consistent across modes. The [API reference](/api/sync-jobs/api-reference.md) lists every error you can hit and how to resolve it. Mode-specific limits (for example, the 10,000-entity cap on `OVERRIDE`) are called out on the mode pages.

## Authentication

Every sync job request needs:

-   An API key in the `Authorization: Bearer <token>` header.
-   The target account in the `jupiterone-account` header.

See [Authentication](/api/authentication.md) for full setup.

## Next steps

-   Pick a mode using the table or decision questions above.
-   Read the mode page for full request shape, scenarios, and constraints.
-   Skim the [API reference](/api/sync-jobs/api-reference.md) for the endpoint list.

---

Source: /api/sync-jobs/patch

# PATCH sync mode

`PATCH` updates existing entities. It never creates new entities, and unlike [`DIFF`](/api/sync-jobs/diff.md), it never deletes — anything not included in your upload is left alone.

This is the mode for layering data onto entities that already exist in the graph, whether they came from a managed integration or a different sync job. A PATCH upload is additive: properties you include are written, properties you don't include are untouched.

## When to use PATCH

-   You are enriching existing entities, not replacing a dataset.
-   Every entity in your upload already exists in the graph. PATCH cannot create entities — a patch targeting an entity that doesn't exist is skipped.
-   You don't have (or don't want to compute) the full set of entities — only the ones you have new data for.
-   You only need to change entity properties; PATCH does not accept relationships.
-   The properties you're setting do **not** need to survive a managed-integration re-sync. If they do, use [`OVERRIDE`](/api/sync-jobs/override.md) instead.

## Example use cases

PATCH is the right mode in two situations: you're refreshing data on managed-integration entities **faster than that integration's own DIFF cycle** (and you accept that each integration run will reset to the integration's truth), or you're updating entities in a **custom dataset** that no managed integration owns. If you need values to _survive_ a managed integration's next sync, use [`OVERRIDE`](/api/sync-jobs/override.md) instead.

### Higher-frequency updates between managed-integration runs

Your AWS integration runs once an hour. Between runs, an internal process polls CloudWatch every five minutes and refreshes a `lastErrorCount` property on `aws_lambda_function` entities so dashboards stay closer to real-time.

-   **Scope**: `lambda-error-counts`
-   **Mode**: `PATCH`
-   **Why PATCH**: You only need the value to live between integration runs. Each AWS sync re-asserts AWS's own state for these entities, and the next CloudWatch push refreshes `lastErrorCount` again. OVERRIDE would be wrong here because you do _not_ want the value to persist across integration syncs.

```json
POST /persister/synchronization/jobs
{
  "source": "api",
  "syncMode": "PATCH",
  "scope": "lambda-error-counts"
}
```

```json
{
  "entities": [
    { "_id": "lambda-fn-123", "lastErrorCount": 4, "lastSampledAt": "2026-04-28T14:05:00Z" },
    { "_id": "lambda-fn-456", "lastErrorCount": 0, "lastSampledAt": "2026-04-28T14:05:00Z" }
  ]
}
```

### Updating a custom dataset you already pushed

You maintain a `Person` dataset in JupiterOne by pushing a [`DIFF`](/api/sync-jobs/diff.md) from your HRIS each night. During the day, a separate process updates a `lastGoogleLoginAt` property on those Persons hourly from the Google Workspace audit log.

-   **Scope**: `google-login-activity`
-   **Mode**: `PATCH`
-   **Why PATCH**: No managed integration owns these entities; the only writers are your two custom syncs. PATCH lets the hourly update touch only `lastGoogleLoginAt` without disturbing anything the nightly DIFF set, and there's no integration DIFF to worry about resetting your values.

## Required entity fields

PATCH lets you target by either `_id` or `_key`:

-   **When `scope` is defined**: either `_key` or `_id` is required.
-   **When `scope` is not defined**: `_id` is required.

`_id` is unambiguous globally; `_key` requires the scope context to resolve.

You do **not** need to include `_type` or `_class` on a PATCH upload — those are creation-time fields, and PATCH never creates entities.

## Relationships are not allowed

PATCH rejects relationships:

```text
Relationships are not allowed in PATCH jobs
```

If you need to add relationships, use [`DIFF`](/api/sync-jobs/diff.md) (when you own both entities and the scope) or [`CROSS_SCOPE`](/api/sync-jobs/cross-scope.md) (when the from and to entities live in different scopes).

## PATCH vs OVERRIDE vs the entity mutation API

`PATCH`, [`OVERRIDE`](/api/sync-jobs/override.md), and the GraphQL [`updateEntity`](/api/entity-mutations.md#updating-entity) mutation can all write properties onto an existing entity, but they answer different questions about _persistence_:

| Tool | Property survives the next managed-integration sync? | Best for |
| --- | --- | --- |
| `PATCH` sync mode | **No.** PATCH writes the value onto the entity but does not register a persistent override. The next integration sync replaces the entity wholesale, and any PATCH-set property the integration doesn't itself assert is lost. | High-frequency refreshes of entities you own, or short-lived enrichments on managed entities that you actively re-PATCH. |
| `OVERRIDE` sync mode | **Yes.** OVERRIDE records the property as a persistent override; it is reapplied after every integration sync. | Bulk overrides across many managed entities (up to 10,000 per sync job) under a stable scope. |
| `updateEntity` GraphQL mutation | **Yes.** Properties set via `updateEntity` are recorded as persistent overrides on the target entity and survive every future integration sync. | One-off edits to a single entity, or scripts that touch a small number of entities and don't need to be grouped under a scope. |

Pick `PATCH` only when "wiped by the next integration run" is acceptable — usually because you're going to re-PATCH on a tight cadence, or because no managed integration owns the entity. If you need the value to last, use OVERRIDE for batches and `updateEntity` for one-offs.

## Example: PATCH sync job

POST /persister/synchronization/jobs

```json
{
  "source": "api",
  "syncMode": "PATCH",
  "scope": "google-login-activity"
}
```

POST /persister/synchronization/jobs/{jobId}/upload

```json
{
  "entities": [
    { "_id": "person-123", "lastGoogleLoginAt": "2026-04-28T14:00:00Z" },
    { "_id": "person-456", "lastGoogleLoginAt": "2026-04-28T13:42:00Z" }
  ]
}
```

```text
POST /persister/synchronization/jobs/{jobId}/finalize
```

After finalize, the two persons have updated `lastGoogleLoginAt`. No other persons were affected. No entities or relationships were created or deleted.

## Operational notes

-   **PATCH never creates entities.** If a targeted entity doesn't exist in the graph, that patch is silently skipped — no error is raised and no entity is created. Create the entity first (via a managed integration or a [`DIFF`](/api/sync-jobs/diff.md) job), then PATCH it.
-   **PATCH is non-destructive.** Re-running PATCH with no entities is a no-op.
-   **Setting a property to `null` clears it** for the targeted entity.
-   **Stale values aren't cleaned up.** If you stop sending a property for an entity, the previous value stays on the entity. To remove it, send the entity with that property set to `null`.
-   **PATCH does not protect properties from managed integrations.** A PATCH-set value lives on the entity until the source integration's next sync, at which point the entity is rewritten and any PATCH-set property the integration itself doesn't assert is lost. For values that need to survive every integration run, use [`OVERRIDE`](/api/sync-jobs/override.md) (sync-job batches) or the [`updateEntity`](/api/entity-mutations.md#updating-entity) GraphQL mutation (one-offs).

## Common errors

| Error | Cause | Fix |
| --- | --- | --- |
| `Relationships are not allowed in PATCH jobs` | Uploaded relationships to a PATCH job. | Use DIFF or CROSS\_SCOPE for relationships. |
| Required either `_id` or `_key` | Neither identifier present. | Include `_id` (preferred) or `_key`. |
| Property not visible after finalize | Property starts with `_`. | Custom property names cannot begin with `_`. |
| Entity unchanged after finalize, no error | The targeted entity doesn't exist — PATCH does not create entities; non-matching patches are silently skipped. | Create the entity first with [`DIFF`](/api/sync-jobs/diff.md) (or let the owning integration create it), then PATCH. |

See the [API reference](/api/sync-jobs/api-reference.md) for the complete error table.

---

Source: /api/sync-jobs/put

# PUT sync mode

`PUT` creates entities that don't exist yet and updates the ones that do. Unlike [`DIFF`](/api/sync-jobs/diff.md), it never deletes: anything that was in the scope last time and is missing from this upload is left exactly as it was.

This is the mode for sources that can only show you part of the picture. If your API exposes a rolling window — the last seven days of records, say — `DIFF` would delete everything older on every run, and [`PATCH`](/api/sync-jobs/patch.md) would refuse to create the records that are new. `PUT` is the middle ground: upsert what you have, leave the rest alone.

> **INFO**
> 
> `PUT` is enabled per account by JupiterOne. Requests from accounts that aren't enabled are rejected with `PUT sync mode is not enabled for this account`. To have it turned on, [contact JupiterOne support](https://support.jupiterone.io/) with your account ID and a short description of the data source. See [Requesting access](#requesting-access).

## When to use PUT

-   Your source can't give you the full dataset on every run, so `DIFF`'s delete sweep would remove valid data.
-   New records appear over time and need to be created, which rules out [`PATCH`](/api/sync-jobs/patch.md).
-   You are the source of truth for the entities you _do_ send, and you want the upload to win on those.
-   You accept that records which age out of your source stay in the graph until something else removes them.
-   You need to upload relationships as well as entities. `PUT` accepts both, including mapped relationships.

If your source _can_ produce the full dataset, prefer [`DIFF`](/api/sync-jobs/diff.md) — automatic cleanup of stale data is worth having.

## Example use cases

### A source API with a rolling window

Your GRC platform exposes findings through an API that only returns the last seven days of activity. You poll it nightly and push the results into JupiterOne.

-   **Scope**: the custom integration instance
-   **Mode**: `PUT`
-   **Why PUT**: `DIFF` would delete every finding older than a week on the first run, because they aren't in the upload. `PATCH` would keep existing findings up to date but silently skip the ones created since yesterday. `PUT` creates the new findings and refreshes the ones it can still see, and leaves the older history in place.

POST /persister/synchronization/jobs

```json
{
  "source": "integration-external",
  "integrationInstanceId": "d246255c-1530-4fd7-9e99-6c2323402483",
  "syncMode": "PUT"
}
```

POST /persister/synchronization/jobs/{jobId}/upload

```json
{
  "entities": [
    {
      "_key": "grc-finding:2718471",
      "_type": "grc_finding",
      "_class": "Finding",
      "status": "open",
      "severity": "high",
      "identifiedOn": "2026-04-17T13:45:53Z"
    }
  ]
}
```

### An append-only event feed

An internal service emits audit events to a queue. A worker batches them and pushes them into JupiterOne every few minutes. Events are never revised and never deleted at the source.

-   **Mode**: `PUT`
-   **Why PUT**: Each batch is genuinely new data. `DIFF` would treat every batch as the complete history and delete everything from the previous batch.

### A slow-moving dataset you only partially refresh

You mirror a large asset inventory, but a full export takes hours, so you refresh it in slices — one business unit per run.

-   **Mode**: `PUT`
-   **Why PUT**: Each run is a valid partial upload. Under `DIFF`, syncing one business unit would delete the others.

## Requesting access

`PUT` is gated per account while it rolls out. To request it, [contact JupiterOne support](https://support.jupiterone.io/) with:

-   the **account ID** you want it enabled for (each account is enabled separately — a sandbox or POV account and a production account are two requests);
-   the **data source** you're ingesting and why a rolling window or partial upload means `DIFF` isn't suitable;
-   whether you'll be uploading **relationships** as well as entities.

Enablement is a configuration change on JupiterOne's side, so allow for a normal support turnaround rather than expecting it to be self-serve. Until your account is enabled, starting a `PUT` job returns:

```text
PUT sync mode is not enabled for this account
```

Nothing else about the request needs to change once it's enabled — the same payload starts working.

## Required entity fields

Every entity in a `PUT` upload needs:

-   `_key` — unique within the scope. This is what `PUT` matches on to decide between create and update.
-   `_type` — your entity type, in `snake_case`.
-   `_class` — JupiterOne class (string or array of strings, max 5 items).

These are the same three fields [`DIFF`](/api/sync-jobs/diff.md) requires, and for the same reason: `PUT` creates entities, so it needs enough to build one.

> **NOTE**
> 
> `PUT` identifies entities by `_key` only. Unlike [`PATCH`](/api/sync-jobs/patch.md), it does not accept `_id` as an alternative identifier — an upload containing `_id` is rejected.

## Required relationship fields

Standard relationships need `_key`, `_type`, `_class`, `_fromEntityKey`, and `_toEntityKey`.

Mapped relationships — for connecting to entities you don't own in this scope — need `_mapping` instead of `_fromEntityKey`/`_toEntityKey`. `PUT` writes mapped relationships, the same as [`DIFF`](/api/sync-jobs/diff.md) does. See the [API reference](/api/sync-jobs/api-reference.md) for the mapped-relationship shape.

As with entities, relationships are upserted and never deleted. A relationship that stops appearing in your uploads stays in the graph.

## How updates are applied

When `PUT` updates an entity that already exists, it writes the properties present in your payload and leaves every other property alone. Properties you stop sending keep their previous values — `PUT` has no way to tell "this property is gone" from "this property wasn't in this batch."

Values pinned with [`OVERRIDE`](/api/sync-jobs/override.md) are respected: if a property on the target entity is held by an override, `PUT` will not overwrite it.

> **CAUTION**
> 
> Sending a property as `null` does **not** clear it. Null values are stripped from `PUT` uploads before they reach the graph, so the property keeps whatever value it had. (This differs from [`PATCH`](/api/sync-jobs/patch.md), where `null` does clear a property.)
> 
> To remove a property from a `PUT`\-maintained entity, use the [entity mutation API](/api/entity-mutations.md), or run a [`DIFF`](/api/sync-jobs/diff.md) over the scope with the property omitted.

## Example: full PUT sync job

POST /persister/synchronization/jobs

```json
{
  "source": "integration-external",
  "integrationInstanceId": "d246255c-1530-4fd7-9e99-6c2323402483",
  "syncMode": "PUT"
}
```

Response:

```json
{
  "job": {
    "id": "f445397d-8491-4a12-806a-04792839abe3",
    "status": "AWAITING_UPLOADS",
    "syncMode": "PUT",
    "numEntitiesUploaded": 0
  }
}
```

Upload entities and relationships:

POST /persister/synchronization/jobs/{jobId}/upload

```json
{
  "entities": [
    {
      "_key": "grc-finding:2718471",
      "_type": "grc_finding",
      "_class": "Finding",
      "status": "open",
      "severity": "high"
    },
    {
      "_key": "grc-supplier:8891",
      "_type": "grc_supplier",
      "_class": "Vendor",
      "displayName": "Northwind Logistics"
    }
  ],
  "relationships": [
    {
      "_key": "grc-finding:2718471|affects|grc-supplier:8891",
      "_type": "grc_finding_affects_supplier",
      "_class": "AFFECTS",
      "_fromEntityKey": "grc-finding:2718471",
      "_toEntityKey": "grc-supplier:8891"
    }
  ]
}
```

Finalize:

```text
POST /persister/synchronization/jobs/{jobId}/finalize
```

After finalize, those two entities and the relationship between them exist and are current. Everything else already in the scope is untouched — nothing was deleted.

## Nothing is ever removed

This is the point of `PUT`, and it's worth stating plainly: a `PUT` job has no delete step. Records that disappear from your source stay in the graph indefinitely.

That's the correct behavior when your source genuinely can't tell you what was removed. It is the wrong behavior if you want stale data cleaned up — in which case use [`DIFF`](/api/sync-jobs/diff.md).

If you need to remove entities from a `PUT`\-maintained scope, you have two options:

-   Run a one-off [`DIFF`](/api/sync-jobs/diff.md) job over the same scope with the complete dataset, which reconciles it in a single pass.
-   Delete the entities individually through the [entity mutation API](/api/entity-mutations.md).

## Known limitation: property search on updated entities

When `PUT` **creates** an entity, the entity is fully indexed and behaves like any other.

When `PUT` **updates** an existing entity, the search index and change-detection data for that entity are not recomputed from the merged result — they stay as they were when the entity was created. In practice this means a property-value search may not match a value that was added by a later `PUT` update, even though the property is present on the entity and returned by queries that select it directly.

Entities that a managed integration or a [`DIFF`](/api/sync-jobs/diff.md) job also writes are unaffected: those writes refresh the index normally.

If property-value search across the full history of an entity matters for your use case, plan on a periodic [`DIFF`](/api/sync-jobs/diff.md) over the scope, or filter on properties in your queries rather than relying on free-text search. This is a current limitation and is expected to change.

## Operational notes

-   **Partial uploads are safe.** That's the entire premise — send what you have.
-   **Stable `_key`s matter more than usual.** With no delete sweep, a change in your `_key` strategy doesn't churn the data, it _duplicates_ it: the old entities stay and the new ones are created alongside them.
-   **Re-running the same upload is a no-op.** `PUT` is idempotent.
-   **Chunk across uploads, finalize once.** A single sync job accepts many upload calls before finalize.
-   **`PUT` does not protect properties from managed integrations.** If a managed integration owns the entity, its next sync rewrites the entity and any `PUT`\-set property it doesn't itself assert is lost. Use [`OVERRIDE`](/api/sync-jobs/override.md) for values that must survive integration syncs.

## PUT vs DIFF vs PATCH

|  | Creates entities | Updates entities | Deletes what's missing | Accepts relationships |
| --- | --- | --- | --- | --- |
| [`DIFF`](/api/sync-jobs/diff.md) | yes | yes | **yes** | yes |
| [`PATCH`](/api/sync-jobs/patch.md) | no | yes | no | no |
| `PUT` | yes | yes | **no** | yes |

The short version: pick `DIFF` when your upload is the whole truth, `PATCH` when you're only enriching entities that already exist, and `PUT` when you have partial data that includes records nobody has seen before.

## Common errors

| Error | Cause | Fix |
| --- | --- | --- |
| `PUT sync mode is not enabled for this account` | The account isn't on the PUT allowlist. | [Contact support](https://support.jupiterone.io/) to request enablement. See [Requesting access](#requesting-access). |
| Validation error naming `_id` | An entity was uploaded with `_id`. | `PUT` identifies entities by `_key`. Remove `_id`. |
| `/entities/0/_key is required` | Missing `_key`. | Add `_key` — `PUT` requires it to match create against update. |
| Entities linger after they leave your source | Working as designed; `PUT` never deletes. | Run a [`DIFF`](/api/sync-jobs/diff.md) over the scope, or delete via the [entity mutation API](/api/entity-mutations.md). |
| A property added by a later update isn't found by property search | The search index isn't recomputed on `PUT` update. | See [Known limitation](#known-limitation-property-search-on-updated-entities). |
| A property sent as `null` still has its old value | Nulls are stripped from `PUT` uploads. | Clear it via the [entity mutation API](/api/entity-mutations.md) or a [`DIFF`](/api/sync-jobs/diff.md) over the scope. |

See the [API reference](/api/sync-jobs/api-reference.md) for the complete error table.

---

Source: /api/validate-optimize-queries

# Validate Queries

The validate and optimize j1ql endpoints are used to validate j1ql queries.

## Validate queries

The validate endpoint takes in an array of queries sent as a json object in the request body. It returns an array of objects containing the query and a boolean flag indicating whether the query is valid or not.

### Sample request

```text
POST /j1ql/validate
```

```json
{
    "queries": [
        "Find Person as p that relates to User"
    ]
}
```

### Sample response

```json
[
    {
        "query": "Find Person as p that relates to User",
        "valid": true
    }
]
```

---

Source: /data-model/entity-ingestion-labels

# Entity ingestion labels

JupiterOne's standardized entity labels indicate how an entity is ingested into the graph. The Metadata tab in J1 Assets provides this information, and it can be used to filter queries with the `_source` property in a `WITH` clause.

## Ingestion labels

The labels for ingestion sources are:

-   `system-internal` for metadata about the JupiterOne instance.
-   `integration-managed` for entities ingested by integrations.
-   `system-mapper` for assets not ingested by an integration but exist another way, like inferred entity relationships or timing.
-   `api` for entities created through JupiterOne's APIs.
-   `sample-data` for entities created through the sample data feature.

### Example query

For example, you could find AWS instances that were ingested by integrations and use a data store by running the following query:

Which of my aws instances were ingested by an integration using a data store?

```sql
FIND aws_instance
WITH _source = 'integration-managed'
THAT USES DataStore
RETURN TREE
```

### `system-mapper` behavior

In JupiterOne, a `system-mapper` entity is created when it's inferred that a certain entity should exist based on correlation data with other entities, but it hasn't been ingested yet by an integration. For example, a `HostAgent` entity may require a corresponding `Host` entity to exist in the graph, which the `system-mapper` can create if it's missing.

Another use case for a `system-mapper` entity is when an asset likely exists based on relationship data, but other integration sources haven't yet had a chance to add it to the JupiterOne graph. In such cases, JupiterOne uses an entity with a `_source` value of `system-mapper` to represent the asset.

---

Source: /data-model/entity-property-normalization

# Normalization

JupiterOne normalizes some entity properties on specific classes to make querying easier and to make query results more consistent. In the event that we normalize properties into a property provided in a raw upload, or from an integration, the original raw value is persisted in `raw_<property>` to prevent any data loss.

Reading diffs:

```diff
{
  "property": "this is unchanged",
+ "newProperty": "this is added",
- "removedProperty": "this is removed"

- "changedProperty": "This gets Changed"
+ "changedProperty": "this has been changed"
}
```

## Devices and HostAgents

### Collect and normalize serial numbers

A property called `serials` is added containing normalized values of all matching properties. **Source properties are not modified**. This is primarily feature for improved reliability of our device consolidation features.

| \_class | matching property name (one of) | target property | matching property value (one of) |
| --- | --- | --- | --- |
| Device, HostAgent | `serial` OR `serialNumber` | `serials` | `/^((([^0-9a-f]*[0-9a-f]){7}[0-9a-z\W]*)$|(([^0-9a-z]*[0-9a-z]){12}[0-9a-z\W]*))$/i` |

#### Example Normalizations

```diff
// Example 1:
{
 "serial": "AB-CD-EF-12-34-56"
+ "serials": ["ab-cd-ef-12-34-56"] 
}

// Example 2:
{
  "serialNumber": ["123456789"]
+ "serials": ["123456789"]
}

// Example 3:
{
  "serial": "32CCBFD3-2436-41AA-8492-016D20241767",
  "serialNumber": ["A12345", "ABCD12345" ],
+ "serials": [
+   "32ccbfd3-2436-41aa-8492-016d20241767",
+   "a12345",
+   "abcd12345"
+ ]
}
```

### Collect associated IP(v4) addresses

A property called `associatedIpAddresses` is added containing normalized values of all matching properties. **Source properties are not modified**. This allows easier searching for entities that may be associated with an IP Address in an unknown way, regardless of the semantic meaning of the original IP Address properties.

| \_class | matching property name (one of) | target property | matching property value (one of) |
| --- | --- | --- | --- |
| Device, HostAgent | `ipAddresses` OR `ipAddress` OR `publicIpAddress` OR `privateIpAddress` OR `lastIpAddress` OR `network.ipAddress` OR `lastExternalIpAddress` OR `IP_Address` | `associatedIpAddresses` | `/^(((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))$/` |

#### Example normalizations

```diff
// Example 1:
{
  "ipAddress": "024.249.245.253",
+ "associatedIpAddresses": [ "024.249.245.253" ]
}
// Example 2:
{
  "ipAddress": "024.249.245.253",
  "publicIpAddress": "1.9.243.250",
  "privateIpAddress": "250.236.221.208",
+ "associatedIpAddresses": [ 
+   "024.249.245.253",
+   "1.9.243.250",
+   "250.236.221.208"
+ ]
}
```

### Collect associated email addresses

> [https://html.spec.whatwg.org/multipage/input.html#valid-e-mail-address](https://html.spec.whatwg.org/multipage/input.html#valid-e-mail-address)

A property called `associatedEmailAddresses` is added containing normalized values of all matching properties. **Source properties are not modified**. This allows easier searching on any entities that may be associated with an email address in any unknown way, regardless of relationships or the semantic meaning of the original email address properties.

| \_class | matching property name (one of) | target property | matching property value (one of) |
| --- | --- | --- | --- |
| Device | `email` OR `primaryEmail` OR `recoveryEmail` OR `contactEmails` OR `userEmail` OR `userEmails` OR `serviceAccountEmails` OR `serviceAccountEmail` OR `publisherEmail` OR `maintainerEmails` OR `homeEmail` OR `verifiedEmail` OR `verifiedEmails` OR `userEmails` OR `emailAddress` OR `workEmail` OR `Email` OR `general.assignedUserEmail` OR `techLeadEmail` OR `managerEmail` OR `cooEmail` OR `ceoEmail` OR `ctoEmail` OR `techContractEmail` OR `registrantContactEmail` OR `adminContactEmail` OR `abuseContactEmail` | `associatedEmailAddresses` | `/^([a-zA-Z0-9.!#$%&'*+/=?^_{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)\*$)/i` |

#### Example normalizations

```diff
// Example 1:
{
  "email": "support@jupiterone.io",
  "primaryEmail": "Support@JupiterOne.io",
  "recoveryEmail: "security@jupiterone.io",
+ "associatedEmails": [
+   "support@jupiterone.io",
+   "security@jupiterone.io
+ ]
}
```

### Normalize make

Source property `make` may be modified. If so, the original value will be maintained in `raw_make`.

| \_class | matching property name (one of) | target property | matching property value (one of) |
| --- | --- | --- | --- |
| Device, HostAgent | `make` OR `Manufacturer` OR `hardwareManufacturer` OR `hardwareVendor` | `make` | `/^(.+)$/` |

```diff
// Example 1:
{
  "make": "Intel" // no change
}

// Example 2:
{
  "Manufacturer": "intel",
+ "make": "Intel"
}
```

#### Further refine make based on MAC address

Source property `make` may be modified. If so, the original value will be maintained in `raw_make`.

Using IEEE OUI lookups based on the [registration authority](https://standards.ieee.org/products-programs/regauth/), we can determine device make from its MAC Address in over thirty thousand MAC address blocks. Below are a few examples:

| \_class | matching property name (one of) | target property |
| --- | --- | --- |
| Device, HostAgent | `macAddress` | `make` |

#### Example normalizations

```diff
// Example 1:
{
  "macAddress": "6C:29:95:6E:69:F6", 
+ "make": "Intel" // normalized from the macAddress based on IEEE OUI lookup
}

// Example 2 (make already defined):
{
  "macAddress": "6C:29:95:6E:69:F6",
- "make": "Dell",
+ "make": "Intel", // normalized from the macAddress based on IEEE OUI lookup
+ "raw_make": "Dell" // preserved original raw value
}
```

Other Example IEEE OUI lookups:

### Normalize OS versions

Source property `osVersion` may be modified. If so, the original value will be maintained in `raw_osVersion`.

| \_class | matching property name (one of) | target property | matching property value (one of) |
| --- | --- | --- | --- |
| Device, HostAgent | `osVersion` OR `os_version` OR `operatingSystemVersion` OR `os` OR `OS` OR `Operating System` OR `operatingSystem` OR `operatingsystem` | `osVersion` | `/^(?:.*?)(?:\b|\()(\d+(\.\d+)*)(?:\b|\))(?:.*)$/i` |

#### Example normalizations

```diff
// Example 1:
{
 "operatingSystemVersion": "16.5.0",
+ "osVersion": "16.5"
}

// Example 2:
{
- "osVersion": "Mac OS X 12.3.4"
+ "osVersion": "12.3.4", // normalized value
+ "raw_osVersion: "Mac OS X 12.3.4" // preserved original raw value
}
```

Other normalized values examples:

### Normalize OS types

Source property `osType` may be modified. If so, the original value will be maintained in `raw_osType`.

| \_class | matching property name (one of) | target into | matching property value (one of) |
| --- | --- | --- | --- |
| Device, HostAgent | `operatingSystem` OR `operatingsystem` OR `os` OR `OS` OR `osFamily` OR `os_family` OR `osName` OR `osname` OR `os_name` OR `Operating System` OR `os_version` OR `@osVersion` OR `osVersion` | `osType` | `/(^.*(ios [\d]|iphone).*$)/i` OR `/(^.*ipad.*$)/i` OR `/(^(Cupcake|Donut|Eclair|Froyo|Gingerbread|Honeycomb|Ice Cream Sandwich|Jelly Bean|KitKat|Lollipop|Marshmallow|Nougat|Oreo|Pie|Android).*$)/` OR `/(^.*ipad.*$)/i` OR `/(^.*(OS\s?x|macos).*$)/i` OR `/((^.*(windows|microsoft).*$)|(^.*\s+(win|ms)(\s|\d|-)+.*$)|(^(win|ms)(\s|\d|-)+.*$))/i` OR `/^(Linux|Debian|Ubuntu|Fedora|Red Hat|CentOS|Arch(\s?Linux)?|openSUSE|Gentoo|Slackware|Mint|Kali(\s?Linux)?|Zorin(\s?OS)?|Manjaro|Mageia).*$/i` |

#### Example normalizations

```diff
// Example 1:
{
  "Operating System": "Apple iOS 16.6.1"
+ "osType": "iOS"
}

// Example 2:
{
  "osName": "Debian GNU/Linux 10 (buster)"
+ "osType": "*nix (Debian)"
}

// Example 3:
{
- "osType": "Apple MAC OS X",
+ "osType": "MacOS",
+ "raw_osType": "Apple MAC OS X" // preserved original raw value
}
```

Other example value normalizations:

### Normalize and collect MAC addresses

Source property `macAddress` may be modified. If so, the original value will be maintained in `raw_macAddress`. _All_ matching fields will be merged into an array in the normalized `macAddress` field:

| \_class | matching property name (one of) | normalizes into | matching property value (one of) |
| --- | --- | --- | --- |
| Device, HostAgent, Host, Gateway, Finding, Record, NetworkInterface, Printer | `macAddress` OR `macAddresses` OR `MacAddress` OR `MACADDRESS` OR `MACAddress` OR `MAC_Address` OR `mac_address` OR `mac-address` OR `altMacAddress` OR `wifiMacAddress` OR `wifiMacAddresses` OR `wirelessDeviceMac` OR `recentDeviceMac` OR `wifiMac` OR `mac` OR `network.macAddress` OR `bluetoothMac` | `macAddress` | `/^([0-9a-f]{1,2})([.:-])?([0-9a-f]{1,2})([.:-])?([0-9a-f]{1,2})([.:-])?([0-9a-f]{1,2})([.:-])?([0-9a-f]{1,2})([.:-])?([0-9a-f]{1,2})$/i` |

#### Example normalizations

```diff
{
- "macAddress": "aabbccddeeff",
  "altMacAddress": "11.22.33.44.aa.bb",
+ "macAddress": [  // normalized AND collected into array
+   "AA:BB:CC:DD:EE:FF",
+   "11:22:33:44:AA:BB"
+ ],
+ "raw_macAddress": "aabbccddeeff" // preserved original raw value
}
```

### Normalize encryption status

Source property `encryptionStatus` may be modified. If so, the original raw value will be maintained in `raw_encryptionStatus`

| \_class | matching property name (one of) | target property | matching property value (one of) |
| --- | --- | --- | --- |
| Device, HostAgent | `encrypted` OR `encryptionStatus` OR `isEncryptionEnabled` OR `encryptionState` | `encryptionStatus` | `[true] OR` \[false\] OR `/^(encrypted|true|yes)/i` OR `/^(not encrypted|false|no|not_encrypted|notencrypted|unencrypted)$/i` OR `/^(unknown)?/i` |

#### Example normalizations

```diff
// Example 1:
{
  "encryped": true,
+ "encryptionStatus": "encrypted"
}

// Example 2:
{
  "isEncryptionEnabled": "FALSE",
+ "encryptionStatus": "unencrypted"
}

// Example 3:
{
- "encryptionStatus": "yes",
+ "encryptionStatus": "encrypted",
+ "raw_encryptionStatus: "yes" // preserved original raw value
}
```

## Findings

### Normalize severity

| \_class | \_type (one of) | matching property name (one of) | matching property value (one of) |
| --- | --- | --- | --- |
| Finding | `aws_accessanalyzer_finding` OR `aws_guardduty_finding` OR `aws_inspector_finding` OR `aws_inspectorv2_finding` OR `aws_macie_finding` OR `azure_advisor_recommendation` OR `bugcrowd_submission` OR `cbdefense_alert` OR `checkmarx_finding` OR `cobalt_finding` OR `crowdstrike_vulnerability` OR `cycognito_issue` OR `detectify_finding` OR `github_code_scanning_finding` OR `github_finding` OR `github_repo_finding` OR `gitlab_finding` OR `gitleaks_finding` OR `hacker_one_report` OR `hackerone_report` OR `microsoft_defender_vulnerability` OR `netskope_compliance_finding` OR `nowsecure_finding` OR `nuclei_finding` OR `orca_finding` OR `orca_finding_alert` OR `probely_finding` OR `sast_scan_finding` OR `snyk_finding` OR `sysdig_finding` OR `tenable_container_finding` OR `tenable_vulnerability_finding` OR `trivy_finding` OR `veracode_finding` OR `qualys_finding` OR `qualys_host_finding` OR `wiz_vunerability_finding` | `severity` OR `Severity` | `/(^(info(rmational)?|(very low)|none|negligible))/i` OR `/(^low)/i` OR `/(^(medium|moderate))/i` OR `/(^high)/i` OR `/(^(critical|(very high)|hazardous|urgent))/i` OR `/(^unknown)/i` |

> **NOTE**
> 
> `aws_ecr_image_scan_finding` entities DO NOT have their severity normalized by default. If you would like them to be normalized, please contact support.

### Example normalizations

```diff
// Example 1:
{
- "severity": "MEDIUM",
+ "severity": "medium",
+ "raw_severity": "MEDIUM" // preserved original value
}

// Example 2:
{
  "Severity": "very low",
+ "severity": "info"
}
```

---

Source: /data-model/entity-relationship-metadata

# Entity relationship metadata

JupiterOne assigns the following metadata internally to entities and relationships, and all internal metadata assigned by JupiterOne features a property name prefixed with and underscore (`_`).

### Class, Type, Key, and ID

| Property | Type | Description |
| --- | --- | --- |
| `_class` | \`string | string\[\]\` |
| `_type` | `string` | The specific type of the resource. |
| `_key` | `string` | An identifier of the resource unique within an integration instance or data source scope. |
| `_id` | `string` | A globally unique identifier of the resource within JupiterOne. |

### Timestamps

All timestamps are store in Epoch milliseconds and displayed in the UI in ISO date string format:

| Property | Type | Description |
| --- | --- | --- |
| `_createdOn` | `number` | The timestamp the entity/relationship was first created in JupiterOne. Usually represents a time after the resource was created in the provider environment. |
| `_beginOn` | `number` | The timestamp when the latest version of entity/relationship was created. Equivalent to last updated timestamp within JupiterOne (_not_ the timestamp of the resource updated in the provider environment). |
| `_endOn` | `number` | THe timestamp a version of the entity/relationship was deleted in JupiterOne. |

> If available, timestamps from the resource provider, are generally normalized to one of the following:
> 
> -   `createdOn`
> -   `updatedOn`
> -   `deletedOn`
> -   `startedOn`
> -   `stoppedOn`

### State and source related metadata

| Property | Type | Description |
| --- | --- | --- |
| `_deleted` | `boolean` | Indicates whether a resource was deleted from JupiterOne graph/CMDB. This typically means the resource was recently deleted from the provider source environment. |
| `_version` | `number` | The version number, which increments every time a change to the resource configuration/attribute is captured. |
| `_source` | `string` | The source from where the resource was created. Valid options include: `integration-managed`, `powerup-managed`, `system-internal`, `system-mapper`, and `api`. |

### Integration specific metadata

The following metadata only exists on resources created via an integration:

| Property | Type | Description |
| --- | --- | --- |
| `_integrationClass` | \`string | string\[\]\` |
| `_integrationType` | `string` | Type of the integration. Typically the service provider name. For example: `aws`, `google`, `azure`, `okta`, `knowbe4`, `vmware`, etc. |
| `_integrationName` | `string` | User-provided friendly name of the integration instance. |
| `_integrationDefinitionId` | `string` | Internal UUID that identifies the definition for this integration, e.g. AWS, Azure, etc. |
| `_integrationInstanceId` | `string` | Internal UUID that identifies the integration instance. An integration can have more than one configuration instances. For example, multiple AWS accounts have multiple AWS integration instances. |

---

Source: /data-model/jupiterone-data-model

# JupiterOne Data Model

The JupiterOne Data Model is a reference model that illustrates digital resources and their complex interconnections across all ingested resources of an organization within an entity-relationship graph.

The Data Model is defined by a set of **Entities** and their **Relationships**, operating as an adaptable model rather than a strict or rigid structure.

**[📋 Download OpenAPI 3.1 Specification](/assets/files/openapi-69de98b255a4d6e96c30bd1ec962b026.json)**

## Entities

An **Entity** is a node, or vertex, within the JupiterOne graph that represents a resource within your digital infrastructure.

Each entity has a specific type that defines what that entity is and is assigned one or more higher-level class that represents a more abstract categorization or labeling of the entity in the perspective of security and technical operations.

Entities have a dedicated **type** as well as a broader level **class** for categorization at a more abstract level:

-   Entity **Type**: denotes the specific entity type based on the entity's source. For example, an AWS resource may be of type `aws_instance`, `aws_s3_bucket`, or `aws_iam_use`.
-   Entity **Class**: an abstract, _super-type_ that classifies an entity within the general framework of IT and security operations. In the above example, an `aws_instance` entity has a class of `Host`, while an `aws_s3_bucket` is a `DataStore`, and an `aws_iam_user` a `User`.

### Common entity properties

Most entities will share the following common properties:

| Property | Type | Description |
| --- | --- | --- |
| `id` | `string`,`array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |
| `name` | `string` | Name of this entity |
| `displayName` | `string` | Display name, e.g. a person's preferred name or an AWS account alias |
| `summary` | `string` | A summary / short description of this entity. |
| `description` | `string` | An extended description of this entity. |
| `classification` | `string`,`null` | The sensitivity of the data; should match company data classification scheme |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned |
| `active` | `boolean` | Indicates if this entity is currently active. |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. |
| `createdBy` | `string` | The source/principal/user that created the entity |
| `updatedBy` | `string` | The source/principal/user that updated the entity |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |
| `tags` | `array` | An array of unnamed tags |
| `notes` | `array` | User provided notes about this entity |

#### Findings Severity Data Normalization

When JupiterOne ingests data from an integration or an API, it uses the property `severity` to normalize the severity rates of findings when severity is present. Normalizing the data simplifies searches and queries that apply to vendors with properties or values that are semantically equivalent but with different names and values. For example, `severity: LOW` and `Severity: Critical` properties would be normalized to `severity: low` and `severity: critical`, respectively but the original values remain available in `raw_severity`. Not all findings data has a severity rating. In that case, JupiterOne does not normalize a severity value. For more information about normalization, see [Entity Property Normalization](/data-model/entity-property-normalization.md).

### Additional entity properties

In addition to the common entity properties outlined above, there are additional properties that can exist on entities. These properties are dependant upon class or are custom defined.

#### Class-specific Entity properties

Each specific class of Entity also has its own defined properties. For example, a `Person` entity will have properties including `firstName` and `lastName`, while a `Device` entity may have properties such as `hardwareVendor`, `hardwareModel`, and `hardwareSerial`.

#### Custom entity properties

You can also define custom properties for entity types. These are defined by the source system to which the resource belongs and can also be defined by individuals or teams managing the property resource.

### Defined entities

Below is a list of reference entities as defined by the JupiterOne Data model, each with its own respective unique properties outside of the shared [common properties outlined above](#common-entity-properties).

| Entity | Description |
| --- | --- |
| [AccessKey](/data-model/schemas/AccessKey.md) | A key used to grant access, such as ssh-key, access-key, api-key/token, mfa-token/device, etc. |
| [AccessPolicy](/data-model/schemas/AccessPolicy.md) | A policy for access control assigned to a Host, Role, User, UserGroup, or Service. |
| [AccessRole](/data-model/schemas/AccessRole.md) | An access control role mapped to a Principal (e.g. user, group, or service). |
| [Account](/data-model/schemas/Account.md) | An organizational account for a service or a set of services (e.g. AWS, Okta, Bitbucket Team, Google G-Suite account, Apple Developer Account). Each Account should be connected to a Service. |
| [Alert](/data-model/schemas/Alert.md) | A notice of any unusual or dangerous circumstance that is sent to responsible parties for the purpose of triggering action. |
| [Application](/data-model/schemas/Application.md) | A software product or application. |
| [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md) | An application endpoint is a program interface that either initiates or receives a request, such as an API. |
| [Assessment](/data-model/schemas/Assessment.md) | An object to represent an assessment, including both compliance assessment such as a HIPAA Risk Assessment or a technical assessment such as a Penetration Testing. Each assessment should have findings (e.g. Vulnerability or Risk) associated. |
| [Attacker](/data-model/schemas/Attacker.md) | An attacker or threat actor. |
| [Backup](/data-model/schemas/Backup.md) | A specific repository or data store containing backup data. |
| [Certificate](/data-model/schemas/Certificate.md) | A digital Certificate such as an SSL or S/MIME certificate. |
| [Channel](/data-model/schemas/Channel.md) | A communication channel, such as a Slack channel or AWS SNS topic. |
| [Cluster](/data-model/schemas/Cluster.md) | A cluster of compute or database resources/workloads. |
| [CodeCommit](/data-model/schemas/CodeCommit.md) | A code commit to a repo. The commit id is captured in the \_id property of the Entity. |
| [CodeDeploy](/data-model/schemas/CodeDeploy.md) | A code deploy job. |
| [CodeModule](/data-model/schemas/CodeModule.md) | A software module. Such as an npm\_module or java\_library. |
| [CodeRepo](/data-model/schemas/CodeRepo.md) | A source code repository. A CodeRepo is also a DataRepository therefore should carry all the required properties of DataRepository. |
| [CodeReview](/data-model/schemas/CodeReview.md) | A code review record. |
| [Configuration](/data-model/schemas/Configuration.md) | A Configuration contains definitions that describe a resource such as a Task, Deployment or Workload. For example, an `aws_ecs_task_definition` is a `Configuration`. |
| [Container](/data-model/schemas/Container.md) | A standard unit of software that packages up code and all its dependencies and configurations. |
| [Control](/data-model/schemas/Control.md) | A security or IT Control. A control can be implemented by a vendor/service, a person/team, a program/process, an automation code/script/configuration, or a system/host/device. Therefore, this is most likely an additional Class applied to a Service (e.g. Okta SSO), a Device (e.g. a physical firewall), or a HostAgent (e.g. Carbon Black CbDefense Agent). Controls are mapped to security policy procedures and compliance standards/requirements. |
| [ControlPolicy](/data-model/schemas/ControlPolicy.md) | An technical or operational policy with rules that govern (or enforce, evaluate, monitor) a security control. |
| [CryptoKey](/data-model/schemas/CryptoKey.md) | A key used to perform cryptographic functions, such as an encryption key. |
| [DataCollection](/data-model/schemas/DataCollection.md) | An individual collection of data. The collection may exist in various formats, such as a table (e.g. a MySQL table). The exact data type is described in the \_type property of the Entity. |
| [DataObject](/data-model/schemas/DataObject.md) | An individual data object, such as an aws-s3-object, sharepoint-document, source-code, or a file (on disk). The exact data type is described in the \_type property of the Entity. |
| [DataStore](/data-model/schemas/DataStore.md) | A virtual repository where data is stored, such as aws-s3-bucket, aws-rds-cluster, aws-dynamodb-table, bitbucket-repo, sharepoint-site, docker-registry. The exact type is described in the \_type property of the Entity. |
| [Database](/data-model/schemas/Database.md) | A database cluster/instance. |
| [Deployment](/data-model/schemas/Deployment.md) | A deployment of code, application, infrastructure or service. For example, a Kubernetes deployment. An auto scaling group is also considered a deployment. |
| [Device](/data-model/schemas/Device.md) | A physical device or media, such as a server, laptop, workstation, smartphone, tablet, router, firewall, switch, wifi-access-point, usb-drive, etc. The exact data type is described in the \_type property of the Entity. |
| [Directory](/data-model/schemas/Directory.md) | Directory, such as LDAP or Active Directory. |
| [Disk](/data-model/schemas/Disk.md) | A disk storage device such as an AWS EBS volume |
| [Document](/data-model/schemas/Document.md) | A document or data object. |
| [Domain](/data-model/schemas/Domain.md) | An internet domain. |
| [DomainRecord](/data-model/schemas/DomainRecord.md) | The DNS Record of a Domain Zone. |
| [DomainZone](/data-model/schemas/DomainZone.md) | The DNS Zone of an Internet Domain. |
| [Entity](/data-model/schemas/Entity.md) | A node in the graph database that represents an Entity. This reference schema defines common shared properties among most Entities. |
| [Finding](/data-model/schemas/Finding.md) | A security finding, which may be a vulnerability or just an informative issue. A single finding may impact one or more resources. The `IMPACTS` relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The `IMPACTS` relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc. |
| [Firewall](/data-model/schemas/Firewall.md) | A piece of hardware or software that protects a network/host/application. |
| [Framework](/data-model/schemas/Framework.md) | An object to represent a standard compliance or technical security framework. |
| [Function](/data-model/schemas/Function.md) | A virtual application function. For example, an aws\_lambda\_function, azure\_function, or google\_cloud\_function |
| [Gateway](/data-model/schemas/Gateway.md) | A gateway/proxy that can be a system/appliance or software service, such as a network router or application gateway. |
| [GraphObject](/data-model/schemas/GraphObject.md) | Standard metadata properties of a graph object, maintained by the system. These are visible to users but may not be directly modified. |
| [Group](/data-model/schemas/Group.md) | A defined, generic group of Entities. This could represent a group of Resources, Users, Workloads, DataRepositories, etc. |
| [Host](/data-model/schemas/Host.md) | A Host represents a computer, virtual machine, or other device that can run software and connect to a network. |
| [HostAgent](/data-model/schemas/HostAgent.md) | A software agent or sensor that runs on a host/endpoint. |
| [Image](/data-model/schemas/Image.md) | A system image. For example, an AWS AMI (Amazon Machine Image). |
| [Incident](/data-model/schemas/Incident.md) | An operational or security incident. An event that negatively affects the confidentiality, integrity or availability of an organization's assets. |
| [Internet](/data-model/schemas/Internet.md) | The Internet node in the graph. There should be only one Internet node. |
| [IpAddress](/data-model/schemas/IpAddress.md) | An re-assignable IpAddress resource entity. Do not create an entity for an IP Address _configured_ on a Host. Use this only if the IP Address is a reusable resource, such as an Elastic IP Address object in AWS. |
| [IpRange](/data-model/schemas/IpRange.md) | consecutive set of IP addresses used for network addressing and management. |
| [Issue](/data-model/schemas/Issue.md) | An issue as used by GitHub, Jira, or other project trackers. |
| [Key](/data-model/schemas/Key.md) | An ssh-key, access-key, api-key/token, pgp-key, etc. |
| [Logs](/data-model/schemas/Logs.md) | A specific repository or destination containing application, network, or system logs. |
| [Model](/data-model/schemas/Model.md) | A system of postulates, data, and inferences presented as a mathematical description of an entity or state of affairs. For example, a machine learning model. |
| [Module](/data-model/schemas/Module.md) | A software or hardware module. Such as an npm\_module or java\_library. |
| [NHI](/data-model/schemas/NHI.md) | A non-human identity (NHI) — any digital identity that is not a person, such as a service account, machine credential, secret, OAuth app, bot, certificate, API key, webhook, or CI/CD identity. NHIs are typically used by software, automation, or workloads to access systems and services. |
| [Network](/data-model/schemas/Network.md) | A network, such as an aws-vpc, aws-subnet, cisco-meraki-vlan. |
| [NetworkEndpoint](/data-model/schemas/NetworkEndpoint.md) | A network endpoint for connecting to or accessing network resources. For example, NFS mount targets or VPN endpoints. |
| [NetworkInterface](/data-model/schemas/NetworkInterface.md) | An re-assignable software defined network interface resource entity. Do not create an entity for a network interface _configured_ on a Host. Use this only if the network interface is a reusable resource, such as an Elastic Network Interface object in AWS. |
| [Organization](/data-model/schemas/Organization.md) | An organization, such as a company (e.g. JupiterOne) or a business unit (e.g. HR). An organization can be internal or external. Note that there is a more specific Vendor class. |
| [PR](/data-model/schemas/PR.md) | A pull request. |
| [PasswordPolicy](/data-model/schemas/PasswordPolicy.md) | A password policy is a specific `Ruleset`. It is separately defined because of its pervasive usage across digital environments and the well known properties (such as length and complexity) unique to a password policy. |
| [Person](/data-model/schemas/Person.md) | An entity that represents an actual person, such as an employee of an organization. |
| [Policy](/data-model/schemas/Policy.md) | A written policy documentation. |
| [Port](/data-model/schemas/Port.md) | A number assigned to identify a network communication endpoint. |
| [Problem](/data-model/schemas/Problem.md) | A problem identified from the analysis and correlation of assets and findings that is a notable issue worthy of action. It could be (or become) the cause, or potential cause, of one or more incidents or findings. |
| [Procedure](/data-model/schemas/Procedure.md) | A written procedure and control documentation. A Procedure typically `IMPLEMENTS` a parent Policy. An actual Control further `IMPLEMENTS` a Procedure. |
| [Process](/data-model/schemas/Process.md) | A compute process -- i.e. an instance of a computer program / software application that is being executed by one or many threads. This is NOT a program level operational process (i.e. a Procedure). |
| [Product](/data-model/schemas/Product.md) | A product developed by the organization, such as a software product. |
| [Program](/data-model/schemas/Program.md) | A program. For example, a bug bounty/vuln disclosure program. |
| [Project](/data-model/schemas/Project.md) | A software development project. Can be used for other generic projects as well but the defined properties are geared towards software development projects. |
| [Question](/data-model/schemas/Question.md) | An object that represents an inquiry, usually around some matter of uncertainty or difficulty. |
| [Queue](/data-model/schemas/Queue.md) | A scheduling queue of computing processes or devices. |
| [Record](/data-model/schemas/Record.md) | A DNS record; or an official record (e.g. Risk); or a written document (e.g. Policy/Procedure); or a reference (e.g. Vulnerability/Weakness). The exact record type is captured in the \_type property of the Entity. |
| [RecordEntity](/data-model/schemas/RecordEntity.md) | A node in the graph database that represents a Record Entity, with a set of different defined common properties than standard (resource) entities. |
| [Repository](/data-model/schemas/Repository.md) | A repository that contains resources. For example, a Docker container registry repository hosting Docker container images. |
| [Requirement](/data-model/schemas/Requirement.md) | An individual requirement for security, compliance, regulation or design. |
| [Resource](/data-model/schemas/Resource.md) | A generic assignable resource. A resource is typically non-functional by itself unless used by or attached to a host or workload. |
| [Review](/data-model/schemas/Review.md) | A review record. |
| [Risk](/data-model/schemas/Risk.md) | An object that represents an identified Risk as the result of an Assessment. The collection of Risk objects in JupiterOne make up the Risk Register. A Control may have a `MITIGATES` relationship to a Risk. |
| [Root](/data-model/schemas/Root.md) | The root node in the graph. There should be only one Root node per organization account. |
| [Rule](/data-model/schemas/Rule.md) | An operational or configuration compliance rule, often part of a Ruleset. |
| [Ruleset](/data-model/schemas/Ruleset.md) | An operational or configuration compliance ruleset with rules that govern (or enforce, evaluate, monitor) a security control or IT system. |
| [Scanner](/data-model/schemas/Scanner.md) | A system vulnerability, application code or network infrastructure scanner. |
| [Secret](/data-model/schemas/Secret.md) | A stored encrypted secret, accessed by permitted users or applications. |
| [Section](/data-model/schemas/Section.md) | An object to represent a section such as a compliance section. |
| [Service](/data-model/schemas/Service.md) | A service provided by a vendor. |
| [Site](/data-model/schemas/Site.md) | The physical location of an organization. A Person (i.e. employee) would typically has a relationship to a Site (i.e. located\_at or work\_at). Also used as the abstract reference to AWS Regions. |
| [Standard](/data-model/schemas/Standard.md) | An object to represent a standard such as a compliance or technical standard. |
| [Subscription](/data-model/schemas/Subscription.md) | A subscription to a service or channel. |
| [Task](/data-model/schemas/Task.md) | A computational task. Examples include AWS Batch Job, ECS Task, etc. |
| [Team](/data-model/schemas/Team.md) | A team consists of multiple member Person entities. For example, the Development team or the Security team. |
| [ThreatIntel](/data-model/schemas/ThreatIntel.md) | Threat intelligence captures information collected from vulnerability risk analysis by those with substantive expertise and access to all-source information. Threat intelligence helps a security professional determine the risk of a vulnerability finding to their organization. |
| [Training](/data-model/schemas/Training.md) | A training module, such as a security awareness training or secure development training. |
| [User](/data-model/schemas/User.md) | A user account/login to access certain systems and/or services. Examples include okta-user, aws-iam-user, ssh-user, local-user (on a host), etc. |
| [UserGroup](/data-model/schemas/UserGroup.md) | A user group, typically associated with some type of access control, such as a group in Okta or in Office365. If a UserGroup has an access policy attached, and all member Users of the UserGroup would inherit the policy. |
| [Vault](/data-model/schemas/Vault.md) | A collection of secrets such as a key ring |
| [Vendor](/data-model/schemas/Vendor.md) | An external organization that is a vendor or service provider. |
| [Vulnerability](/data-model/schemas/Vulnerability.md) | A security vulnerability identified by a Common Vulnerabilities and Exposures (CVE) identifier. A single vulnerability may relate to multiple findings and impact multiple resources. The IMPACTS relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The IMPACTS relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc. |
| [Weakness](/data-model/schemas/Weakness.md) | A security weakness identified by a Common Weakness Enumeration (CWE) identifier. |
| [Workflow](/data-model/schemas/Workflow.md) | A workflow such as an AWS CodePipeline, GitHub repository workflow, or Apache Airflow. |
| [Workload](/data-model/schemas/Workload.md) | A virtual compute instance, it could be an aws-ec2-instance, a docker-container, an aws-lambda-function, an application-process, or a vmware-instance. The exact workload type is described in the \_type property of the Entity. |

### Special entities

There are three special, singleton entities within the JupiterOne Data Model as well:

| Entity | Description |
| --- | --- |
| `Everyone` | The global `UserGroup` the represents "everyone" publicly. |
| `Internet` | The Internet, i.e., a `Network` entity with a CIDR value of `0.0.0.0/0` |
| `Root` | The entity that represents the top-level organization. |

## Relationships

Relationships are the edges between two entity nodes in the graph. The `_class` of the relationship should be, in most cases, a generic descriptive verb, such as `HAS` or `IMPLEMENTS`. Relationships can also carry their own properties.

For example, `CodeRepo -- DEPLOYED TO -> Host` may have version as a property on the `DEPLOYED` relationship. This represents the mapping between a code repo to multiple deployment targets, while one deployment may be of a different version of the code than another. Storing the version as a relationship property allows us to avoid duplicate instances of the code repo entity being created to represent different versions.

Relationships also have the same metadata properties as entities, which are managed by the integration providers.

### Findings Severity Data Normalization

When JupiterOne ingests data from an integration or an API, it uses the property `j1_severity` to normalize the severity rates of findings when severity is present. Normalizing the data simplifies searches and queries that apply to vendors with properties or values that are semantically equivalent but with different names and values. For example, `vendor1_severity` and `vendor2_severity` properties would be normalized to be `j1_severity`, but the original values remain in the database. Not all findings data has a severity rating. In that case, JupiterOne does not provide the `j1_severity` for those findings.

#### Example queries:

`find Finding with [j1_severity] = "high"` This query returns a list of all findings with a normalized severity of “high”.

`find Finding with [j1_severity] != undefined as f RETURN f.[j1_severity], count (f)` This query returns a count of all findings in JupiterOne grouped by j1\_severity.

### Relationship examples

Below is a list of example relationships between abstract entity classes.

##### HAS / CONTAINS

```text
      Account         -- HAS ->             User
      Account         -- HAS ->             UserGroup
      Account         -- HAS ->             AccessRole
      Account         -- HAS ->             Resource
      CodeRepo        -- HAS ->             Vulnerability
      Host            -- HAS ->             Vulnerability
      Organization    -- HAS ->             Site
      Organization    -- HAS ->             Organization (e.g. a business unit)
      Application     -- HAS ->             Vulnerability
      CodeRepo        -- HAS ->             Vulnerability
      Host            -- HAS ->             Vulnerability
      Service         -- HAS ->             Vulnerability
      Site            -- HAS ->             Network
      Site            -- HAS ->             Site
      UserGroup       -- HAS ->             User
      Network         -- CONTAINS ->        Host
      Network         -- CONTAINS ->        Database
      Network         -- CONTAINS ->        Network (e.g. a subnet)
```

##### IS / OWNS

```text
User            -- IS ->              Person
Vulnerability   -- IS ->              Vulnerability (e.g. a Snyk Vuln IS a CVE)
Person          -- OWNS ->            Device
```

##### EXPLOITS / IMPACTS

```text
Vulnerability   -- EXPLOITS ->        Weakness
Vulnerability   -- IMPACTS  ->        CodeRepo | Application
```

##### USES

```text
Host            -- USES ->            Resource (e.g. aws_instance USES aws_ebs_volume)
```

##### CONNECTS / TRIGGERS / EXTENDS

```text
Application     -- CONNECTS ->        Account
Gateway         -- CONNECTS ->        Network
Gateway         -- TRIGGERS ->        Function
HOST            -- EXTENDS  ->        Resource
```

##### IMPLEMENTS / MITIGATES

```text
Procedure       -- IMPLEMENTS ->      Policy
Control         -- IMPLEMENTS ->      Policy
Control         -- MITIGATES  ->      Risk
```

##### MANAGES

```text
Person          -- MANAGES ->         Person
Person          -- MANAGES ->         Organization
Person          -- MANAGES ->         Team
User            -- MANAGES ->         Account
User            -- MANAGES ->         UserGroup
ControlPolicy   -- MANAGES ->         Control
AccessPolicy    -- MANAGES ->         AccessRole
```

##### EVALUATES / MONITORS / PROTECTS

```text
ControlPolicy   -- EVALUATES ->       <any entity>
HostAgent       -- MONITORS  ->       Host
HostAgent       -- PROTECTS  ->       Host
```

##### TRUSTS

```text
AccessRole      -- TRUSTS ->          AccessRole
AccessRole      -- TRUSTS ->          Service
AccessRole      -- TRUSTS ->          Account
```

##### ASSIGNED

```text
User            -- ASSIGNED ->        Application
User            -- ASSIGNED ->        AccessRole
UserGroup       -- ASSIGNED ->        AccessRole
```

##### IDENTIFIED / PERFORMED / COMPLETED

```text
Person          -- PERFORMED  ->      Assessment
Person          -- COMPLETED  ->      Training
Assessment      -- IDENTIFIED ->      Risk
Assessment      -- IDENTIFIED ->      Vulnerability
```

##### PROVIDES

```text
Vendor          -- PROVIDES ->        Service
```

##### CONTRIBUTES TO

```text
User            -- CONTRIBUTES TO ->  CodeRepo
```

##### OPENED

```text
User            -- OPENED   ->        CodeReview (i.e. PR)
```

##### DEPLOYED TO

```text
CodeRepo        -- DEPLOYED TO ->     Account
CodeRepo        -- DEPLOYED TO ->     Host
CodeRepo        -- DEPLOYED TO ->     Container
CodeRepo        -- DEPLOYED TO ->     Function
```

---

Source: /data-model/schemas/AccessKey

# AccessKey

A key used to grant access, such as ssh-key, access-key, api-key/token, mfa-token/device, etc.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `fingerprint` | `string` | The fingerprint that identifies the key |  |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `material` | `string` | The key material |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `usage` | `string` | The key usage - for example: ssh access or data encryption |  |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/AccessPolicy

# AccessPolicy

A policy for access control assigned to a Host, Role, User, UserGroup, or Service.

##### AccessPolicy properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` | Indicates if the policy grants administrative privilege. |  |
| `content` | `string` | Content of a policy contains the raw policy rules, if applicable. For example, the JSON text of an AWS IAM Policy. This is stored in raw data. |  |
| `rules` | `array` of `string`s | Rules of this policy. Each rule is written 'as-code' that can be operationalized with a control provider or within JupiterOne's rules engine. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/AccessRole

# AccessRole

An access control role mapped to a Principal (e.g. user, group, or service).

##### AccessRole properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `privilegeNames` | `array` of `string`s | The role's privilege names |  |
| `privilegeServiceIds` | `array` of `string`s | The role's privilege service IDs |  |
| `superAdmin` | `boolean` | Is the role an administrator role? |  |
| `systemRole` | `boolean` | Is this a system role? |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Account

# Account

An organizational account for a service or a set of services (e.g. AWS, Okta, Bitbucket Team, Google G-Suite account, Apple Developer Account). Each Account should be connected to a Service.

##### Account properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`vendor` \*

 | `string` | The canonical full name of the vendor of this account. For example, prefer 'Amazon Web Services' over 'AWS'.  
  
**Examples**: Amazon Web Services, ServiceNow, Okta |  |
| `accessURL` | `string` | The main URL to access this account, e.g. [https://jupiterone.okta.com](https://jupiterone.okta.com) | 

**Format**: `uri`

  
 |
| `mfaEnabled` | `boolean` | Specifies whether multi-factor authentication (MFA) is enabled/required for users of this account. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `vendor`

---

Source: /data-model/schemas/Alert

# Alert

A notice of any unusual or dangerous circumstance that is sent to responsible parties for the purpose of triggering action.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Application

# Application

A software product or application.

##### Application properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alternateURLs` | `array` of `string`s | The additional URLs related to this application. |  |
| `COTS` | `boolean` | Indicates if this is a Commercial Off-The-Shelf software application. Custom in-house developed application should have this set to false. | **default**: false |
| `devURL` | `string` | The Development URL | 
**Format**: `uri`

  
 |
| `external` | `boolean` | Indicates if this is an externally acquired software application. Custom in-house developed application should have this set to false. | **default**: false |
| `FOSS` | `boolean` | Indicates if this is a Free or Open-Source software application or library. Custom in-house developed application should have this set to false. | **default**: false |
| `license` | `string` | Stores the type of license  
  
**Examples**: BSD, CC-BY-3.0, CC-BY-4.0, GPL-2.0, GPL-3.0, LGPL-2.0, LGPL-2.1, LGPL-3.0, MIT, EULA, Proprietary, UNLICENSED, other |  |
| `licenseURL` | `string` | The URL to the full license | 

**Format**: `uri`

  
 |
| `mobile` | `boolean` | Indicates if this is a mobile app. | **default**: false |
| `productionURL` | `string` | The Production URL | 

**Format**: `uri`

  
 |
| `SaaS` | `boolean` | Indicates if this is a Software-as-a-Service product. | **default**: false |
| `stagingURL` | `string` | The Non-Production / Staging URL | 

**Format**: `uri`

  
 |
| `testURL` | `string` | The Test URL | 

**Format**: `uri`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/ApplicationEndpoint

# ApplicationEndpoint

An application endpoint is a program interface that either initiates or receives a request, such as an API.

##### ApplicationEndpoint properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`address` \*

 | `string` **|** `null` | The endpoint address (e.g. an URI/URL, hostname) |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `address`

---

Source: /data-model/schemas/Assessment

# Assessment

An object to represent an assessment, including both compliance assessment such as a HIPAA Risk Assessment or a technical assessment such as a Penetration Testing. Each assessment should have findings (e.g. Vulnerability or Risk) associated.

##### Assessment properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` | The category of the Assessment.  
  
**Examples**: Risk Assessment, Readiness Assessment, Gap Assessment, Validation Assessment, Compliance Assessment, Self Assessment, Certification, Audit, Technical Review, Operational Review, Penetration Testing, Vulnerability Scan, Other |  |
| 

`internal` \*

 | `boolean` | Indicates if this is an internal or external assessment/audit. Defaults to true. | **default**: true |
| 

`summary` \*

 | `string` | The summary description of the Assessment. |  |
| `assessor` | `string` | Email or name or ID of the assessor |  |
| `assessors` | `array` of `string`s | List of email or name or ID of the assessors |  |
| `completedOn` | `number` | The timestamp (in milliseconds since epoch) when the Assessment was completed. | 

**Format**: `date-time`

  
 |
| `reportURL` | `string` | Link to the assessment report, if available. | 

**Format**: `uri`

  
 |
| `startedOn` | `number` | The timestamp (in milliseconds since epoch) when the Assessment was started. | 

**Format**: `date-time`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `summary`
-   `internal`

---

Source: /data-model/schemas/Attacker

# Attacker

An attacker or threat actor.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Backup

# Backup

A specific repository or data store containing backup data.

##### Backup properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encrypted` | `boolean` | Indicates whether the backup data is encrypted. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Certificate

# Certificate

A digital Certificate such as an SSL or S/MIME certificate.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Channel

# Channel

A communication channel, such as a Slack channel or AWS SNS topic.

##### Channel properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encrypted` | `boolean` | Indicates whether the communication channel is encrypted. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Cluster

# Cluster

A cluster of compute or database resources/workloads.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/CodeCommit

# CodeCommit

A code commit to a repo. The commit id is captured in the \_id property of the Entity.

##### CodeCommit properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`branch` \*

 | `string` | The branch the code was committed to. |  |
| 

`merge` \*

 | `boolean` | Indicates if this commit is a merge, defaults to false. | **default**: false |
| 

`message` \*

 | `string` | The commit message. |  |
| 

`versionBump` \*

 | `boolean` | Indicates if this commit is a versionBump, defaults to false. | **default**: false |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `branch`
-   `message`
-   `merge`
-   `versionBump`

---

Source: /data-model/schemas/CodeDeploy

# CodeDeploy

A code deploy job.

##### CodeDeploy properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `action` | `string` | Deploy action (e.g. plan, apply, destroy, rollback). |  |
| `jobName` | `string` | Build/deploy job name. |  |
| `jobNumber` | `integer` | Build/deploy job number. |  |
| `production` | `boolean` | Indicates if this is a production deploy, defaults to true. | **default**: true |
| `summary` | `string` | Descriptive text of the job. |  |
| `target` | `string` | Name of the target system or environment. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/CodeModule

# CodeModule

A software module. Such as an npm\_module or java\_library.

##### CodeModule properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `public` | `boolean` | Indicates if this is a public module. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/CodeRepo

# CodeRepo

A source code repository. A CodeRepo is also a DataRepository therefore should carry all the required properties of DataRepository.

##### CodeRepo properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `application` | `string` | The application that this repo is part of. |  |
| `project` | `string` | The project that this repo belongs to. |  |
| `public` | `boolean` | Indicates if this is a public repo. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/CodeReview

# CodeReview

A code review record.

##### CodeReview properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`title` \*

 | `string` | The title text of the review. |  |
| `state` | `string` | The state of the review. |  |
| `summary` | `string` | The summary text of the review. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `title`

---

Source: /data-model/schemas/Configuration

# Configuration

A Configuration contains definitions that describe a resource such as a Task, Deployment or Workload. For example, an `aws_ecs_task_definition` is a `Configuration`.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Container

# Container

A standard unit of software that packages up code and all its dependencies and configurations.

##### Container properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dockerVersion` | `string` | The version of the Docker Engine |  |
| `image` | `string` | The container image that the container is built from |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Control

# Control

A security or IT Control. A control can be implemented by a vendor/service, a person/team, a program/process, an automation code/script/configuration, or a system/host/device. Therefore, this is most likely an additional Class applied to a Service (e.g. Okta SSO), a Device (e.g. a physical firewall), or a HostAgent (e.g. Carbon Black CbDefense Agent). Controls are mapped to security policy procedures and compliance standards/requirements.

##### Control properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `function` | `string` **|**
`array` of `string`s

 | The function of the control. It can be a string or string array. Value of each item should be either all lower case or, in the case of an acronym, all upper case. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/ControlPolicy

# ControlPolicy

An technical or operational policy with rules that govern (or enforce, evaluate, monitor) a security control.

##### ControlPolicy properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `string` | The category of policy. | **enum**: compliance, config, password, other |
| `content` | `string` | Contents of the raw rules, if applicable. |  |
| `rules` | `array` of `string`s | Rules of policy. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/CryptoKey

# CryptoKey

A key used to perform cryptographic functions, such as an encryption key.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `fingerprint` | `string` | The fingerprint that identifies the key |  |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `material` | `string` | The key material |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `usage` | `string` | The key usage - for example: ssh access or data encryption |  |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Database

# Database

A database cluster/instance.

##### Database properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encrypted` | `boolean` **|** `null` | If the repository is encrypted |  |
| `encryptionRequired` | `boolean` | If the data needs to be encrypted |  |
| `location` | `string` | URI to access the database. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/DataCollection

# DataCollection

An individual collection of data. The collection may exist in various formats, such as a table (e.g. a MySQL table). The exact data type is described in the \_type property of the Entity.

##### DataCollection properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encrypted` | `boolean` | If the data in the table is encrypted |  |
| `encryptionRequired` | `boolean` | If the objects in the table need to be encrypted |  |
| `PCI` | `boolean` | Indicates if this data table contains Payment Card Information |  |
| `PHI` | `boolean` | Indicates if this data table contains Protected Health Information |  |
| `PII` | `boolean` | Indicates if this data table contains Personally Identifiable Information |  |
| `public` | `boolean` | Indicates if the data table is open to public access |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`classification` \*

 | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `classification`

---

Source: /data-model/schemas/DataObject

# DataObject

An individual data object, such as an aws-s3-object, sharepoint-document, source-code, or a file (on disk). The exact data type is described in the \_type property of the Entity.

##### DataObject properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `string` | A user-provided category of the data, such as 'Source Code', 'Report', 'Patent Application', 'Business Plan', 'Customer Record', 'Genetic Data', etc. |  |
| `encrypted` | `boolean` | If the data is encrypted |  |
| `encryptionRequired` | `boolean` | If the data needs to be encrypted |  |
| `format` | `string` | The format of the data, such as 'document', 'raw', 'plaintext', 'binary', etc. |  |
| `location` | `string` | URI to the data, e.g. file path |  |
| `PCI` | `boolean` | Indicates if this data object is or contains Payment Card Information |  |
| `PHI` | `boolean` | Indicates if this data object is or contains Protected Health Information |  |
| `PII` | `boolean` | Indicates if this data object is or contains Personally Identifiable Information |  |
| `public` | `boolean` | Indicates if the data object is open to public access |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`classification` \*

 | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `classification`

---

Source: /data-model/schemas/DataStore

# DataStore

A virtual repository where data is stored, such as aws-s3-bucket, aws-rds-cluster, aws-dynamodb-table, bitbucket-repo, sharepoint-site, docker-registry. The exact type is described in the \_type property of the Entity.

##### DataStore properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`encrypted` \*

 | `boolean` **|** `null` | If the data store is encrypted |  |
| `encryptionAlgorithm` | `string` | Encryption algorithm used to encrypt the data store |  |
| `encryptionKeyRef` | `string` | Reference to the encryption key used to encrypt the data store |  |
| `encryptionRequired` | `boolean` | If the data needs to be encrypted |  |
| `hasBackup` | `boolean` | Indicates if the data store is data backup has been configured/enabled. |  |
| `location` | `string` | URI to the data store, e.g. [https://docker-registry.jupiterone.com](https://docker-registry.jupiterone.com) or [https://jupiterone.sharepoint.com](https://jupiterone.sharepoint.com). Or a description to the physical location. |  |
| `public` | `boolean` | Indicates if the data store is open to public access |  |
| `retentionPeriodDays` | `number` | The number of days for which data is retained |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`classification` \*

 | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `classification`
-   `encrypted`

---

Source: /data-model/schemas/Deployment

# Deployment

A deployment of code, application, infrastructure or service. For example, a Kubernetes deployment. An auto scaling group is also considered a deployment.

##### Deployment properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `currentSize` | `number` | Current size (i.e. number of instances) active with this deployment. |  |
| `desiredSize` | `number` | Desired size (i.e. number of instances) associated with this deployment. |  |
| `maxSize` | `number` | Maximum size (i.e. number of instances) limited by this deployment. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Device

# Device

A physical device or media, such as a server, laptop, workstation, smartphone, tablet, router, firewall, switch, wifi-access-point, usb-drive, etc. The exact data type is described in the \_type property of the Entity.

##### Device properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` | The device category  
  
**Examples**: server, endpoint, storage-media, mobile, network, other |  |
| 

`deviceId` \*

 | 

`array` of `string`s

**|** `null` | The unique device identifier, traditionally known as a UDID |  |
| 

`displayName` \*

 | `string` | The display name of the device |  |
| 

`fqdn` \*

 | 

`array` of `string`s

**|** `null` | The fully qualified domain name of the Device |  |
| 

`hostname` \*

 | `string` **|** `null` | The primary/local hostname |  |
| 

`ipv4Addresses` \*

 | 

`array` of `string`s

**|** `null` | The IPv4 Addresses associated with the Device |  |
| 

`ipv6Addresses` \*

 | 

`array` of `string`s

**|** `null` | The IPv6 Addresses associated with the Device |  |
| 

`lastSeenOn` \*

 | `integer` **|** `null` | The timestamp (in milliseconds since epoch) when the device was either last checked in or was scanned. |  |
| 

`macAddresses` \*

 | 

`array` of `string`s

**|** `null` | The MAC Addresses associated with the Device, lowercase colon delimited |  |
| 

`make` \*

 | `string` **|** `null` | Same as hardwareVendor: The manufacturer or vendor of the device, e.g. Apple Inc., Generic |  |
| 

`model` \*

 | `string` **|** `null` | Same as hardwareModel: The device hardware model, e.g. MacBookPro13,3 |  |
| 

`osDetails` \*

 | `string` **|** `null` | Human readable details of the operating system, such as edition, service pack or code name (e.g. Microsoft Windows Server 2022 (64-bit) Enterprise, macOS Sequoia 15.1.1 (24B91)) |  |
| 

`osName` \*

 | `string` **|** `null` | The proper name of the operating system, without version (e.g. Microsoft Windows, macOS, Ubuntu Linux, Red Hat Enterprise Linux) |  |
| 

`osType` \*

 | `string` **|** `null` | The classification of the operating system |  |
| 

`osVersion` \*

 | `string` **|** `null` | The version of the operating system, ideally semver-ish (e.g. 20.04.3 LTS, 10.0.19045.3803) |  |
| 

`privateIpAddresses` \*

 | 

`array` of `string`s

**|** `null` | The private IP addresses associated with the Device |  |
| 

`publicIpAddresses` \*

 | 

`array` of `string`s

**|** `null` | The public IP addresses associated with the Device |  |
| 

`serial` \*

 | `string` **|** `null` | Same as hardwareSerial: The device serial number |  |
| `assetTag` | `array` of `string`s | The asset tag number/label that matches the identifier in asset tracking system, for company owned physical devices | **uniqueItems**: true, |
| `autoSecurityPatchEnabled` | `boolean` | Indicates if security updates are auto-installed | **default**: false |
| `autoSystemPatchEnabled` | `boolean` | Indicates if operating system updates are auto-installed | **default**: false |
| `BYOD` | `boolean` | Indicates if this is a BYOD device -- an employee-provided device that has access to company systems/resources. | **default**: false |
| `cost` | `number` | The purchase cost of the device. |  |
| `encrypted` | `boolean` | Indicates if the primary device storage is encrypted | **default**: false |
| `firewallEnabled` | `boolean` | Indicates if local/host firewall is enabled | **default**: false |
| `hardwareModel` | `string` | The device hardware model, e.g. MacBookPro13,3 |  |
| `hardwareSerial` | `string` | The device serial number |  |
| `hardwareVendor` | `string` | The manufacturer or vendor of the device, e.g. Apple Inc., Generic |  |
| `hardwareVersion` | `string` | The device hardware version |  |
| `location` | `string` | Site where this device is located. |  |
| `malwareProtected` | `boolean` | Indicates if malware protection is enabled | **default**: false |
| `osKernel` | `string` **|** `null` | The version of the kernel running on the system (e.g. 5.15.0-91-generic, 4.18.0-513.5.1.el8\_9.x86\_64, 24.1.0, 10.0.22631) |  |
| `public` | `boolean` **|** `null` | Indicates if the device is publicly accessible from the internet | **default**: false |
| `remoteAccessEnabled` | `boolean` | Indicates if remote access/login to the device is enabled | **default**: false |
| `screenLockEnabled` | `boolean` | Indicates if screen lock protection is enabled | **default**: false |
| `screenLockTimeout` | `number` | Screen lock timeout in seconds |  |
| `status` | `string` **|** `null` | Status label of this device | **enum**: assigned, archived, decommissioned, defective, deployed, disposed, locked, lost/stolen, pending, ready, unknown, other |
| `userEmails` | `array` of `string`s | The email addresses of the users this device is assigned to. Used if the device is shared by more than one user. Otherwise the 'owner' is the sole user. Leave empty/undefined if the device is unassigned. | **uniqueItems**: true,

**Format**: `email`

  
 |
| `value` | `number` | The estimated business value of the device. The value is typically calculated as the monetary cost of the device + the value of data on the device. |  |
| `version` | `string` | Same as hardwareVersion: The device hardware version |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `ipv4Addresses`
-   `ipv6Addresses`
-   `macAddresses`
-   `publicIpAddresses`
-   `privateIpAddresses`
-   `hostname`
-   `fqdn`
-   `serial`
-   `deviceId`
-   `lastSeenOn`
-   `make`
-   `model`
-   `osName`
-   `osType`
-   `osDetails`
-   `osVersion`

---

Source: /data-model/schemas/Directory

# Directory

Directory, such as LDAP or Active Directory.

##### Directory properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `directoryServers` | `array` of `string`s | List of directory servers. |  |
| `domainControllers` | `array` of `string`s | List of domain controllers. |  |
| `parent` | `string` | Parent directory, if the entity is a sub-directory. |  |
| `type` | `string` | Directory type.  
  
**Examples**: LDAP, AD |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Disk

# Disk

A disk storage device such as an AWS EBS volume

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`classification` \*

 | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`encrypted` \*

 | `boolean` **|** `null` | If the data store is encrypted |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `encryptionAlgorithm` | `string` | Encryption algorithm used to encrypt the data store |  |
| `encryptionKeyRef` | `string` | Reference to the encryption key used to encrypt the data store |  |
| `encryptionRequired` | `boolean` | If the data needs to be encrypted |  |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `hasBackup` | `boolean` | Indicates if the data store is data backup has been configured/enabled. |  |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `location` | `string` | URI to the data store, e.g. [https://docker-registry.jupiterone.com](https://docker-registry.jupiterone.com) or [https://jupiterone.sharepoint.com](https://jupiterone.sharepoint.com). Or a description to the physical location. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if the data store is open to public access |  |
| `retentionPeriodDays` | `number` | The number of days for which data is retained |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `classification`
-   `encrypted`

---

Source: /data-model/schemas/Document

# Document

A document or data object.

##### Document properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `product` | `string` | The name of the product this document is applicable to. This reference is used when the document is product related, such as a product requirement document (PRD) or software bill-of-materials (SBOM). |  |
| `version` | `string` | The version of this document. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Domain

# Domain

An internet domain.

##### Domain properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainName` \*

 | `string` | Domain name. |  |
| `abuseContactEmail` | `string` | Abuse contact email. |  |
| `adminContactEmail` | `string` | Administrative contact email. |  |
| `autoRenew` | `boolean` | Indicates whether auto-renewal is configured. |  |
| `billingContactEmail` | `string` | Billing contact email. |  |
| `contactEmails` | `array` of `string`s | List of contact emails. |  |
| `locked` | `boolean` | Indicates whether domain transfer is locked/protected. |  |
| `nameservers` | `array` of `string`s | List of nameservers. |  |
| `parent` | `string` | Parent domain, if the entity is a sub-domain. |  |
| `registrantContactEmail` | `string` | Registrant contact email. |  |
| `registrar` | `string` | Domain registrar where this domain is registered. |  |
| `registrarName` | `string` | Domain registrar name. |  |
| `registrarUrl` | `string` | Domain registrar URL. |  |
| `techContactEmail` | `string` | Technical contact email. |  |
| `whoisServer` | `string` | WHOIS server that is responsible for resolving the details of this domain. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `domainName`

---

Source: /data-model/schemas/DomainRecord

# DomainRecord

The DNS Record of a Domain Zone.

##### DomainRecord properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`TTL` \*

 | `number` | Time to Live before resolver cache expires. |  |
| 

`type` \*

 | `string` | DNS Record type. | **enum**: A, AAAA, ALIAS, CAA, CERT, CNAME, DNSKEY, DS, LOC, MX, NX, NS, NAPTR, PTR, SMIMEA, SOA, SPF, SRV, SSHFP, TLSA, TXT, URI |
| `value` | `string` **|** `array` | The record value. Could be referenced as `data`, `content`, `resourceRecords`, `aliasTarget` or another property name depending on the DNS provider. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `type`
-   `TTL`

---

Source: /data-model/schemas/DomainZone

# DomainZone

The DNS Zone of an Internet Domain.

##### DomainZone properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainName` \*

 | `string` | Domain name. |  |
| `parent` | `string` | Parent domain, if the entity is a sub-domain. |  |
| `recordsCount` | `number` | Total number of DNS records in this zone. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `domainName`

---

Source: /data-model/schemas/Entity

# Entity

A node in the graph database that represents an Entity. This reference schema defines common shared properties among most Entities.

##### Entity properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Finding

# Finding

A security finding, which may be a vulnerability or just an informative issue. A single finding may impact one or more resources. The `IMPACTS` relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The `IMPACTS` relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc.

##### Finding properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `array` **|** `null` | The category of the finding.  
  
**Examples**: data, application, host, network, endpoint, malware, event |  |
| 

`numericSeverity` \*

 | `number` **|** `null` | Severity rating based on impact and exploitability.  
  
**Examples**: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 |  |
| 

`open` \*

 | `boolean` **|** `null` | Indicates if this is an open vulnerability. |  |
| 

`severity` \*

 | `string` **|** `null` | Severity rating based on impact and exploitability.  
  
**Examples**: none, informational, low, medium, high, critical |  |
| `assessment` | `string` **|** `null` | The name/id of the assessment that produced this finding. |  |
| `blocksProduction` | `boolean` **|** `null` | Indicates whether this vulnerability finding is a blocking issue. If true, it should block a production deploy. Defaults to false. |  |
| `exploitability` | `number` **|** `null` | The exploitability score/rating. |  |
| `impact` | `number` **|** `null` | The impact description or rating. |  |
| `priority` | `string` **|** `null` | Priority level mapping to Severity rating. Can be a string such as 'critical', 'high', 'medium', 'low', 'info'. Or an integer usually between 0-5. |  |
| `production` | `boolean` **|** `null` | Indicates if this vulnerability is in production. |  |
| `public` | `boolean` **|** `null` | Indicates if this is a publicly disclosed vulnerability. If yes, this is usually a CVE and the 'webLink' should be set to '[https://nvd.nist.gov/vuln/detail/$\\{CVE-Number\\}](https://nvd.nist.gov/vuln/detail/$%5C%7BCVE-Number%5C%7D)' or to a vendor URL. If not, it is most likely a custom application vulnerability. |  |
| `recommendation` | `string` **|** `null` | Recommendation on how to remediate/fix this finding. Use 'remediationActions' field instead. | **deprecated**: true |
| `references` | `array` **|** `null` | The array of links to references. |  |
| `remediationActions` | `string` **|** `null` | Recommended remediation actions or steps to address a finding, vulnerability or weakness. This field supports markdown formatting for rich text content including links, code blocks, and structured lists. Markdown-formatted text describing remediation steps is preferred. |  |
| `remediationSLA` | `integer` **|** `null` | The number of days that the Vulnerability must be remediated within, based on SLA set by the organization's internal vulnerability management program policy. The actually due date is set by 'remediationDueOn' property on the `IMPACTS` relationship between the Vulnerability and its impacted resource entity. |  |
| `score` | `number` **|** `null` | The overall vulnerability score, e.g. CVSSv3. |  |
| `status` | `string` **|** `null` | Status of the vulnerability |  |
| `stepsToReproduce` | `array` **|** `null` | Steps to reproduce this finding. |  |
| `targetDetails` | `array` **|** `null` | Additional details about the targets. Can be a string or an array. |  |
| `targets` | `array` **|** `null` | The target listing of projects, applications, repos or systems this vulnerability impacts. Specifying either the project/repo name or the application URL here will auto-map this Vulnerability to the corresponding Project/CodeRepo/Application entity if a match is found. |  |
| `validated` | `boolean` **|** `null` | Indicates if this Vulnerability finding has been validated by the security team. |  |
| `vector` | `string` **|** `null` | The vulnerability attack vector. (e.g. a CVSSv3 vector looks like this - 'AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N') |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `severity`
-   `numericSeverity`
-   `open`

---

Source: /data-model/schemas/Firewall

# Firewall

A piece of hardware or software that protects a network/host/application.

##### Firewall properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s | The category of the Firewall. Indicates the scope that the Firewall applies to -- i.e. Network, Host, Application. | **Enum**: network, host, application, other |
| `isStateful` | `boolean` | Indicates if the rules in the firewall is stateful. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`

---

Source: /data-model/schemas/Framework

# Framework

An object to represent a standard compliance or technical security framework.

##### Framework properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` | Display name |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| 

`standard` \*

 | `string` | The name of the framework standard.  
  
**Examples**: HIPAA, NIST, CSA STAR, PCI DSS, NIST CSF, FedRAMP, ISO 27001, SOC, OWASP, Other |  |
| 

`version` \*

 | `string` | The version of the framework. For example, OWASP may have version 2010, 2013, 2017. |  |
| `description` | `string` | An extended description of this entity. |  |
| `summary` | `string` | A summary / short description of this entity. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `standard`
-   `version`

---

Source: /data-model/schemas/Function

# Function

A virtual application function. For example, an aws\_lambda\_function, azure\_function, or google\_cloud\_function

##### Function properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `codeHash` | `string` | The hash of code of this function. |  |
| `codeSize` | `string` | The size of code of this function. |  |
| `handler` | `string` | The handler of this function |  |
| `image` | `string` | The image of this function, typically refers to a zip package. |  |
| `memorySize` | `string` | The allocated memory of this function to execute. |  |
| `runtime` | `string` | The runtime of this function. For example: 'nodejs6.10', 'nodejs8.10', or 'python2.7'. |  |
| `trigger` | `string` | What triggers this function to execute. |  |
| `version` | `string` | The version of this function. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Gateway

# Gateway

A gateway/proxy that can be a system/appliance or software service, such as a network router or application gateway.

##### Gateway properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s | The category of the Gateway (corresponds to which OSI layer does the Proxy operates at). | **Enum**: network, application, data, other |
| 

`function` \*

 | `array` of `string`s | The function of the Gateway | **Enum**: routing, nat, api-gateway, content-filtering, content-distribution, load-balancing, firewall, ssl-termination, reverse-proxy, remote-access-gateway, application-protection, intrusion-detection, intrusion-prevention, mail-filtering, malware-protection, other |
| 

`public` \*

 | `boolean` | Indicates if the Gateway is open to public access |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `function`
-   `public`

---

Source: /data-model/schemas/GraphObject

# GraphObject

Standard metadata properties of a graph object, maintained by the system. These are visible to users but may not be directly modified.

##### GraphObject properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`

---

Source: /data-model/schemas/Group

# Group

A defined, generic group of Entities. This could represent a group of Resources, Users, Workloads, DataRepositories, etc.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Host

# Host

A Host represents a computer, virtual machine, or other device that can run software and connect to a network.

##### Host properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` | The host category  
  
**Examples**: server, endpoint, storage-media, mobile, network, other |  |
| 

`deviceId` \*

 | 

`array` of `string`s

**|** `null` | The unique device identifier, traditionally known as a UDID |  |
| 

`displayName` \*

 | `string` | The display name of the host |  |
| 

`fqdn` \*

 | 

`array` of `string`s

**|** `null` | The fully qualified domain name of the Device |  |
| 

`hostname` \*

 | `string` **|** `null` | The primary/local hostname |  |
| 

`ipv4Addresses` \*

 | 

`array` of `string`s

**|** `null` | The IPv4 Addresses associated with the Device |  |
| 

`ipv6Addresses` \*

 | 

`array` of `string`s

**|** `null` | The IPv6 Addresses associated with the Device |  |
| 

`lastSeenOn` \*

 | `integer` **|** `null` | The timestamp (in milliseconds since epoch) when the host was either last checked in or was scanned. |  |
| 

`macAddresses` \*

 | 

`array` of `string`s

**|** `null` | The MAC Addresses associated with the Device, lowercase colon delimited |  |
| 

`make` \*

 | `string` **|** `null` | Same as hardwareVendor: The manufacturer or vendor of the host, e.g. Apple Inc., Generic |  |
| 

`model` \*

 | `string` **|** `null` | Same as hardwareModel: The host hardware model, e.g. MacBookPro13,3 |  |
| 

`osDetails` \*

 | `string` **|** `null` | Human readable details of the operating system, such as edition, service pack or code name (e.g. Microsoft Windows Server 2022 (64-bit) Enterprise, macOS Sequoia 15.1.1 (24B91)) |  |
| 

`osName` \*

 | `string` **|** `null` | The proper name of the operating system, without version (e.g. Microsoft Windows, macOS, Ubuntu Linux, Red Hat Enterprise Linux) |  |
| 

`osType` \*

 | `string` **|** `null` | The classification of the operating system |  |
| 

`osVersion` \*

 | `string` **|** `null` | The version of the operating system, ideally semver-ish (e.g. 20.04.3 LTS, 10.0.19045.3803) |  |
| 

`privateIpAddresses` \*

 | 

`array` of `string`s

**|** `null` | The private IP addresses associated with the Device |  |
| 

`publicIpAddresses` \*

 | 

`array` of `string`s

**|** `null` | The public IP addresses associated with the Device |  |
| 

`serial` \*

 | `string` **|** `null` | Same as hardwareSerial: The host serial number |  |
| `osKernel` | `string` **|** `null` | The version of the kernel running on the system (e.g. 5.15.0-91-generic, 4.18.0-513.5.1.el8\_9.x86\_64, 24.1.0, 10.0.22631) |  |
| `public` | `boolean` **|** `null` | Indicates if the host is publicly accessible from the internet | **default**: false |
| `status` | `string` **|** `null` | Status label of this device |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `ipv4Addresses`
-   `ipv6Addresses`
-   `macAddresses`
-   `publicIpAddresses`
-   `privateIpAddresses`
-   `hostname`
-   `fqdn`
-   `serial`
-   `deviceId`
-   `lastSeenOn`
-   `make`
-   `model`
-   `osName`
-   `osType`
-   `osDetails`
-   `osVersion`

---

Source: /data-model/schemas/HostAgent

# HostAgent

A software agent or sensor that runs on a host/endpoint.

##### HostAgent properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`function` \*

 | `array` of `string`s | The function of sensor/agent | **Enum**: endpoint-compliance, endpoint-configuration, endpoint-protection, anti-malware, DLP, FIM, host-firewall, HIDS, log-monitor, activity-monitor, vulnerability-detection, container-security, other |
| 

`lastSeenOn` \*

 | `number` **|** `null` | The timestamp (in milliseconds since epoch) when the device either last checked in or was scanned. | 

**Format**: `date-time`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `function`
-   `lastSeenOn`

---

Source: /data-model/schemas/Image

# Image

A system image. For example, an AWS AMI (Amazon Machine Image).

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Incident

# Incident

An operational or security incident. An event that negatively affects the confidentiality, integrity or availability of an organization's assets.

##### Incident properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` | The category of the incident  
  
**Examples**: 1. General Incident, 2. Attack on Internal Facing Assets, 3. Attack on External Facing Assets, 4. Malware, 5. Social Engineering, 6. Data Breach, 7. Physical or Environmental |  |
| 

`reportable` \*

 | `boolean` | Indicates if this is a reportable incident per applicable regulations, such as HIPAA, PCI, or GDPR. | **default**: false |
| 

`severity` \*

 | `string` | Severity rating based on impact. Can be a string such as 'critical', 'major', 'minor', or an integer usually between 1-3. |  |
| `impacts` | `array` of `string`s | The target listing of \[IDs/keys to\] systems and resources this incident impacts. |  |
| `postmortem` | `string` | Summary and/or a link to the documented lesson learned. |  |
| `reporter` | `string` | The person/entity who reported this incident. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `severity`
-   `reportable`

---

Source: /data-model/schemas/Internet

# Internet

The Internet node in the graph. There should be only one Internet node.

##### Internet properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `CIDR` | `string` | The IPv4 network CIDR block | **const**: 0.0.0.0/0 |
| `CIDRv6` | `string` | The IPv6 network CIDR block | **const**: ::/0 |
| `displayName` | `string` | Display name | **const**: Internet |
| `public` | `boolean` | Indicates if the network is open to public access | **const**: true |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`

---

Source: /data-model/schemas/IpAddress

# IpAddress

An re-assignable IpAddress resource entity. Do not create an entity for an IP Address _configured_ on a Host. Use this only if the IP Address is a reusable resource, such as an Elastic IP Address object in AWS.

##### IpAddress properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`ipAddress` \*

 | `string` | The assigned IP address | 

**Format**: `ip`

  
 |
| `dnsName` | `string` | The assigned DNS name | 

**Format**: `hostname`

  
 |
| `ipVersion` | `integer` | Indicates IP version 4 or 6 | **default**: 4, **enum**: 4, 6 |
| `privateIpAddress` | `string` | The assigned private IP address | 

**Format**: `ip`

  
 |
| `publicIpAddress` | `string` | The assigned public IP address | 

**Format**: `ip`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `ipAddress`

---

Source: /data-model/schemas/IpRange

# IpRange

consecutive set of IP addresses used for network addressing and management.

##### IpRange properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`active` \*

 | `boolean` | Indicates if the IP Range is currently active |  |
| 

`begin` \*

 | `string` | The beginning IP address of the range | 

**Format**: `ip`

  
 |
| 

`end` \*

 | `string` | The ending IP address of the range | 

**Format**: `ip`

  
 |
| 

`public` \*

 | `boolean` | Indicates if the IP Range is public |  |
| `asn` | `string` | Autonomous System Number that identifies a routing policy | 

**Format**: `asn`

  
 |
| `cidr` | `array` of `string`s | An array of CIDRs that determine the IP Range | 

**Format**: `ipCidr`

  
 |
| `country` | `string` | Country where the IP range is registered or assigned |  |
| `source` | `string` | The IP Range source |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `begin`
-   `end`
-   `active`
-   `public`

---

Source: /data-model/schemas/Issue

# Issue

An issue as used by GitHub, Jira, or other project trackers.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Key

# Key

An ssh-key, access-key, api-key/token, pgp-key, etc.

##### Key properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fingerprint` | `string` | The fingerprint that identifies the key |  |
| `material` | `string` | The key material |  |
| `usage` | `string` | The key usage - for example: ssh access or data encryption |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Logs

# Logs

A specific repository or destination containing application, network, or system logs.

##### Logs properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `type` | `string` | The type of logs  
  
**Examples**: network, system, application, access, other |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Model

# Model

A system of postulates, data, and inferences presented as a mathematical description of an entity or state of affairs. For example, a machine learning model.

##### Model properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encrypted` | `boolean` | Indicates whether the model is encrypted | **default**: false |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Module

# Module

A software or hardware module. Such as an npm\_module or java\_library.

##### Module properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `public` | `boolean` | Indicates if this is a public module. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Network

# Network

A network, such as an aws-vpc, aws-subnet, cisco-meraki-vlan.

##### Network properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`CIDR` \*

 | `string` **|** `null` | The IPv4 network CIDR block (e.g. 0.0.0.0/0) | **pattern**: ^(\[0-9\]{1,3}.){3}\[0-9\]{1,3}(/(\[0-9\]|\[1-2\]\[0-9\]|3\[0-2\]))?$ |
| 

`internal` \*

 | `boolean` **|** `null` | Indicates if this is an internal/private network. |  |
| 

`public` \*

 | `boolean` **|** `null` | Indicates if the network is publicly accessible. |  |
| `CIDRv6` | `string` | The IPv6 network CIDR block (e.g. ::/0) | 

**Format**: `ipv6`

  
 |
| `environment` | `string` | The environment of network  
  
**Examples**: development, test, staging, production, private, wireless, guest, remote-access, administrative, other |  |
| `wireless` | `boolean` | Indicates if this is a wireless network. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `CIDR`
-   `public`
-   `internal`

---

Source: /data-model/schemas/NetworkEndpoint

# NetworkEndpoint

A network endpoint for connecting to or accessing network resources. For example, NFS mount targets or VPN endpoints.

##### NetworkEndpoint properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `ipAddress` | `string` | The endpoint IP address | 
**Format**: `ip`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/NetworkInterface

# NetworkInterface

An re-assignable software defined network interface resource entity. Do not create an entity for a network interface _configured_ on a Host. Use this only if the network interface is a reusable resource, such as an Elastic Network Interface object in AWS.

##### NetworkInterface properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dnsName` | `string` | The assigned DNS name | 
**Format**: `hostname`

  
 |
| `ipAddress` | `string` | The assigned primary IP address | 

**Format**: `ip`

  
 |
| `ipVersion` | `integer` | Indicates IP version 4 or 6 | **default**: 4, **enum**: 4, 6 |
| `macAddress` | `string` **|** `null` | The assigned MAC address |  |
| `privateIpAddress` | `string` | The assigned private IP address | 

**Format**: `ip`

  
 |
| `publicIpAddress` | `string` | The assigned public IP address | 

**Format**: `ip`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/NHI

# NHI

A non-human identity (NHI) — any digital identity that is not a person, such as a service account, machine credential, secret, OAuth app, bot, certificate, API key, webhook, or CI/CD identity. NHIs are typically used by software, automation, or workloads to access systems and services.

##### NHI properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiConfidence` | `string` | Confidence that this NHI is AI-related. 'confirmed' = signed evidence; 'high'/'medium'/'low' = heuristic strength. | **enum**: confirmed, high, medium, low |
| `aiPlatform` | `string` | The AI platform or vendor this NHI belongs to (e.g. 'openai', 'anthropic', 'google-vertex'). Open string — new platforms appear constantly. |  |
| `isAi` | `boolean` | Whether this NHI is associated with an AI agent, model, or AI-powered workload. |  |
| `nhiOwnerStatus` | `string` | Ownership state used by governance triage workflows. | **enum**: assigned, unassigned, orphaned |
| `nhiType` | `string` | The category of non-human identity. | **enum**: service\_account, credential, secret, oauth\_app, bot, certificate, api\_key, webhook, ci\_cd\_identity, service\_linked\_role, service\_role, workload\_identity, ci\_cd\_role, cross\_account\_role, sso\_role, federated\_role, iam\_role |
| `owner` | `string` | Identifier of the human or team responsible for this NHI (e.g. email, team handle, employee ID). Free-form string — owner-resolution conventions are integration-specific. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Organization

# Organization

An organization, such as a company (e.g. JupiterOne) or a business unit (e.g. HR). An organization can be internal or external. Note that there is a more specific Vendor class.

##### Organization properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_type` \*

 | `string` | The type of organization (within the context of the primary organization).  
  
**Examples**: company, department, business-unit, subsidiary, government-agency, partner, other |  |
| `emailDomain` | `string` | The domain name for internal organization email addresses. |  |
| `external` | `boolean` | Indicates if this organization is external |  |
| `website` | `string` | The organization's main website URL. | 

**Format**: `uri`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/PasswordPolicy

# PasswordPolicy

A password policy is a specific `Ruleset`. It is separately defined because of its pervasive usage across digital environments and the well known properties (such as length and complexity) unique to a password policy.

##### PasswordPolicy properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `autoUnlockMins` | `integer` | Specifies the time interval (in minutes) a locked account remains locked before it is automatically unlocked (0 indicates no limit) |  |
| `excludeAttributes` | `array` of `string`s | The user profile attributes whose values must be excluded from the password |  |
| `excludeCommonPasswords` | `boolean` | Indicates whether to check passwords against a common/weak password dictionary |  |
| `excludeUsername` | `boolean` | Indicates if the username must be excluded from the password |  |
| `expiryWarningDays` | `integer` | Specifies the number of days prior to password expiration when a user will be warned to reset their password (0 indicates no warning) |  |
| `hardExpiry` | `boolean` | Specifies whether users are prevented from setting a new password after their password has expired |  |
| `historyCount` | `integer` | Specifies the number of previous passwords that users are prevented from reusing (0 indicates none) |  |
| `lockoutAttempts` | `integer` | Specifies the number of times users can attempt to log in to their accounts with an invalid password before their accounts are locked (0 indicates no limit) |  |
| `maxAgeDays` | `integer` | Specifies how long (in days) a password remains valid before it expires (0 indicates no limit - passwords do not expire) |  |
| `minAgeMins` | `integer` | Specifies the minimum time interval (in minutes) between password changes (0 indicates no limit) |  |
| `minLength` | `integer` | Minimum password length |  |
| `preventReset` | `boolean` | Indicates if the user is allowed/prevented to change their own password |  |
| `requireLowercase` | `boolean` | Indicates if a password must contain at least one lowercase character |  |
| `requireMFA` | `boolean` | Specifies whether multi-factor authentication (MFA) is required |  |
| `requireNumbers` | `boolean` | Indicates if a password must contain at least one number |  |
| `requireSymbols` | `boolean` | Indicates if a password must contain at least one symbol |  |
| `requireUppercase` | `boolean` | Indicates if a password must contain at least one uppercase character |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Person

# Person

An entity that represents an actual person, such as an employee of an organization.

##### Person properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`email` \*

 | `array` of `string`s | The email addresses of the person; the first one in the array is the primary email. | 

**Format**: `email`

  
 |
| 

`firstName` \*

 | `string` | The person's official first name in the system (such as HR database) |  |
| 

`lastName` \*

 | `string` | The person's official last name in the system (such as HR database) |  |
| `address` | `string` | The person's physical contact address |  |
| `backgroundCheckedBy` | `string` | The agency or person who conducted the background/reference check |  |
| `backgroundCheckedOn` | `number` | Timestamp of the background and/or reference check | 

**Format**: `date-time`

  
 |
| `emailDomain` | `array` of `string`s | The domain portion of the email addresses associated with the user account. |  |
| `employeeId` | `string` | The person's employee ID/number within an organization |  |
| `employeeType` | `string` | The type of employment  
  
**Examples**: employee, contractor, intern, vendor, advisor, other |  |
| `manager` | `string` | Name of the person's manager |  |
| `managerEmail` | `string` | Email of the person's manager | 

**Format**: `email`

  
 |
| `managerId` | `string` | Employee ID of the person's manager |  |
| `middleName` | `string` | The person's official middle name in the system (such as HR database) |  |
| `phone` | `array` of `string`s | The person's phone numbers; the first one in the array is the primary contact number. |  |
| `title` | `string` | The person's role or title within an organization |  |
| `userIds` | `array` of `string`s | One or more user Ids associated with this person |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `firstName`
-   `lastName`
-   `email`

---

Source: /data-model/schemas/Policy

# Policy

A written policy documentation.

##### Policy properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`content` \*

 | `string` | Text content of the policy. For policies/procedures used by the Policy Builder app, this will contain the template text in markdown format. Stored in raw data. |  |
| 

`summary` \*

 | `string` | Summary or overview the describes the policy. Summary text is intended as guidance to the author and not included in the published version. |  |
| 

`title` \*

 | `string` | Title of the policy |  |
| `adopted` | `boolean` | Indicates if policy or procedure has been adopted. Only adopted policies and procedures are included in the published view of the Policy Builder app. |  |
| `applicable` | `boolean` | Indicates if policy or procedure is applicable based on the organization's current risk and compliance needs. A Policy that is not applicable may become applicable later as the organization's requirements and maturity change. |  |
| `author` | `string` | Author of the record |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `title`
-   `summary`
-   `content`

---

Source: /data-model/schemas/Port

# Port

A number assigned to identify a network communication endpoint.

##### Port properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`open` \*

 | `boolean` | Indicates if the port is open or shut communication. |  |
| 

`port` \*

 | `integer` | Port number | **minimum**: 1, **maximum**: 65536 |
| 

`protocol` \*

 | `string` | Communication protocol last observed being used on this port. | **enum**: TCP, UDP, TCP/UDP, UDP/TCP |
| `banner` | `string` | Provides information about the service running on the port. |  |
| `service` | `string` | Indicates the type or protocol of the service running on the port. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `protocol`
-   `open`
-   `port`

---

Source: /data-model/schemas/PR

# PR

A pull request.

##### PR properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`repository` \*

 | `string` | The name of the CodeRepo this PR belongs to. |  |
| 

`source` \*

 | `string` | The source branch. |  |
| 

`state` \*

 | `string` | The state of the PR.  
  
**Examples**: open, merged, declined, superseded |  |
| 

`target` \*

 | `string` | The target/destination branch. |  |
| 

`title` \*

 | `string` | The title text of the PR. |  |
| `approved` | `boolean` | Indicates if every commit associated with this PR has been approved by a reviewer other than the code author. |  |
| `summary` | `string` | The summary text of the PR. |  |
| `validated` | `boolean` | Indicates if every commit associated with this PR was submitted by a validated author known to the organization. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `title`
-   `state`
-   `source`
-   `target`
-   `repository`

---

Source: /data-model/schemas/Problem

# Problem

A problem identified from the analysis and correlation of assets and findings that is a notable issue worthy of action. It could be (or become) the cause, or potential cause, of one or more incidents or findings.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`category` \*

 | `string` **|** `array` **|** `null` | The category of the finding.  
  
**Examples**: data, application, host, network, endpoint, malware, event |  |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| 

`numericSeverity` \*

 | `number` **|** `null` | Severity rating based on impact and exploitability.  
  
**Examples**: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 |  |
| 

`open` \*

 | `boolean` **|** `null` | Indicates if this is an open vulnerability. |  |
| 

`severity` \*

 | `string` **|** `null` | Severity rating based on impact and exploitability.  
  
**Examples**: none, informational, low, medium, high, critical |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `assessment` | `string` **|** `null` | The name/id of the assessment that produced this finding. |  |
| `blocksProduction` | `boolean` **|** `null` | Indicates whether this vulnerability finding is a blocking issue. If true, it should block a production deploy. Defaults to false. |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `exploitability` | `number` **|** `null` | The exploitability score/rating. |  |
| `impact` | `number` **|** `null` | The impact description or rating. |  |
| `priority` | `string` **|** `null` | Priority level mapping to Severity rating. Can be a string such as 'critical', 'high', 'medium', 'low', 'info'. Or an integer usually between 0-5. |  |
| `production` | `boolean` **|** `null` | Indicates if this vulnerability is in production. |  |
| `public` | `boolean` **|** `null` | Indicates if this is a publicly disclosed vulnerability. If yes, this is usually a CVE and the 'webLink' should be set to '[https://nvd.nist.gov/vuln/detail/$\\{CVE-Number\\}](https://nvd.nist.gov/vuln/detail/$%5C%7BCVE-Number%5C%7D)' or to a vendor URL. If not, it is most likely a custom application vulnerability. |  |
| `recommendation` | `string` **|** `null` | Recommendation on how to remediate/fix this finding. Use 'remediationActions' field instead. | **deprecated**: true |
| `references` | `array` **|** `null` | The array of links to references. |  |
| `remediationActions` | `string` **|** `null` | Recommended remediation actions or steps to address a finding, vulnerability or weakness. This field supports markdown formatting for rich text content including links, code blocks, and structured lists. Markdown-formatted text describing remediation steps is preferred. |  |
| `remediationSLA` | `integer` **|** `null` | The number of days that the Vulnerability must be remediated within, based on SLA set by the organization's internal vulnerability management program policy. The actually due date is set by 'remediationDueOn' property on the `IMPACTS` relationship between the Vulnerability and its impacted resource entity. |  |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `score` | `number` **|** `null` | The overall vulnerability score, e.g. CVSSv3. |  |
| `status` | `string` **|** `null` | Status of the vulnerability |  |
| `stepsToReproduce` | `array` **|** `null` | Steps to reproduce this finding. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `targetDetails` | `array` **|** `null` | Additional details about the targets. Can be a string or an array. |  |
| `targets` | `array` **|** `null` | The target listing of projects, applications, repos or systems this vulnerability impacts. Specifying either the project/repo name or the application URL here will auto-map this Vulnerability to the corresponding Project/CodeRepo/Application entity if a match is found. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` **|** `null` | Indicates if this Vulnerability finding has been validated by the security team. |  |
| `vector` | `string` **|** `null` | The vulnerability attack vector. (e.g. a CVSSv3 vector looks like this - 'AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N') |  |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `severity`
-   `numericSeverity`
-   `open`

---

Source: /data-model/schemas/Procedure

# Procedure

A written procedure and control documentation. A Procedure typically `IMPLEMENTS` a parent Policy. An actual Control further `IMPLEMENTS` a Procedure.

##### Procedure properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`content` \*

 | `string` | Text content of the policy. For policies/procedures used by the Policy Builder app, this will contain the template text in markdown format. Stored in raw data. |  |
| 

`summary` \*

 | `string` | Summary or overview the describes the procedure. Summary text is intended as guidance to the author and not included in the published version. |  |
| 

`title` \*

 | `string` | Title of the procedure |  |
| `adopted` | `boolean` | Indicates if procedure has been adopted. Only adopted policies and procedures are included in the published view of the Policy Builder app. |  |
| `applicable` | `boolean` | Indicates if procedure is applicable based on the organization's current risk and compliance needs. A Policy that is not applicable may become applicable later as the organization's requirements and maturity change. |  |
| `author` | `string` | Author of the record |  |
| `control` | `string` | The type of control specified by this procedure.  
  
**Examples**: administrative, technical, physical, operational, other |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `title`
-   `summary`
-   `content`

---

Source: /data-model/schemas/Process

# Process

A compute process -- i.e. an instance of a computer program / software application that is being executed by one or many threads. This is NOT a program level operational process (i.e. a Procedure).

##### Process properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `state` | `string` | Indicates the state of the process. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Product

# Product

A product developed by the organization, such as a software product.

##### Product properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appLink` | `array` of `string`s | App links/URLs related to this product. |  |
| `category` | `string` | Category that defines the product (e.g. 'web', 'mobile'). |  |
| `description` | `string` | Description of the product |  |
| `projectKey` | `array` of `string`s | Project key(s) that reference a Jira project, Bitbucket project, or similar related to this product. |  |
| `statusPage` | `array` of `string`s | Link to the status page of this product (for a SaaS product). |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Program

# Program

A program. For example, a bug bounty/vuln disclosure program.

##### Program properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `overview` | `string` | Program overview. |  |
| `type` | `string` | The type of program. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Project

# Project

A software development project. Can be used for other generic projects as well but the defined properties are geared towards software development projects.

##### Project properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alternateURLs` | `array` of `string`s | The additional URLs related to this application. |  |
| `devURL` | `string` | The Development URL | 
**Format**: `uri`

  
 |
| `key` | `string` | A defined project key. It is ideal for a code project to have a consistent key that matches that of issue tracking project. For example, the key for a Bitbucket project should match the key of its corresponding Jira project. |  |
| `productionURL` | `string` | The Production URL | 

**Format**: `uri`

  
 |
| `stagingURL` | `string` | The Non-Production / Staging URL | 

**Format**: `uri`

  
 |
| `testURL` | `string` | The Test URL | 

**Format**: `uri`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Question

# Question

An object that represents an inquiry, usually around some matter of uncertainty or difficulty.

##### Question properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`queries` \*

 | `array` | A request for information that contributes to answering a question. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `queries`

---

Source: /data-model/schemas/Queue

# Queue

A scheduling queue of computing processes or devices.

##### Queue properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `items` | `array` | The items (processes, devices, jobs, etc.) in the queue |  |
| `priority` | `number` | The priority of the queue |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Record

# Record

A DNS record; or an official record (e.g. Risk); or a written document (e.g. Policy/Procedure); or a reference (e.g. Vulnerability/Weakness). The exact record type is captured in the \_type property of the Entity.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/RecordEntity

# RecordEntity

A node in the graph database that represents a Record Entity, with a set of different defined common properties than standard (resource) entities.

##### RecordEntity properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Repository

# Repository

A repository that contains resources. For example, a Docker container registry repository hosting Docker container images.

##### Repository properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `public` | `boolean` | Indicates if this is a public repo. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Requirement

# Requirement

An individual requirement for security, compliance, regulation or design.

##### Requirement properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`title` \*

 | `string` | The title text of the requirement. |  |
| `state` | `string` | The state of the requirement (e.g. 'implemented'). |  |
| `summary` | `string` | The summary text of the requirement. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `title`

---

Source: /data-model/schemas/Resource

# Resource

A generic assignable resource. A resource is typically non-functional by itself unless used by or attached to a host or workload.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Review

# Review

A review record.

##### Review properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`title` \*

 | `string` | The title text of the review. |  |
| `state` | `string` | The state of the review. |  |
| `summary` | `string` | The summary text of the review. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `title`

---

Source: /data-model/schemas/Risk

# Risk

An object that represents an identified Risk as the result of an Assessment. The collection of Risk objects in JupiterOne make up the Risk Register. A Control may have a `MITIGATES` relationship to a Risk.

##### Risk properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`impact` \*

 | `integer` | Impact rating. '3: high/severe', '2: medium/moderate', '1: low/minor', '0: none/insignificant'.  
  
**Examples**: 0, 1, 2, 3 |  |
| 

`probability` \*

 | `integer` | Probability rating of the risk: '3: high/certain', '2: medium/likely', '1: low/unlikely', '0: none/negligible'.  
  
**Examples**: 0, 1, 2, 3 |  |
| 

`score` \*

 | `integer` | Overall Risk Score = Probability x Impact |  |
| 

`status` \*

 | `string` | Current status of this documented risk. Default status is `open`.  
  
**Examples**: reported, acknowledged, accepted, mitigated, prioritized, transferred, pending, open |  |
| `assessment` | `string` | The name/id of the assessment that produced this risk. |  |
| `category` | `string` | The category (or area) of the risk. For example, 'process maturity' or 'natural disaster'. |  |
| `details` | `string` | Additional details to describe the risk. |  |
| `mitigation` | `string` | Description of the mitigation, either planned or implemented, if applicable. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `probability`
-   `impact`
-   `score`
-   `status`

---

Source: /data-model/schemas/Root

# Root

The root node in the graph. There should be only one Root node per organization account.

##### Root properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `displayName` | `string` | Display name |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`

---

Source: /data-model/schemas/Rule

# Rule

An operational or configuration compliance rule, often part of a Ruleset.

##### Rule properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `string` | The category of ruleset.  
  
**Examples**: compliance, config, password, other |  |
| `content` | `string` | Contents of the rule, if applicable. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Ruleset

# Ruleset

An operational or configuration compliance ruleset with rules that govern (or enforce, evaluate, monitor) a security control or IT system.

##### Ruleset properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `string` | The category of ruleset.  
  
**Examples**: compliance, config, password, other |  |
| `content` | `string` | Contents of the raw rules, if applicable. |  |
| `rules` | `array` of `string`s | Rules of ruleset. Each rule is written 'as-code' that can be operationalized with a control provider or within JupiterOne's rules engine. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Scanner

# Scanner

A system vulnerability, application code or network infrastructure scanner.

##### Scanner properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s | The category of scanner | **Examples**: system, network, application, other |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`

---

Source: /data-model/schemas/Secret

# Secret

A stored encrypted secret, accessed by permitted users or applications.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Section

# Section

An object to represent a section such as a compliance section.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Service

# Service

A service provided by a vendor.

##### Service properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s | The category of service, e.g. software, platform, infrastructure, other | **Examples**: software, platform, infrastructure, physical, network, application, security, other |
| 

`function` \*

 | `array` of `string`s | The functions provided by the service, e.g. access-review, database, load-balancing, other | **Examples**: access-review, api-gateway, auditing, caching, certificate-management, config-auditing, content-distribution, container-orchestration, container-registry, compute, database, data-analytics, data-warehousing, ddos-protection, desktop-virtualization, DLP, DNS, email, encryption, file-system, IAM, indexing, key-management, kubernetes-management, load-balancing, logging, monitoring, networking, notification, password-management, provisioning, queuing, scheduling, serverless, SFTP, SIEM, storage, VAS, WAF, workflow, workload-management, other |
| `endpoints` | `array` of `string`s | Array of service endpoints, e.g. ec2.amazonaws.com |  |
| `fedrampModerate` | `boolean` | Indicates whether this service is compliant with FedRAMP Moderate |  |
| `hipaaEligible` | `boolean` | Indicates whether this service is HIPPA eligible |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`
-   `function`

---

Source: /data-model/schemas/Site

# Site

The physical location of an organization. A Person (i.e. employee) would typically has a relationship to a Site (i.e. located\_at or work\_at). Also used as the abstract reference to AWS Regions.

##### Site properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `array` of `string`s | Type of site | **Examples**: headquarters, branch, campus, office, aws-region, data-center, lab, other |
| `hours` | `string` | Hours of operation. e.g. M-F 9am-6pm |  |
| `location` | `string` | The address/location of the site. Or an AWS Region (e.g. us-east-2). |  |
| `restricted` | `boolean` | Indicates that access to the site is restricted (a level above secured access). |  |
| `secured` | `boolean` | Indicates the site is secured with physical controls such as key card access and surveillance cameras. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Standard

# Standard

An object to represent a standard such as a compliance or technical standard.

##### Standard properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` | The name of the standard.  
  
**Examples**: HIPAA, NIST, CSA STAR, PCI DSS, NIST CSF, FedRAMP, ISO 27001, SOC, OWASP, Other |  |
| 

`version` \*

 | `string` | The version of the standard. For example, OWASP may have version 2010, 2013, 2017. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `version`

---

Source: /data-model/schemas/Subscription

# Subscription

A subscription to a service or channel.

##### Subscription properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authenticated` | `boolean` | Indicates whether the subscription is authenticated. |  |
| `pending` | `boolean` | Indicates whether the subscription is pending. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Task

# Task

A computational task. Examples include AWS Batch Job, ECS Task, etc.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Team

# Team

A team consists of multiple member Person entities. For example, the Development team or the Security team.

##### Team properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `email` | `string` | The team email address | 
**Format**: `email`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/ThreatIntel

# ThreatIntel

Threat intelligence captures information collected from vulnerability risk analysis by those with substantive expertise and access to all-source information. Threat intelligence helps a security professional determine the risk of a vulnerability finding to their organization.

##### ThreatIntel properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `references` | `array` of `string`s | The array of links to references. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Training

# Training

A training module, such as a security awareness training or secure development training.

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `category` | `string` | The category of the official record  
  
**Examples**: exception, finding, hr, incident, issue, job, legal, request, policy, procedure, problem, review, risk, other |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `open` | `boolean` | Indicates if this record is currently open. For example, an open Vulnerability finding (Vulnerability extends Record). |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/User

# User

A user account/login to access certain systems and/or services. Examples include okta-user, aws-iam-user, ssh-user, local-user (on a host), etc.

##### User properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`email` \*

 | 

`array` of `string`s

**|** `null` | The primary email address associated with the user account |  |
| 

`firstName` \*

 | `string` **|** `null` | The user's official first name in the system (such as HR database) |  |
| 

`lastName` \*

 | `string` **|** `null` | The user's official last name in the system (such as HR database) |  |
| 

`shortLoginId` \*

 | 

`array` of `string`s

**|** `null` | The shortened login Id. For example, if the username is the full email address ([first.last@company.com](mailto:first.last@company.com)), the shortLoginId would be the part before @ (first.last). |  |
| 

`username` \*

 | 

`array` of `string`s

**|** `null` | Username |  |
| `active` | `boolean` | Prefer property 'isActive' | **deprecated**: true |
| `emailDomain` | 

`array` of `string`s

**|** `null` | The domain portion of the email addresses associated with the user account. |  |
| `employeeId` | `string` | The employee ID associated with the user account |  |
| `isActive` | `boolean` | Specifies whether user account is active or disabled. |  |
| `isAdmin` | `boolean` | Specifies whether the user is an admin user. |  |
| `isGuest` | `boolean` | Indicates whether the user is a guest is the system. A guest user is often a user outside of the organization who has limited or temporary access to the system. |  |
| `isMfaEnabled` | `boolean` | Specifies whether multi-factor authentication (MFA) is enabled for this user. |  |
| `isPerson` | `boolean` | Specifies whether the user is a person or a non-human identity. |  |
| `mfaEnabled` | `boolean` | Prefer property 'isMfaEnabled' | **deprecated**: true |
| `mfaType` | `string` | Specifies what type of multi-factor authentication (MFA) is being used by this user. |  |
| `passwordChangedOn` | `number` | The timestamp (in milliseconds since epoch) of when the user's password was last rotated for this particular account. | 

**Format**: `date-time`

  
 |
| `userIds` | `array` of `string`s | The user IDs associated with the user account | **uniqueItems**: true, |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `firstName`
-   `lastName`
-   `email`
-   `shortLoginId`
-   `username`

---

Source: /data-model/schemas/UserGroup

# UserGroup

A user group, typically associated with some type of access control, such as a group in Okta or in Office365. If a UserGroup has an access policy attached, and all member Users of the UserGroup would inherit the policy.

##### UserGroup properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `email` | `string` | The group email address | 
**Format**: `email`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Vault

# Vault

A collection of secrets such as a key ring

##### Vault properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` | Name of the vault |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Vendor

# Vendor

An external organization that is a vendor or service provider.

##### Vendor properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `array` | The category of vendor.  
  
**Examples**: business-operations, cloud, facilities, finance, infrastructure, legal, purchasing, security, software, platform-development, platform-social-media, professional-services-staffing, professional-services-recruiting, professional-services-consulting, generic-service-provider, generic-subscription, CSP, ISP, MSP, MSSP, IdP, other |  |
| `admins` | `array` of `string`s | List of admin users to the vendor account, if applicable. If this vendor account is integrated directly to JupiterOne and its data is ingested, the admin users should be already mapped as User entities. |  |
| `alternateContactAddress` | `string` | Alternate/secondary physical/mailing address of the vendor. |  |
| `alternateContactEmail` | `string` | Email of the vendor's alternate/secondary point of contact person. | 

**Format**: `email`

  
 |
| `alternateContactName` | `string` | The vendor's alternate/secondary point of contact person. |  |
| `alternateContactPhone` | `string` | Phone number of the vendor's alternate/secondary point of contact person. |  |
| `alternateContactTitle` | `string` | The title of the vendor's alternate/secondary point of contact. For example, 'CISO'. |  |
| `breachResponseDays` | `integer` | The number of days the vendor agrees to report an identified data breach, per vendor agreement and/or SLA. This is typically 3 to 30 days. Note that GDPR requires breach notification within 3 days / 72 hours. |  |
| `departments` | `array` of `string`s | List of business departments the vendor provides service for (e.g. IT, HR, Finance, Marketing, Development/Engineering, Security). |  |
| `emailDomain` | `string` | The email domain for the vendor (e.g. @jupiterone.io). |  |
| `linkToBAA` | `string` | Link to Business Associate Agreement (BAA) document - for HIPAA only. | 

**Format**: `uri`

  
 |
| `linkToDPA` | `string` | Link to GDPR Data Processing Addendum (DPA) document - for GDPR only. | 

**Format**: `uri`

  
 |
| `linkToISA` | `string` | Link to the external information security assessment (ISA) report. | 

**Format**: `uri`

  
 |
| `linkToMSA` | `string` | Link to Master Service Agreement (MSA) document. | 

**Format**: `uri`

  
 |
| `linkToNDA` | `string` | Link to Non-Disclosure Agreement (NDA) document. | 

**Format**: `uri`

  
 |
| `linkToSLA` | `string` | Link to Service Level Agreement (SLA) document. | 

**Format**: `uri`

  
 |
| `linkToVTR` | `string` | Link to the external vendor technology risk (VTR) report. | 

**Format**: `uri`

  
 |
| `mainContactAddress` | `string` | Main physical/mailing address of the vendor. |  |
| `mainContactEmail` | `string` | Email of the vendor's point of contact person. | 

**Format**: `email`

  
 |
| `mainContactName` | `string` | The vendor's point of contact person. |  |
| `mainContactPhone` | `string` | Phone number of the vendor's point of contact person. |  |
| `mainContactTitle` | `string` | The title of the vendor's main point of contact. For example, 'Manager of Operations'. |  |
| `statusPage` | `string` | Link to the vendor's service status page (e.g. [https://status.aws.amazon.com/](https://status.aws.amazon.com/)). | 

**Format**: `uri`

  
 |
| `validatedOn` | `number` | The timestamp (in milliseconds since epoch) of when this vendor was last validated per the vendor management policy. | 

**Format**: `date-time`

  
 |
| `website` | `string` | The vendor's main website URL. | 

**Format**: `uri`

  
 |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `category`

---

Source: /data-model/schemas/Vulnerability

# Vulnerability

A security vulnerability identified by a Common Vulnerabilities and Exposures (CVE) identifier. A single vulnerability may relate to multiple findings and impact multiple resources. The IMPACTS relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The IMPACTS relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc.

##### Vulnerability properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cveId` \*

 | `string` **|** `null` | The Common Vulnerabilities and Exposures (CVE) identifier of the vulnerability as a string, formatted exactly as CVE-YYYY-NNNN (where YYYY is the 4-digit year and NNNN is a sequence of at least 4 digits). This field must contain only the CVE ID with no additional text or details. For example, CVE-2021-44228 is valid, but CVE-2021-44228 (YOKOGAWA) is invalid. |  |
| 

`open` \*

 | `boolean` **|** `null` | Indicates whether the CVE vulnerability is currently open (unresolved) against the entity. This boolean field is true when the vulnerability is active and false when it is resolved or no longer applicable. If the open status is not provided, it defaults to true. | **default**: true |
| `blocking` | `boolean` **|** `null` | Indicates whether this vulnerability finding is a blocking issue. If true, it should block a production deploy. Defaults to false. | **default**: false |
| `category` | `string` **|** `null` | The category of the vulnerability finding  
  
**Examples**: application, system, infrastructure, other |  |
| `exploitability` | `number` **|** `null` | The exploitability score/rating. |  |
| `impact` | `number` **|** `null` | The impact score/rating. |  |
| `impacts` | `array` **|** `null` | The target listing of projects, applications, repos or systems this vulnerability impacts. Specifying either the project/repo name or the application URL here will auto-map this Vulnerability to the corresponding Project/CodeRepo/Application entity if a match is found. |  |
| `priority` | `string` **|** `null` | Priority level mapping to Severity rating. Can be a string such as 'critical', 'high', 'medium', 'low', 'info'. Or an integer usually between 0-5. |  |
| `production` | `boolean` **|** `null` | Indicates if this vulnerability is in production. |  |
| `public` | `boolean` **|** `null` | Indicates if this is a publicly disclosed vulnerability. If yes, this is usually a CVE and the 'webLink' should be set to '[https://nvd.nist.gov/vuln/detail/$\\{CVE-Number\\}](https://nvd.nist.gov/vuln/detail/$%5C%7BCVE-Number%5C%7D)' or to a vendor URL. If not, it is most likely a custom application vulnerability. |  |
| `references` | `array` **|** `null` | The array of links to references. |  |
| `remediationSLA` | `integer` **|** `null` | The number of days that the Vulnerability must be remediated within, based on SLA set by the organization's internal vulnerability management program policy. The actually due date is set by 'remediationDueOn' property on the `IMPACTS` relationship between the Vulnerability and its impacted resource entity. |  |
| `score` | `number` **|** `null` | The overall vulnerability score, e.g. CVSSv3. |  |
| `severity` | `string` **|** `null` | Severity rating based on impact and exploitability. Can be a string such as 'critical', 'high', 'medium', 'low', 'info'. Or an integer usually between 0-5. |  |
| `status` | `string` **|** `null` | Status of the vulnerability |  |
| `validated` | `boolean` **|** `null` | Indicates if this Vulnerability finding has been validated by the security team. |  |
| `vector` | `string` **|** `null` | The vulnerability attack vector. (e.g. a CVSSv3 vector looks like this - 'AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N') |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `open`
-   `cveId`

---

Source: /data-model/schemas/Weakness

# Weakness

A security weakness identified by a Common Weakness Enumeration (CWE) identifier.

##### Weakness properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cweId` \*

 | `string` **|** `null` | The Common Weakness Enumeration (CWE) identifier of the weakness as a string formatted exactly as CWE-NNN, where NNN is one or more digits. This field must contain only the CWE ID with no additional text or context. For example, CWE-117 is valid, but 'cwe-117: FeedbackSubmit.java (Line: 142)' is invalid. |  |
| 

`open` \*

 | `boolean` | Indicates whether the CWE weakness is currently open (unresolved) against the entity. This boolean field is true when the weakness is active and false when it is resolved or no longer applicable. If the open status is not provided, it defaults to true. | **default**: true |
| `category` | `string` | The category of the vulnerability finding  
  
**Examples**: application, system, infrastructure, other |  |
| `exploitability` | `string` | Indicates the likelihood of exploit. |  |
| `references` | `array` of `string`s | The array of links to references. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `approved` | `boolean` | If this is record has been reviewed and approved. |  |
| `approvedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was approved. | 

**Format**: `date-time`

  
 |
| `approvers` | `array` of `string`s | The list of approvers on the record. |  |
| `classification` | `string` | The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.  
  
**Examples**: critical, confidential, internal, public |  |
| `content` | `string` | Text content of the record/documentation |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `exception` | `boolean` | Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved. |  |
| `exceptionReason` | `string` | Reason / description of the exception. |  |
| `production` | `boolean` | If this is a production record. For example, a production change management ticket would have this set to `true`, and have a `category` = `change` property. Another example would be a Vulnerability finding in production. |  |
| `public` | `boolean` | If this is a public record. Defaults to false. | **default**: false |
| `reportedOn` | `number` | The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as `createdOn` but occasionally a record can be created at a different time than when it was first reported. | 

**Format**: `date-time`

  
 |
| `reporter` | `string` | The person or system that reported or created this record. |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `webLink` | `string` | Hyperlink to the location of this record, e.g. URL to a Jira issue | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`
-   `open`
-   `cweId`

---

Source: /data-model/schemas/Workflow

# Workflow

A workflow such as an AWS CodePipeline, GitHub repository workflow, or Apache Airflow.

##### Workflow properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` | Name of the workflow |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /data-model/schemas/Workload

# Workload

A virtual compute instance, it could be an aws-ec2-instance, a docker-container, an aws-lambda-function, an application-process, or a vmware-instance. The exact workload type is described in the \_type property of the Entity.

##### Workload properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fqdn` | `string` | The fully qualified domain name of attached to the instance, if applicable |  |
| `image` | `string` | The image this workload is derived from, such as an AMI or docker image. At the abstract level, this usually maps to the \_id of a Resource. |  |

##### Inherited properties

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_class` \*

 | `string` **|**

`array` of `string`s

 | One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '\_class':'Host'. |  |
| 

`_key` \*

 | `string` | An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role. | **minLength**: 10 |
| 

`_type` \*

 | `string` | The type of object, typically reflecting the vendor and resource type. For example, 'aws\_iam\_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user\_endpoint' or 'cve'. | **minLength**: 3 |
| 

`displayName` \*

 | `string` | Display name, e.g. a person's preferred name or an AWS account alias |  |
| 

`name` \*

 | `string` | Name of this entity |  |
| `active` | `boolean` | Indicates if this entity is currently active. |  |
| `classification` | `string` **|** `null` | The sensitivity of the data; should match company data classification scheme  
  
**Examples**: critical, confidential, internal, public |  |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. | **minimum**: 0, **maximum**: 1 |
| `createdBy` | `string` | The source/principal/user that created the entity |  |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. | 

**Format**: `date-time`

  
 |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |  |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. | 

**Format**: `date-time`

  
 |
| `description` | `string` | An extended description of this entity. |  |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |  |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. | 

**Format**: `date-time`

  
 |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. | 

**Format**: `date-time`

  
 |
| `id` | `string` **|** `array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |  |
| `notes` | `array` of `string`s | User provided notes about this entity |  |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |  |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |  |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned  
  
**Examples**: active, inactive, suspended, terminated, open, closed, pending, unknown, other |  |
| `summary` | `string` | A summary / short description of this entity. |  |
| `tags` | `array` of `string`s | An array of unnamed tags |  |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |  |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. | **minimum**: 1, **maximum**: 10 |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |  |
| `updatedBy` | `string` | The source/principal/user that updated the entity |  |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. | 

**Format**: `date-time`

  
 |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |  |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. | 

**Format**: `uri`

  
 |

##### Required properties

-   `_key`
-   `_class`
-   `_type`
-   `name`
-   `displayName`

---

Source: /features/admin/access-controls

# Role-Based Access Control (RBAC)

## Table of Contents

-   [Overview](#overview)
-   [Components of RBAC](#components-of-rbac)
    -   [Data Layer RBAC](#data-layer-rbac)
    -   [Resource RBAC](#resource-rbac)
    -   [App Level Permissions](#app-level-permissions)
-   [Managing User Groups](#managing-user-groups)
-   [Troubleshooting](#troubleshooting)

## Overview

JupiterOne provides a comprehensive role-based access control (RBAC) system that allows administrators to manage user access across the platform. The system is designed to provide granular control over:

-   What data users can access
-   What resources they can manage
-   What features they can use

> **NOTE**
> 
> All JupiterOne accounts have access to RBAC features. The system is designed to be flexible enough to support both simple and complex permission requirements.

## Components of RBAC

The RBAC system consists of three main components that work together to provide comprehensive access control:

1.  **Data Layer RBAC** - Controls what data users can access when writing J1QL queries or viewing dashboards
2.  **Resource RBAC** - Manages CRUD permissions for major resource types (Integrations, Rules, Dashboards)
3.  **App Level Permissions** - Controls read/write access to application components

### Data Layer RBAC

Data Layer RBAC allows administrators to restrict what data users can access when writing J1QL queries or viewing dashboards. This is configured through query policies that filter data based on:

-   Entity class
-   Entity type
-   Integration class
-   Integration type
-   Any other properties that are queryable on an entity

#### Where Query Policies Apply

Query policies filter the J1QL a user runs on demand. Some features run queries on their own or show stored results, and they handle query policies differently:

-   **Alert rules**: Rules run with account-wide access. A rule's scheduled run isn't tied to the user who created or last edited it, and no query policy is applied to its J1QL. This covers everything the rule produces: its stored evaluation results, its alert counts, and the data passed to its actions (Slack, email, webhooks, ticketing, and so on).
-   **Stored rule results**: Stored evaluation results are shown as they were captured. They aren't filtered by the viewer's query policy. Resource RBAC controls who can see a rule's results, based on whether the viewer can access that rule or its resource group. Access isn't controlled row by row.
-   **Trend widgets**: Trend widgets filter the results they show by the viewer's query policy. Admins can turn this filtering off for an individual widget. Filtering works by matching the policy's properties against each returned row, so queries that aggregate or that return renamed properties may not filter the way you expect.
-   **Questions**: Question results aren't filtered by query policy, including question widgets on dashboards.

> **NOTE**
> 
> If some users shouldn't see sensitive data, use Resource RBAC to stop them from creating or viewing alert rules and questions.

To configure Data Layer RBAC:

1.  Go to **Settings** (the gear icon) **\>** **User Groups**
2.  Select the user group you want to edit
3.  In the Query Policy section, select and add the query type and values for each filter and click **Add**

![Configure Data Layer RBAC](/assets/images/data-layer-rbac-a62299730ebc149fb42f28041a2b15a2.png)

![Data Layer RBAC Query Policy Configuration](/assets/images/data-layer-rbac-query-policy-4ac5b560ce71557c2e27be56da65d34f.png)

If you want to set up queries based on sets of filters that you want to then link by OR logic, create separate permission sets.

### Resource RBAC

Resource RBAC allows administrators to manage CRUD (Create, Read, Update, Delete) permissions for major resource types within JupiterOne:

-   Alerts
-   Collectors
-   Dashboards
-   Integrations
-   Control Frameworks
-   Controls

> **NOTE**
> 
> Resource RBAC has no impact on Data Layer RBAC for resource management. For example, if a user has Resource RBAC permissions to manage an integration, they will be able to do so regardless of their Data Layer RBAC settings.

#### Resource Groups

Resources can be organized into resource groups for easier permission management. A resource group is a collection of resources that logically belong together to meet a specific use case.

![Resource Groups](/assets/images/resource-groups-eaf47541c968e57c4ae3bb7a67a764b6.png)

> **NOTE**
> 
> -   A resource can only be part of a single resource group
> -   Multiple groups can have access to that resource group
> -   _No Resource Group_ is not a resource group itself. You cannot give a group access to all resources that do not have a resource group. You can, however, create a resource group called 'General', and assign resources to that group.

#### Resource RBAC Permissions

You can manage RBAC permissions at the user group level in the settings app. Below are some common use cases:

##### Resource Group Admin

This group can create, read, update, and delete resources within a single resource group.

![Resource Group Admin](/assets/images/resource-group-admin-ffb4e0bd0efba75682c6afb5a88c1735.png)

##### Resource Group Readonly

This group can read resources within a single resource group, but cannot create or update resources. This user will have read access to all future resources that are created within this resource group.

![Resource Group Readonly](/assets/images/resource-group-readonly-2e2bc790bb19d49a71d072a72bbab497.png)

##### Resource Area Admin

This group can read, update, and delete **all** resources as well as create resources within any resource group. They can also create resources outside of resource groups.

![Resource Area Admin](/assets/images/resource-area-admin-dc3a6f8f05207f8cabe11a0937dac8c6.png)

##### Granular Resource Access

This is a group that has access to only a few specific resources. This group cannot create resources because only a resource area admin can create resources outside of resource groups.

![Granular Resource Access](/assets/images/granular-resource-7e2244d3f8bc8620d986c8ce53d552d2.png)

> **NOTE**
> 
> We recommend staying away from granular resource access unless it is very limited in scope. Managing access this way, without resource groups, can become very cumbersome and runs into some system limitations that are set in place.

### App Level Permissions

App Level Permissions manage read and write access to application components that do not currently support Resource RBAC. Each app has two permission levels:

-   **Read-only** - Allows viewing and using the app's features
-   **Admin** - Allows all actions including administrative functions

![App Level Permissions](/assets/images/app-level-permissions-1f5b0a4fc1d49374b79ae73680fa29b3.png)

> **NOTE**
> 
> Admin permissions will allow all actions included in the Read-only permissions for each app.

#### Global Shared Permissions

Some permissions are not bound to a specific app but are relevant to resources that span different apps:

-   **Graph Data** - Used anywhere entity and relationship data is retrieved on demand or when entities/relationships are mutated directly
-   **Questions** - Saved J1QL queries used in the Home page Questions Library and in app for mapping to compliance requirements

> **NOTE**
> 
> The Graph Data permission does not completely restrict the ability to query graph data. You should limit access to graph data through Data Layer RBAC described above.

#### App List and Required Permissions

The following apps are available, along with shared permissions that may be used by features in each app:

> **NOTE**
> 
> You may see a subset of these apps in your settings based on your account subscription level.

-   **Home Page** (the base/root page - `/home`)
    
    > Shared permissions used by this app: **Read / Write Questions** and **Read Graph Data** for access to Questions Library and running J1QL queries respectively. Optionally **Write Graph Data** for editing entities from query results.
    
-   **Assets** (URL ending with `/assets`)
    
    > Shared permissions used by this app: **Read / Write Graph Data** (app is unusable without Read Graph Data, Write Graph Data used for editing entities). **Assets: Admin** is required to view and manage [asset criticality](/features/assets/asset-criticality.md).
    
-   **Policies** (URL ending with `/policies`)
    
    > Shared permissions used by this app: **Read Graph Data** for loading the policy elements and raw data, and **Write Graph Data** for saving changes to the policy entities.
    
-   **Compliance** (URL ending with `/compliance`)
    
    > Shared permissions used by this app: **Read Graph Data** for expanding queries used as evidence to view results, **Read / Write Questions** for editing the questions used in this app.
    
-   **Vulnerabilities** (URL ending with `/vulnerabilities`)
    
    > Shared permissions used by this app: **Read Graph Data** (the app shows empty tables without it) and **Write Graph Data** for changing vulnerability lifecycle states. See [Unified Vulnerability Management permissions](/features/vulnerability-management/permissions.md) for the permissions required by each action.
    
-   **Shared: Graph Data**
    
    > Shared permissions used by this app: **Read Graph Data**. App will not function without this permission as it is focused on graph exploration.
    
-   **Shared: Questions**
    
    > Shared permissions used by this app: **Questions**. This gives users access to the question library in JupiterOne.
    

## Managing User Groups

### Creating User Groups

1.  Navigate to the **Settings** menu (the cog icon next to notifications)
2.  Click on **User groups** in the **Admin** section
3.  From the new window select **New group**
4.  Enter the desired **Group name** and **Group description**, and click **Create**
5.  You will be navigated to the Group's **Details** page. From here, you can customize:
    -   Data Layer RBAC policies
    -   Resource RBAC permissions
    -   App Level Permissions
6.  Lastly, to add users to the group, navigate to the Group Members tab and select **Add Member**

![Create and edit user groups within JupiterOne](/assets/images/group-create-edit-f1afdf764efc8ecf48c258309b510e54.png)

### Editing User Groups

1.  Navigate to **Settings > User Groups**
2.  Select the user group from the menu that you wish to edit
3.  Make your desired changes in the Details and/or Group Members sections
4.  Press **Save group**

> **NOTE**
> 
> Changes made to members are saved immediately, only changes made to the user group's details section will need to be manually saved with the Save button. You can also revert accidental changes to a user group by pressing **Reset**.

### Switching User Group Views

Users can be members of multiple groups. You can switch between groups to utilize different permission sets:

1.  Select the profile icon in the side nav
2.  Choose the group listed under **User groups**

![Choosing user permission group in JupiterOne](/assets/images/role-based-changes-13cdfc642119d6a4c91e4d6237db4250.png)

> **NOTE**
> 
> When "All Permissions" is selected, permissions across groups are 'rounded up'. For example, if a user is part of the Administrator group, their edit access from that group would override view permissions in any other group they may be a part of. To swap to the read-only view, they would need to choose a particular group.

## Troubleshooting

### Common Issues

1.  **Users Can't Access Expected Resources**
    
    -   Check if the user is in the correct group
    -   Verify Data Layer RBAC policies are correctly configured
    -   Ensure resource groups are properly assigned
2.  **Resource Group Problems**
    
    -   Confirm resources are assigned to the correct group
    -   Check if resources can only be in one group
    -   Verify group access permissions are properly set

### Getting Help

If you encounter issues with RBAC configuration consult with your JupiterOne account representative

---

Source: /features/admin/admin-settings

# Admin settings

In addition to account settings, JupiterOne workspace admins have additional configuration settings available to them to manage and organize their JupiterOne workspace.

All of the Admin settings can be found in the **Admin** panel in the **Settings** menu (the cog icon) in the top-right of the window.

From within the Admin panel, you can access:

-   Account management
-   Users
-   User groups
-   Security & access
-   Account API tokens
-   Account parameters
-   User API tokens
-   Organizational units
-   Resource groups
-   Audit events
-   Data streaming

### Account Management

The Account Management section provides an overview of your JupiterOne Workspace's account. Here you can find your account usage details, including the breakdown of total entities and billable entities.

![Account Usage graph and billable entity count on JupiterOne](/assets/images/billable-entities-31eb463529f27fc74494c229e8c174a8.png)

You can also access the following information relating to your workspace:

-   Company Logo URL (editable)
-   Display Name (editable)
-   Vanity URL
-   Account ID
-   Owner

### Users

Within the Users section, you can review all current workspace users and manage user access.

#### Invite users

You can invite new users to your JupiterOne workspace by selecting **Invite user**. Provide their email and select the corresponding user group for which you would like them to have access, and click **Send invitation**.

#### Review pending invitations

In addition to inviting new users, you can review outstanding invitations from the Users section. If there are pending invitations, they will be displayed above the User list as illustrated below.

![Pending invites in the JuptierOne Admin User&#39;s section](/assets/images/pending-invites-ca3db719333f76d2be1fd3ec3481664a.png)

Select **Review invitations** within the notification to view the pending invitations. Within the new window, you will find the group member email and invitation send date.

**To revoke an invitation**, click the revoke button next to the invite.

### User groups

From the User Groups tab, you are able to create and manage the user groups within your JupiterOne workspace.

You can find detailed [documentation covering user access and groups here](/features/admin/access-controls.md).

### Security & Access

There are several options for managing your workspace's Access and Security to your JupiterOne workspace.

From within the Security & Access section, you can:

-   **Control Domain Access**: Restrict user workspace access to only allow user emails with particular whitelisted domains.
-   Configure an **IP allowlist**: Restrict the account to a set of source IP addresses, rejecting web app and API traffic from anywhere else. [Read more about the IP allowlist →](/features/admin/ip-allowlist.md)
-   Specify the **Default User Groups**: this determines the user groups assigned to SSO sign-ins that arrive without a `group_names` claim. When the list is empty, these sign-ins fall back to the **Users** group. This behavior is controlled by the **Assign default groups to SSO users without group claims** switch, which is on by default. When you turn it off, a SAML sign-in with no `group_names` claim does not create a new user and does not add or remove any group memberships—useful when there is another source of truth for users and groups.
-   Enable **Single Sign On (SSO)** [Read more about enabling SSO →](/features/admin/saml-sso.md)
-   Enable **Require MFA for non-SSO users**: this requires users that are able to log in with email and password to enroll an Authenticator app to access the JupiterOne workspace.
-   Configure an **Inactivity Timeout**: as an added security measure, you can automatically log users out after a period of inactivity. When a user's session is idle for longer than the configured duration, they are signed out of the JupiterOne workspace and must log in again.
-   Set the **User API token expiration**: define an account-wide maximum lifetime for personal User API Tokens. The limit applies only to newly created tokens—users cannot create a token that expires beyond it, and the create-token dialog caps the expiration accordingly. Existing tokens are unaffected and keep their original expiration. Leaving this unset (or set to no limit) allows tokens up to the standard one-year maximum.

### Account API Tokens

You can manage account-wide API Tokens by navigating to **Settings > Admin > Account API Tokens**. From here, you are able to access, create, and remove API Tokens for your JupiterOne workspace.

Additionally, within this window, JupiterOne displays am API Consumption graph that tracks the total number of invocations on a daily basis.

### Account Parameters

Account parameters allow you to configure and store lengthy values as variables for use within queries and rules. Defining parameters enables users in your JupiterOne workspace to utilize those parameters as shorthand reference to a particular value when querying or creating alerts. [Read more about Parameter configuration here →](/features/admin/parameters.md)

### User API Tokens

Much like Account API Tokens, JupiterOne Admin have the ability to review personal User API Tokens for all users within their JupiterOne workspace. From User Tokens in the Admin panel, you can review and remove all personal API Tokens that have been created by users in your JupiterOne workspace.

---

Source: /features/admin/askj1-ai

# Natural Language search

> **INFO**
> 
> This page has moved. JupiterOne AI capabilities, including natural language search, are now documented in the [JupiterOne AI](/features/jupiterone-ai.md) section.
> 
> For natural language search specifically, see [Natural language search](/features/jupiterone-ai/ai-capabilities.md#natural-language-search).

---

Source: /features/admin/data-streaming

# Data Streaming (J1DS)

JupiterOne Data Streaming (J1DS) streams your JupiterOne data to an Amazon S3 bucket you own, giving you access to it outside JupiterOne. Two streams are available, and each can be enabled on its own:

| Stream | Contents |
| --- | --- |
| **Graph changes** | Entity and relationship changes from your graph |
| **Audit log** | Account activity events — who did what, and when |

Both write to the same bucket under separate prefixes, so you configure the destination once.

## How it Works

**Graph changes.** J1DS captures the graph database transaction logs, gathers the change events, and writes those events to your configured AWS S3 bucket. These events represent the "after" state of any change made to an Entity or Relationship in the graph. The events can be Create, Update, or Delete events.

**Audit log.** J1DS periodically reads your account's activity events and writes them to the same bucket. These are the same records shown under **Settings > Audit Events** in the JupiterOne UI, in a form suited to long-term retention and querying.

## Requirements

-   A JupiterOne account with the J1DS entitlement (covers both streams)
-   Administrator access to your JupiterOne account
-   An Amazon S3 bucket in the required AWS region (shown in the Data Streaming settings page)
-   Your 12-digit AWS Account ID
-   The S3 bucket name

## Configuring Your S3 Bucket Policy

Before enabling data streaming, you must add a bucket policy to your S3 bucket that grants JupiterOne write access. Without this policy, the **Test Connection** step will fail.

The **S3 Bucket Policy** panel on the Data Streaming settings page provides a ready-to-use policy with the correct AWS account ID and role already filled in for your environment. Copy the policy from that panel and replace `<BUCKET_NAME>` with the name of your S3 bucket.

> **INFO**
> 
> The role name `jupiterone-data-streaming` is the same for all deployments — do not change it. This policy grants JupiterOne **write-only** access (`s3:PutObject`) to the `jupiterone/*` prefix in your bucket and requires encrypted transport.

## Enabling Data Streaming

1.  Navigate to **Settings > Data Streaming**.
    
2.  Review the **Setup Instructions** panel on the right — it shows the required AWS region for your S3 bucket.
    
3.  Copy the bucket policy from the **S3 Bucket Policy** panel and apply it to your S3 bucket.
    
4.  Turn on the streams you want:
    
    -   **Stream graph changes** — entity and relationship changes
    -   **Stream audit log** — account activity events
    
    You can enable either, or both. Turning on at least one enables the fields below.
    
5.  Enter your **S3 Bucket Name**.
    
6.  Enter your **AWS Account ID** (12 digits).
    
7.  Check the region confirmation checkbox to confirm your S3 bucket is in the required region.
    
8.  Click **Test Connection** — the test must succeed before you can save.
    
9.  Click **Save**.
    

> **NOTE**
> 
> You must successfully run **Test Connection** before saving for the first time. The Save button is not enabled until the connection test passes.

> **TIP**
> 
> Enabling only the audit log is a supported configuration. Because graph streaming is what requires change capture on your graph database, leaving it off means your account carries none of that overhead while still receiving audit data.

## What Happens When You Enable Data Streaming

-   Data is written to your S3 bucket every few minutes (typically every 5–15 minutes). If there is nothing new, no file is written at all.
-   Only data from the point of enablement forward is captured — there is no historical backfill, for either stream.
-   With **graph changes** on, JupiterOne begins capturing changes to entities and relationships in your graph.
-   With **audit log** on, audit events are exported once they have settled. An event becomes eligible a few minutes after it occurs, so the audit stream trails live activity slightly more than the graph stream does. Nothing is skipped as a result — the delay exists precisely so that events still in flight are not missed.

## Data Partitioning

Each stream writes under its own prefix, with the same partitioning below it:

```text
jupiterone/graph/cdc/accountId=<JUPITERONE_ACCOUNT_ID>/year=<YEAR>/month=<MONTH>/day=<DAY>/time=<TIME_UTC>.jsonl.gz
jupiterone/audit/accountId=<JUPITERONE_ACCOUNT_ID>/year=<YEAR>/month=<MONTH>/day=<DAY>/time=<TIME_UTC>.jsonl.gz
```

Each file is gzip compressed and contains newline-delimited JSON records covering the period since the last export. This partitioning scheme works well with standard discovery tools (e.g. AWS Glue crawler) and allows customers with multiple JupiterOne accounts to collect data into a single target bucket.

Because the two streams occupy separate prefixes, you can grant access to one and not the other, apply different lifecycle rules to each, or crawl them as separate tables.

> **INFO**
> 
> J1DS also writes to `jupiterone/.connection-test`, which is used to test connectivity from the JupiterOne platform to your S3 bucket.

## Data Format

### Graph changes

Each record represents the "after" state of a graph object following a change. Example:

```json
{
    "operation": "u",
    "eventType": "entity",
    "properties": {
        "_scope": "eb4f2fac-e9a1-474d-8859-5f0e5ef90b16",
        "_source": "integration-managed",
        "_key": "slack-user:team_T0129XXXXXX:user_U09B1XXXXXX",
        "_accountId": "j1dev",
        "_type": "slack_user",
        "_class": ["User"],
        "_id": "3e6fa6e5-158d-5f03-8839-a964652b57dc",
        "_deleted": false,
        "_version": 1,
        "_createdOn": 1755879780646,
        "_beginOn": 1759510655079,
        "username": "some.user",
        "email": "some.user@example.com",
        "displayName": "Some User",
        "active": true
    },
    "labels": ["Entity", "User", "slack_user"]
}
```

-   `eventType` — `entity` or `relationship`
-   `operation` — `c` (create), `u` (update), or `d` (delete)
-   `properties` — the full set of properties for the object after the change
-   `labels` — the graph labels (classes and type) for the object

### Audit log

Each record is one activity event. Example:

```json
{
    "id": "c95f969f-9f95-4822-a075-8271156a6f3a",
    "accountId": "j1dev",
    "timestamp": 1787747715680,
    "category": "audit/create",
    "resourceType": "iam:token",
    "resourceId": "9c1019cc-adda-44e8-8923-74ebf3c3e79d",
    "performedByUserId": "someone@example.com",
    "data": {
        "username": "someone@example.com",
        "tokenName": "user-session-566c7868",
        "tokenType": "user-session"
    }
}
```

-   `id` — unique identifier for the event. Use it to deduplicate (see [Known Limitations](#known-limitations))
-   `accountId` — your JupiterOne account, included in the record as well as the path so records stay self-describing when merged across accounts
-   `timestamp` — when the action occurred, in epoch milliseconds
-   `category` — the action, prefixed `audit/`; for example `audit/create`, `audit/update`, `audit/delete`, `audit/authenticate`
-   `resourceType` / `resourceId` — what was acted on
-   `performedByUserId` — who performed it, resolved to an email address where possible. **May be absent**: the field is optional, and events raised by the platform itself rather than by a person carry no user. Treat it as nullable when you define a table schema over these files
-   `data` — event-specific detail; the shape varies by `resourceType`

> **NOTE**
> 
> Records within a single audit file are ordered newest first. Order across files is not guaranteed, so sort by `timestamp` if sequence matters to you.

## Security

-   When configuring J1DS you must provide the bucket name **and** the AWS account that the bucket belongs to. J1DS uses the `expected bucket owner` mechanism when writing, which mitigates S3 bucket hijacking.
-   The bucket policy grants **write-only** access — J1DS cannot read data from your bucket.
-   All data transfer requires encrypted transport (`aws:SecureTransport`).

## Disabling Data Streaming

1.  Navigate to **Settings > Data Streaming**.
2.  Turn off the stream you no longer want — or both.
3.  Click **Save**.

That stream stops and no new data is written for it. Existing data in your S3 bucket is not affected or deleted, and the other stream is unaffected if you left it on.

## Re-enabling Data Streaming

> **WARNING**
> 
> Re-enabling a stream starts fresh. Anything that occurred while it was disabled is **not** retroactively captured. Only new data going forward will be streamed. This applies to both streams.

To re-enable, follow the same steps described in [Enabling Data Streaming](#enabling-data-streaming).

## Known Limitations

1.  Graph change data is written on a best-efforts basis and is designed for "at most once" delivery. The system is tolerant to transient failures but cannot buffer transactions indefinitely.
2.  Audit log data is designed for "at least once" delivery, so an event can appear more than once — for example if an export is retried. Deduplicate on the `id` field, which is stable for a given event.
3.  S3 managed KMS encryption is supported. The `PutObject` calls made by J1DS (including multipart uploads) work with S3 managed KMS encryption keys.
4.  Audit records carry the fields listed under [Data Format](#audit-log). Resource display names and descriptions are not included as separate fields; where available, equivalent detail appears inside `data`.

---

Source: /features/admin/data-streaming-athena-queries

# Querying J1DS Data in Amazon Athena

This page walks through deploying an AWS Glue and Athena infrastructure stack on top of your J1DS S3 bucket and running three SQL query patterns against your JupiterOne entity and relationship change history.

For instructions on enabling J1DS and configuring your S3 bucket, see [Data Streaming (J1DS)](/features/admin/data-streaming.md).

> **NOTE**
> 
> This stack covers the graph change stream (`jupiterone/graph/cdc`) only. The audit log stream writes under `jupiterone/audit` with a different record shape, so it needs its own Glue table and is not created by this template.

## Prerequisites

-   AWS account with permissions to create CloudFormation stacks, Glue databases and tables, Athena workgroups, S3 buckets, and IAM roles
-   AWS CLI v2 installed and configured with credentials for your target account
-   J1DS enabled and streaming to an S3 bucket (see [Data Streaming (J1DS)](/features/admin/data-streaming.md) for setup)
-   The S3 bucket name where J1DS is writing data

## Deploy the Stack

**1\. Download the CloudFormation template:**

[Download the CloudFormation template](/assets/files/j1ds-athena-setup-fcf675926654923f4ab9c25c6dc51a51.yaml)

**2\. Deploy the stack:**

```bash
aws cloudformation deploy \
  --template-file j1ds-athena-setup.yaml \
  --stack-name j1ds-usage-example \
  --parameter-overrides \
    SourceBucketName=YOUR_BUCKET_NAME \
  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM
```

Replace `YOUR_BUCKET_NAME` with your J1DS S3 bucket name.

**3\. Note the stack outputs** — the deploy command prints the Glue database name (`j1ds-usage-example-cdc`) and Athena WorkGroup name (`j1ds-usage-example`). These values appear in every query.

## Verify the Deployment

Run a COUNT query in the Athena console to confirm data is accessible. Open the [Amazon Athena console](https://console.aws.amazon.com/athena/), select the `j1ds-usage-example` workgroup, and run:

```sql
SELECT COUNT(*) FROM "j1ds-usage-example-cdc".entities
WHERE accountid = 'YOUR_ACCOUNT_ID'
  AND year = 2026 AND month = 3;
```

Replace `YOUR_ACCOUNT_ID` with your JupiterOne account ID and adjust `year`/`month` to the current period.

**Expected:** a non-zero row count. If the result is zero, verify that J1DS is streaming (check your S3 bucket for recent `.jsonl.gz` files) and that the `year`/`month` values match files present in the bucket.

> **INFO**
> 
> The `accountid` partition filter is **required** for all queries. Omitting it causes an Athena error, not an empty result — the table uses an injected partition projection that requires a caller-supplied value.
> 
> This is especially important if you stream multiple JupiterOne accounts (e.g., dev and prod) into the same CDC bucket. Each account's data is stored under a separate `accountId=` partition, so the `accountid` filter ensures your query returns results for a single account.

## CDC Schema Reference

### Record Structure

Every row in the `entities` and `relationships` tables corresponds to one CDC event:

| Field | Column | Type | Values |
| --- | --- | --- | --- |
| operation | `operation` | string | `c` (create), `u` (update), `d` (delete) |
| eventType | `eventtype` | string | `entity` or `relationship` |
| properties | `properties` | string (JSON) | JSON blob — access with `json_extract_scalar()` |
| labels | `labels` | array<string> (entities) / string (relationships) | Entity: `["Entity","User","slack_user"]` / Relationship: `"HAS"` |

### Key Properties Fields

The `properties` column is a raw JSON string. Use `json_extract_scalar()` to access individual fields:

| Field | Access Pattern | Description |
| --- | --- | --- |
| `_id` | `json_extract_scalar(properties, '$._id')` | Stable UUID — the entity or relationship identifier |
| `_type` | `json_extract_scalar(properties, '$._type')` | Provider-specific type, e.g., `slack_user`, `aws_s3_bucket` |
| `_class` | `json_extract_scalar(properties, '$._class')` | Abstract class, e.g., `User`, `DataStore` |
| `_beginOn` | `CAST(json_extract_scalar(properties, '$._beginon') AS BIGINT)` | Epoch milliseconds when this version became current |
| `displayName` | `json_extract_scalar(properties, '$.displayName')` | Human-readable name |

## Query: Entity History

Use this query to audit all state changes to a specific entity over time. It returns every CDC event for a single entity ID, ordered chronologically. Replace `YOUR_ENTITY_ID` with the `_id` value of the entity you want to audit.

```sql
SELECT
    year,
    month,
    day,
    operation,                                              -- c=create, u=update, d=delete
    eventtype,                                              -- always 'entity' in this table
    json_extract_scalar(properties, '$._id')          AS entity_id,
    json_extract_scalar(properties, '$._type')        AS entity_type,
    json_extract_scalar(properties, '$._class')       AS entity_class,
    json_extract_scalar(properties, '$.displayName')  AS display_name,
    properties
FROM "j1ds-usage-example-cdc".entities
WHERE accountid = 'YOUR_ACCOUNT_ID'                        -- REQUIRED: injected partition
  AND year  = 2026                                         -- narrow partition range
  AND month = 3                                            -- to reduce bytes scanned
  AND json_extract_scalar(properties, '$._id') = 'YOUR_ENTITY_ID'  -- replace with your entity _id
ORDER BY year, month, day;
```

### Example Output

| year | month | day | operation | entity\_type | entity\_class | display\_name |
| --- | --- | --- | --- | --- | --- | --- |
| 2026 | 3 | 17 | c | slack\_user | User | Alice Johnson |
| 2026 | 3 | 18 | u | slack\_user | User | Alice Johnson |
| 2026 | 3 | 19 | u | slack\_user | User | Alice J. |

## Query: Latest State Snapshot

Use this query to get the current state of all entities in your account — one row per entity, deduplicated to the most recent version. It uses `MAX_BY` to select the properties blob with the highest `_beginon` timestamp for each entity ID.

```sql
SELECT
    json_extract_scalar(latest_properties, '$._id')         AS entity_id,
    json_extract_scalar(latest_properties, '$._type')       AS entity_type,
    json_extract_scalar(latest_properties, '$._class')      AS entity_class,
    json_extract_scalar(latest_properties, '$.displayName') AS display_name,
    latest_properties                                       AS properties
FROM (
    SELECT
        MAX_BY(properties, CAST(json_extract_scalar(properties, '$._beginon') AS BIGINT)) AS latest_properties
    FROM "j1ds-usage-example-cdc".entities
    WHERE accountid = 'YOUR_ACCOUNT_ID'                    -- REQUIRED: injected partition
      AND year  = 2026                                     -- filter to recent data
      AND month = 3                                        -- to control scan cost
      AND json_extract_scalar(properties, '$._beginon') IS NOT NULL  -- guard against missing _beginon
    GROUP BY json_extract_scalar(properties, '$._id')
)
ORDER BY entity_type, display_name;

-- NOTE: _beginon is epoch milliseconds stored as a JSON number.
-- CAST to BIGINT is required for correct MAX_BY ordering (not lexicographic).
-- operation: c=create, u=update, d=delete
```

### Example Output

| entity\_id | entity\_type | entity\_class | display\_name |
| --- | --- | --- | --- |
| a1b2c3d4-... | aws\_s3\_bucket | DataStore | my-data-bucket |
| d4e5f6a7-... | slack\_user | User | Alice Johnson |

## Query: Change Detection

Use this query to see what changed in your account over a time window, grouped by day, operation type, and entity type. Adjust the `day BETWEEN` range to scope the window you want to examine.

```sql
SELECT
    year,
    month,
    day,
    operation,                                              -- c=create, u=update, d=delete
    json_extract_scalar(properties, '$._type')        AS entity_type,
    COUNT(*)                                           AS change_count
FROM "j1ds-usage-example-cdc".entities
WHERE accountid = 'YOUR_ACCOUNT_ID'                        -- REQUIRED: injected partition
  AND year  = 2026
  AND month = 3
  AND day   BETWEEN 1 AND 7                                -- replace with your window
GROUP BY year, month, day, operation,
         json_extract_scalar(properties, '$._type')
ORDER BY year, month, day, operation;

-- TIP: To compare two windows, wrap each as a subquery and LEFT JOIN on entity_type,
-- or use EXCEPT to find entity types that appeared only in one window.
-- eventtype is always 'entity' in this table (use relationships table for relationship changes).
```

### Example Output

| year | month | day | operation | entity\_type | change\_count |
| --- | --- | --- | --- | --- | --- |
| 2026 | 3 | 1 | c | aws\_iam\_role | 12 |
| 2026 | 3 | 1 | u | slack\_user | 45 |
| 2026 | 3 | 2 | c | aws\_s3\_bucket | 3 |

## Cost and Performance Notes

> **NOTE**
> 
> -   Athena charges **$5 per TB scanned**
> -   All queries include partition filters (`accountid`, `year`, `month`) to minimize scan scope
> -   The WorkGroup enforces a **10 GB per-query cutoff** (~$0.05 maximum per query)
> -   Typical per-query cost for a single account's daily data: **under $0.01**
> -   Adding `day` filters (e.g., `AND day BETWEEN 1 AND 7`) reduces scanned data further

---

Source: /features/admin/ip-allowlist

# IP allowlist

The IP allowlist restricts your JupiterOne account to a set of source IP addresses that you define. Once enabled, requests coming from any other address are rejected.

The allowlist applies to the whole account, not to individual users or groups. It is configured by account admins in **Settings > Admin > Security & Access**.

> **NOTE**
> 
> The allowlist is an access control, not a network boundary. It does not make JupiterOne unreachable from other addresses — it means requests from those addresses are refused.

## What the allowlist blocks

When the allowlist is enabled, JupiterOne checks the source IP of every authenticated request against your entries and rejects anything that does not match. This covers:

-   **Web app usage.** Every action a user takes in the JupiterOne app.
-   **API and SDK traffic.** Anything authenticated with a JupiterOne API token, including the CLI, the SDK, custom scripts, and CI jobs.
-   **Integrations you run yourself.** Any collector or job that authenticates to JupiterOne with an account or user API token from your own infrastructure.

Blocked requests fail with a permission error. They are not treated as authentication failures, so a blocked user is not prompted to log in again.

### What the allowlist does not block

**Signing in.** A user connecting from a non-allowed address can still authenticate, but no action they take afterward will succeed. Expect this to look like a working login followed by an app that cannot load anything.

The allowlist governs requests made against your account with your users' sessions and your API tokens. It is a restriction on where your account can be used from, not a replacement for the rest of your access controls — keep managing token lifetimes, user offboarding, and group permissions as you would without it.

> **NOTE**
> 
> If you are assessing the allowlist as part of a security review and need its exact coverage boundary, contact your JupiterOne account team or support rather than relying on this page.

> **CAUTION**
> 
> JupiterOne staff are subject to your allowlist too. Support engineers cannot access your account from outside your allowed addresses. See [If you get locked out](#if-you-get-locked-out) for what this means for support requests.

## Configure the allowlist

1.  Click **Settings** (the gear icon) and select **Admin**.
2.  Open **Security & Access** and find the **IP allowlist** section.
3.  Enable the allowlist and add your entries. You can add them one at a time, or paste many at once with **Bulk add** (see [Add entries in bulk](#add-entries-in-bulk)). For each entry, provide:
    -   **Address or range** — a single IPv4 or IPv6 address, or a CIDR block of either family. For example `203.0.113.42`, `203.0.113.0/24`, `2001:db8::1`, or `2001:db8::/48`.
    -   **Label** — a short description of what the entry covers, such as `HQ office egress` or `Chicago VPN`. Labels are up to 64 characters.
4.  Save your changes.

An account can hold up to 500 entries, and malformed addresses are rejected as you type them. An enabled allowlist with no entries is not a valid configuration and will not save.

### Add entries in bulk

To add many entries at once, click **Bulk add** next to **Add CIDR**. This opens the **Bulk add CIDR ranges** dialog with a box to paste into.

Paste one entry per line, as `<cidr>, <label>`. The label is optional — a line with no comma is a CIDR with no label. Only the first comma separates the two fields, so a label may itself contain commas: `10.0.0.0/24, Frankfurt, DE` adds the range `10.0.0.0/24` with the label `Frankfurt, DE`. Blank lines are ignored, so a list pasted out of a spreadsheet or with a trailing newline causes no error.

Each line is checked as you type and marked with one of three outcomes:

-   **To add** — a valid new range that will be added.
-   **Invalid** — a malformed entry, shown with the same message the inline field gives.
-   **Duplicate** — a range already in the list, or one that appears on an earlier line in the same paste.

A running summary above the list reads `N to add · N invalid · N duplicate`. Duplicates are matched on the normalized address, so `2001:DB8::/48` and `2001:db8::/48` are the same range, and a bare `10.0.0.1` is the same range as `10.0.0.1/32`.

Only the addable lines are committed. The confirm button names the count — for example **Add 3 ranges** — and is disabled when nothing is addable. Invalid and duplicate lines are reported, never silently added.

> **CAUTION**
> 
> A paste that would exceed the 500-entry limit is refused whole, not truncated. The dialog tells you how many slots remain and how many lines to remove, and nothing is added until you bring the paste within that limit.

Added ranges become ordinary rows — you can edit or remove each one individually, and they are saved by the same **Save changes** button and typed confirmation as the rest of the section.

### Verify your own address first

The section displays **the source IP JupiterOne sees for your current request**. This is the value that will actually be compared against your entries, and it is not necessarily the address your machine reports for itself — traffic through a VPN, a corporate proxy, or NAT arrives from the egress address of that hop.

Use the displayed value as your reference when you build the list. If you are unsure what a location's egress range is, get it from whoever manages that network rather than guessing.

### Confirming a save

Some saves ask you to type your account short name before they apply. The confirmation shows your proposed entries next to the source IP JupiterOne sees for you, so you can check your own access before committing. You are asked to confirm when:

-   **You turn the allowlist on.** Enforcement affects everyone in the account, so this is confirmed even when your own address is covered.
-   **Your source IP falls outside the entries you are saving.** The confirmation warns you explicitly that you are about to lose access.

Other saves apply without the extra step: turning the allowlist off, and editing an already-enabled list in a way that still covers your own address.

> **NOTE**
> 
> You cannot save an enabled allowlist while JupiterOne is unable to determine the address you are connecting from. Without that value there is no way to tell whether your entries cover you.

## Avoid locking yourself out

Saving a list that does not include your own address locks out the person best placed to undo it. Before you save:

-   Confirm your entries cover the source IP shown in the section.
-   Add every egress range your users actually come from — each office, each VPN concentrator, each cloud NAT gateway — not just your own.
-   Include the egress addresses of any automation that authenticates with a JupiterOne API token. A CI runner or a self-hosted collector that falls outside the list stops working as soon as enforcement begins.
-   Remember that ranges change. Consumer ISPs, cellular networks, and CGNAT pools reassign addresses; a home address that works today may not tomorrow. Prefer stable egress points.

> **NOTE**
> 
> This check matters most right after a bulk paste. When you add a long list at once it is easy to stop reading each entry, but the save confirmation still shows your proposed entries against the source IP JupiterOne sees for you. Read that confirmation and make sure your own address is covered before you save, whether the list was pasted or built by hand.

## Removing an entry or turning the allowlist off

Editing entries and disabling the allowlist are both done from the same section. Turning the allowlist off leaves your entries in place, so you can re-enable the same list later without re-entering it.

## When changes take effect

Allowlist changes apply immediately in most cases, but some can take a few minutes to propagate.

Allow for that when you widen the list or re-enable enforcement: access you have just granted may take a few minutes to work. If you need a change to take effect immediately, contact support.

## If you get locked out

Raise a request through your normal JupiterOne support channel, as an account administrator. Support can **pause** enforcement on your account, which restores access without touching your entries — your addresses and labels are preserved exactly as you saved them.

Two things to know about the recovery path:

-   **While enforcement is paused, your account is not IP-restricted.** Correct your entries and re-enable enforcement promptly rather than leaving the pause in place.
-   **Only you can turn it back on.** Support cannot re-enable enforcement or edit your entries. Once you have access again, fix the list in **Security & Access** and enable the allowlist yourself.

After you re-enable it, allow a few minutes for the change to propagate before concluding that something is wrong.

## Limitations

-   **Not compatible with AWS PrivateLink.** If your account reaches JupiterOne over PrivateLink, do not enable an IP allowlist — PrivateLink already restricts network access, and combining the two will break your connectivity. Contact your JupiterOne representative if you are unsure whether this applies to you.
-   **Up to 500 entries** per account, with labels up to 64 characters.
-   **Account-wide only.** The allowlist cannot be scoped to a user group, a role, or a specific API token.

---

Source: /features/admin/j1-dashboard

# JupiterOne Dashboard

## JupiterOne Dashboard

By default, the JupiterOne workspace home page features an high-level breakdown of several data points relating to your environment. This provided view is the _Dashboard Overview_.

![The JupiterOne Dashboard Overview](/assets/images/dashboard-overview-06d2d239641bac134fbebf0514bfbee0.png)

### Dashboard Overview

-   **What's changed?**: An overview breaking down the changes in your environment for a given time frame (last 7 days is the default). You can adjust the time frame from time of your last login up to 90 days.
-   **What's in my environment?**: An aggregate view of the problems, alerts, and critical assets within your JupiterOne workspace.
-   **What compliance gaps for I have?**: Showcases the running total of compliance gaps within your JupiterOne workspace.

> **NOTE**
> 
> Your initial overview page may or may not feature the sections above depending on your user access. For more information on access and user roles, [see our documentation](/features/admin/access-controls.md).

## JupiterOne Graph

JupiterOne is built as a data-driven graph platform. The JupiterOne graph provides a deep, highly contextualized representation of your assets, their relationships, and metadata. By capturing this data in a graph, JupiterOne enables you to gain a much more accurate picture of your entire environment.

![JupiterOne Graph](/assets/images/graph-overview-e440bbd10aaa47cff39d6e5fe6770819.png)

The graph allows for dialing in to particular assets to explore what and where a blast radius could pose a security threat.

### Accessing the graph

You can access the JupiterOne graph from any query, simply change the view to **Graph** or add `RETURN TREE` to the end of the query.

### Up Next

Now that you've explored the JupiterOne home view and graph, explore [configuring your user settings](/features/admin/user-settings.md), or if you're a workspace admin, [configuring your workspace settings](/features/admin/admin-settings.md).

---

Source: /features/admin/organizational-units

# Organizational Units

Organizational units (OUs) scope your JupiterOne data to the teams that own it. An OU groups the assets, controls, and findings that belong to a single part of your organization so that each team can see its own posture without asking a central team to build a report. OUs are used as a filter in both Compliance (Continuous Control Monitoring) and Vulnerability Management, and are configured once from a single admin interface.

## Namespaces and organizational units

OUs are organized into **namespaces**. A namespace is a _grouping dimension_ — a way of dividing your environment — and the OUs inside it are the individual buckets along that dimension.

JupiterOne provides one built-in namespace and lets you create as many custom namespaces as you need:

-   **Integration (built-in)** — A system-managed namespace where every integration instance in your account is automatically an OU. This namespace is read only: you cannot edit or delete it or its queries. Its OUs follow the integration instance lifecycle — when you add an integration its OU appears, and when you remove an integration its OU is removed.
-   **Custom namespaces** — Namespaces you define yourself, where OU membership is computed from J1QL queries. Use custom namespaces to group your environment by team, business unit, region, environment, tag, or any other dimension that matters to your organization.

A single entity can belong to OUs in more than one namespace at the same time. For example, an EC2 instance can be in the `Production` OU of an _Environment_ namespace and the `Platform` OU of a _Teams_ namespace simultaneously.

## The organizational unit admin interface

Configure namespaces and OUs from a single page. Navigate to **Settings** > **Organizational Units** to open the OU admin page.

The page lists every namespace as an expandable grouping. Expand a namespace to see the OUs it contains in a table with:

-   **OU name** and integration icon — the name of the bucket, with the provider icon shown for integration-derived OUs.
-   **Assets** — how many entities are scoped to this OU.
-   **Metadata** — an **Added** or **Missing** badge indicating whether the OU has an owner configured. OUs without an owner are flagged **Missing** so you can see at a glance what still needs attention.

![Organizational Units admin page showing namespaces, their OUs, asset counts, and metadata status](/assets/images/ou-admin-15b3e93badb7327fd1d425102a8ec330.png)

### Create a custom namespace

1.  On the OU admin page, click **New grouping**. The admin interface refers to a namespace as a _grouping_ and to an OU as a _unit_.
2.  Enter a **Name** (for example, `Teams`) and an optional **Description**.
3.  Optionally select a **Default ticketing workflow** — the Data Out ticketing instance pre-selected when someone creates a ticket for a vulnerability case whose asset doesn't belong to any OU. See [Ticketing workflows and routing](#ticketing-workflows-and-routing) for how this setting is used and its prerequisites.
4.  Add one or more **Queries** that define how entities are bucketed into OUs.
5.  Click **Save grouping**.

Each query must `RETURN` exactly two aliased columns:

-   `AS entityId` — the matching entity.
-   `AS ouValue` — the bucket key the entity is grouped by (a region, a tag, a team name). This value becomes the OU's label.

The bucket value must be populated on every matching entity. When you project an optional property such as a tag or a custom field, filter to entities that have it with `WITH`, otherwise the save fails with _"must return at least one of ouValue or ouId"_.

> **WARNING**
> 
> Always project the bucket key `AS ouValue`. A second alias, `AS ouId`, is accepted only for keys that are UUIDs, but OUs created this way have no human-readable label and show as raw identifiers in the filter and admin interface. Use `AS ouValue` for every namespace query.

For example, to group AWS accounts by their `Team` tag:

```j1ql
FIND aws_account WITH tag.Team != undefined AS a
RETURN a._id AS entityId, a.tag.Team AS ouValue
```

A namespace can contain several queries — each one contributes its matched entities to the OUs in that namespace.

> **TIP**
> 
> Start broad. A namespace that buckets every asset by a single tag or owner attribute you already maintain (for example, `tag.Team` or `tag.Environment`) gives every team a self-service view with almost no setup.

### Configure OU routing metadata

Click any OU in the table to open its detail panel and configure routing metadata — who owns the OU and where its work is routed:

-   **Owner email (primary owner)** — The primary person responsible for the OU. This is required for the OU to count as configured, and it receives the OU contact digest.
-   **Additional owner emails** — Secondary owners, entered as a comma-separated list.
-   **Ticketing workflow** — The Data Out ticketing instance used to create tickets for cases on this OU's assets. Until it is set, the **Create ticket** action is disabled for those cases. See [Ticketing workflows and routing](#ticketing-workflows-and-routing).

Changes persist immediately and are available through the API.

> **TIP**
> 
> Set a primary owner email on every OU. The owner email clears the **Missing** badge, drives the OU contact digest, and identifies who to route a finding or control failure to when it belongs to that team.

## Ticketing workflows and routing

OUs can carry a ticketing destination so that a case raised against a team's assets is filed in that team's ticketing system. There are two settings:

| Setting | Where to set it | What it does |
| --- | --- | --- |
| **Ticketing workflow** | OU detail panel (click an OU) | The destination for tickets on cases whose asset belongs to this OU. |
| **Default ticketing workflow** | **New grouping** / **Edit grouping** dialog | The fallback destination for tickets on cases whose asset doesn't belong to any OU in the namespace. |

### What a ticketing workflow is

The options in both dropdowns are **Data Out instances** (Data Out uses _instance_ and _workflow_ interchangeably). Each instance is a named delivery target that pairs a ticketing connection with a destination, such as a Jira project and issue type. JupiterOne runs each instance as a managed automation recipe behind the scenes, but you create and manage instances only from **Integrations** > **Data out**.

-   Only instances for ticketing providers (**Jira** and **ServiceNow**) are listed. Instances for other Data Out providers are not.
-   Recipes you build yourself in **Automations** are not Data Out instances and never appear in these dropdowns.
-   If no ticketing instances exist, the dropdown is disabled and shows a **Manage connections** link.

### Configure ticket routing

1.  **Connect a ticketing provider.** Go to **Integrations** > **Data out** > **Connections** and authorize Jira or ServiceNow. See [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md).
2.  **Create one or more instances.** Go to **Integrations** > **Data out** > **Instances** and click **\+ Add instance** on the provider section. A common pattern is one instance per team's project. See [Create an instance](/integrations/data-out/create-instance.md). You can also reach this page from the **New workflow** link under any ticketing workflow dropdown in the OU admin page.
3.  **Assign a workflow to each OU.** On the OU admin page, click an OU, select its **Ticketing workflow**, set the **Owner email**, and click **Save**. The owner email pre-fills the ticket assignee for Jira instances.
4.  **Set a default for unassigned work.** Edit the grouping and select a **Default ticketing workflow**, for example a central security triage project.
5.  **Point Vulnerability Management at the namespace.** In Vulnerability Management, open **Risk configuration** and, under **Cases — Ownership assignment**, set the **OU namespace** to the namespace you configured. Vulnerability Management uses the built-in **Integration** namespace until you change this.

### How a destination is chosen

When you open a vulnerability remediation case and click **Create ticket**, JupiterOne picks the destination as follows:

1.  If the case's asset belongs to an OU in the selected **OU namespace**, the OU's **Ticketing workflow** is used, and its **Owner email** pre-fills the assignee.
2.  If the asset doesn't belong to any OU, the namespace's **Default ticketing workflow** is used.
3.  If the applicable setting is empty, **Create ticket** is disabled with a message linking to OU settings.

The selected workflow is pre-filled in the **Create ticket** dialog, and you can still choose a different active instance before creating the ticket.

### Limitations

-   **Tickets are created on demand.** A ticketing workflow pre-selects the destination when someone clicks **Create ticket**. It does not file tickets automatically when a case is created.
-   **The default applies only to the Vulnerability Management OU namespace.** A **Default ticketing workflow** on any other namespace is stored but not used today.
-   **An OU doesn't inherit the namespace default.** If an OU has no **Ticketing workflow** of its own, **Create ticket** is disabled for its cases even when the namespace has a default. Set a workflow on every OU that should receive tickets.
-   **Only the first workflow is used.** An OU holds a single ticketing workflow.

### Troubleshooting

| Symptom | Cause and fix |
| --- | --- |
| The dropdown is disabled with _No ticketing workflows are available_ | No Jira or ServiceNow instance exists. Connect a provider and create an instance under **Integrations** > **Data out**. |
| A recipe I built in Automations is missing from the dropdown | Only Data Out instances are listed. Recreate the destination with **\+ Add instance** under **Integrations** > **Data out** > **Instances**. |
| The dropdown shows _Workflow no longer available (…)_ | The selected instance was deleted. Select a different workflow and save. |
| The **Create ticket** dialog doesn't pre-select the configured workflow | The **Create ticket** dialog only offers active instances, while the OU dropdowns list instances in any status. Resume the instance from **Integrations** > **Data out** > **Instances**, or fix its error. |
| **Create ticket** is disabled with _No destination configured for the … OU_ | The OU has no **Ticketing workflow**. Set one in the OU detail panel. |
| **Create ticket** is disabled with _No default destination configured for unassigned work_ | The **OU namespace** selected in Risk configuration has no **Default ticketing workflow**. Edit that grouping and set one. |

## Filtering by organizational unit

Once your namespaces and OUs exist, you can filter by OU in both Compliance and Vulnerability Management. The OU filter narrows every view to the assets, controls, and findings that belong to the selected team.

### In Compliance (Continuous Control Monitoring)

The Controls Status View and its drill-down can be scoped to one or more OUs.

1.  Open the **Org Units** filter at the top of the Controls Status View.
2.  Select one or more OUs, organized by namespace.
3.  The controls list filters to show only the controls with results related to assets in the selected OUs.
4.  The summary header adapts to show OU-specific compliance metrics, and the drill-down shows which assets within the selected OUs are affected, with individual pass and fail status.

The OU selection persists in the URL, so you can share a link to a specific OU's compliance view with a team member.

![Controls Status View filtered by the Org Units selector to a single organizational unit](/assets/images/ccm-ou-picker-e45b91dc390ff8888d2980938707fcde.png)

> **TIP**
> 
> Give each team lead a self-service compliance view. An IT or Cloud Ops leader can select their OU and immediately see their team's compliance posture without asking the central compliance team for a report.

### In Vulnerability Management

In Vulnerability Management, the OU identifies which team owns an affected asset and drives where remediation work is routed.

-   The **Owner team** column shows the OU that owns the affected asset on the Prioritized view and on remediation plans.
-   Filtering by OU narrows the vulnerability funnel to the findings on assets owned by that team.
-   When you create a remediation plan, the OU determines which team the resulting case is routed to.

Vulnerability Management draws owner teams from a single configurable namespace, set as the **OU namespace** in the Risk configuration panel. It defaults to the built-in **Integration** namespace, so change it to a custom namespace — such as a team or business-unit grouping — when you want cases routed by that dimension instead.

![Vulnerability Management Prioritized view showing the Owner team column populated from organizational units](/assets/images/prioritized-view-9193d2b4da359eb76c77e2728e339872.png)

## Organizational unit metadata on entities

OUs are represented on the graph through internal metadata, which is what makes OU filtering and scoping possible. All internal metadata uses an underscore (`_`) prefix.

Every entity carries an `_ou` property: a pipe-delimited set of `<namespace-slug>:<value>` tokens for every OU the entity belongs to, across all namespaces. For example, an entity might carry `|integration:8f3c…|teams:platform|environment:production|`. The built-in **Integration** namespace populates these tokens automatically; custom namespaces populate them by evaluating their queries.

| Property | Type | Description |
| --- | --- | --- |
| `_ou` | `string` | The set of OUs the entity belongs to, as pipe-delimited `namespace:value` tokens. This is what the OU filter matches on. |
| `_integrationInstanceId` | `string` | Internal UUID of the integration instance the entity was ingested from. Backs the built-in Integration namespace. |
| `_integrationName` | `string` | User-provided friendly name of the integration instance. Surfaced as the OU name in the Integration namespace. |
| `_integrationType` | `string` | Type of the integration, typically the provider name (for example, `aws`, `azure`, `okta`). |

You can filter entities by OU in J1QL using the `_ou` property and the `~=` contains operator. For example, to find every entity in the `platform` OU of the `teams` namespace:

```j1ql
FIND * WITH _ou ~= '|teams:platform|'
```

> **NOTE**
> 
> For the built-in Integration namespace, `_ou` tokens are assigned and maintained by JupiterOne and follow the integration instance an entity was ingested from. For custom namespaces, membership is recomputed from the namespace queries — edit the query to change which entities fall into which OU.

For the full list of internal metadata assigned to entities and relationships, see [Entity and Relationship Metadata](/jupiterOne-data-model/metadata.md).

## Related topics

-   [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md)
-   [Vulnerability Management](/features/vulnerability-management.md)
-   [Entity and Relationship Metadata](/jupiterOne-data-model/metadata.md)

---

Source: /features/admin/parameters

# Using Parameters

Some use cases of JupiterOne required referencing a _literal_ value that is better suited to reference as a _variable_ or a **parameter**. Sometimes common values are better stored and retrieved at runtime instead of saved literally. Some examples include:

-   Long or unwieldy values (such as a long URL)
-   Sensitive values (such as a private key or API token)
-   Common values (such as dates, keys) that you may want to change in many places at one time

A better alternative exists in the form of _parameters_–which can be stored and referenced in rules and queries with a special syntax.

## Examples

In the use case of a very long URL, which may not be easily human-readable and may be referenced in many rules, queries, or questions, use:

### Example: Parameters in J1QL

```j1ql
FIND Application WITH loginUrl = ${ param.longURL }
```

### Example: Parameters in Rules

```json
  "headers": {
    "Authorization": "Bearer {{param.secretApiKey}}"
  }
```

The service hydrates the value of `longUrl` or `secretApiKey` and evaluates it against the remote contents instead of the parameter expression. You can leverage this same pattern for different types of parameter types and comparisons, explained below. As shown above, the syntax between rules and queries differs slightly, but is consistent with variables (in the case of queries) and expressions (in the case of rules).

## Usage: Schema

Parameters can be managed from **Settings > Account Parameters** in the app, or through the public-facing GraphQL endpoints described below. The settings page is where you choose a parameter's type (String, Number, Boolean, or a list of strings or numbers); the stored type is what queries then compare and compute with.

A parameter is an object stored in the parameter-service, which uses the following schema:

| Property | Type | Description |
| --- | --- | --- |
| `name` | `string` | The parameter **key** or "name" |
| `value` | `string` | `number` | `boolean` | `list` | The parameter **value** to be stored/retrieved |
| `secret` | `boolean` | **Flag** to treat value as sensitive data |
| `lastUpdatedOn` | `date` | **Date** which indicates last update |

#### List Types

Lists are considered to be arrays of `string`, `number`, or `boolean` types.

## Usage: API Operations and Queries

| Queriable fields: |  |
| --- | --- |
| parameter | Individual `QUERY` for one parameter |
| parameterList | Bulk `QUERY` for parameters |

| Mutations: |  |
| --- | --- |
| setParameter | Create/update a remote parameter |
| deleteParameter | Remove a parameter from the remote store |

### GraphQL API

### Query: `parameter`

| _Argument_ | _Type_ | _Required?_ |
| --- | --- | --- |
| name | `string` | Yes |

**_Returns_**: Parameter

**_Example_**:

```gql
query Query($name: String!) {
  parameter(name: $name) {
    name
    value
    secret
    lastUpdatedOn
  }
}
```

### Query: `parameterList`

| _Argument_ | _Type_ | _Required?_ | _Default_ |
| --- | --- | --- | --- |
| limit | `number` | No | 100 |
| cursor | `string` | No (unless paginating) | n/a |

**_Returns_**: Paginated

**_Example_**:

```gql
query Query($limit: Int, $cursor: String) {
  parameterList(limit: $limit, cursor: $cursor) {
    items {
      name
      value
      secret
      lastUpdatedOn
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

### Mutation: `setParameter`

| _Argument_ | _Type_ | _Required?_ | _Default_ |
| --- | --- | --- | --- |
| name | `string` | Yes | n/a |
| value | `string` | `number` | `boolean` | `list` | Yes | n/a |
| secret | `boolean` | No | `false` |

### **_Returns_**

```ts
{
  success: boolean;
}
```

**_Example_**

```gql
mutation Mutation($name: String!, $value: ParameterValue!) {
  setParameter(name: $name, value: $value) {
    success
  }
}
```

**_List Parameters Variables Example_**

```gql
{
  "name": "items",
  "value": ["jupiterone.com", 2] // multi-type arrays are allowed
}
```

**_Non-List Parameters Variables Example_**

```gql
{
  "name": "j1domain",
  "value": "jupiterone.com"
}
```

#### Mutation: `deleteParameter`

| _Argument_ | _Type_ | _Required?_ |
| --- | --- | --- |
| name | `Array<string>` | Yes |

#### **_Returns_**

```ts
{
  success: boolean;
}
```

**_Example_**

```gql
mutation Mutation($name: String!) {
  deleteParameter(name: $name) {
    success
  }
}
```

## Parameter References

You can reference parameters in [rules' configurations](/api/alert-rules.md#rule-definition-reference) or any [query expression](/j1ql.md), although the syntax is slightly different between the two. `param` is a special keyword that, when invoked, fetches values from the parameter-storing service.

> **NOTE**
> 
> In the case of both rules and queries, referencing a nonexistent parameter causes an error and abandon execution.

### Where parameters can be used in J1QL

A parameter can stand in for a literal value in these positions.

As a comparison value in a `WITH`, `WHERE` or `HAVING` clause:

```j1ql
FIND Application WITH loginUrl = ${ param.longURL }
```

```j1ql
FIND Finding AS f WHERE f.score > ${ param.riskThreshold }
```

```j1ql
FIND Finding AS f RETURN f.severity AS severity, COUNT(f) AS total
HAVING total > ${ param.minimumCount }
```

As a returned value, with or without an alias. An unaliased parameter is returned in a column named `param.<name>`, so the column name stays the same when you change the parameter's value:

```j1ql
FIND Finding AS f RETURN f.displayName AS finding, ${ param.riskThreshold } AS threshold
```

In arithmetic, function arguments and aggregation arguments, in both `RETURN` and `WHERE`, and as a function argument in `HAVING`:

```j1ql
FIND unified_vulnerability AS uv
RETURN ${ param.cvssWeight } * COALESCE(uv.cvssImpactScore / 6.05, 0.0)
     + ${ param.epssWeight } * COALESCE(uv.epssScore, 0.0) AS riskScore
```

```j1ql
FIND Finding AS f WHERE f.numericSeverity * ${ param.weight } > ${ param.threshold }
```

This is what makes a query reusable: the thresholds and weightings live in parameters, so the query text does not change when you retune them.

A parameter's stored type is preserved — a parameter saved as a number is compared and computed as a number. A parameter saved as text or as a boolean cannot be used in arithmetic, and the error names the parameter so you can correct its type.

A parameter holding a list can be used as a comparison value in `WITH` or `WHERE`, where it expands into a comparison against each element:

```j1ql
FIND Application WITH _type = ${ param.approvedTypes }
```

A list is not supported in `HAVING`, as a returned value, or inside arithmetic, and an empty list is rejected wherever it appears.

Parameters are not accepted in `ORDER BY`, `LIMIT` or `SKIP`, or as the address range in `CIDR()`. A parameter cannot supply a regular expression: its value is compared as a value, never as a pattern. `HAVING` does not accept arithmetic, with or without a parameter — `HAVING total * 2 > 10` is rejected too.

A [secret parameter](#secret-parameters) can only be used as a comparison value in `WITH` or `WHERE`.

## Auditing and Security

All changes (including creation and deletion) of parameters is captured by an audit trail providing visibility into the historic usage and access of these values. In addition, all parameters are encrypted-at-rest and in-transit, subject to log redaction, and are subject to either ABAC or IAM-based fine-grained permissions.

## Secret Parameters

Any parameters set with `secret` to be `true` have write-only values and are not readable from the API. Only evaluations of the query can access these parameter values. This usage enables the storage of sensitive parameters such as API keys that JupiterOne users should not be able to see. All read access to these secret parameters contains redacted values, but metadata is able to be read.

In a query, a secret parameter can only be used as a comparison value in `WITH` or `WHERE`:

```j1ql
FIND Application WITH clientId = ${ param.secretClientId }
```

Anywhere else (as a returned value, in arithmetic or a function argument, or in `HAVING`), the query is rejected with an error that names the parameter, so a query cannot return a secret's value.

> **NOTE**
> 
> By design, you cannot update a parameter that has had `secret` set to true to `secret: false` without also changing the value in the same request.

---

Source: /features/admin/query-builder

# Query Builder

The JupiterOne Query Builder is a tool that provides a visual way to build a query in [J1QL](/j1ql.md) without having to be proficient in the JupiterOne Query Language (J1QL).

![JupiterOne Query Builder](/assets/images/query-builder-309379e0f49bb56ed1e766f2262bb59f.gif)

#### To create a query in Query Builder:

1.  Navigate to the **Home** -> **Query Builder** page.
    
2.  Click on a class from the bubble chart or the left navigation menu. You can use the search bar to search through classes.
    
3.  Click **Add Filter** to filter by a specific property, tag, or metadata. Add an operator and specific value you want to query on, if applicable. You can as many filters as you want.
    
4.  Clicking on the first class will load relationships to other classes that exist in your graph. Click on one of the relationships to add it to your query.
    
5.  Click `List` or `Graph` to choose how you want to return the results. You can toggle between the options by clicking **Run Query** after you make your selection.
    
6.  Click **Open in search** to open the generated query.
    

Using the icons in the box at the top right of the page, you can:

-   Save the query as a question in the questions library
-   Add the query results to [JupiterOne Insights](/features/insights-and-alerts/insights.md)
-   Create an [alert](/features/insights-and-alerts/alerts.md)
-   Generate a link to the query that you can share
-   Copy the query to the clipboard
-   Download the query as csv or json

### Questions

In addition to the Query Builder, JupiterOne also features a preset library full of common questions, or queries that can assist in jump-starting your data exploration in JupiterOne.

![JupiterOne Question Library](/assets/images/question-library-a7e58ba7179e171bb3400fb5b09c3b16.png)

To access the Question Library, navigate to the **Home** -> **Questions library** page.

#### Running a question

To run a question from the Question Library:

1.  Select the desired question from the list.
2.  View the results.

#### Adding a question to the library

In addition to running the prebuilt questions, you can create a question to add to the Question Library by selecting **Create Question**.

Creating a question required the following:

-   Title: the title of the question
-   Description: a brief description of the question
-   Enable trend data collection (opitonal): informs the system to collect trend data and chart the query results over time
-   Set the polling interval: the interval at which the system runs the query (30 minutes, 1 hour, 1 day)
-   Tags: additional metadata used to reference the question
-   Queries: the [J1QL](/j1ql.md) query or queries run within this question

---

Source: /features/admin/resource-allowlist

# Resource Allowlist tool

JupiterOne provides a resource allowlisting tool as a Power Up for all Enterprise customers and all Premium customers who have added the Power Up Pack.

This Power Up enables you to list the applications, internal IP addresses, and external IP addresses that are approved, in use, and trusted by the organization. When an asset is created by the System Mapper, during the analysis of roles and policies in your account, or uploaded via API, the asset is checked against the allowlist. When a match is found, the asset is updated with an additional property for querying purposes.

## Configuration

To configure the resource allowlist:

1.  Click on **Settings** (the gear icon) and click **Power Ups**.
2.  Select **Configure Resource Allowlist**.
3.  Populate each allowlist, following the instructions outlined below.

### Configure the Approved Applications Allowlist

When you create an `Application` asset in J1, the property `approved` is set equal to `true` if the `name` of the application matches a value listed under the allowlist **Approved Applications**.

You should add applications you approve to the list by name, for example:

```text
Google Chrome.app
zoom.us.app
```

After you have configured the allowlist, your application data is automatically enriched, and you can run useful queries such as the following to find non-approved applications installed on any device:

```j1ql
Find Device 
    that installed Application with approved=false
```

### Configure the Internal IP Addresses Allowlist

When you create a `Host` or `Network` asset in J1, the property `internal` is set equal to `true` if the `ipAddress` or `privateIpAddress` of the host or network matches a value listed under the **Internal IP Addresses** allowlist.

You should add internal IP addresses that you own to the list in CIDR notation, for example:

```text
16.5.4.3/32
16.5.4.0/24
```

After you have configured the allowlist, your application data is automatically enriched, and you can run useful queries to find a list of external IP hosts and networks in your account, such as the following:

```j1ql
FIND (Host|Network) 
    with _source!='integration-managed' and internal!=true
```

### Configure the Trusted External IP Addresses Allowlist

When you create a `Host` or `Network` asset in J1, the property `trusted` is set equal to `true` if the `ipAddress` or `privateIpAddress` of the host or network matches a value listed under the **Trusted External IP Addresses** allowlist.

You should add the external IP addresses you trust to the list in CIDR notation, for example:

```text
16.5.4.3/32
16.5.4.0/24
```

After you configure the list, your application data is automatically enriched, and you can run useful queries to see a graph of untrusted sources that have inbound SSH access to your environment, such as the following:

```j1ql
FIND Firewall that ALLOWS as rule (Host|Network)
  with _source!='integration-managed' and trusted!=true
WHERE 
  rule.ingress=true and rule.fromPort <= 22 and rule.toPort >=22
RETURN TREE
```

---

Source: /features/admin/saml-sso

# How to Configure SAML SSO Integration with JupiterOne

Single sign-on is supported using a custom authentication client configured within a J1 account. This feature is available to all Enterprise customers.

## Supported Features

-   **SP-initiated SSO**
    
    Service Provider-Initiated (SP-initiated) SSO means when the service provider (SP) initiates SAML authentication. SP-initiated SSO is triggered when you try to access a resource in J1.
    
-   **JIT (Just In Time) Provisioning**
    
    Users are created and updated instantly using the SAML attributes sent as part of the SAML response coming from the Identity Provider (IdP). The user is created during the initial sign-in to J1 and updated during subsequent sign-ins.
    

> **NOTE**
> 
> IdP-initiated SSO is currently unsupported due to a limitation of Amazon Cognito.

## Configuring SSO

You must be a member of the Administrators group to perform configurations.

1.  In your JupiterOne workspace, navigate to **Settings > Security & Access**.
    
2.  Enable the **Single Sign On (SSO)** toggle.
    
3.  You will be provided the `SSO URL` and `Audience URI` (SP Entity ID) for you to provide your IdP SSO application.
    
4.  Copy the SSO URL and Audience URI and enter them where necessary for your IdP SSO application. In your IdP account, add a new SAML application and name it JupiterOne.
    
    1.  Copy the SSO URL and Audience URI values in the SAML settings.
    2.  Use the same JupiterOne single sign-on URL string value for Recipient URL and Destination URL.
    3.  Leave the **Default Relay State** field empty.
    4.  Select **EmailAddress** for the name ID format.
    5.  Select **Email** _or_ **Username** for the application username.
    6.  See the next section for details on attribute mappings.
5.  Complete the configuration of the SAML application in your IdP account, and copy the identity provider metadata link. For example, in Okta, you can find this link on the **Sign On** tab of the application, under **Metadata details** > **Metadata URL**. ​ ![okta-idp-metadata](/assets/images/okta-idp-metadata-d2de7d4d62484e3804bdf9f048cdc753.png)
    
6.  Go back to the JupiterOne single sign-on settings, and paste the identity provider metadata link in the **SAML Metadata File** field. Alternatively, you can enter the SAML Metadata manually if you so choose. Simply select **Type the SAML Metadata file manually** and enter the metadata into the provided text field.
    
7.  **Save** your settings to complete the configuration. Next time you access your JupiterOne account using your organization custom URL (for example, `https://your_company.apps.us.jupiterone.io`), you are redirected to your SAML IdP for authentication.
    

## Attribute Mappings

JupiterOne supports the following SAML attribute mappings:

-   `email`: User email address (required)
-   `family_name`: User last name
-   `given_name`: User first name
-   `name`: User display name
-   `group_names`: Dynamically assigns the user to the specified groups within JupiterOne.

J1 highly recommends that if you are a large organization, you should use the [JupiterOne1 API](/reference.md) to create group names and then use the `group_names` attribute to more easily synchronize all username data with J1 on a regular basis. You can use the `group_names` attribute to equate to a filtered list of groups that match the names of the J1 groups (case-sensitive). For example, create a group name to contain all the users who have administrative privileges in J1.

> **NOTE**
> 
> Users without a `group_names` mapping are assigned to your workspace's configured default groups (the **Users** group, unless you have changed it). This fallback can be turned off in **Settings > Security & Access** with the **Assign default groups to SSO users without group claims** switch; when it is off, a sign-in with no `group_names` claim does not create a user or change any group memberships. See [Admin settings](/features/admin/admin-settings.md) for details.

## Okta Configuration

To configure SSO for Okta, you must have administrator access. In addition, ensure you can access the SSO URL and your Audience URI before proceeding.

1.  In the Okta Admin Console, go to **Applications > Applications** and click **Create App Integration**.
    
2.  Select **SAML 2.0** and click **Next**.
    
3.  Enter a name in the **App name** field, such as JupiterOne, and click **Next**.
    
4.  In the **SAML Settings** section:
    
    -   In the **Single sign-on URL** field, enter your `SSO URL`. Leave **Use this for Recipient URL and Destination URL** selected.
    -   In the **Audience URI (SP Entity ID)** field, enter your `Audience URI`.
    -   In the **Name ID format** field, select `EmailAddress`.
    -   In the **Application username** field, select `Email`.
5.  Click **Next**.
    
6.  On the **Feedback** step, select **This is an internal app that we have created**, and click **Finish**.
    
7.  On the app's **Sign On** tab, go to **Attribute statements** and click **Add expression** for each of the following. Only `email` is required.
    
    | Name | Expression |
    | --- | --- |
    | `email` | `user.profile.email` |
    | `family_name` | `user.profile.lastName` |
    | `given_name` | `user.profile.firstName` |
    | `name` | `user.profile.displayName` |
    
8.  To send `group_names`, first create the `jupiterone_groups` app attribute (see [Okta Group Attribute Configuration](#okta-group-attribute-configuration)). The expression editor cannot reference app user attributes, so expand **Show legacy configuration**, click **Edit** under **Profile attribute statements**, add `group_names` with the value `appuser.jupiterone_groups`, and click **Save**.
    
9.  Under **Metadata details** on the **Sign On** tab, click **Copy** next to **Metadata URL**.
    
10.  Paste the link into the **SAML Metadata Document URL** field in JupiterOne.
     
11.  Click **Save** in the top right of the window to save your configuration. A green confirmation message displays in the lower-left corner of the screen.
     

### Okta Group Attribute Configuration

JupiterOne recommends adding a custom group attribute to the JupiterOne app profile in your IdP account (such as Okta). In Okta, go to **Directory > Profile Editor**, open the **JupiterOne User** profile, and click **Add Attribute**. Enter `jupiterone_groups` for the **Display name** and **Variable name**, set **Attribute type** to **Group**, and click **Save**.

An example in Okta:

![okta-app-profile-editor](/assets/images/okta-app-profile-editor-57552f5a15b499f1ba608df63b82bc86.png)

You can then use this custom app attribute to assign group memberships to your users based on their IdP group assignments. Set the value on the groups assigned to the app: on the app's **Assignments** tab, click **Assign > Assign to Groups**, click **Assign** next to a group, enter a comma-separated list of JupiterOne group names in **jupiterone\_groups**, and click **Save and Go Back**.

An example in Okta:

![okta-app-group-assignment](/assets/images/okta-app-group-assignment-394cecbe5ea4e643d87a140ea0501623.png)

## Microsoft Entra ID Configuration

To configure SSO for Microsoft Entra ID (formerly Azure AD), you must be able to create enterprise applications in your tenant. In addition, ensure you can access the SSO URL and your Audience URI before proceeding.

1.  In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID > Enterprise apps** and click **New application**.
    
2.  Click **Create your own application**, enter a name such as JupiterOne, select **Integrate any other application you don't find in the gallery (Non-gallery)**, and click **Create**.
    
3.  In the app, go to **Single sign-on** and select **SAML**.
    
4.  Click **Edit** on **Basic SAML Configuration**:
    
    -   Under **Identifier (Entity ID)**, click **Add identifier** and enter your `Audience URI`.
    -   Under **Reply URL (Assertion Consumer Service URL)**, click **Add reply URL** and enter your `SSO URL`.
    -   Click **Save**.
5.  Click **Edit** on **Attributes & Claims**. Delete the default claims under **Additional claims**, then click **Add new claim** for each of the following. Leave **Namespace** empty. Only `email` is required.
    
    | Name | Source attribute |
    | --- | --- |
    | `email` | `user.mail` |
    | `family_name` | `user.surname` |
    | `given_name` | `user.givenname` |
    | `name` | `user.displayname` |
    | `group_names` | `user.assignedroles` |
    
    ![azure-ad-attribute-mappings](/assets/images/sso-azure-user-attr-claims-3e41b960f074e7009458bb4ec9822e79.png)
    
6.  On the **Single sign-on** page, under **SAML Certificates**, copy the **App Federation Metadata Url**.
    
7.  Paste the link into the **SAML Metadata Document URL** field in JupiterOne, and click **Save**.
    

### Entra ID Group Assignment

The `user.assignedroles` → `group_names` claim sends the app roles assigned to a user, and JupiterOne maps each role to the JupiterOne group with the same name (case-sensitive).

![azure-ad-app-group-assignment](/assets/images/sso-azure-auto-assign-groups-33058a3636c6281971bfa6d56bb36424.png)

To create an app role for each JupiterOne group:

1.  Go to **Entra ID > App registrations**, open the JupiterOne app (under **All applications**), and click **App roles**.
    
2.  Click **Create app role**. Enter the JupiterOne group name, such as `Administrators`, in **Display name** and **Value**, select **Users/Groups** for **Allowed member types**, enter a description, and click **Apply**.
    

To assign a role, go back to the enterprise app, open **Users and groups**, click **Add user/group**, select the users or groups, select the role, and click **Assign**.

![User assigned Azure AD App role](/assets/images/sso-azure-app-user-and-groups-c40e46d27ab228d8b96db6a008a68659.png)

> **INFO**
> 
> Read [Microsoft's documentation](https://learn.microsoft.com/en-us/entra/identity-platform/howto-add-app-roles-in-apps) for more information on adding app roles and assigning them to users and groups.

## Google Workspace Configuration

Before beginning a configuration through Google Workspace, ensure you have access to the SSO URL and your audience URI. Go to the [Google Admin Console](https://admin.google.com/ac/apps/unified?hl=en).

1.  From the **Add App** dropdown menu, select **Add custom SAML app**.
2.  In the App name field, enter JupiterOne.
3.  Click **DOWNLOAD METADATA** to download an XML metadata file to use later.
4.  Paste your `SSO URL` in the ACS URL field.
5.  In the **Entity ID** field, paste your `Audience URI`. In the Name ID format field, select **EMAIL**, and select **Primary email** in the Name ID field.
6.  When mapping directory attributes, ensure you use the following names in the App attributes fields. group\_names is optional.

-   _Primary email_ > `email`
-   _Last name_ > `family_name`
-   _First name_ > `given_name`

6.  Paste the downloaded XML metadata file contents into the SAML Metadata File field.

## Current Limitations

### IdP-initiated sign-on flow is not supported

JupiterOne uses Amazon Cognito service to manage authentication, including SSO. Cognito currently does _not_ support IdP-initiated sign-on. This means you can _not_ click on the app icon in your IdP account (such as JumpCloud, Okta, OneLogin). Instead, you must initiate single sign-on by going to your JupiterOne vanity (custom) URL or your account sign-in URL:

JupiterOne vanity URL:

```text
https://<your_j1_subdomain>.apps.us.jupiterone.io
```

JupiterOne account login URL:

```text
https://login.us.jupiterone.io/account/<your_j1_account_id>
```

These URLs redirect to your configured SSO provider for authentication.

You can find your J1 account ID by running the following query:

```j1ql
Find jupiterone_account as a return a.accountId
```

**Workaround**

If your SSO provider supports configuring a bookmark or secure web authentication (SWA) app, you can work around this limitation by doing the following:

-   Hide the app icon to users for the configured JupiterOne SAML SSO app.
-   Configure a Bookmark/SWA app with your JupiterOne account URL and assign it to the same users and groups that are assigned the JupiterOne SAML app.

## Troubleshooting

Different SSO providers have varying UIs and nomenclature, therefore, ultimately the SAML response and attribute statement should look similar.

### **Common Problems**

**Infinite Redirect Loop**

An infinite redirect loop can occur if the SAML subject is incorrect or missing or if the required SAML attribute `email` (case-sensitive) is not present.

**SAML Subject**

A common problem during SSO configuration is an incorrect SAML subject. Here is an example of a correct subject:

```xml
<saml2:Subject>
    <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">john.smith@example.com</saml2:NameID>
    ...
</saml2:Subject>
```

**SAML Attribute Statement**

Another common problem during SSO configuration is an incorrect SAML attribute statement. An example of a correct attribute statement is:

```xml
<saml2:AttributeStatement>
    <saml2:Attribute Name="email">
        <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">john.smith@example.com</saml2:AttributeValue>
    </saml2:Attribute>
    <saml2:Attribute Name="family_name">
        <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">Smith</saml2:AttributeValue>
    </saml2:Attribute>
    <saml2:Attribute Name="given_name">
        <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">John</saml2:AttributeValue>
    </saml2:Attribute>
    <saml2:Attribute Name="group_names">
        <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">Administrators,Users</saml2:AttributeValue>
    </saml2:Attribute>
</saml2:AttributeStatement>
```

**Viewing the SAML Response**

To view the SAML response, you can use browser plugins to capture the POST to `/saml2/idpresponse`. For example, in the Chrome browser the plugin, you can use [SAML-tracer](https://chrome.google.com/webstore/detail/saml-tracer/mpdajninpobndbfcldcmbpnnbhibjmch?hl=en) to decode and view the SAML response and, therefore, the SAML attribute statement.

The following is an example of what SAML-tracer looks like after logging in by SSO. The `SAML` tab is active to view the XML. Calls that have SAML are also flagged with a yellow `SAML` tag on the right of the HTTP request.

![SAML-tracer](/assets/images/saml-tracer-example-ed92c45cc89590c5daa2c71044d67250.png)

---

Source: /features/admin/scim2

# SCIM 2.0 in JupiterOne

JupiterOne supports SCIM 2.0 (System for Cross-domain Identity Management) following the protocol defined by the IETF. SCIM is an industry-standard protocol designed to simplify user identity management tasks in a multi-domain environment.

With SCIM 2.0 support, you can keep JupiterOne in sync with your identity provider by managing group membership, provisioning, and deprovisioning all through the IdP.

## Key Benefits of SCIM

-   **Automated User Provisioning**: SCIM support allows administrators to automatically provision user accounts within JupiterOne when users are added to the identity provider. This eliminates the need for manual user account creation, reducing the chances of human errors and saving valuable time.
    
-   **User Deprovisioning**: When a user is removed from the identity provider, SCIM ensures that the user's access to JupiterOne and associated resources is promptly revoked, maintaining security and compliance by preventing lingering access.
    
-   **Real-time User Sync**: SCIM enables real-time synchronization of user identity information including group membership, ensuring that changes made in the identity provider are immediately reflected in JupiterOne. This ensures consistency and accuracy in user access control.
    

## Setting Up SCIM with you IdP in JupiterOne

### Prerequisites

1.  Confirm that your IdP supports SCIM 2.0 protocol. JupiterOne does not support SCIM 1.0.
2.  Confirm that your IdP supports SCIM authentication by API Bearer Token. J1 does not support basic auth or OAuth with SCIM.
3.  SAML SSO is required before setting up SCIM. Follow these steps to enable SP-initiated SSO: [How to Configure SAML SSO Integration with JupiterOne](/features/admin/saml-sso.md).

### Common steps

No matter your IdP integration, there are some common steps that you will need to take within JupiterOne.

#### Generating an API Token

As previously stated, JupiterOne supports authentication through an API Bearer Token header. You can generate one through code or through the JupiterOne UI. More information can be found here: [Authentication](/api/authentication.md). We recommend generating an account level api token (as opposed to a user level token) for SCIM.

> Note: the max Time To Live for an API token is 365 days. You will need to figure out your own token rotation strategy that is either manual or using our api.

#### SCIM Endpoint

The endpoint URL for JupiterOne SCIM is: `https://api.us.jupiterone.io/iam/scim/v2`.

#### In the Identity Provider

Once confirming support of SCIM 2.0 by your IdP, follow their SCIM setup instructions. You can see example instructions for integrating with Okta below.

> **NOTE**
> 
> JupiterOne’s support of SCIM allows for Create/Read/Update/Delete actions from the Identity Provider (IdP) to JupiterOne. JuptierOne’s support of SCIM does not permit the reverse action of Create/Read/Update/Delete from JupiterOne to the Identity Provider.

### Using SCIM alongside SAML SSO

When SCIM is the source of truth for users and groups—for example, when provisioning runs from a separate Microsoft Entra ID app while SAML SSO runs from another—every SSO sign-in arrives without a `group_names` claim. In this setup, turn off **Assign default groups to SSO users without group claims** in **Settings > Security & Access**. See [Admin settings](/features/admin/admin-settings.md) for details.

> **NOTE**
> 
> With this switch off, SSO sign-ins that carry no `group_names` claim never change SCIM-managed group memberships, and users must be provisioned by SCIM before they can sign in. Sign-ins that do carry a `group_names` claim still sync groups as usual.

### Example: JupiterOne SCIM support through Okta

Following the [SCIM setup instructions](https://help.okta.com/en-us/Content/Topics/Apps/Apps_App_Integration_Wizard_SCIM.htm) from Okta:

Log in to Okta (IdP) as an administrator and follow these steps:

1.  After setting up your SAML SSO Integration, navigate to that application in Okta.
    
2.  Click on the **Provisioning** tab.
    
3.  Top Level Integration Settings:
    
    -   Click on the **Integration** option in the **Settings** nav on the left.
        
    -   Click **Edit**.
        
    -   Set **SCIM connector base URL** to `https://api.us.jupiterone.io/iam/scim/v2`
        
    -   Set **Unique identifier field for users** to `email`
        
    -   Enable the following **Supported provisioning actions**:
        
        > Note: JupiterOne does not support “Import New Users and Profile Updates”
        
        1.  **Push New Users**
        2.  **Push Profile Updates**
        3.  **Push Groups**
    -   Set **Authentication Mode** to `HTTP Header`
        
        > Note: JupiterOne does not support basic authentication or Oauth with SCIM.
        
    -   Set `Authorization` to an account level API Token as described above.
        
4.  To App Settings:
    
    -   Click on the **To App** option in the **Settings** nav on the left.
    -   Click **Edit**
    -   Enable the following:
        1.  Create Users
        2.  Update User Attributes
        3.  Deactivate Users

---

Source: /features/admin/user-settings

# User settings

JupiterOne provides each user the ability to access, view, and customize various areas of their JupiterOne profile. From within your profile settings, you can access your profile, review permissions, manage notifications, and create personal API Tokens.

![JupiterOne user settings](/assets/images/user-settings-88afce9279b60f07d91ef1339526356f.png)

## Accessing your profile settings

When logged in to the JupiterOne platform, you can access your profile by clicking Settings (the cog icon) in the top right and selecting **Profile**.

There are several actions that can be made while viewing your profile. From here, you can:

-   Change your display name
-   Review account details, such as User ID and email
-   Find your current app permissions

## Notification preferences

While in your profile settings, you can change your notification preferences in the **Notifications** tab. Here you can toggle your preferred notifications by area: Compliance, Policies, J1 Rapid Response, and Alerts.

![JupiterOne user notification preferences](/assets/images/user-notifications-8e2c007e48f1b96a827a126c7671c2b8.png)

In addition to choosing which notifications you'd like to receive, you can specify how you would like to receive the notifications. JupiterOne can send notifications through the app (found under the the bell alert icon), notify via email, and additionally supports sending notifications through Slack.

> **INFO**
> 
> See [our Slack documentation](/integrations/directory/slack.md) for more information regarding configuring our Slack integration to receive notifications.

## Personal API Tokens

You can create and access personal API Tokens within your Account settings. From the API Token tab, you can create, view, and delete any tokens you have created.

**When creating a new token**, be sure to specify a token name and the number of days before the token expires.

> **WARNING**
> 
> Be sure to copy the new API Token value when creating a token as it is the only time the token will be displayed for you to copy the value.

To delete an API Token, select the trash icon on the right of the table. Note that this action cannot be undone.

JupiterOne workspace Admin can view all User API tokens from within the Admin settings panel. You can find more information on the [Admin settings options here](/features/admin/admin-settings.md).

---

Source: /features/admin/whats-new-in-search

# What's new in Search

**Release Date:** June 2026

Several improvements to how you find, explore, and query your data.

### What is New

| Change | Meaning |
| --- | --- |
| Instant results in search anywhere (⌘K) | Search anywhere now uses full-text search to scan your entities and give you instant results. |
| Refreshed search bar | Autocomplete with property value fetching. Reduced menu noise while writing a query. |
| AI returns multiple query candidates | Type a plain-English question and get several query options back instead of one. |
| Inspector available everywhere | Open the inspector from anywhere in the app, not just query results. Every traversal stays in the URL. |
| Inspect relationships | Relationships can be expanded from anywhere, not just the graph canvas. |
| Graph canvas improvements | Fidelity scales with zoom. Hover to spotlight. Significantly faster. |
| AI assistant with context | In supported views, the assistant is aware of what you're looking at. Start a conversation about it without leaving the page. |
| Dark mode | Supported throughout the app. Set it in Preferences. |

---

## Search

**⌘K from anywhere.** A global search palette is now available from every page. Type a CVE, a user, a host, a rule — start typing and go. From a result, open the entity directly in the inspector.

![Search Anywhere palette](/assets/images/search-cmd-k-9beb7f7ce58b436219b4861faa71b25a.png)

**Cleaner search bar.** Default state is your recently run queries — no more menu on focus. Start typing and they dismiss. Press the right arrow to browse recent queries inline, or go to the Query History page to search and re-run.

**Smarter autocomplete.** The editor now surfaces token types and fetches real property values as you type, alongside a reference panel showing class documentation, properties, and relationships.

![Autocomplete with property value fetching](/assets/images/search-autocomplete-2c5a3f4de20285cdc7e8ef7281faed1d.png)

**AI returns more options.** Input that doesn't start with `FIND` defaults to AI mode. You now get several query candidates back instead of one.

![AI query candidates](/assets/images/search-ai-candidates-196fb9a8086c15bc48daf009abc886db.png)

**Results are easier to work with.** Resize and reorder columns by drag. Enter selection mode to pick rows, then bulk-set tags, owners, or open everything in the inspector together.

**Better query authoring.** When writing a query for a rule, question, or control, you now get a full-screen view that lets you iterate and inspect results before saving it to the form.

---

## Query builder

The query builder now lands you with your inventory selection and a heatmap showing the distribution of assets in your environment. As you build, your query renders as a live graph — the actual traversals and relationships in your data. The generated J1QL is less of a focus and lets you focus on your data model and filtering results.

![Query builder heatmap](/assets/images/query-builder-heatmap-9a2e238312613cab4383225955a89dd0.png)

![Query builder live graph](/assets/images/query-builder-graph-5b16596f2fdec318f15b89711472cd9a.png)

---

## Questions library

Questions now have their own dedicated page with your account's questions and the JupiterOne library in separate tabs. Trend analysis is available on question detail pages when enabled.

![Questions library](/assets/images/questions-library-2e783f3315767e32cbb62b9fd595fefd.png)

---

## Inspecting your graph

![Inspector open alongside graph](/assets/images/inspector-8eda0d31c486b196fd8ebe56dc67c150.png)

The inspector is now available from anywhere in the app — not just within a query result. Every entity or relationship you open pushes onto a navigation stack. The full traversal stays in the URL, so you can share exactly where you are or hand it off to a teammate, or open it as a graph to see a birds-eye view of what you just walked.

![Inspector overflow menu — open as graph, copy link](/assets/images/inspector-overflow-0966c18ca72c55eaf7988c5ba5a5d9b3.png)

Relationships are first-class — you can inspect them directly, not just entities. For entities with a dedicated in-app experience (ControlTest, Framework, Vulnerability, Rule), you can route directly to that page from the inspector.

The Overview tab includes a 1-hop neighborhood graph, openable in Search for the full experience.

---

## AI assistant

In supported views, the AI assistant is aware of what you're looking at. With the inspector open, you can start a conversation about the entity you're viewing — the assistant has context of the active entity or query result, and can link you directly to other entities in its responses.

![AI assistant with query results in context](/assets/images/ai-query-results-89cbc8eef4fb0705f2e8b91eec42b778.png)

![AI assistant with entity context](/assets/images/ai-entity-context-533bcd8a5d4bb46823a00124c0255fdd.png)

---

## Graph canvas

![Graph canvas](/assets/images/graph-canvas-36348164db243bc9d451014606cd7e0b.png)

The canvas now scales fidelity with zoom — less noise when you're zoomed out and more detail as you move in.

Hovering a node spotlights it and fades everything else. Clicking selects. For pack nodes, you can search members, peel them off individually, or expand in batches of 10.

Performance is significantly improved — snappier and more responsive than before.

---

## Preferences

A new Preferences page lets you set your timezone, switch between light and dark mode, and choose your number and date format.

![Preferences page](/assets/images/preferences-66ae434be1dac28280466725719ca10d.png)

---

## Removed

-   `${me}` variables in J1QL
-   Critical asset badge
-   "Problem" indicator on entities (`hasProblem`)
-   Bulk entity upload in the UI — use the API for bulk ingestion
-   Editing entity properties from the UI — use the API
-   Deleting entities from the UI — use the API
-   Account logo setting

---

Source: /features/admin/whats-new-in-the-jupiterone-app

# What's new in the JupiterOne app

**Release date: October 2026**

Usability updates that change how you get around JupiterOne. The new search palette reaches the whole platform from one box, a top bar puts it above every page, and the inspector and the AI assistant now resize to fit your screen.

> **INFO**
> 
> **No.** These updates are on for every account. Select **Search** at the top of any page, or press **⌘K** (**Ctrl+K** on Windows and Linux).

## What is new

| Feature | What it means for you |
| --- | --- |
| **Search palette** | One search box for pages, integrations, asset classes and types, anything in your graph, J1QL queries, and questions for the AI assistant |
| **Top bar** | **Search**, **Ask AI**, and your account menu sit above every page, in the same place everywhere |
| **Resizable inspector** | Drag the inspector wider or narrower, snap it to full width, or pull it closed. It keeps the width you choose |
| **Resizable AI assistant** | Drag the assistant wider or narrower, pull it left to open it as a full page, or pull it right to tuck it away while it works |

## Search palette

Getting somewhere in JupiterOne used to mean knowing where it lived: which page, which menu, or which J1QL query to write. Now you type what you are looking for.

Select **Search** at the top of any page, or press **⌘K**, and type any of these:

| What you type | What you get |
| --- | --- |
| A page name, such as `alerts`, `frameworks`, or `asset criticality` | The page. Select it to go there |
| An integration, class, or type, such as `aws` or `User` | The AWS integration with matching types and classes, or every `User` asset |
| A name, a property value, or a UUID | Matching entities from your graph. Control tests, rules, questions, alerts, and attestations are entities in your graph, so they come up too |
| A J1QL query, such as `FIND aws_s3_bucket` | **Run query** opens it on the query page |
| A question in plain words | **Ask AI** sends it to the AI assistant |

Before you type anything, the palette shows the pages you opened recently and a few places from each part of the app.

Entities from your graph open in the inspector together with the other matches, so you can step through them. To see every match as a result table, select **Search the graph for "..."**.

Some searches to try:

-   `kubernetes`: the Kubernetes integration, Kubernetes types, and matching entities in one list
-   A UUID: the entity with that ID
-   Part of a control test's name: the control test
-   "Which hosts have critical vulnerabilities?": a new conversation with the AI assistant

## Top bar

**Search**, **Ask AI**, and your account menu now sit in a bar above every page. Select your avatar to open the account menu, where you can switch between the light and dark themes or open your profile.

## Resize the inspector

Drag the handle on the inspector's left edge to make it wider or narrower.

-   **Your width sticks.** The inspector opens at the width you last left it in this browser.
-   **Full width.** Keep dragging left past the widest point, and release to snap the inspector to full width. A strip of the page stays visible beside it.
-   **Pull to close.** Drag the handle right past the narrowest point, and release to close the inspector.
-   **Reset.** Double-click the handle to return to the default width.

From the keyboard, focus the handle and use the arrow keys to resize (hold **Shift** for larger steps), or **Home** and **End** to jump to the narrowest and widest width.

## Resize the AI assistant

Drag the handle on the assistant panel's left edge to make it wider or narrower.

-   **Full page.** Keep dragging left past the widest point, and release to open the conversation as a full page.
-   **Tuck it away.** Drag right past the narrowest point, and release to tuck the assistant away. It keeps working, and the **Ask AI** button shows its progress, then reads **View response** when the answer is ready.

To close the assistant from the side panel or the full page, select **X**.

For more about the assistant, see [What's new in the AI assistant](/features/jupiterone-ai/whats-new-in-ai-assistant.md).

## Getting started

1.  Select **Search** at the top of any page, or press **⌘K**
2.  Type a page, an integration, an entity name or UUID, a J1QL query, or a question
3.  Select a result to go there
4.  Drag the left edge of the inspector or the AI assistant to fit them to your screen

---

Source: /features/ai-asm/ai-asm-1-0

# AI-ASM 1.0 Release Notes

**Release date: June 2026**

AI Attack Surface Management (AI-ASM) 1.0 gives you a single, governed view of the non-human identities (NHIs) in your environment and the AI usage hiding among them. As teams adopt AI assistants, agents, and platform services, machine identities — service accounts, API keys, OAuth apps, bots, and roles — multiply far faster than the human identities security teams traditionally track, and many of them are AI-powered. AI-ASM discovers those identities through the integrations you already have, automatically flags the AI-related ones, shows what each can reach, ranks them by risk, and governs them against an out-of-the-box framework mapped to AI and security regulations.

## What is new in AI-ASM 1.0

| Feature | What it means for you |
| --- | --- |
| Non-human identity discovery | Every NHI across your cloud, SaaS, and source-control integrations is brought into the graph automatically — no manual inventory |
| Automatic AI identity detection | NHIs associated with AI agents, models, and platforms are flagged, each with a confidence level and the detection method that matched |
| AI-ASM dashboard | A single landing view summarising your AI attack surface — AI identities, frameworks at risk, failing controls, platforms, and NHI types |
| Top risk AI identities | AI identities ranked by what they can reach, so the highest-impact identities surface first |
| Data reachability | See the data stores, repositories, databases, packages, vaults, tables, and disks each identity can reach |
| AI inventory | A filterable inventory of every NHI, with an AI-only view, detection confidence, ownership, and per-identity reach |
| NHI governance framework | An out-of-the-box framework that governs AI and non-human identities against standards including NIST AI RMF, the EU AI Act, NIS2, and DORA |

## Non-human identity discovery

AI-ASM brings the non-human identities in your environment into the JupiterOne graph using the integrations you already have configured. A **non-human identity (NHI)** is any digital identity that is not a person — a service account, machine credential, secret, OAuth app, bot, certificate, API key, webhook, or CI/CD identity.

Because NHIs are first-class graph entities, they participate in queries, controls, and relationships like any other asset. The dashboard summarises the full population at the top of the page, alongside the AI subset:

-   **Total NHIs** — every non-human identity discovered in your environment
-   **AI NHIs** — the subset classified as AI-related
-   **Reaching data** and **Reachable assets** — how many identities can reach data, and how many assets they can reach in total

![AI-ASM dashboard with summary metrics, frameworks at risk, AI platforms, and NHI type breakdown](/assets/images/ai-asm-dashboard-0259d318e50789ff6147f810bdb40b9e.png)

## Automatic AI identity detection

AI-ASM evaluates every discovered NHI against a set of detection heuristics and records the result on the identity, so you can see not just _that_ an identity is AI-related but _why_.

Each AI identity carries:

-   **A confidence level** — `confirmed` when there is signed evidence, or `high`, `medium`, or `low` for heuristic matches
-   **A detection method** — the signal that matched, such as a Slack bot or app name, an API key named for an AI provider, an AI platform service-account or role pattern, or a display-name pattern
-   **A platform** — the AI vendor or platform the identity belongs to, such as Anthropic, OpenAI, AWS Bedrock, or AWS SageMaker
-   **A category** — the kind of AI usage, such as a **Foundation** model provider or an **AI SaaS** application

The **AI platforms** and **NHI types** panels on the dashboard break your AI identities down by platform and by identity category, so you can see at a glance where your AI usage is concentrated.

## Risk-ranked dashboard

The **Top risk AI identities** table ranks your AI identities by what they can reach. Each row shows the identity, its platform, NHI type, and detection confidence and method, followed by a breakdown of reachable assets — **Stores**, **Repos**, **DBs**, **Pkgs**, **Vaults**, **Tables**, and **Disks** — and a **Total** reach count. Identities with the broadest reach surface first, so you can focus on the ones that would cause the most damage if compromised.

![Top risk AI identities ranked by data reachability, showing platform, NHI type, detection, and reach counts](/assets/images/ai-asm-top-risk-identities-904ac698686f41fb84e56c1b87fd4ad3.png)

> **TIP**
> 
> Use the reach breakdown to triage. An AI identity that can reach hundreds of repositories or data stores is a far higher priority than one with no reach, even when both have failing controls.

## AI inventory

The **Inventory** view lists every non-human identity in a single sortable, filterable table. Switch between your full NHI population and just the AI identities with the **AI only** / **Non-AI only** filter, and narrow further by type, platform, category, detection confidence, or organisational unit.

Each identity shows its class and type, platform, NHI type, category, AI detection confidence and method, owner, data reach, status, and the number of failing controls against it. AI identities are marked with an **AI** badge. Use **Export** to download the current view, respecting your active filters.

![AI inventory filtered to AI identities, showing platform, NHI type, category, AI detection, and owner](/assets/images/ai-asm-inventory-744f14303f551d3fdb6e967a3552dccc.png)

Select any identity to open its detail panel, which includes an AI-generated summary of the identity, its **AI context** (platform, detection confidence, and detection method), when it was first and last seen, and its neighbours and relationships in the graph.

![Identity detail panel with an AI-generated summary, AI context, and graph relationships](/assets/images/ai-asm-nhi-detail-69e0cfa6270d7b9415831d8fae6b6a83.png)

## NHI governance framework

AI-ASM 1.0 ships with the **AI Attack Surface Management (AI-ASM) — NHI Governance Framework**, an out-of-the-box framework that applies the [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md) model to your non-human and AI identities. Its controls cover common governance obligations, including:

-   **Every NHI has an assigned owner** — each identity must have a designated human owner accountable for its security posture and lifecycle
-   **Shadow AI identities are flagged** — AI-powered identities provisioned outside approved channels are detected and surfaced
-   **AI-powered NHIs have a documented purpose** — each AI identity must have a documented business justification and approved use case
-   **Access control policies cover NHIs** — non-human identities are included in access control governance alongside human identities

The controls map to recognised standards and regulations — including NIST AI RMF, the EU AI Act, NIS2, and DORA — so governing your AI identities contributes directly to your compliance posture. Because they run on the same engine as the rest of CCM, their results appear in the AI-ASM dashboard, the controls views, and your framework compliance scores.

The dashboard's **Control status** section brings these controls together. Filter by **AI only**, framework, priority, or organisational unit; each control card shows the control description, its priority, the framework it belongs to, how many identities it affects, and the requirements it maps to.

![Control status section showing AI governance controls with priority, framework, and affected identity counts](/assets/images/ai-asm-control-status-e774cccab7480fe0afea2624c20c1cf4.png)

## Getting started

**If you already use JupiterOne integrations:** AI-ASM works with the integrations you have configured — no new setup is required to start discovering identities.

1.  Navigate to **AI-ASM** > **Dashboard** to see your AI attack surface, the frameworks it affects, and your highest-risk identities.
2.  Open **AI-ASM** > **Inventory** and filter to **AI only** to review the AI identities in your environment, their detection confidence, and what they can reach.
3.  Assign owners to unowned identities, and use the **Control status** section to address failing governance controls.

**If you are new to JupiterOne:** Connect the integrations that hold your identities — cloud platforms, SaaS applications, and source control — so JupiterOne can discover your NHIs. The AI-ASM dashboard and inventory populate automatically as identities are ingested.

For full feature documentation, see [AI Attack Surface Management](/features/ai-asm/ai-attack-surface-management.md).

---

Source: /features/ai-asm/ai-attack-surface-management

# AI Attack Surface Management

JupiterOne AI Attack Surface Management (AI-ASM) gives security and governance teams a single view of the non-human identities (NHIs) in their environment, automatically flags the ones that are AI-related, and shows what each identity can reach across your connected systems.

As teams adopt AI assistants, agents, and platform services, the number of machine identities — service accounts, API keys, OAuth apps, bots, and roles — grows far faster than the human identities security teams traditionally track. AI-ASM brings these identities into the JupiterOne graph, classifies which ones are AI-powered, and governs them against the same control framework model used by [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md).

## Overview

AI Attack Surface Management enables your team to:

-   **Discover every non-human identity** across your integrated cloud platforms, SaaS tools, and source control, without manual inventory work
-   **Identify AI identities automatically** using detection heuristics that flag NHIs associated with AI agents, models, and AI-powered workloads
-   **See what each identity can reach** — the data stores, repositories, databases, packages, vaults, tables, and disks an identity has access to
-   **Prioritise by risk** so the identities with the broadest reach and the most failing controls surface first
-   **Govern AI usage** against an out-of-the-box NHI governance framework mapped to standards such as NIST AI RMF, the EU AI Act, NIS2, and DORA
-   **Find shadow AI** — AI-powered identities provisioned outside approved channels

![AI-ASM dashboard showing summary metrics, frameworks at risk, AI platforms, NHI type breakdown, and failing controls](/assets/images/ai-asm-dashboard-0259d318e50789ff6147f810bdb40b9e.png)

## Data model

AI-ASM is built on the **non-human identity (NHI)** — any digital identity that is not a person, such as a service account, machine credential, secret, OAuth app, bot, certificate, API key, webhook, or CI/CD identity. NHIs are discovered through your existing JupiterOne integrations and stored as entities in the graph, so they participate in queries, controls, and relationships like any other asset.

Each NHI carries a set of properties that AI-ASM uses to classify and govern it:

| Property | Description |
| --- | --- |
| `nhiType` | The category of identity — for example `service_account`, `secret`, `oauth_app`, `bot`, `service_role`, `service_linked_role`, or `credential` |
| `isAi` | Whether the identity is associated with an AI agent, model, or AI-powered workload |
| `aiConfidence` | How strong the evidence is that the identity is AI-related: `confirmed`, `high`, `medium`, or `low`. See [Confidence ratings](#confidence-ratings) |
| `aiDetectionMethod` | The detection rule that classified the identity as AI-related, for example `inherent_resource` or `api_key_name`. See [Detection methods](#detection-methods) |
| `aiPlatform` | The AI platform or vendor the identity belongs to — for example Anthropic, OpenAI, AWS Bedrock, or AWS SageMaker |
| `owner` | The human or team accountable for the identity |
| `nhiOwnerStatus` | Ownership state used by governance triage: `assigned`, `unassigned`, or `orphaned` |

Because NHIs are first-class graph entities, you can query them directly in [J1QL](/j1ql.md):

```j1ql
FIND NHI WITH isAi = true AND aiConfidence = ('confirmed' OR 'high')
```

> **NOTE**
> 
> `aiConfidence` is a string value (`confirmed`, `high`, `medium`, or `low`), not a number. Compare it against those literal values rather than a numeric threshold.

## How AI-ASM detects AI identities

AI-ASM checks every discovered NHI against a catalog of known AI platforms and records the result on the identity. Each AI identity shows a **confidence** rating and the **detection method** that matched, so you can see why it was classified as AI-related.

Detection is deterministic and based on the identity itself. AI-ASM compares the identity's entity type and identifying properties (its name, display name, email, OAuth client ID, or GitHub App slug) against the patterns for each platform. It does not read the values of secrets or keys, and it does not use an AI model to judge individual identities.

Detection runs in the background after your integrations sync. A newly discovered identity might take some time to show AI detection results.

Identities are also grouped into a **category** that describes the kind of AI usage: **Foundation** (model and inference providers), **Code assistant**, **AI SaaS**, or **Agent framework**.

### Confidence ratings

The confidence rating tells you how strong the evidence is that an identity is AI-related. It is stored on the identity as `aiConfidence`, and it appears in the **AI detection** column of the inventory, in the **Top risk AI identities** table, and in the identity detail panel.

| Rating | What it means | Detection methods | Examples |
| --- | --- | --- | --- |
| **Confirmed** | An exact match proves the identity belongs to an AI platform. Either the entity type is inherently an AI resource, or an exact identifier matches a known AI application. No name interpretation is involved. | `inherent_resource`, `oauth_client_id`, `github_app_slug` | An `aws_bedrock_agent`, `aws_sagemaker_endpoint`, or `azure_machine_learning_workspace` entity. A GitHub App installed with the slug `copilot` or `coderabbitai`. |
| **High** | The identity follows a naming convention specific to an AI provider. Secret and key names, and service account names and emails, are usually set on purpose, so they are a strong signal. | `api_key_name`, `service_account_pattern` | A repository secret named `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`. A Google Cloud service account whose email contains `-aiplatform@`. An AWS IAM role named `AmazonSageMaker-ExecutionRole-…`. |
| **Medium** | The identity's display name, Slack bot name, or cloud resource name mentions an AI product. Names are free text, so they are a useful signal but can produce false positives. | `display_name_pattern`, `slack_bot_name`, `cloud_resource_pattern` | An Okta application labelled `ChatGPT Enterprise`. A Slack bot named `Claude`. A Google Cloud API service named `aiplatform.googleapis.com`. |
| **Low** | Weak or indirect evidence. Treat it as a lead to investigate, not a classification to rely on. | Supplementary rules only (see below) | The built-in catalog does not assign **Low**. You see it only when a supplementary detection rule rates its own evidence as weak. |

AI-ASM evaluates the detection methods from strongest to weakest and stops at the first match. An identity's rating therefore always reflects the strongest evidence available. For example, a secret named `OPENAI_API_KEY` is rated **High** through `api_key_name`, even though its name would also match a weaker pattern.

The confidence rating is not a risk score. It says nothing about what the identity can access or how likely it is to be misused. To prioritise by risk, use data reach and failing controls, as shown in the **Top risk AI identities** table.

> **NOTE**
> 
> An identity that matches no detection rule has no `isAi` or `aiConfidence` value. A missing rating means AI-ASM found no evidence. It does not prove the identity is not AI-related, for example a key for an AI provider that is not yet in the catalog, or a secret with a generic name such as `API_KEY`.

### Detection methods

The detection method shows which rule matched. It is stored as `aiDetectionMethod` and is shown next to the confidence rating in the **AI detection** column.

| Method | Rating | What matched |
| --- | --- | --- |
| `inherent_resource` | Confirmed | The entity type is always AI-related, such as an AWS Bedrock agent, AWS SageMaker model or endpoint, Google Vertex AI model, or Azure Machine Learning workspace |
| `oauth_client_id` | Confirmed | The OAuth client ID or application ID of an Azure service principal, Okta application, or Auth0 client exactly matches a known AI application |
| `github_app_slug` | Confirmed | The slug of an installed GitHub App exactly matches a known AI application, such as GitHub Copilot or CodeRabbit |
| `api_key_name` | High | The name of a secret, access key, access token, or API key matches a provider's key naming convention, such as `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, or `AZURE_OPENAI_API_KEY` |
| `service_account_pattern` | High | The name or email of a service account or role matches a provider's naming convention, such as `AmazonBedrock…`, `AmazonSageMaker…`, or `…-aiplatform@…` |
| `display_name_pattern` | Medium | The display name or label of an application or service principal mentions an AI product, such as `OpenAI`, `ChatGPT`, or `Claude` |
| `slack_bot_name` | Medium | The name of a Slack bot mentions an AI assistant, such as `ChatGPT` or `Claude` |
| `cloud_resource_pattern` | Medium | The name of a cloud resource, such as a Google Cloud API service, mentions an AI service |

#### Supplementary detection rules

The built-in catalog is checked first. When an identity matches nothing in the catalog, AI-ASM also checks supplementary detection rules. JupiterOne reviews and approves these rules before they are used, and they cover AI platforms and naming conventions that are not yet in the catalog. Each rule applies only to the entity types it was written for, and it sets its own rating on the same **Confirmed**, **High**, **Medium**, **Low** scale.

Identities matched by a supplementary rule can show these additional detection methods: `oauth_app`, `github_app`, `inherent_identity`, `api_key_pattern`, `slack_app`, `service_account_pattern`, `display_name_pattern`, and `cloud_resource_pattern`.

### Using confidence ratings

Choose how much to rely on a rating based on what you need it for:

-   **Confirmed and High:** treat these as AI identities for governance, reporting, and control scope. False positives are rare.
-   **Medium:** check before you act on them. Open the identity to confirm that the name reflects real AI usage, such as an application that is actually an AI assistant, and not an unrelated resource that only mentions an AI product.
-   **Low:** treat these as leads for investigation.

To focus the inventory, use the detection confidence filter in **AI-ASM** > **Inventory**. You can query the same groupings in J1QL:

```j1ql
FIND NHI WITH isAi = true AND aiConfidence = ('confirmed' OR 'high')
```

```j1ql
FIND NHI WITH isAi = true AND aiConfidence = 'medium'
  AS n RETURN n.displayName, n._type, n.aiPlatformName, n.aiDetectionMethod
```

## The AI-ASM dashboard

The **Dashboard** is the landing view for AI-ASM. It summarises your AI attack surface and highlights where attention is needed.

**Summary metrics** across the top show:

-   **Total NHIs** — every non-human identity discovered in your environment
-   **AI NHIs** — the subset classified as AI-related
-   **Frameworks** — the number of frameworks with at least one failing control on an AI identity
-   **Controls** — the number of failing controls
-   **Reaching data** — the number of AI identities that can reach data
-   **Reachable assets** — the total number of assets those identities can reach

Below the metrics, the dashboard breaks the surface down into focused panels:

-   **Frameworks at risk** — frameworks with at least one failing control on an AI identity, so you can see which compliance obligations your AI usage affects
-   **Failing controls** — failing controls grouped and ordered by priority
-   **AI platforms** — a breakdown of AI identities by platform (for example Anthropic, AWS SageMaker, Foqal Agent, Intercom, OpenAI, AWS Bedrock, and Cursor)
-   **NHI types** — the distribution of identities across NHI categories such as bot, service account, secret, and the various role types

### Top risk AI identities

The dashboard ranks AI identities by risk in the **Top risk AI identities** table. Each row shows the identity, its platform, NHI type, and AI detection confidence and method, followed by a breakdown of what the identity can reach — **Stores**, **Repos**, **DBs**, **Pkgs**, **Vaults**, **Tables**, and **Disks** — and a **Total** reach count. Identities with the broadest reach surface at the top, so you can focus on the identities that would cause the most damage if compromised.

![Top risk AI identities table showing platform, NHI type, AI detection, and data reachability counts](/assets/images/ai-asm-top-risk-identities-904ac698686f41fb84e56c1b87fd4ad3.png)

### Control status

The **Control status** section at the bottom of the dashboard shows the controls that govern your AI identities. Filter by **AI only**, framework, priority, or organisational unit to focus the view. Each control card shows the control name and description, its priority, the framework it belongs to, the number of identities affected, and the number of requirements it maps to.

![Control status section showing AI governance controls with priority, framework, and affected identity counts](/assets/images/ai-asm-control-status-e774cccab7480fe0afea2624c20c1cf4.png)

## The AI inventory

The **Inventory** view lists every non-human identity in your environment in a single sortable, filterable table. Use the **AI only** / **Non-AI only** filter to switch between your full NHI inventory and just the AI identities, and filter further by type, platform, category, detection confidence, or organisational unit.

Each row shows:

| Column | Description |
| --- | --- |
| **Name** | The identity name, with an **AI** badge when the identity is AI-related |
| **Class** and **Type** | The graph class and entity type (for example `aws_iam_role`, `github_repo_secret`, `slack_user`) |
| **Platform** | The AI platform the identity belongs to, where known |
| **NHI type** | The identity category (bot, service account, secret, role types, and so on) |
| **Category** | The kind of AI usage, such as Foundation or AI SaaS |
| **AI detection** | The detection confidence and the method that matched |
| **Owner** | The human or team accountable for the identity |
| **Data reach** | A link into the graph and a count of reachable assets |
| **Status** | The identity's current status |
| **Failing controls** | The number of failing controls for the identity |

Use **Export** to download the current view, respecting your active filters.

![AI inventory filtered to AI identities, showing platform, NHI type, category, AI detection, and owner columns](/assets/images/ai-asm-inventory-744f14303f551d3fdb6e967a3552dccc.png)

### Inspecting an identity

Select any identity to open its detail panel. The panel includes an AI-generated summary of the identity, its **AI context** (platform, detection confidence, and detection method), when it was first and last seen, its neighbours in the graph, and its relationships — so you can understand what an identity is, why it was classified as AI, and what it connects to without leaving the view.

![Identity detail panel showing an AI-generated summary, AI context, and graph relationships](/assets/images/ai-asm-nhi-detail-69e0cfa6270d7b9415831d8fae6b6a83.png)

## Governing AI identities

AI-ASM ships with the **AI Attack Surface Management (AI-ASM) — NHI Governance Framework**, an out-of-the-box framework that applies the [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md) model to your non-human and AI identities. Its controls cover common governance obligations, such as:

-   **Every NHI has an assigned owner** — each identity must have a designated human owner accountable for its security posture and lifecycle
-   **Shadow AI identities are flagged** — AI-powered identities provisioned outside approved channels are detected and surfaced
-   **AI-powered NHIs have a documented purpose** — each AI identity must have a documented business justification and approved use case
-   **Access control policies cover NHIs** — non-human identities must be included in access control governance alongside human identities

These controls map to recognised standards and regulations — including NIST AI RMF, the EU AI Act, NIS2, and DORA — so governing your AI identities contributes directly to your compliance posture. Because the controls run on the same engine as the rest of CCM, their results appear in the AI-ASM dashboard, the controls views, and your framework compliance scores.

## Getting started

1.  Connect the integrations that hold your identities — cloud platforms, SaaS applications, and source control — so JupiterOne can discover your NHIs. AI-ASM uses the integrations you already have configured.
2.  Navigate to **AI-ASM** > **Dashboard** to see your AI attack surface, the frameworks it affects, and your highest-risk identities.
3.  Open **AI-ASM** > **Inventory** and filter to **AI only** to review the AI identities in your environment, their detection confidence, and what they can reach.
4.  Assign owners to unowned identities and review the **Control status** section to address failing governance controls.

## Related topics

-   [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md)
-   [What's new in AI-ASM 1.0](/features/ai-asm/ai-asm-1-0.md)
-   [J1QL query language](/j1ql.md)

---

Source: /features/assets/asset-criticality

# Asset criticality

Asset criticality classifies your assets by how much they matter to your business. You define a small set of ordered levels, such as crown jewels, high value, standard, and low impact, and each level is filled by J1QL queries. An AI agent can propose the whole setup from what JupiterOne knows about your environment. You review every level and query before anything takes effect, and JupiterOne then keeps every asset's level up to date as your environment changes.

Criticality levels feed the [Unified Vulnerability Management risk score](/features/vulnerability-management/risk-scoring.md), so vulnerabilities on your most critical assets rise to the top of the Prioritized view. Levels are also stored as properties on each asset, so you can use them in any J1QL query, alert rule, or dashboard.

## How asset criticality works

-   **Levels are ordered from most to least critical.** A setup has between two and six levels. Each level has a name you choose and a description of what losing those assets would mean to your business.
-   **Queries fill the levels.** Each level is defined by one or more J1QL queries. An asset joins a level when it matches any of that level's queries.
-   **The most critical match wins.** An asset that matches queries in more than one level gets the most critical of those levels.
-   **JupiterOne applies levels automatically.** Your levels run every hour. Each run writes the level onto every matching asset and removes it from assets that no longer match, so new assets are classified without any action from you.
-   **Unmatched assets stay unclassified.** An asset that no query matches carries no level.

Asset criticality is built for assets: hosts, devices, cloud resources, data stores, applications, identities, and similar entities. Findings, vulnerabilities, alerts, controls, and other record-like entities are not counted as assets, and the agent does not propose queries for them. A query you write classifies whatever entities it returns.

> **NOTE**
> 
> Smart classes you created before asset criticality was released, including a `CriticalAsset` smart class, were not migrated into asset criticality. To have yours migrated into your setup, contact your Customer Success team.

## Prerequisites

-   You need **Assets: Admin** with **Shared: Graph Data: Read**, or **Full Admin Access: Admin**, to view and manage asset criticality. **Vulnerabilities: Admin** does not grant access. See [App Level Permissions](/features/admin/access-controls.md#app-level-permissions).
-   For the agent to propose a setup, your integrations must have ingested data about your environment. The more of your environment JupiterOne sees, the better the proposal.

## Set up asset criticality

Navigate to **Assets > Asset criticality**. The first time you open the page, select how to start:

| Option | What it does |
| --- | --- |
| **Set up for me** | The agent studies your environment and proposes a complete setup. Recommended for most accounts. |
| **Start from our policy** | The agent reads your asset management or classification policy and turns it into a setup that matches your environment. |
| **Build it myself** | You define the levels and write the J1QL queries yourself. |

### Let the agent propose a setup

1.  Navigate to **Assets > Asset criticality**.
2.  Select **Set up for me**.
3.  Answer **Do you already have classification levels?**
    -   Select **No — start with the recommended model** to use four levels: Critical, High, Medium, and Low.
    -   Select **Yes — we have our own** to pick a common scheme, such as Tier 0–3, or to enter your own level names. Enter the names with the most critical level first. The agent uses your names everywhere.
4.  Click **Start analysis**. The analysis usually takes one to two minutes.
5.  When the analysis finishes, the **Review your setup** page opens. Nothing takes effect until you apply it.

### Start from your policy

If your organization already has an asset classification policy, a tiering standard, or a business impact analysis, the agent can use it as the starting point.

1.  Navigate to **Assets > Asset criticality**.
2.  Select **Start from our policy**.
3.  Click **Upload policy** and select your policy file, or paste the policy text into the text box. The file must be Markdown or plain text, up to 50,000 characters. Your browser reads the file, and only its text is sent to the agent.
4.  Answer **Do you already have classification levels?** If your policy names its levels, select **Yes — we have our own** and enter them with the most critical level first.
5.  Click **Start analysis**.

> **TIP**
> 
> If your policy is a PDF or Word document, export it as plain text or copy the sections that define your levels into the text box. Keep the sections that define your levels if the policy is longer than 50,000 characters.

### Build it myself

Select **Build it myself** to open the **Edit levels and queries** page with an empty setup. See [Edit levels and queries](#edit-levels-and-queries).

## Review the proposal

The **Review your setup** page shows each proposed level, the business consequence it represents, and the queries that fill it. Each query shows a plain-language description, its J1QL, and how many assets it matches today.

On this page you can:

-   **Rename a level.** Edit the level name and click **Save name**.
-   **Turn a level off** to leave it out of the setup. A setup needs at least two levels, so you cannot turn off a level when only two remain.
-   **Change a query.** Use **Edit**, **Move to**, or **Remove query** on any query, and click **View matching assets** to see which assets a query matches.
-   **Ask for changes.** Describe a change in plain language, such as "exclude sandbox accounts," and the agent updates the proposal for you. See [Ask the agent for changes](#ask-the-agent-for-changes).
-   Click **Undo edits** to reverse your changes, **Restore previous version** to return to an earlier version of the proposal, or **Discard proposal** to start over.

The page also tells you when the agent changed its own draft, for example when a level was left out because the agent could not fill it, when a query was moved to a less critical level, or when a query's match count is an estimate. Read these messages before you apply.

### Ask the agent for changes

On the **Review your setup** page, describe what to change:

-   If your account has the JupiterOne AI assistant, click **Ask for changes**. The assistant opens so you can describe the change and keep refining the proposal in a conversation.
-   Otherwise, enter the request in the box under **Ask the agent for changes** and click **Send**. A request can be up to 1,000 characters.

The proposal updates in place, and each level notes what changed. Nothing is applied until you apply the setup.

The agent can add, remove, move, and rewrite queries. It does not change level names or the number of levels. Rename or turn off levels by hand.

## Preview and apply

1.  On the **Review your setup** page, click **Preview changes**.
2.  The **Preview changes** page shows what the first run will do: an estimate of how many assets each level will classify, how each level is written onto your assets, and the expected distribution of your assets across levels.
3.  Click **Apply setup**. JupiterOne saves your setup and starts a run to classify your assets.

## Monitor your levels

After you apply a setup, **Assets > Asset criticality** shows two tabs.

**Overview** summarizes your classification:

-   **Total assets**, **Classified**, the number of assets at your most critical level, and **Last run**
-   A **Distribution** chart of your assets across levels
-   A table of your levels with their **Queries**, **Assets**, change over the last seven days (**Δ 7d**), and **Status**

Select a level to open its page, which lists the level's queries and a sample of its matched assets. Click **View all** to see every asset at that level.

**Run history** lists every manual and setup run, and every scheduled run that changed something, with what triggered it (**Scheduled**, **Manual**, or **Setup**), how many assets changed level, and who started it. Run history keeps up to 500 runs from the last 90 days.

### Run your levels now

Your levels run every hour. To run them immediately, click **Run now** on the **Overview** tab. Results appear in **Run history** within a few minutes. You can start a manual run once every 15 minutes.

The first run classifies every matching asset. After that, each run applies up to 100,000 changes. When more assets need to change level, for example after you rewrite a broad query, the run shows **Partial — continues on the next run** and the remaining changes are applied over the following runs.

## Edit levels and queries

To change your setup after you apply it, click **Edit levels** on the **Overview** tab.

1.  On the **Edit levels and queries** page, list your levels with the most critical first. You can have between two and six levels, and each level needs a unique name.
2.  For each query, enter a **Query name**, pick the level it belongs to, and write its J1QL. Click **Preview matches** to check what the query returns.
3.  To add a query, click **Add query** and select **Write J1QL**, or select **Draft with AI** to describe the assets you want in plain language and let the agent draft the queries.
4.  Click **Save changes**. Saving starts a run, which begins once at least 15 minutes have passed since the previous run.

> **WARNING**
> 
> A level's name determines the value written onto its assets. Renaming a level re-tags every asset at that level, starting with the next run, so update any queries, alert rules, or dashboards that filter on the old value.

To keep a query in your setup without applying it, turn the query off. A level whose queries are all off shows **All queries off** in the **Status** column.

When you remove a query, its assets lose the level on the next run unless another query still places them there.

### Draft queries with AI

Select **Draft with AI** when you add a query, then describe what belongs in the level, for example "systems in PCI scope." If your account has the JupiterOne AI assistant, the request opens there. Otherwise, click **Draft queries**. The agent drafts up to five queries for each request. Review each proposed query, then click **Accept change** or **Accept all**. Nothing is saved until you click **Save changes**.

### Query requirements

Each query must return the assets it classifies:

-   Leave out the `RETURN` clause, and JupiterOne adds one for you when you save. The query classifies the entities of its first term. If the query traverses to other entities, give the first term an alias, for example `FIND Host AS h THAT RELATES TO DataStore`.
-   If you write your own `RETURN`, it must return one entity's `_id` as `entityId`, for example `FIND Host AS h RETURN h._id AS entityId`.
-   Do not use `LIMIT` or `SKIP`. A query defines the complete set of assets for its level, so any asset it leaves out loses the level.
-   A query can be up to 1,024 characters long.
-   A setup can hold up to 50 queries across all levels.

## Run the agent again

To rebuild your setup from scratch, click **Set up again** on the **Overview** tab. The agent analyzes your environment again and produces a new proposal. Your current levels and queries stay exactly as they are until you apply the new proposal. Applying it replaces all of them.

## How the agent builds a proposal

The agent judges criticality by consequence: what breaks, and how badly, if an asset is lost, degraded, or compromised.

-   **It works from a summary of your environment.** The agent reads which classes and types of assets you have, their property names and values, how many of each exist, and the names of your integrations and accounts. If you start from your policy, it also reads the policy text. The agent runs each proposed query against your data where it can, so you see real match counts. When it cannot, the review page says the count is an estimate.
-   **It does not use exposure or vulnerability signals.** Internet exposure, vulnerability counts and severity, risk scores, cost, size, and age do not determine a level. Your risk score already accounts for exposure and vulnerabilities, so using them again here would count them twice.
-   **The more critical levels hold production assets.** When your data marks assets as non-production, such as development, test, and sandbox resources, queries in every level except the least critical exclude them, and those assets go to the least critical level. Queries that cannot be limited this way are flagged on the review page.
-   **Stale devices stay out of the more critical levels.** Device queries in every level except the least critical exclude devices that have not been seen in 180 days. Devices with no last-seen date are kept.
-   **The top two levels come from high-consequence assets.** In a setup with three or more levels, the two most critical levels are built from assets whose compromise has the widest consequence, such as root and administrator accounts, production data stores, backups, credentials, and workloads with privileged access. To place specific systems, such as your payment platform, in a top level, add or move their queries on the review page.
-   **People and devices are covered.** The agent adds queries that place people and devices in the least critical level when no other query covers them, so they are classified rather than left out.

Review every proposal before you apply it. The agent can make mistakes, and it can only work with the data your integrations have ingested. For how JupiterOne AI handles your data, see [JupiterOne AI](/features/jupiterone-ai.md#what-data-does-jupiterone-ai-access).

## Query criticality in J1QL

JupiterOne writes two properties onto every classified asset:

| Property | Value | Example |
| --- | --- | --- |
| `j1.criticality` | The level's tag, made from its name: lowercase, with each run of characters other than a–z and 0–9 replaced by one hyphen, and cut to 40 characters | `crown-jewels` for a level named Crown jewels |
| `j1.normalizedCriticality` | The level's rank, where `0` is the most critical level and the value counts up by one for each level | `0` to `3` in a four-level setup |

Use `j1.criticality` to select a specific level, and `j1.normalizedCriticality` to compare across levels. Adding, removing, or reordering levels renumbers `j1.normalizedCriticality`, and renaming a level changes its `j1.criticality` value.

Find every asset at your most critical level:

```j1ql
FIND * WITH j1.normalizedCriticality = 0
```

Find assets at a level named Crown jewels:

```j1ql
FIND * WITH j1.criticality = 'crown-jewels'
```

Find hosts in your two most critical levels:

```j1ql
FIND Host WITH j1.normalizedCriticality <= 1
```

Count assets by level:

```j1ql
FIND * WITH j1.criticality != undefined AS e
RETURN e.j1.criticality AS level, count(e) AS total
```

Find unclassified assets:

```j1ql
FIND * WITH j1.criticality = undefined
```

JupiterOne manages the `j1.criticality` and `j1.normalizedCriticality` properties. Values you write to `j1.*` properties through the entity API are ignored. To change an asset's level, change the queries that place it.

## Limits

| Item | Limit |
| --- | --- |
| Levels | 2–6 per setup, each with a unique name of up to 64 characters |
| Queries | 50 across all levels |
| Query length | 1,024 characters |
| Policy text | Markdown or plain text, up to 50,000 characters |
| Scheduled runs | Every hour |
| Changes per run | Every matching asset on the first run, then up to 100,000 per run |
| Manual runs | One every 15 minutes |
| Draft with AI | Up to five queries per request |
| Run history | Up to 500 runs from the last 90 days |
| Unapplied proposal | Kept for 7 days after its last change, with up to 5 previous versions |
| Change request | 1,000 characters |

## Troubleshooting

| Symptom | Cause | Resolution |
| --- | --- | --- |
| The analysis ends with "There is not enough information about this environment yet to propose a setup." | JupiterOne has not yet collected enough data about your environment | Try again once more of your integrations have run, or select **Build it myself** |
| A level you asked for is missing from the proposal | The agent could not fill that level. Your level names are applied in order to the levels that remain, so the names listed as left out are the least critical ones. | Check each level's name against its queries before you apply. To add the level back, apply the setup, click **Edit levels**, and then click **Add level**. |
| The analysis ends with "The analysis could not be completed. Start it again." or "This run stopped unexpectedly. Start the analysis again." | The analysis was interrupted | Start the analysis again |
| An asset has the wrong level | An asset takes the most critical level that has a query matching it | Click **Edit levels** and use **Preview matches** on that level's queries to find the one that matches the asset. Edit the query to exclude it, or move the query to a different level. |
| **Run now** is unavailable | A run is in progress or queued (saving your setup queues one), the previous run's changes are still being applied, or a run was requested in the last 15 minutes | Wait for the current run to finish, or try again after the time shown |
| A run shows **Partial — continues on the next run** | More than 100,000 assets needed to change level in one run | No action needed. The remaining changes apply on the following runs. |
| The **Δ 7d** column is empty | Your setup has less than seven days of run history | The column fills in once there are seven days of run history |
| An alert rule or dashboard stopped matching after you changed your levels | Renaming a level changes its `j1.criticality` value, and adding, removing, or reordering levels renumbers `j1.normalizedCriticality` | Update the rule or dashboard to filter on the new values |

## Related topics

-   [Risk scoring](/features/vulnerability-management/risk-scoring.md)
-   [Unified Vulnerability Management](/features/vulnerability-management.md)
-   [UVM permissions](/features/vulnerability-management/permissions.md)
-   [Smart classes](/features/assets/smart-classes.md)
-   [JupiterOne AI](/features/jupiterone-ai.md)

---

Source: /features/assets/create-assets-in-j1

# Manual asset creation

Explore how to create and add assets directly within your JupiterOne workspace to bring in new assets to your workspace or enrich existing entries with additional information.

## Add an asset

Out of the box, JupiterOne supports over 90 different asset classifications or defined assets. For a comprehensive list of these defined assets, see the [JupiterOne data model](/data-model/jupiterone-data-model.md). Each of these defined assets features its own relevant properties in addition to the common properties shared across assets.

Navigate to the **Assets** section of your workspace, open the actions menu (the three-dot menu), and select **Add new asset**. From there:

1.  Choose the type of asset you wish to create.
2.  Define the **Type** for the asset. This defines the source of the asset source. For example, an AWS resource may be of type `aws_instance` or `aws_s3_bucket` or `aws_iam_user`.
3.  Provide a **Display Name** for the asset. This determines how it will be displayed within the asset view. The asset’s **Name** value will default to the **Display Name** unless a separate **Name** value is provided.
4.  Optionally, provide a **Summary**, **Description**, and **Classification** for the asset.
5.  Add any relevant **Defined Properties** or desired **Custom Properties**, [more information on asset properties can be found here](/data-model/jupiterone-data-model.md).
6.  Provide any relevant tags through which the asset can be filtered or tracked.
7.  Click **Save** once all desired values have been provided for the asset.

Once created, you’ll be able to view and interface with your newly created asset within your Asset workspace.

## Bulk upload assets

To upload or update assets and relationships in quantity, use JupiterOne's [sync jobs API](/api/sync-jobs/overview.md). You format your data as JSON or YAML and submit it through the API, which supports scoped diffing (updating and deleting entities and relationships within a scope) and creating relationships across scopes.

-   [Sync jobs overview](/api/sync-jobs/overview.md)
-   [Sync jobs API reference](/api/sync-jobs/api-reference.md)
-   [Create relationships between owned and non-owned assets](/features/assets/relationships-across-scopes.md)

---

Source: /features/assets/critical-assets

# Critical assets (Deprecated)

> **WARNING**
> 
> Critical assets have been replaced by [JupiterOne smart classes](/features/assets/smart-classes.md). If you were using Critical assets, your critical asset definition was migrated to a smart class. To recreate it, create a smart class named `CriticalAsset`.

> **INFO**
> 
> To classify assets by how critical they are to your business, use [Asset criticality](/features/assets/asset-criticality.md). Asset criticality supports several ordered levels instead of a single critical group, and its levels feed the Unified Vulnerability Management risk score.

Critical assets are a grouping of the assets that contain your most crucial data and therefore carry the most risk. They are now expressed as the `CriticalAsset` smart class: define the queries that determine which assets are critical, and JupiterOne tags matching entities with `tag.CriticalAsset` and re-evaluates them on a schedule. See [smart classes](/features/assets/smart-classes.md) for how to create one and add its queries.

## Querying critical assets

JupiterOne uses smart classes to apply asset filters with shorthand syntax. The `#CriticalAsset` smart class lets you reference your configured critical asset definitions in a query.

For example, to find critical assets with compliance gaps:

`FIND #CriticalAsset THAT HAS jupiterone_compliance_gap`

Or to find critical assets with findings:

`FIND #CriticalAsset THAT HAS Finding`

### Example definition queries

These queries are useful starting points for the `CriticalAsset` smart class definition:

`FIND (Application | CodeRepo | DataStore | Function | Host | Logs | Secret | Vault) WITH tag.Production = true OR tag.CriticalAsset = true OR classification = "critical"`

`FIND (Device | Host) THAT RELATES TO (DataStore | Database) WITH (tag.Production = true OR tag.CriticalAsset = true OR classification = 'critical' OR tags ~= 'Production' OR Access = 'Public')`

`FIND (Device | Host) that (ALLOWS|CONNECTS) (Internet|Everyone)`

`FIND (Function|Host) THAT PROTECTS Firewall THAT ALLOWS << Internet`

---

Source: /features/assets/custom-data-ingestion

# Custom data ingestion

The first step in working with JupiterOne is to import the data for your cyber assets. If JupiterOne does not have an integration for a product in which your data is located, you can still import it into JupiterOne. You can also enrich current data in your JupiterOne account. There are three steps to importing: gather the data, classify the data, and import the data.

## Gather the Data

The power of JupiterOne is that it stores the data in a graph database. Not only can you store an asset such as a user record with properties such as ID, first name, last name, email address, and manager, but you can also define relationships between assets in the database. For example, when you then look at user records, you see all the user data as well as which AWS profiles they are assigned, which applications they have access to, and other information.

The data you want to add to JupiterOne can come from different sources. You can:

-   Export it as a CSV file from another application to upload to JupiterOne.
-   Get the data from an API that a tool provides.
-   Generate the data by combining data from multiple sources.

The data should include the:

-   Assets you want to import to JupiterOne, such as a user or device.
-   Properties for each asset, such as user first name or device MAC address.

> **INFO**
> 
> To learn more about asset and their properties, refer to our [data model documentation](/data-model/jupiterone-data-model.md).

## Classify the Data

Classifying the data ensures that what you import is useful. Depending on the application from which you are importing, you must first identify which assets you want to import. In addition, you must identify the properties, type, and class of the assets. For example, when JupiterOne imports data from Salesforce, it imports the following assets: Group, PermissionSet, Profile, User, and UserRole.

You must also identify the relationships between the assets from the application. In the Salesforce example, some of the relationships J1 creates include:

-   `salesforce_user` ASSIGNED `salesforce_permission_set`
-   `salesforce_user` ASSIGNED `salesforce_user_role`
-   `salesforce_group` HAS `salesforce_user`

In addition, you may need to identify the relationships between assets in Salesforce and assets in other applications that you have in your JupiterOne account.

The [JupiterOne data model](/data-model/jupiterone-data-model.md) is a reference model that, as an asset-relationship graph, describes the digital resources and complex interconnections among all the resources in a technology organization. It represents a reference model, not a strict or rigid structure.

## Import the Data

There are several different ways to get data into JupiterOne:

-   Add a single asset using [JupiterOne Assets](/features/assets/create-assets-in-j1.md). This method is useful for adding low volumes of data. You can add a new asset and its associated properties one at a time.
-   [Bulk upload assets](/api/sync-jobs/overview.md) using the sync jobs API. You format your data in JSON or YAML and submit it through the API.
-   Use the [JupiterOne Node.js client and `j1` CLI](/api/nodejs-client.md) to create or update entities and relationships from JSON or YAML files, or from your own scripts.
-   Use the [JupiterOne API](/reference.md), which is what JupiterOne uses in the integrations. You can access all the data in your account and add or update data using a graphQL endpoint.
-   Use the [JupiterOne SDK](https://github.com/JupiterOne/sdk). The SDK allows you to build a complete integration for JupiterOne. It is the most sophisticated way to import data into JupiterOne. It features the best practices that JupiterOne uses to build integrations with other applications.

JupiterOne also supports creating custom integrations to bring in data from particular sources. Read more about [creating custom integrations in JupiterOne](/integrations/development/overview.md) to curate your data ingestion for particular apps or services.

---

Source: /features/assets/device-unification

# Device Unification

Device Unification is the process by which JupiterOne produces a single representation of a device or host across all integrations.

Unified Devices have a very specific data model and are designed to be used as an entry point for asking more interesting questions about your infrastructure.

JupiterOne ingests data from a variety of sources, and each source may represent the same physical device in a different way. For example, a server may be represented by an integration as a `Host` or `Device`. Device Unification is used to present a single view of Device and Hosts across all integrations. The unification is driven by an accumulation of correlations, and is intended to provide a single node in the JupiterOne graph for each uniquely identified device or host.

This unified entity has the `_class` of `UnifiedDevice`, and the `_type` of `unified_entity`. It will be related to the source `Host` and `Device` entities via an `IS` relationship, used to indicate the entites it is derived from.

To complement this data modeling JupiterOne provides an enhanced "Unified" view which auto-displays when querying for `UnifiedDevice` entities. This view is intended to provide an intuitive view of the hierarchical data represented in the graph.

![FIND UnifiedDevice Showcase](/assets/images/unified-device-showcase-69d28c4bdb686d523fda6a8c3cc9385f.png)

## Searching for Unified Devices

There are lots of ways to search for Unified Devices, the most simple approach is to use the following J1QL query to directly open the `UnifiedDevice` unified view:

```j1ql
FIND UnifiedDevice
```

This unified view is the most intuitive way to view the Unified Device data, and typically meets the needs of most users. As you interact with the filters on the left you will see the data dynamically update, but also the query used to power the view. This can help build queries you may wish to use in dashboards or alerts.

### Visualising Relationships

Visualise the `IS` relationships between the Unified Device and their source Device or Host entities:

```j1ql
FIND UnifiedDevice
  THAT IS (Device|Host)
RETURN TREE
```

### Finding Over-Correlated UnifiedDevices

Find Unified Devices that represent more than one source Device or Host entity:

```j1ql
FIND UnifiedDevice AS t
  THAT IS (Device|Host) AS s
RETURN t.displayName, COUNT(s) AS sources
ORDER BY sources DESC
```

This query will show you the `UnifiedDevice` entities that have the most source entities linked to them. If there is bad / invalid data on source devices it can cause a `UnifiedDevice` to have many source entities linked to it (i.e. over-correlation). This is a good query to find that situation.

### Finding Unified Devices with context

Looking at Unified Devices that are protected by a Host Agents

```j1ql
FIND UnifiedDevice
  THAT IS (Device|Host)
  THAT PROTECTS HostAgent
RETURN TREE
```

Finding Owners of Unified Devices

```j1ql
FIND UnifiedDevice
  THAT IS (Device|Host)
  THAT OWNS User
RETURN TREE
```

![FIND UnifiedDevice with Owners](/assets/images/unified-device-owners-73451f10093054745cb9eab52702e076.png)

## Derived Properties

Unified Devices have 3 additional properties that are derived from the source `Device` and `Host` entities, or their extended relationships in the graph. Each of these properties is available as a filter on the left hand side of the Unified view.

![Unified Device Derived Properties](/assets/images/unified-device-derived-properties-2a0d14e813b2a5ee017eabb36833a514.png)

> **INFO**
> 
> The derived properties rely on the relevant integrations to provide the required information. JupiterOne is continually reviewing integrations to ensure that all relevant properties are ingested where available. If you believe a property should be available for a specific integration please let us know!

### Encrypted

This propery is a rollup of the `encrypted` property from the source `Device` and `Host` entities. On a `Host` or `Device` this property should be a boolean value. On a `UnifiedDevice` entity it will roll up to one of four values:

Encrypted if any of the source `Device` or `Host` entities have the `encrypted` property set to `true`, and there are no conflicting values

Not Encrypted if any of the source `Device` or `Host` entities have the `encrypted` property set to `false`, and there are no conflicting values

Conflicting if some of the source `Device` or `Host` entities have the `encrypted` property set to `true` and some are set to `false`

Unknown if none of the source `Device` or `Host` entities have the `encrypted` property set, i.e. encrypted is `undefined` for all sources

### Managed

The `managed` property is summary of the incoming relationships to the source `Device` and `Host` entities. If the Unified Device has any sources that have an incoming `MANAGES` relationship it will be set to `Managed`. If the Unified Device does not have any such sources the propery will be set to `Not Managed`.

Managed if any of the source `Device` or `Host` entities have an incoming `MANAGES` relationship.

Not Managed if none of the source `Device` or `Host` entities have an incoming `MANAGES` relationship.

The J1QL equivalent for when this property is `Managed`:

```j1ql
FIND UnifiedDevice
  THAT IS (Device|Host)
  THAT MANAGES *
```

To find the specific sources that contribute to a Unified Device's Managed status, you can use the following J1QL query:

```j1ql
FIND UnifiedDevice WITH _id = <The _id of the UnifiedDevice>
  THAT IS (Device|Host)
  THAT MANAGES *
RETURN TREE
```

### Protected

The `protected` property is summary of the incoming relationships to the source `Device` and `Host` entities. If the Unified Device has any sources that have an incoming `PROTECTS` relationship it will be set to `Protected`. If the Unified Device does not have any such sources the propery will be set to `Not Protected`.

Protected if any of the source `Device` or `Host` entities have an incoming `PROTECTS` relationship.

Not Protected if none of the source `Device` or `Host` entities have an incoming `PROTECTS` relationship.

The J1QL equivalent for when this property is `Protected`:

```j1ql
FIND UnifiedDevice
  THAT IS (Device|Host)
  THAT PROTECTS *
```

To find the specific sources that contribute to a Unified Device's Protected status, you can use the following J1QL query:

```j1ql
FIND UnifiedDevice WITH _id = <The _id of the UnifiedDevice>
  THAT IS (Device|Host)
  THAT PROTECTS *
RETURN TREE
```

## How Does it Work?

The device unification process is multi-step, and will not happen immediately. The three main phases of the process are:

1.  **Creation**: The `UnifiedDevice` entity is created from the source `Host` and `Device` entities.
2.  **Correlation**: The `UnifiedDevice` entity is correlated with other `UnifiedDevice` entities.
3.  **Merging**: Highly correlated `UnifiedDevice` entities are merged.

Depending on the size of your graph and the number of integrations you have enabled, this process can take some time to complete.

### Source Data

The unified representation is driven from the data found in `Device` and `Host` entities in your graph. Any integration or custom data that creates such entities will be part of the Unified Device experience.

Unified Device expects to find the following normalized properties on the source `Device` and `Host` entities:

| Property | Type | Description | Notes |
| --- | --- | --- | --- |
| `ipv4Addresses` | `string[]` | The IPv4 addresses of the device, public or private |  |
| `ipv6Addresses` | `string[]` | The IPv6 addresses of the device, public or private | IPv6 Addresses should be in their long format (e.g. `2607:FB90:1000:0000:0000:0000:0000:0001`) |
| `macAddresses` | `string[]` | The MAC addresses of the device | MAC Addresses should be lowercase and colon delineated (e.g. `a4:83:e7:25:3e:f1`). Managed or randomized MAC addresses should be excluded where possible |
| `publicIpAddresses` | `string[]` | The public IP addresses of the device, both IPv4 and IPv6 | IP addresses that do not fall under private or reserved ranges |
| `privateIpAddresses` | `string[]` | The private IP addresses of the device, both IPv4 and IPv6 | IP addresses that fall under private or reserved ranges |
| `hostname` | `string` | The hostname of the device, or the leaf node of the FQDN | Case should be preserved. This is just the hostname, not the FQDN. For example the output of `hostname -s` |
| `fqdn` | `string` | The fully qualified domain name of the device | Case should be preserved. This is the FQDN for the host. For example the output of `hostname -f` |
| `serial` | `string` | The serial number of the device | As close as possible to the BIOS serial number. For example the output of `dmidecode -t system` on Linux, `ioreg -l | grep IOPlatformSerialNumber` on macOS, or `wmic csproduct get uuid` on Windows |
| `deviceId` | `string[]` | Other unique identifiers for the device |  |
| `lastSeenOn` | `date` | The last seen date of the device |  |
| `make` | `string` | The hardware make of the device | The hardware manufacturer for the device, such as `Dell`, `HP`, `Lenovo`, etc. |
| `model` | `string` | The hardware model of the device | The device model, such as `PowerEdge R740`, `EliteBook 840 G3`, `ThinkPad X1 Carbon 7th`, etc. |
| `osName` | `string` | The name of the operating system |  |
| `osType` | `string` | The type of the operating system |  |
| `osDetails` | `string` | The details of the operating system |  |
| `osVersion` | `string` | The version of the operating system |  |
| `status` | `string` | The status of the device |  |

> **INFO**
> 
> Only some of these properties are used for correlation, although where possible integrations and custom data uploads should include as many of these properties as possible.

### Correlation and Unification

There are various weighted properties that are used to determine if two devices are the same. The most important property is the `serial` property, which has a very strong weighting to determine if two devices are the same.

Additional correlation properties include `deviceId`, `macAddresses`, `hostname`, `fqdn`, `privateIpAddresses`, and `publicIpAddresses`.

It is possible to view the correlations either between two UnifiedDevice entities that have not been merged, or between the source Hosts and their UnifiedDevice representations.

---

Source: /features/assets/identity-unification

# Identity Unification

JupiterOne has a unified entity `UnifiedIdentity` class of object, and replace the existing `Person` entities with this new entity.

Note that the entities still carry the `Person` class, so any existing queries against `Person` will continue to work, although some properties are changed (see below).

## What is UnifiedIdentity?

The legacy `User -IS-> Person` mapping logic relies on the legacy system mapper engine, which will no longer be supported from April 2025. The legacy engine relied on per-integration rules that were difficult to maintain and provided good, but not perfect results. The new Unifier (as first released for UnifiedDevice) has proven to be significantly more accurate in it's unification and has additional capabilites regarding latency and self-healing.

In summary we can provide a better user experience and a more reliable adherance to the data model with the new system.

## What are the features?

THe most notable feature is the Unified view for identities. You will be able to access this view by running the query `FIND UnifiedIdentity` which will give you the canonical list of all identies in the system and their source `User` objects.

This view will also give you easy filtering for some new derived properties, specifically `admin`, `active`, and `mfa`; allowing for easy filtering of potentially vulnerable or over-privilidged identities.

## What do you need to do?

Nothing! The deployment of the `UnifiedIdentity` system is automated and as soon as you ingest compatible `User` entities it will start to show the `UnifiedIdentity` records. It is recommended to review the data model for UnifiedIdentity to understand how these entities are derived and how they can be queried.

## What Properties will be available?

The `UnifiedIdentity` entities have the following properties available:

| Property | Format | Notes | Correlation |
| --- | --- | --- | --- |
| `username` | `String[]` | A set of the source `username` values from the source `User` entities. | yes |
| `email` | `String[]` | A set of the source `email` values from the source `User` entities. | yes |
| `shortLoginId` | `String[]` | A set of the source `shortLoginId` values from the source `User` entities. This property is normalized in the integrations and derived from the `email` property, removing the domain element and any plus aliasing. | yes |
| `firstName` | `String[]` | A set of the source `firstName` values from the source `User` entities. | yes |
| `lastName` | `String[]` | A set of the source `lastName` values from the source `User` entities. | yes |
| `emailDomain` | `String[]` | A set of the source `emailDomain` values from the source `User` entities. |  |
| `employeeId` | `String[]` | A set of the source `employeeId` values from the source `User` entities. |  |
| `userIds` | `String[]` | A set of the source `userIds` values from the source `User` entities. |  |
| `active` | `enum {'Active', 'Not Active', 'Unknown', 'Conflicting'}` | A derived property from the source `User` entites `isAdmin` property |  |
| `admin` | `enum {'Admin', 'Not Admin', 'Unknown', 'Partial Admin'}` | A derived property from the source `User` entites `isActive` property |  |
| `mfa` | `enum {'MFA Enabled', 'No MFA', 'Unknown', 'Conflicting'}` | A derived property from the source `User` entites `isMfaEnabled` property |  |
| `guest` | `enum {'Guest', 'Empplyee', 'Unknown', 'Conflicting'}` | A derived property from the source `User` entities `isGuest` property |  |

---

Source: /features/assets/ingesting-assets

# Ingesting assets

Before you can query and act on your data in JupiterOne, you need to bring your assets into your workspace. Most organizations start with integrations, which populate and refresh the majority of their assets automatically, and then fill the gaps with custom data.

## Managed integrations

JupiterOne offers more than 200 managed integrations with cloud providers, identity providers, endpoint and vulnerability tools, and other technologies. Once you configure an integration instance, it pulls assets and relationships from that tool on a polling interval, so your data stays current without manual work.

-   [Browse the integrations directory and configure an integration →](/integrations.md)

## On-premise and self-hosted sources

Some sources, such as applications in your own data center or behind a firewall, are not reachable from JupiterOne's cloud. Run these integrations on a JupiterOne collector deployed inside your network.

-   [Learn more about JupiterOne collectors →](/integrations/development/collector.md)

## Custom data

If JupiterOne does not have an integration for a tool, or you want to enrich assets that integrations already ingest, you can import your own data:

-   **Custom definitions** describe an integration that JupiterOne does not ship out of the box. Instances of a custom definition can receive data from your own code or from CSV files. [Learn more about custom definitions →](/integrations/development/custom-definitions.md)
-   **Custom File Transfer** uploads assets and relationships from CSV files into an instance of a custom definition. [Learn more about Custom File Transfer →](/integrations/development/custom-file-transfer.md)
-   **Sync jobs** let you push entities and relationships through the JupiterOne API in batches. [Learn more about sync jobs →](/api/sync-jobs/overview.md)
-   **API clients** for [Python](/api/python-client.md) and [Node.js](/api/nodejs-client.md) wrap the JupiterOne API for scripts and automation.

For guidance on gathering and classifying your data before you import it, see [Custom data ingestion](/features/assets/custom-data-ingestion.md).

## Creating assets in JupiterOne

You can also create individual assets directly in your workspace. This is useful for a small number of assets that no integration or import covers.

-   [Learn more about creating assets in JupiterOne →](/features/assets/create-assets-in-j1.md)

### What's next

Once data is flowing into JupiterOne, review your assets in the **Assets** section of your workspace. Continue to [Working with assets](/features/assets/working-with-assets.md) to learn how to explore and manage them.

---

Source: /features/assets/relationships-across-scopes

# Create relationships between owned and non-owned assets

When forming relationships between assets you own and assets you don't (e.g., assets ingested by an integration), you will need to use a `_key` and include a `_source` and `_scope` of the existing entities in the graph. This guide explains the correct way to create relationships between assets you own and those you do not. By following the instructions outlined below, you will be able to successfully create relationships and view the desired data in the graph.

It is important to note that when seeking to pass a source or scope via API, it should be done so as `source` or `scope`–without underscores. When retrieving the metadata property or querying an existing source or scope, it will need to be notated as `_source` or `_scope`–with underscores.

When providing a source or scope via graphQL query (without underscores), JupiterOne adds the underscores when the source or scope is added to the entity properties, as this is our standard pattern for metadata properties.

> **TIP**
> 
> For managing relationships between entities in different scopes at scale, consider using the `CROSS_SCOPE` sync mode. This specialized mode is designed specifically for creating cross-scope relationships and requires the use of `_fromEntityScope` and `_toEntityScope` fields. See the [`CROSS_SCOPE` sync mode documentation](/api/sync-jobs/cross-scope.md) for more details.

## Ownership and subgraphs

The concept of ownership in JupiterOne determines what you see. What is not obvious when viewing the graph is that the graph you see is the aggregation of many subgraphs. There are subgraphs for the AWS integration, the system mapper, and API ingested data among other things.

All of these different subgraphs provide a cohesive set of results. These subgraphs denote ownership. For example, if a certain subgraph owns `entity A`, it means that `entity A` is in that subgraph. Ownership is important because it is how JupiterOne interprets datasets.

A subgraph is created by fusing the `source` and the `scope` of an entity together. For example, `api:your-api-call` could be a subgraph. These subgraphs provide identity to your data in the JupiterOne. When interacting with assets that are owned by various subgraphs, you must be specific in your interactions so the resulting graph is how you expect it to look.

## Getting started

For this guide, we'll be working with the an example available within our JupiterOne Node.js client repo, [here](https://github.com/JupiterOne/jupiterone-client-nodejs/tree/main/examples/sync-api).

Running this example provides you with the necessary ephemeral data owned by an `integration-managed` source. The example creates data controlled by the `integration-managed` and `api` sources, and it also creates a relationship between those two assets.

## Acquiring Assets in the Graph to Form Relationships

After you have compiled the assets that you want to upload to JupiterOne, you still must acquire assets from the JupiterOne graph in order to form the relationships. Therefore, the first step is to acquire our `integration-managed` data.

If you have run the [example scenario above](https://github.com/JupiterOne/jupiterone-client-nodejs/tree/main/examples/sync-api), you should have newly-created [CodeRepos](https://github.com/JupiterOne/jupiterone-client-nodejs/blob/main/examples/sync-api/src/data/code-repos.json) in your graph to query. The example code uploads assets into JupiterOne in an `integration-managed` scope. This upload enables us to work with assets that is outside of your scope (`api`).

To acquire the `integration-managed` data, you can use the following query to retrieve the newly-created `CodeRepos`:

```j1ql
FIND github_repository
    WITH from = 'testing'
```

Here is an example response payload from one of the `CodeRepos`:

```json
{
    "_class": [
        "CodeRepo"
    ],
    "_type": [
        "github_repository"
    ],
    "_key": "MDEwOlJlcG9zaXRvcnkxNjkzMzI3NTQ=",
    "displayName": "ibzibid",
    "_integrationType": "github",
    "_integrationClass": [
        "ITS",
        "SCM",
        "VCS",
        "VersionControl"
    ],
    "_integrationDefinitionId": "1babe084-d58d-4ff0-9d98-e0d9bb8499be",
    "_integrationName": "JupiterOne",
    "_beginOn": "2022-01-19T20:26:17.842Z",
    "_id": "2218b983-139b-4447-9889-f04f48761b15",
    "_integrationInstanceId": "40d8cd20-054e-4b77-82bd-f01af7593170",
    "_rawDataHashes": "eyJkZWZhdWx0IjoiMUlKVFNaT00vM2FwQmtWTWt0alYxcml6ZjZsRGFNa1VTRHBvakxIR2sxVT0ifQ==",
    "_version": 18,
    "_accountId": "j1dev",
    "_deleted": false,
    "_source": "integration-managed",
    "_createdOn": "2020-03-23T19:10:09.298Z"
}
```

## Forming the Relationship

The next step is to form relationships between assets you own and assets you do not. There are two primary options for creating a relationship:

```text
{
    _fromEntityKey: string;
    _toEntityKey: string;
    _fromEntityId: string;
    _toEntityId: string;
}
```

You can form the relationship in the following ways:

-   `CodeRepo` `_key` -> `CodeModule` `_key`
-   `CodeRepo` `_id` -> `CodeModule` `_key`

Keep in mind that you do not have the `CodeModule` `_id` yet, which is important because these two options are _NOT_ equal in how they behave.

Forming a relationship using the `_id` of the `CodeRepo` and the `_key` of the CodeModule works because the `_id` is unique in all of the data in your account. The `_key` value is _NOT_ globally unique, meaning that two assets can have the same `_key`.

When you form a relationship with two `_key` values and you do not specify the `source` and the `scope` of the data that already exists in the graph, JupiterOne does not understand which asset you are referencing and, therefore, does not create the relationship. Because two assets could have the same `_key`, the software needs more information to be able to identify the asset you are referencing.

### Acquiring more information

To acquire more information, use the `source` and `scope` of your JupiterOne data with the `_key`!

```text
{
    _fromEntitySource: string;
    _toEntitySource: string;
    _fromEntityScope: string;
    _toEntityScope: string;
}
```

This:

-   `CodeRepo` `_key` -> `CodeModule` `_key`
-   `CodeRepo` `_id` -> `CodeModule` `_key`

Should actually be:

-   `CodeRepo` `_key`, `_source`, `_scope` -> `CodeModule` `_key`
-   `CodeRepo` `_id` -> `CodeModule` `_key`

In JSON, it looks like this:

```js
{
    _fromEntitySource: entityFrom.entity._source,
    _fromEntityScope: entityFrom.entity._integrationInstanceId,
    _fromEntityKey: entityFrom.entity._key,
    _toEntityKey: entityTo.entity._key,
}
```

## Putting It Together

Now that you know how to form relationships with assets that you do not own, here is what your [bulk upload](/api/sync-jobs/api-reference.md) payload should look like put together:

```json
{
    "entities": [
        {
            "_key": "npm_package:hizurur",
            "_class": "CodeModule",
            "_type": "npm_package",
            "displayName": "hizurur",
            "from": "testing"
        },
        {...}
    ],
    "relationships": [
        {
            "_key": "codeRepo:USES:codeModule",
            "_type": "codeRepo:USES:codeModule",
            "_class": "USES",
            "displayName": "USES v3.4.3",
            "_fromEntitySource": "integration-managed",
            "_fromEntityScope": "integration_id",
            "_fromEntityKey": "codeRepo_key",
            "_toEntityKey": "npm_package:hizurur"
        },
        {...}
    ]
}
```

After you have uploaded the data, use the query posted earlier in the guide in JupiterOne to view your results:

```j1ql
FIND CodeModule
WITH displayName = ('hizurur' OR 'carnud' OR 'vici' OR 'iti' OR 'jifguilo' OR 'kiwoj' OR 'juvhove')
AND from = 'testing'
THAT USES << CodeRepo
```

### Conclusion

By following this guide, you can successfully create relationships between assets you own and those you do not. This will allow you to effectively manage your data and leverage the full capabilities of JupiterOne's graph.

---

Source: /features/assets/sbom

# Software Bill of Materials (SBOM)

## Overview

The SBOM (Software Bill of Materials) integration scans container images from your registry to generate comprehensive software inventories and identify vulnerabilities. It uses [Syft](https://github.com/anchore/syft) for SBOM generation and [Grype](https://github.com/anchore/grype) for vulnerability detection.

Use JupiterOne to understand the risks in your software supply chain, track all components in your container images, and prioritize security issues based on EPSS (Exploit Prediction Scoring System) data.

![JupiterOne SBOM View](/assets/images/sbom-main-c83b15211cc4a12f23139a2229557a69.png)

## Prerequisites

-   Container registry with images to scan
-   Registry credentials (if private)
-   Access to configure JupiterOne integrations
-   JupiterOne collector deployed and running

## Key Features

-   **Container Image Scanning**: Analyzes container images in your registry
-   **Package Discovery**: Identifies all packages and dependencies within images
-   **Vulnerability Detection**: Scans for known CVEs and security vulnerabilities
-   **Dependency Mapping**: Creates relationships between packages and their dependencies
-   **EPSS Scoring**: Includes Exploit Prediction Scoring System data for prioritization

## Data Collection

The current SBOM integration works as a registry scanner, and is run using the JupiterOne Collector. This ensures that the images are processed in your infrastructure and not transmitted to JupiterOne.

## Configuration

### Collector Setup

Before configuring the SBOM integration, you must have a JupiterOne collector deployed:

1.  **Deploy a Collector**: If you haven't already, deploy a [JupiterOne collector](/integrations/development/collector.md) in your environment
2.  **Verify Connectivity**: Ensure the collector can reach your container registry
3.  **Select Collector**: When configuring the integration, select the appropriate collector from the dropdown

### Integration Configuration

When configuring the integration you will need to provide the following information:

1.  **Registry**
    
    -   The URL of your container registry
    -   Example: `docker.io`, `gcr.io/my-project`, `123456789.dkr.ecr.us-east-1.amazonaws.com`
2.  **Registry Username** (optional)
    
    -   Username for private registry authentication
    -   Required if your registry needs authentication
3.  **Registry Password** (optional)
    
    -   Password for private registry authentication
    -   Must be provided together with username
4.  **Images** (`images`)
    
    -   Comma separated list of image names to scan
    -   Format: `image1:tag1, image2:tag2`
    -   If no tag is specified for an image, defaults to `latest`
    -   Example: `myapp:v1.0, database:latest, frontend`

### Verifying Data Collection

To confirm that you have data from the SBOM integration run the following command:

```j1ql
FIND sbom_container_image
```

## How It Works

1.  **Collector Execution**: The JupiterOne collector runs the SBOM integration on your configured schedule
2.  **Image Scanning**: The integration uses Syft to scan each configured image and generate an SBOM in JSON format
3.  **Package Discovery**: Extracts all packages, libraries, and dependencies from the image layers
4.  **Vulnerability Analysis**: Runs Grype against the SBOM to identify known vulnerabilities
5.  **Entity Creation**: Creates JupiterOne entities for:
    -   Container Images (`sbom_container_image`)
    -   Packages (`sbom_software_package`)
    -   Vulnerabilities (`sbom_vulnerability`)
    -   Findings (`sbom_finding`)
6.  **Relationship Mapping**: Establishes relationships between:
    -   Image scanned and the contained packages
    -   Packages and their inter-dependencies
    -   Packages and their vulnerabilities

## The Software Bill of Materials (SBOM) View

In addition to the standard JupiterOne interfaces (i.e. Query, Dashboards, Rules) JupiterOne provides a dedicated view for interacting with the SBOM data in your account. You can access this page by navigating to Assets > SBOM.

This view shows high level metrics for your account, as well as a filterable table of `Image` and `CodeModule` entities. The table also provides summary details of Vulnerabilities found in your images and code modules.

## Data Model

The Data Model for SBOM data is relatively straightforward. The primary SBOM payload and associated Vulnerabilities is modelled as follows:

### Entities Created

#### sbom\_container\_image

-   Represents a scanned container image
-   Properties include: name, tag, registry, digest, OS info
-   \_class: `["Image"]`
-   \_type: `sbom_container_image`

#### sbom\_software\_package

-   Represents a software package/library found in the image
-   Properties include: name, version, type, language, licenses, CPEs, PURL
-   \_class: `["CodeModule"]`
-   \_type: `sbom_software_package`

#### sbom\_vulnerability

-   Represents a known security vulnerability
-   Properties include: CVE ID, severity, CVSS scores, EPSS data, fix information
-   \_class: `["Finding", "Vulnerability"]`
-   \_type: `sbom_vulnerability`

### Entity Relationships

In addition to the core data model the following relationships are also created:

-   A mapped relationship from the `sbom_container_image` to any other `Image` that shares the same digest
-   The `sbom_vulnerability` entity will create a `UnifiedVulnerability` entity that will be enriched

## Useful Queries

### What Images do I have that are not scanned?

This query can help you find images that JupiterOne knows about, but which do not have a related SBOM scanned

```j1ql
FIND Image
  THAT !IS sbom_container_image
```

### What Packages have Vulnerabilities

```j1ql
FIND CodeModule
  THAT HAS >> Vulnerability
```

### What Images have Vulnerabilities

```j1ql
FIND Image
  THAT CONTAINS >> CodeModule
  THAT HAS >> Vulnerability
```

### What Versions of a package am I using

```j1ql
FIND CodeModule WITH name ~= 'imagemagick' AS cm
RETURN cm.version, COUNT(cm)
```

For more details on specific major/minor versions

```j1ql
FIND CodeModule WITH name ~= 'imagemagick' AS cm
RETURN cm.name, regex(cm.version, '(?<major>\d+)\.(?<minor>\d+)\.\d+\.'), COUNT(cm)
```

## Common Use Cases

1.  **Supply Chain Security**: Track all components in your container images
2.  **Vulnerability Management**: Identify and prioritize security issues
3.  **Compliance**: Generate SBOMs for regulatory requirements
4.  **Dependency Analysis**: Understand package relationships and potential risks
5.  **License Compliance**: Track open source licenses in your containers

## Troubleshooting

> **NOTE**
> 
> The integration host machine (i.e. the host running The Collector) must have sufficient disk storage available to download the images, the Grype vuln database, and the SBOM manifests. The exact amount of storage needed will depend on the size, complexity, and number of images to be scanned.

### Collector Issues

-   Verify collector is running and healthy
-   Check collector logs for connectivity errors
-   Ensure collector has network access to registry
-   Confirm collector is selected in integration configuration
-   Confirm sufficient local disk space to hold images and manifest

### Authentication Errors

-   Verify registry URL is correct
-   Ensure username/password are valid
-   Check if registry requires specific authentication methods (NOTE: only username/password authentication is currently supported)

### Image Not Found

-   Verify image name and tag exist in registry
-   Check registry URL format
-   Ensure you have pull permissions

### Scan Failures

-   Check if image architecture is supported
-   Verify Syft/Grype can access the registry
-   Review integration logs for specific error messages

---

Source: /features/assets/smart-classes

# Smart Classes

Smart Classes are a mechanism to annotate assets with additional business and technical context, enabling you to enhance your IT management and security use cases. Some intended use cases for Smart Classes include annotating assets with:

-   Criticality levels and business impact
-   Accessibility information, such as whether they are publicly accessible
-   SLAs, RPO, RTO, and other risk tracking metrics

> **TIP**
> 
> To classify assets by business criticality, use [Asset criticality](/features/assets/asset-criticality.md). It gives your assets ordered criticality levels, has an AI agent propose the queries that fill them, and feeds the Unified Vulnerability Management risk score.

Once assets have been assigned to a Smart Class, you can update your queries to filter on Smart Classes. This allows you to be more granular with the assets that form part of your posture management program, apply compliance control tests to a subset of all organizational assets, or use Smart Classes to inform your risk-based vulnerability management program.

## Defining Smart Classes

> **NOTE**
> 
> Smart Classes are queryable by the name you provide them, which means you cannot change the name once set.

> **NOTE**
> 
> Smart Classes are evaluated when their configuration changes and then daily thereafter. You can manually click the **Evaluate Now** button under the Smart Class page if you need a one-off evaluation.

![New Smart Class](/assets/images/smart-classes-overview-0cc75d8aa1f7afe8a59c543a076bd936.png)

To access Smart Classes, open the **Smart Classes** item in the navigation bar to go to the dedicated Smart Classes page. Smart classes also appear in the **Smart classes** group of the class list on the **Assets** page, where you can select one to filter your assets down to it.

On the Smart Classes page, click a smart class to view the results of its query. To edit an existing smart class, use the **Edit** button on its row, which opens an edit modal.

To create a new smart class, click **New Smart Class**, give it a name and a detailed description, and click **Create**. The choice of name is important as it defines how you refer to the Smart Class and you won't be able to change it once set.

Next you will need to add the queries that power the Smart Class. Click **New query** and then provide a description as well as the query for the Smart Class. Click **Run Query** and confirm the query is returning the results you expect before clicking **Create**. You can add up to 5 queries per Smart Class, if you need to annotate more data, it is suggested to write broader queries that cover multiple subsets.

Finally, add any other tags to power the use cases you are interested in. Examples of tags that could be useful could be `businessImpact`, `RPO`, `owner`, `SLAs`. Special tags that unlock further JupiterOne functionality are:

-   `businessImpact` - used to prioritise findings as part of our CTEM offering
-   `attackPathTarget` - used to build attack paths as part of our CTEM offering
-   `owner` - used to build relationships to the owner entities

![Smart Class Defition](/assets/images/smart-classes-definition-c272db0d3620902914381eeee2058e49.png)

## Querying Smart Classes

Smart classes should be considered as a subgraph of your entire graph that only contains entities with additional context captured in the smart class. The additional context can be business-related, like asset criticality or owner group, or technical, like whether the assets are EOL or publicly accessible. When building your posture management, vulnerability management, or compliance use cases, you can use the following query patterns to only query for assets that are in your smart class.

### Using Smart Class Instance

The first way to query smart classes is by directly referring to the smart class. Smart classes are queryable by using the hash character before the name of the smart class. Some example queries that follow this pattern include:

-   `FIND #Sev1`
-   `FIND Finding THAT HAS #Sev1`

### Using Smart Classes as a Filter

Beyond directly referencing the smart class as in the above example, it is also possible to use the smart class as a filter. For example, if you are only interested in your DataStores with a certain criticality, you could use the following queries:

-   `FIND #Sev1 DataStore`
-   `FIND AccessRole THAT ALLOWS #Sev1 aws_s3_bucket`

### Using Smart Class Tags

Finally, smart classes can also be referenced by using tags. This is helpful if you want to find entities that belong to multiple smart classes. For example, if you want to find public entities that belong to a certain severity level, you can run the following queries:

-   `FIND DataStore WITH tag.Sev1=true AND tag.Public=true`

---

Source: /features/assets/whats-new-in-asset-criticality

# What's new in asset criticality

**Release date: October 2026**

Until now, an asset was either a crown jewel or it was not, and you wrote and maintained the queries that decided which. Asset criticality replaces that single flag with ordered levels, such as crown jewels, high value, standard, and low impact. An AI agent studies your environment and proposes the levels and the J1QL queries that fill them, so you start from a complete setup instead of a blank page. You review every level and query before anything takes effect, and JupiterOne keeps every asset's level current from then on.

## What is new

| Feature | What it means for you |
| --- | --- |
| **Criticality levels** | Two to six ordered levels with names you choose, replacing the single crown jewel flag |
| **Agent-proposed setup** | The agent analyzes your environment and proposes your levels and their queries in one to two minutes |
| **Start from your policy** | Give the agent your asset classification policy, and it builds a setup that follows your policy and matches your environment |
| **Review before anything changes** | Rename levels, edit or move queries, see match counts, and ask the agent for changes in plain language before you apply |
| **Always current** | Levels run every hour, so new assets are classified as they arrive. **Run history** shows what each run changed. |
| **Levels in the risk score** | Each level has its own multiplier in the UVM risk configuration, so vulnerabilities on your most critical assets rank highest |
| **Queryable everywhere** | Every classified asset carries `j1.criticality` and `j1.normalizedCriticality`, for use in J1QL, alert rules, and dashboards |

## An agent-proposed setup

The hardest part of asset criticality has always been the setup: deciding the levels and writing queries that hold up across a large environment. Select **Set up for me** on **Assets > Asset criticality**, and the agent proposes a complete setup from what JupiterOne already knows about your environment. It judges each asset by consequence—what breaks if the asset is lost or compromised—and keeps production assets in the most critical levels.

If you already have a classification policy, select **Start from our policy** instead. If you prefer to write every query yourself, select **Build it myself**.

## You stay in control

Nothing the agent proposes takes effect until you apply it. On the **Review your setup** page, every query shows its J1QL and how many assets it matches today. You can rename levels, edit, move, or remove queries, or describe a change in plain language and let the agent revise the proposal. **Preview changes** shows an estimate of how your assets will be distributed before you click **Apply setup**.

After you apply a setup, you can edit levels and queries at any time, draft new queries with AI, or run the agent again.

## Criticality levels in the risk score

The UVM risk score now uses criticality levels in its context layer. Each level has its own multiplier, which you set in the **Risk configuration** panel, so a vulnerability on an asset at your most critical level ranks above the same vulnerability on a less critical asset. See [Risk scoring](/features/vulnerability-management/risk-scoring.md).

## Upgrading from smart classes and crown jewels

-   Smart classes you created before this release were not migrated into asset criticality. To have yours migrated into your setup, contact your Customer Success team.
-   The `tag.crownJewel` property no longer affects the risk score. If your alert rules, dashboards, or saved queries filter on `tag.crownJewel`, update them to filter on `j1.criticality` or `j1.normalizedCriticality`.

## Getting started

1.  Confirm you have **Assets: Admin** with **Shared: Graph Data: Read**, or **Full Admin Access: Admin**
2.  Navigate to **Assets > Asset criticality** and select **Set up for me**
3.  Review the proposed levels and queries, and ask the agent for any changes
4.  Click **Preview changes**, then **Apply setup**
5.  Open the **Risk configuration** panel in Vulnerabilities and review the multiplier for each level

For full feature documentation, see [Asset criticality](/features/assets/asset-criticality.md).

---

Source: /features/assets/whats-new-in-asset-data

# Asset Data Release Notes

**Release date: September 2026**

Two changes to what JupiterOne stores on your assets and how you reach it. Your queries, your integrations, and the asset inspector all work the way they did — but free-text search now covers a deliberately narrower set of values, and raw data is retrieved on demand rather than from a stored copy. Both are worth knowing about.

## What is new

| Change | What it means for you |
| --- | --- |
| Free-text search indexes human-readable values | `FIND "..."` searches the values a person would type. JSON documents, `true`/`false`, and epoch-millisecond timestamps are no longer indexed — the properties are unchanged and still queryable directly |
| Searching `object` no longer matches everything | Assets carrying an object-valued property used to match a free-text search for `object`. They no longer do |
| Long assets are more findable | The search index has a size limit. Assets that used to overflow it now fit more of their content, so more of their text is reachable |
| Asset updates are more stable | An upstream API returning the same values in a different order no longer produces a change to your asset |
| Raw data is served from the ingestion pipeline | Raw data is fetched on demand from the sync job that produced it. Same inspector tab, same API field, same content |
| Raw data covers your recent syncs | Raw data is available for assets whose integration has synced in the last 7 days. Beyond that it reports as unavailable |

---

## Free-text search indexes human-readable values

A free-text search — `FIND "10.0.0.1"`, or the equivalent `_text ~= "10.0.0.1"` filter — matches against an index JupiterOne builds from your asset's property values. That index now carries the values a person would actually search for and skips three kinds of value that were being carried on every asset without ever being a useful match.

### Serialized JSON documents are no longer indexed

Many integrations present a property as a JSON document — `policyDocument`, `ingressRules`, `eventPattern`, `parameters`, `routes`, `principal`. Indexed verbatim, the document's _structure_ became searchable text, so every asset holding an IAM policy matched a global search for `statement`, `effect`, or `resource`.

The properties themselves are untouched. They are still on the asset, still returned in query results, still shown in the inspector, and still searchable with a filter on the property itself:

```j1ql
FIND aws_iam_role WITH policyDocument ~= "s3:getobject"
```

> **CAUTION**
> 
> This is the one change here that narrows what a free-text search can find. Values that only ever appeared inside a JSON document — an IAM action like `sts:assumerole`, a CIDR like `0.0.0.0/0` buried in a security group rule — are no longer reachable with a bare `FIND "..."`. Filter on the property that holds them, as above, or use [regular expressions](/j1ql/regular-expressions.md) for more advanced matching.
> 
> If you have saved questions, alert rules, or dashboard filters that free-text search for a value found only inside a JSON property, rewrite them as a property filter.

A value is treated as a JSON document only if it actually parses as a JSON object or array. A description that merely opens with a bracket — `[CRITICAL] disk full` — is indexed as the string it is.

### Booleans and epoch timestamps are no longer indexed

-   **Booleans.** `true` recorded only that some property somewhere on the asset was set. It identified nothing, and it made every asset carrying any boolean match a search for `true`. Filter on the property instead: `FIND Host WITH public = true`.
-   **Epoch-millisecond timestamps.** Nobody types `1789430400000`. Where an integration means a date to be searchable it also emits it as a formatted string, and that string is unaffected.

Only timestamp-shaped integers are withdrawn. Ports, severities, counts, versions, and numeric IDs are numbers you might plausibly search for, and they are all still indexed. The string `"true"` is still indexed — it is a string value an integration chose to present as text.

### Changes that do not affect what matches

Three further changes have no effect on your search results:

-   **Duplicate coverage is dropped.** A value that appears in full inside another value on the same asset is no longer carried twice. A free-text search is a "contains" match, so any needle found in the dropped value is still found in the one that contained it.
-   **Unsearchable values are dropped.** Empty values, and the placeholder `[object object]` that any object stringifies to, are gone. This is the fix for a global search for `object` matching every asset with an object-valued property.
-   **The index is sorted.** The order values are stored in is now stable, so an integration that returns the same data in a different order no longer registers as a change to the asset.

### Assets with a lot of text are more findable

The search index has a per-asset size limit. Assets that exceeded it — typically large policy or configuration assets — had their content cut off at the limit, and anything past the cut was unsearchable. Because the index now carries less redundant and machine-readable content, more of those assets fit inside the limit, and more of their text is reachable than before.

### When you will see this

The index is rebuilt for an asset the next time that asset changes and is re-ingested. There is no bulk rewrite, so the change appears across your account as your integrations run their normal syncs.

---

## Raw data is served from the ingestion pipeline

Raw data — the unmodified payload the source system returned, shown in the asset inspector and available through the API — is now fetched on demand from the sync job that produced it, rather than read from a copy held alongside the asset.

**Nothing changes about how you access it.** The same inspector tab, the same API field, and the same content: the payload you get back is identical to what was returned before.

### Raw data covers your recent syncs

Raw data is retained for **7 days** from the sync job that uploaded it. In practice this covers any integration on a normal schedule — an integration syncing daily or more often always has raw data available for the assets in its most recent run.

Where you will notice the difference:

-   **Dormant integrations.** If an integration has not run in more than 7 days, raw data for its assets reports as unavailable rather than returning the older payload. Running the integration restores it.
-   **Assets not in the most recent run.** Raw data comes from an integration's most recent sync. If a run did not include a particular asset — a partial dataset, for example — raw data for that asset may report as unavailable until a run covers it again.

In both cases the asset itself, and all of its properties, are unaffected. Only the raw data payload is unavailable.

> **INFO**
> 
> Raw data is a record of what a source system sent, not a store of record. If you need a durable copy of a source payload, export it or retain it at the source.

### Retrieval takes slightly longer

Fetching raw data now reads from the ingestion pipeline's storage rather than from the graph, which adds a small amount of latency to the first retrieval. For interactive use in the inspector this is not noticeable. If you retrieve raw data in bulk through the API, use the `entityRawDataV2` query. It takes the asset's ingestion address alongside its ID, which avoids the extra lookup and keeps per-asset retrieval times close to what they were before. The `entityRawDataLegacy` query is deprecated and is slower per asset. See [Entity raw data](/api/entity-raw-data.md).

---

Source: /features/assets/whats-new-in-assets

# Assets Release Notes

**Release date: July 7, 2026**

JupiterOne has rebuilt Assets on its modern app foundation. Everything you relied on before is still here, and the rebuild brought a few improvements worth calling out.

## What is new

| Change | What it means for you |
| --- | --- |
| Smart Classes in the class list | Your Smart Classes now appear alongside your other classes on the Assets page - no separate place to look |
| Critical assets are a Smart Class | The critical asset toggle is replaced by the `CriticalAsset` Smart Class, so criticality works like any other Smart Class |
| Open a Smart Class to see its results | Clicking a Smart Class opens the results of its query; editing it happens in a modal so you keep your place |
| Filters at the top of entity pages | On entity pages, the filters now sit at the top where they're easy to find |

## Smart Classes live alongside your classes

Your Smart Classes now show up in the same list of classes on the Assets page as the rest of your classes. Instead of treating Smart Classes as a separate area, you browse them right next to your other classes — one list, one place to look.

![The Assets page class list showing Smart Classes listed alongside the standard classes, expanded to show individual Smart Classes like CriticalAsset](/assets/images/smart-classes-in-class-list-fb583201b604cfdb2d0c86e98d983723.png)

## Critical assets are now a Smart Class

The standalone critical asset toggle has been replaced by a `CriticalAsset` Smart Class. Criticality is now expressed the same way as any other Smart Class, so you define and query it with the same tools you already use for the rest of your Smart Classes.

## Open a Smart Class to see its results

Clicking a Smart Class in the list opens the results of its query, so you go straight to the assets it captures. To make changes, click the **Edit** button that appears on the Smart Class row — it opens in a modal over your list, so you can adjust it and close it to land exactly where you left off.

## Filters where you expect them

On entity pages, the filters now sit at the top of the page. Narrowing down your assets starts right where you're looking, so it's quicker to find what you need.

---

Source: /features/assets/working-with-assets

# Working with assets

JupiterOne Assets enables you to see all your digital assets (entities) in one table or graph, allowing you to centralize your data and gain valuable context around your assets. Assets are organized into categories such as people and organization and networks.

![JupiterOne Assets View](/assets/images/assets-main-1e0a53a013948575a7fb017851e89141.png)

There are several ways to filter the large list of entities displayed in Assets:

-   Filter by class and/or type using the left panel
-   Filter by smart class
-   Add granular property filters from the filter bar at the top of the results

> **INFO**
> 
> Find more information around the default asset types in our data model [here](/data-model/jupiterone-data-model.md).

## Filter by smart class

Smart classes appear in the **Smart classes** group in the left panel, alongside your other classes. Select a smart class to filter the results to the assets it captures.

Critical assets are now expressed as the `CriticalAsset` smart class rather than a separate quick filter. If you previously used critical assets, your definition was migrated to a smart class. To classify assets into ordered criticality levels, use [Asset criticality](/features/assets/asset-criticality.md).

> **INFO**
> 
> See our dedicated guide to find [additional information on smart classes](/features/assets/smart-classes.md).

## Quick Filter All Assets

Assets are organized into the categories you see listed in the left panel of the Asset landing page. Click any of those categories to bring the category into focus. These categories are:

-   Applications & Services
-   Compute & Devices
-   Data & Storage
-   Identities & Access
-   Network
-   People & Organization
-   Policy & Documentation
-   Risks & Alerts
-   Other
-   Custom
-   Smart classes

### Asset classes and types

Each category has classes of assets, and each class has types. In the following example, the category is Applications & Services, the class is `Application`, and the selected type is `kandji_app`.

![Quick filter assets example](/assets/images/asset-quick-filter-type-e722c3ab4ba2ff8c92980eb719aa20ec.png)

The `_class` of an asset is an abstract label that defines what the asset is within the concept of security operations similarly to categories, which are groups of like classes.

The `_type` of an asset represents its specific type of entity as defined by its source. For more details, see the JupiterOne Data Model documentation.

### Asset properties

When you select any asset in the results table, its detailed properties open in a side panel (the inspector).

To filter by properties, use the filter bar at the top of the results. Click **Add filter**, choose a property and operator, and set a value. Active filters appear as chips you can remove, and **Clear filters** resets them.

> **INFO**
> 
> You can find additional information around asset properties within our dedicated guide: [working with properties](/features/assets/working-with-properties.md).

---

Source: /features/assets/working-with-properties

# Working with properties

> **WARNING**
> 
> Editing asset properties in the UI has been deprecated. The properties panel is now read-only, so enriching or modifying property values, bulk-editing owner and tags, and resetting values are no longer available in the app. To update or enrich entities, use the [JupiterOne API](#updating-entities-via-the-api).

When JupiterOne ingests your asset data, properties are also ingested and other JupiterOne-specific properties are assigned to the asset. Asset properties enable you to understand more context around a particular asset and search for assets that have a specific property.

![JupiterOneAsset property panel](/assets/images/asset-properties-panel-5163a2a472c89cf17d5b078e3c396e79.png)

## Accessing the graph inspector

The asset detailed properties side panel (the inspector) opens when you click on any of your assets (entities) anywhere in the JupiterOne UI, including in query or search results.

In addition to properties, JupiterOne ingests and/or assigns metadata and tags. JupiterOne also ingests raw data to document exactly what the source sent in its raw form. Reviewing the raw data enables you to verify what JupiterOne ingested in case the source has any additional information.

> **INFO**
> 
> Raw data is retrieved on demand from the sync job that produced it, and is retained for **7 days** from that sync. Any integration running on a normal schedule always has raw data available for the assets in its most recent run. If an integration has not run in more than 7 days, or a run did not include a particular asset, raw data for that asset reports as unavailable — the asset and its properties are unaffected. See [What's new in Asset Data](/features/assets/whats-new-in-asset-data.md).

## Updating entities via the API

Entity properties are no longer editable in the UI. To update or enrich entities — including their properties, tags, and owner — use the JupiterOne API:

-   [Sync jobs API](/api/sync-jobs/overview.md) — upload or update assets and relationships in quantity, formatted as JSON or YAML.
-   [JupiterOne API reference](/reference.md) — read and update data programmatically through the GraphQL endpoint.

> **INFO**
> 
> If the asset data was ingested by an integration, we recommend updating the data at the source rather than in JupiterOne, so the change persists across syncs.

---

Source: /features/ccm/ccm-1-2

# CCM 1.2 Release Notes

**Release date: February 19, 2026**

Continuous Control Monitoring 1.2 transforms CCM from a technical, JSON-import-driven tool into an accessible experience for your entire compliance team. With UI-based authoring, AI-assisted control creation, and enterprise governance workflows, you can now build and manage your control library without developer assistance or J1QL expertise.

## What is new in CCM 1.2

| Feature | What it means for you |
| --- | --- |
| UI-based framework and requirement authoring | Create your compliance structure directly in the UI — no JSON imports required |
| AI-assisted control authoring | JupiterOne AI generates control descriptions, remediation steps, identifiers, and source catalogs from a title |
| AI-assisted control test creation | Describe what you want to test and JupiterOne AI writes the J1QL query for you |
| Control lifecycle management | Govern controls through Draft, Review, Live, and Retired states |
| Control effectiveness indicators | See at a glance whether controls have datapoints, are passing, or need attention |
| Integration awareness | Know which integrations your control tests depend on before you save |
| Control properties and ownership | Assign owners, define remediation steps, and track exception processes per control |
| Entitlement management | Transparent usage metering based on your Live control count |

## Create frameworks and requirements in the UI

Previously, creating a custom compliance framework required importing a JSON file. Now you can build your entire compliance structure directly in the JupiterOne UI.

You can:

-   Create new frameworks with a title and description using the markdown editor
-   Add requirements within a framework, each with an identifier, priority, and description
-   Edit existing frameworks and requirements inline
-   Delete frameworks and requirements with soft-delete protection

This means compliance managers can define and maintain custom frameworks without developer help or file preparation.

![Framework creation UI](/assets/images/framework-creation-ui-042b6bb2b6715e6e357aabc9f1450c15.png)

> **TIP**
> 
> You can still use the **Use Common Framework** option to start from an out-of-the-box CIS benchmark (including AWS, Azure, GCP, Microsoft 365, GitHub, Oracle Cloud Infrastructure, and Kubernetes), then customize it with your own requirements. If you need a framework that is not listed, click **Request a new Framework** to submit a request.

## Author controls with AI assistance

JupiterOne AI dramatically reduces the time it takes to author a new control. Instead of writing every field from scratch, you enter a control title and JupiterOne AI generates the rest.

**How it works:**

1.  Navigate to a requirement and click **Add a control**
2.  Enter a descriptive title (for example, "S3 Bucket Encryption Control")
3.  Click **Draft control with AI** — JupiterOne AI auto-generates:
    -   Control description
    -   Remediation steps
    -   Identifier
    -   Source catalog
4.  Review and edit any field — AI suggestions are not mandatory

JupiterOne AI uses context from the linked requirement to improve suggestion quality. You maintain full control over the final content.

> **NOTE**
> 
> AI-assisted generation is available when creating a new control. When editing an existing control, you update fields manually.

![AI-assisted control authoring](/assets/images/ai-assisted-control-authoring-95382d4e6218653a23c068e30f0b0170.png)

> **TIP**
> 
> JupiterOne AI is trained on CIS Controls v8.0, so it generates consistent, industry-standard language. You can always edit the output to match your organization's terminology.

## Create control tests with AI-generated queries

You no longer need J1QL expertise to create control tests. Describe what you want to validate and JupiterOne AI writes the query for you.

> **NOTE**
> 
> AI-assisted query generation is available when creating a new control test. When editing an existing test, you update the query manually.

**How it works:**

1.  From a control, click **New control test**
2.  Enter a descriptive title (for example, "S3 buckets without encryption enabled")
3.  Select the test type: **Compliant assets** or **Non-compliant assets**
4.  Click **Generate query** — JupiterOne AI generates the J1QL query based on your title and the control context, and automatically runs it so you can review matching entities
5.  Save the test

**Mirror test creation:** After you save a Non-compliant assets test, CCM prompts you to add a corresponding Compliant assets test (and vice versa) with the test type pre-selected. This ensures comprehensive coverage with minimal effort.

![AI-generated control test query](/assets/images/ai-generated-control-test-18266e9f767bc4a5baaebf2f636c563e.png)

> **TIP**
> 
> Always review the query results before saving. The results grid shows you exactly which entities match, so you can verify the query logic is correct. Click **Run J1QL** to re-run the query if you make manual edits.

## Control lifecycle management

CCM 1.2 introduces enterprise-grade governance for your control library. Every control now moves through a defined lifecycle, preventing untested or unapproved controls from affecting your compliance posture.

**Lifecycle states:**

| State | Purpose |
| --- | --- |
| **Draft** | Control is being developed. This is the default state for new controls. |
| **Review** | Control is ready for validation by your team. |
| **Live** | Control is active and affects compliance scoring. |
| **Retired** | Control is no longer active but preserved for audit history. |

**Key behaviors:**

-   Only **Live** controls are evaluated during compliance scoring
-   Every state transition is recorded in an audit trail with optional notes
-   You can filter your control library by lifecycle state (under **More filters** > **State**)
-   Only **Live** controls count toward your entitlement limits

![Control lifecycle management](/assets/images/control-lifecycle-d8f9ea98afd76a6a0d4af4defd77df9e.png)

> **TIP**
> 
> Use the **Review** state as a quality gate. Controls in Review are visible to your team for validation but do not affect your compliance scores or entitlement usage.

## Control effectiveness at a glance

CCM 1.2 adds clear status indicators so you can instantly understand whether your controls are working.

**Control test statuses:**

-   **No Datapoints** — The test query returned no matching entities, preventing false failures when data is unavailable.
-   Control tests that are effective (passing) are not decorated with a special status.

**Control statuses:**

-   **No Control Tests** — The control has no tests configured.
-   **No Datapoints** — All of the control's tests lack datapoints.
-   Controls with at least one passing test that has datapoints show standard pass/fail results.

Status rolls up from the test level to the control level, and from the control level to the requirement level. You can see at every layer of your compliance hierarchy where attention is needed.

![Control effectiveness indicators](/assets/images/control-effectiveness-67e05918940c54c15e0c90ea53977d39.png)

## Integration awareness

CCM 1.2 automatically detects which integrations a control test queries and gives you real-time feedback on eligibility.

**How it works:**

-   When you author a control test, the UI shows which integrations provide data for your query
-   If no matching entities exist for a test (for example, you have no AWS integrations but the test queries `aws_s3_bucket`), the test shows **No Datapoints**
-   Tests with no datapoints are skipped during evaluation — they do not produce false failures

This prevents the common "why is my control failing?" confusion that occurs when a test queries data from an integration you have not configured.

![Integration awareness display](/assets/images/integration-awareness-747872826a2d1d51b7393e186d2226dc.png)

## New control properties

Controls in CCM 1.2 include richer properties that support accountability and operational workflows:

-   **Title** — Clear, descriptive name for the control
-   **Identifier** — Reference code for sorting and filtering (for example, "IAM-001")
-   **Catalog** — Logical grouping for the control (for example, "CIS Controls v8"). Select an existing catalog or create a new one.
-   **Description** — What the control validates and why (AI-assisted on create)
-   **Remediation** — Steps to take when the control is failing (AI-assisted on create)
-   **Exception Process** — How to handle approved exceptions for this control
-   **Owner** — The JupiterOne user responsible for this control

Assigning a **Control Owner** enables accountability and allows you to filter your control library and see who is responsible for a given control.

## Entitlement management

CCM 1.2 provides transparent usage metering so you always know where you stand relative to your entitlement.

-   Usage is based on your **Live** control count
-   Controls in **Draft**, **Review**, or **Retired** states are excluded from your limit

This means you can freely develop and stage controls without worrying about exceeding your entitlement until you move them to Live.

## Getting started

**If you are an existing CCM user:** Your existing controls are automatically set to **Live** status. No migration action is required. You can begin using lifecycle management, AI authoring, and the new UI features immediately.

**If you are new to CCM:** Follow these steps to get started:

1.  Navigate to **Controls** > **Frameworks** and click **Add a framework** to create your first framework (or choose an out-of-the-box CIS benchmark)
2.  Add requirements to your framework
3.  Create controls within your requirements — use JupiterOne AI to accelerate authoring
4.  Add control tests to validate each control — let JupiterOne AI generate the J1QL queries
5.  Move controls through the lifecycle: **Draft** → **Review** → **Live**
6.  Monitor effectiveness from the framework and requirement views

For full feature documentation, see [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md).

---

Source: /features/ccm/ccm-1-3

# CCM 1.3 Release Notes

**Release date: April 2026**

Continuous Control Monitoring 1.3 gives every persona on your compliance team their own view of compliance posture. Framework Owners see board-ready scorecards across all frameworks. Control Owners see the status of their controls at a glance. OU Owners see compliance scoped to their team - without asking the central compliance team for a report. Daily digest emails surface changes proactively so that nothing falls through the cracks.

## What is new in CCM 1.3

| Feature | What it means for you |
| --- | --- |
| Framework compliance scorecards | See compliance health, failing requirements, and coverage across every framework in one view |
| Worst-results sorting | Failing requirements surface first, prioritised by severity, so you focus on what matters |
| Requirement drill-down | Inspect controls, test results, and remediation steps without leaving the framework view |
| Framework compliance export | Generate board-ready PDF and CSV reports filtered to exactly what you need |
| Controls Status View | Unified view of control health with "My Controls" default - see what you own and its status |
| Organisational units | Integration instances automatically become OUs, scoping compliance data to teams |
| Framework and control ownership | Assign Framework Owners alongside Control Owners for clear accountability |
| Daily digest emails | Proactive notifications for Framework Owners, Control Owners, and OU contacts |

## Framework compliance scorecards

You can now see the compliance health of every framework at a glance. The new **Framework Compliance View** provides a scorecard for each framework showing health percentage, failing requirements, and control coverage.

**What you see:**

-   A card-based grid of all your frameworks with name, controls coverage, and passing percentage
-   Filter and search to find specific frameworks quickly
-   Click any framework card to drill into its details

**Framework detail view:**

When you open a framework, a summary header shows key metrics:

-   **AI Generated analysis** - A strategic summary of your framework
-   **Framework health percentage** - overall compliance score
-   **Failing requirements** - total count of requirements not passing
-   **High-priority failing requirements** - critical failures that need immediate attention

Below the header, requirements are listed with their status, priority, and control mappings grouped by section. The detail view includes an **Framework overview** tab (the new compliance view) and a **Manage** option in the top right (the existing CCM 1.2 authoring UI).

![Framework Compliance View showing scorecard grid with health percentages and coverage](/assets/images/ccm-framework-overview-c33547cc9f36f9a0257f3f339427282d.png)

> **TIP**
> 
> Use the Framework Compliance View export to generate a board-ready compliance report. The PDF includes the JupiterOne logo and metadata, and the CSV provides one row per requirement for further analysis. Both formats respect your active filters.

## Critical-results sorting

Requirements within a framework are filtered so that the most critical failures can be shown. You do not need to scroll through passing requirements to find the ones that need attention.

**How it works:**

-   Requirements are filtered by failure count and priority (High, Medium, Low)
-   Status tabs - **All**, **Failing**, **Passing** - let you toggle the view with live counts
-   Each requirement card shows a priority badge, test counts, failure counts, and a description preview
-   Failing requirements display a red **Failing** chip

![Framework detail view with requirements sorted by priority and failure count](/assets/images/ccm-framework-detail-cbc60bcae2af24a3c7c573329e618dff.png)

## Requirement drill-down

Click any requirement's control to open a detail drawer with:

-   **Summmary** - The description of the control that monitors this requirement, details of the last evaluations, owner of impacted assets
-   **Control tests** - The specific control tests for this requirement, what integrations they interact with, their status
-   **Control remediation** - Remediation details for the control
-   **Exception process** - Exception process details for the control

You can click **Open control page** to navigate to the full control detail.

![Requirement drill-down drawer with control summary and test details](/assets/images/ccm-requirements-drilldown-3d7a5a320703ed7c6f425d3c3e5fab7f.png)

> **TIP**
> 
> Combine the filter bar with the drill-down to quickly triage failures. Filter by priority and status, then click into each failing requirement to review its controls and remediation steps.

## Framework compliance export

You can export your framework compliance status as a PDF or CSV at any time.

-   **PDF** - Includes the JupiterOne logo, framework metadata, and compliance status. Suitable for board reporting and executive summaries.
-   **CSV** - One row per requirement with columns for identifier, name, status, priority, control count, test count, failing tests, and last evaluated timestamp. Suitable for further analysis in spreadsheets.

Both formats respect your active filters, so you can export exactly the subset of data you need.

## Controls Status View

The new **Controls Status View** gives Control Owners and Asset Owners a single place to see the health of their controls.

**Default experience:**

-   The view defaults to **My Controls** if you own any controls - showing only the controls assigned to you
-   Each control displays its status (pass, fail, error, or not evaluated), last evaluated timestamp, and linked framework
-   A summary header shows total controls, passing count, failing count, and pass rate
-   Sort, filter, and search to find specific controls quickly

Clicking on a control takes you to that control's summary page. You can then drill down further into the individual control tests.

**Control test drill-down:**

Click any control test to see:

-   Test result history / Live results with status and timestamps
-   Linked assets / results with individual pass/fail status
-   Specific failure reasons and affected assets

**Filter and search:**

-   Filter inline by status, resource group, framework, or active/inactive state
-   Open **More filters** for lifecycle state, effectiveness, attested status, catalog, and org units
-   Filters use AND logic and are reflected in the URL for shareable links
-   A **Clear Filters** action resets all filters at once

**Export:**

Export the current view as a CSV respecting all active filters. Columns include control name, status, last evaluated, framework, and owner.

![Controls Status View with My Controls filter and summary header](/assets/images/ccm-my-controls-1313d895dafd704690b2eff509349e7b.png)

## Organisational units

CCM 1.3 introduces organisational units (OUs) that scope compliance data to teams. In this release, each integration instance automatically becomes an OU - no manual setup is required.

For full documentation of the OU capability - the admin interface, the OU filter in Compliance and Vulnerability Management, and the OU metadata on entities - see [Organizational Units](/features/admin/organizational-units.md).

**How it works:**

-   Every integration instance in your account automatically appears as an OU
-   All graph entities carry an `_ou` property linking them to their integration instance
-   The OU lifecycle is tied to the integration instance lifecycle - when you add or remove an integration, the corresponding OU is created or removed

**OU admin overview:**

Navigate to the OU admin page (Settings > Organizational Units) to see a table of all your OU groupings with:

-   OU name and integration type
-   Entity count
-   Metadata: Primary and Secondary Owners, Jira project, and Slack channel (coming soon)
-   OUs without routing metadata are indicated "missing" so you know what needs configuration

**Routing metadata:**

For each OU, you can configure operational routing metadata:

-   **Owner email** - The primary and secondary people responsible for this OU
-   **Jira project** - For ticket assignment from compliance drill-downs (coming soon)
-   **Slack channel** - For notifications (coming soon)

All fields are optional. Changes persist immediately and are available via the API.

![OU admin overview with integration instances and routing metadata](/assets/images/ou-admin-15b3e93badb7327fd1d425102a8ec330.png)

> **NOTE**
> 
> In this release, OUs are derived from integration instances. Future releases will expand the OU model to support custom organisational structures.

## OU-scoped compliance views

When you select an OU in the Org Units filter (under **More filters**), the Controls Status View and drill-down filter to show only controls with results related to assets in that organisational unit.

**How it works:**

1.  Open **More filters** on the Controls page and select an OU from the **Org units** filter
2.  The controls list filters to show only controls with assets in the selected OU
3.  The summary header adapts to show the OU name and OU-specific compliance metrics
4.  The drill-down shows which assets within the selected OU are affected, with individual pass/fail status

The OU selection persists in the URL, so you can share a link to a specific OU's compliance view with a team member.

![Controls Status View with OU selector filtering to a specific organisational unit](/assets/images/ccm-ou-picker-e45b91dc390ff8888d2980938707fcde.png)

> **TIP**
> 
> Use OU-scoped views to give each team lead a self-service compliance view. An IT or Cloud Ops leader can select their OU and immediately see their team's compliance posture without asking the central compliance team.

## Framework and control ownership

CCM 1.3 adds **Framework Owners** alongside the existing Control Owners from CCM 1.2.

-   Assign an owner to any framework using the user search and select dropdown
-   Framework Owners can filter to see **My Frameworks** for a focused view
-   Ownership enables targeted daily digest emails (see below)

The Framework Owner assignment follows the same pattern as Control Owner assignment - select any JupiterOne user from the dropdown.

## Daily digest emails

CCM 1.3 delivers proactive compliance notifications so you do not need to check the dashboard manually. Each digest summarises actionable status changes and includes deep links back to the relevant view with pre-configured filters.

**Framework Owner digest:**

-   Daily summary of compliance status for all frameworks you own
-   Includes total frameworks owned, passing and failing counts, and compliance scores
-   Per-framework breakdown with status details
-   Only sent when actionable results exist - no noise on quiet days

**Control Owner digest:**

-   Daily summary of status for all controls you own
-   Includes total controls owned, passing and failing counts
-   Per-control breakdown
-   Deep links to the Controls Status View filtered to your controls

**OU contact digest:**

-   Daily summary sent to the email address configured in the OU routing metadata
-   Includes OU name, integration type, entity count, and compliance score
-   Lists failing controls within the OU
-   Contacts responsible for multiple OUs receive one consolidated email with each OU as a separate section

> **NOTE**
> 
> Digest emails are only sent when there are actionable results. If all your controls are passing and nothing has changed, you do not receive an email.

## Getting started

**If you are an existing CCM user:** All new features are available immediately. Your existing control ownership assignments are preserved. To take advantage of the new views:

1.  Navigate to **Compliance** > **Frameworks** to see the new Framework Compliance View
2.  Click any framework to see the compliance scorecard and drill-down
3.  Navigate to **Compliance** > **Controls Status** to see the unified Controls Status View
4.  Assign Framework Owners to enable framework-level digest emails
5.  Configure OU routing metadata (owner email, Jira project, Slack channel) in the OU admin page to enable OU contact digests

**If you are new to CCM:** Start with the [CCM 1.2 setup steps](/features/ccm/ccm-1-2.md#getting-started) to create your frameworks, requirements, and controls. Once your control library is in place, the CCM 1.3 features - scorecards, status views, OU scoping, and digest emails - activate automatically.

For full feature documentation, see [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md).

---

Source: /features/ccm/ccm-1-4

# CCM 1.4 Release Notes

**Release date: June 2026**

Continuous Control Monitoring 1.4 introduces **Control Attestations**. Until now a control's status came solely from its control tests: any failing test made the control fail, and a control with no tests had no status. There was no first-class, audited way to say "this control is satisfied by evidence that lives outside JupiterOne" - a vendor SOC 2 report, a risk acceptance, or a manual process - and have that reflected in your compliance posture.

Attestations close that gap. An authorised user can formally justify a control for a defined period; when no control test already covers it, the control is then reported as **Attested** - a pass, with a caveat - with the full justification retained for audit and automatic re-failure when the attestation expires. An attestation never overrides a _failing_ test, so it can't mask a real gap.

## What is new in CCM 1.4

| Feature | What it means for you |
| --- | --- |
| Control Attestations | Record external or compensating evidence against a control and have it count toward compliance for a bounded time |
| Attested status | A control passing _solely_ by a valid attestation (no contributing test) reports as **Pass**, with an **Attested** note in the Effectiveness column - a pass with a caveat, never a hidden failure |
| Combined control view | Attestations and control tests now live in one **Control tests and attestations** section on the control page |
| Automatic expiry | When an attestation expires the control automatically re-fails, so a lapsed justification can never silently mask a gap |
| Compliance rollups & filters | Valid attested controls count as passing in scorecards, framework counts, and digests; you can filter the controls list by **Attested** |
| Expiry reminder emails | Attestation owners get a weekly email of attestations expiring soon or already expired, and the daily Control and OU digests now count the controls passing by attestation |

## Control Attestations

An **attestation** is a record that justifies a control's compliance using evidence outside of its automated tests. Create one from the control detail page when you have control-edit permission.

**Each attestation captures:**

-   **Subject** - a short title for the justification (e.g. "Vendor SOC 2 Type II report")
-   **Description** - the supporting detail, in markdown
-   **Expiry date** - when the justification lapses and the control re-evaluates
-   **Owner** - the person responsible for renewing it
-   **Document link** - an optional link to supporting evidence

Attestations are effective immediately - there is no approval workflow in this release. A control can carry more than one attestation (for example, one per vendor); the rules for how multiple attestations combine are described in [How attestations affect control status](#how-attestations-affect-control-status) below.

> **NOTE**
> 
> Attestations apply to **live** controls. The justification, edit, and revocation history is retained in the audit trail independently of the control, so revoking or expiring an attestation never erases the record of why it existed.

## Attested status - a pass with a caveat

When a control passes **solely** by a valid attestation - it has no contributing control test - its status is reported as **Pass**, and the **Effectiveness** column shows an **Attested** note. The Attested marker makes clear the pass is backed by evidence rather than a passing test. A control that already passes on its tests stays a plain **Pass**; a control with a _failing_ test still **Fails** - an attestation never masks it.

-   Scorecards, framework compliance counts, and daily digests count valid attested controls as **passing**.
-   The controls list still lets you find them: open **More filters** and filter by **Attested** to see exactly which controls are passing by attestation rather than by test.
-   An expired attestation is **not** a pass - the control fails (see below).

![Controls list showing an Attested control - Pass status with an Attested effective status](/assets/images/attestation-controls-list-b378ce48ec9b1a833fd990693d769621.png)

## Combined "Control tests and attestations" view

The control detail page now presents a single **Control tests and attestations** section. Attestations appear **above** the control tests. Because a failing test always fails the control - an attestation never masks it - the section calls out the two cases worth explaining: a control _passing by attestation_ (a valid attestation with no contributing test), and a control _failing despite an attestation_ (a failing test you still need to fix or archive).

This keeps everything about a control's compliance in one place: you can see the justification and the underlying test results together, and never have an attestation quietly hide a failing test.

![Passing by attestation: a valid attestation carries a control that has no contributing test](/assets/images/attestation-passing-by-attestation-3e9f4077103c7d1c1e4008f8d2e6c0be.png)

![Failing despite an attestation: a failing control test still fails the control](/assets/images/attestation-control-combined-c30a459431b2beac830849a4860f5f4a.png)

## How attestations affect control status

A control's status weighs its control tests and its attestations **together** - an attestation never overrides a failing test. Revoked attestations are removed and never count. The table below shows the resulting status for every combination:

| Control tests | Attestations | Control status |
| --- | --- | --- |
| None contributing | None (or only revoked) | Not evaluated |
| None contributing | At least one valid attestation | **Pass** _(Attested)_ |
| Passing | None or valid | **Pass** |
| Failing | Any (valid or not) | **Fail** |
| Any | Any non-revoked attestation expired | **Fail** |

**The key rules:**

-   A **failing** control test always **Fails** the control - an attestation never masks it. To pass a control whose test is failing, fix the failing test, or archive the test if it no longer applies and let a valid attestation carry the control.
-   **Attested** is reserved for a control that passes _solely_ by a valid attestation, with no contributing test. A control that already passes on a test stays a plain **Pass**.
-   If **any** non-revoked attestation has **expired**, the control **Fails** - even over passing tests. One lapsed justification fails the control, so an expiry is never overlooked.
-   **Revoking** an attestation removes it from the calculation; the control reverts to whatever its tests (or remaining valid attestations) say.

## Automatic expiry handling

Attestation expiry is a time event, so CCM re-evaluates attested controls on a recurring schedule (within 24 hours) in addition to recomputing immediately whenever an attestation is created, edited, or revoked. A control whose only attestation lapses returns to failing automatically - even if it has no control tests that would otherwise trigger a re-evaluation.

To renew an attestation before it lapses, open the control and **Edit** the attestation to extend its expiry date. Each attestation in the **Control tests and attestations** list shows its current state (active, expiring soon, expired, or revoked) so you can spot upcoming expiries.

## Expiry reminder emails

Because a lapsed attestation re-fails its control, CCM reminds the people who can act on it - before and after an attestation lapses - rather than relying on them to check each control.

**Weekly attestation digest.** Each attestation **owner** receives a weekly email summarising the attestations they own that need attention:

-   **Already expired** - attestations whose date has passed, so the control is failing now. These are listed first, as they need the most urgent action.
-   **Expiring soon** - attestations due to expire within the next 30 days, so you can renew them before the control re-fails.

Each entry shows the attestation's subject, its expiry date, and a link to the control where you renew it. The email is sent only to owners who actually have something expiring or expired - if nothing needs attention, no email goes out - and revoked attestations are never included. The email also links to your **Attested** controls so you can review everything currently passing by attestation in one place.

**Attestation coverage in the daily digests.** The existing [daily Control Owner and OU contact digests](/features/ccm/ccm-1-3.md#daily-digest-emails) now also report how many of your controls are **passing by attestation**, so the attested portion of your posture is visible alongside the passing and failing counts.

## Getting started

**If you are an existing CCM user:** Control Attestations are available immediately on your live controls.

1.  Open any live control from **Compliance** > **Controls Status**.
2.  In the **Control tests and attestations** section, choose **Add an attestation**.
3.  Enter the subject, description, expiry date, owner, and an optional document link, then save.
4.  The control's status updates to **Pass** with an **Attested** note; it will automatically re-fail if the attestation expires.
5.  On the controls list, open **More filters** and use the **Attested** filter to review everything currently passing by attestation.

**If you are new to CCM:** Start with the [CCM 1.2 setup steps](/features/ccm/ccm-1-2.md#getting-started) to create your frameworks, requirements, and controls, then layer attestations on top where automated tests cannot tell the whole story.

For full feature documentation, see [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md#control-attestations).

---

Source: /features/ccm/continuous-control-monitoring

# Continuous Control Monitoring

JupiterOne's Continuous Control Monitoring (CCM) provides enterprise teams with automated, graph-powered validation of security control effectiveness across your entire technology ecosystem.

Designed for organizations with existing governance frameworks and dedicated compliance programs, CCM helps Platform Engineering, DevOps, and Security Architecture teams continuously validate that controls defined in your governance systems are working as intended in your actual infrastructure.

## Overview

Continuous Control Monitoring enables your team to:

-   **Automate control validation** using JupiterOne's graph-powered query engine to continuously test control effectiveness
-   **Monitor control status in real-time** across all your integrated cloud platforms, security tools, and IT infrastructure
-   **Map controls to multiple frameworks** including CIS benchmarks for AWS, Azure, GCP, and other standards
-   **Detect configuration drift** automatically as your infrastructure changes
-   **Visualize control health** through dashboards showing compliance status and control test results
-   **Bridge the gap** between governance requirements and actual infrastructure reality

![CCM Overview Dashboard](/assets/images/ccm-overview-dashboard-10c1effb27c582b5be73807eeb3b6625.png)

The CCM Overview Dashboard provides an at-a-glance view of your control monitoring status, showing:

-   **Total Controls**: Complete count of all controls being monitored
-   **Compliant Controls**: Number of controls with all tests passing
-   **Non-Compliant Controls**: Number of controls with one or more tests failing
-   **Compliance trends over time**: Historical view of how control compliance changes
-   **Failing controls by account**: Breakdown of which cloud accounts or integrations have the most issues

**JupiterOne's Unified Control Framework:**

JupiterOne uses [CIS Controls v8.0](https://www.cisecurity.org/controls/v8) as the unified control list for all out-of-the-box content. All mappings between different security standards (SOC 2, CIS standards, NIST etc.) and JupiterOne-managed controls follow the CIS v8.0 mapping framework. This provides a consistent, industry-standard foundation for cross-framework control reuse and ensures that a single control implementation can satisfy requirements across multiple compliance standards.

## Data Model

CCM uses a four-level hierarchy to organize your compliance and security program:

```text
Framework
  └── Requirement
        └── Control
              └── Control Test
```

| Level | What it answers | Owned by | Example |
| --- | --- | --- | --- |
| **Framework** | What standards do we follow? | External standards body or your organization | CIS v8, SOC 2, HIPAA, or an internal security policy |
| **Requirement** | What must we achieve? | The framework | "Maintain an inventory of enterprise assets" |
| **Control** | How do we meet the requirement? | Your organization | "Automated asset discovery via JupiterOne integrations" |
| **Control Test** | Is our control actually working? | Your organization | J1QL query: `FIND aws_iam_user WITH mfaEnabled != true` |

A single control can satisfy multiple requirements across different frameworks, and each control can have multiple control tests for comprehensive validation.

### Framework properties

| Property | Description |
| --- | --- |
| **Title** | Name of the framework |
| **Description** | Overview of the framework's purpose and scope (markdown) |

### Requirement properties

| Property | Description |
| --- | --- |
| **Title** | Name of the requirement |
| **Identifier** | Reference code from the framework (for example, "CC6.1" or "IDAM3.5"). Used for sorting and filtering. |
| **Priority** | Criticality level: Critical, High, Medium, or Low |
| **Description** | What the requirement mandates (markdown) |

### Control properties

| Property | Description |
| --- | --- |
| **Title** | Name of the control |
| **Identifier** | Reference code for the control. Used for sorting and filtering. |
| **Catalog** | Logical grouping for the control (for example, "CIS Controls v8"). You can select an existing catalog or create a new one. |
| **Owner** | The JupiterOne user responsible for the control |
| **State** | Lifecycle state: Draft, Review, Live, or Retired |
| **Description** | What the control does and why it matters (markdown, AI-assisted on create) |
| **Remediation** | Steps to take when the control is failing (markdown, AI-assisted on create) |
| **Exception Process** | How to handle approved exceptions (markdown) |
| **MITRE technique** | The MITRE ATT&CK technique this control relates to (for example, "T1078" or the sub-technique "T1059.001"). Optional. |

### Control test properties

| Property | Description |
| --- | --- |
| **Title** | Name of the test |
| **Type** | Whether results represent **Compliant assets** or **Non-compliant assets** |
| **J1QL** | The query that runs against your JupiterOne asset graph |

## View and Manage Modes

CCM has two modes that separate day-to-day monitoring from authoring workflows:

-   **View mode** — Use this mode to review CCM results. You can browse frameworks, requirements, controls, and control test outcomes. This is the default mode for users who need to monitor compliance posture without making changes.
-   **Manage mode** — Use this mode to author and edit frameworks, requirements, controls, and control tests. Switch to Manage mode when you need to create new content or modify existing definitions.

You can switch between modes using the toggle in the CCM navigation. View mode is read-only, so you cannot accidentally modify your control library while reviewing results.

> **NOTE**
> 
> View mode only displays **Live** controls and their results. Controls in Draft, Review, or Retired states are excluded from View mode counts and compliance metrics. Manage mode displays controls in all lifecycle states. This means framework control counts and compliance summaries will differ between the two modes.

## How CCM Works

CCM's core capability is continuous, automated validation of control effectiveness using JupiterOne's query engine.

### Automated Control Testing

**How Control Tests Work:**

1.  Each control has one or more test definitions
2.  Each test contains a J1QL query that runs against your asset graph
3.  Tests execute automatically on a regular schedule
4.  Control status updates based on whether all tests pass

#### Control Test Types

Each control test is either a **Compliant assets** test or a **Non-compliant assets** test. This determines how CCM interprets the query results.

| Test type | What it returns | How CCM interprets results |
| --- | --- | --- |
| **Compliant assets** | Resources that satisfy the control | Results are expected — the more, the better |
| **Non-compliant assets** | Resources that violate the control | Any results indicate a problem |

**Example Control Test:**

A control for "Centralize Account Management" might have two tests:

-   **Test 1 (Non-compliant assets)**: Query for users WITHOUT SSO authentication — any results indicate a violation
-   **Test 2 (Compliant assets)**: Query for users WITH verified SSO — results confirm the control is working

**Example Test Patterns:**

-   **Non-compliant assets test**: Find resources that violate the control
    
    ```j1ql
    FIND aws_s3_bucket WITH encrypted = false
    ```
    
-   **Compliant assets test**: Verify required resources or configurations exist
    
    ```j1ql
    FIND aws_cloudtrail WITH enabled = true
    ```
    

## Key Features

### Control Inventory and Management

CCM provides centralized monitoring of all your security and IT controls. The Controls list page displays:

![Controls Dashboard](/assets/images/controls-dashboard-d098de4bf768a0a7accb0334b8c016dc.png)

-   **Complete control inventory**: Searchable and filterable list of all controls being monitored
-   **Real-time status**: Current compliance state (Compliant/Non-Compliant/Not Configured) for each control
-   **Last evaluated timestamp**: When each control was last tested
-   **Filtering options**: Filter by status, resource group, framework, or active/inactive state inline; additional filters for lifecycle state, effectiveness, attested status, catalog, and org units are available under **More filters**

Each control can be clicked to view detailed information including:

-   **Control tests**: J1QL queries that validate whether the control is working
-   **Test results**: Actual data showing what passed or failed
-   **Framework mappings**: Which framework requirements this control satisfies

#### Viewing Control Test Results

When you click on a control, you can expand each test to see the J1QL query and actual results:

![Control Test Results](/assets/images/control-test-results-efb75b30501dc09837c59aabbe1751a0.png)

The control detail page shows:

-   **Control status**: Overall status badge (Compliant/Non-Compliant)
-   **Test list**: All tests defined for this control with individual pass/fail status
-   **J1QL queries**: Click to expand any test to see the exact query being run
-   **Query results**: Table view of actual assets that passed or failed the test
-   **Result count**: Total number of resources affected (e.g., "1-41 of 41" accounts)

This detailed view enables you to:

-   **Investigate failures**: See exactly which resources are violating the control
-   **Validate test logic**: Review the J1QL query to ensure it's testing the right thing
-   **Collect evidence**: Export query results for audit or remediation purposes
-   **Understand impact**: Identify which accounts or resources need attention

#### Viewing Control Framework Mappings

Click the **Requirements** tab on any control detail page to see which framework requirements this control satisfies:

![Control Requirements Tab](/assets/images/control-requirements-tab-1f8d0dba0c237378779afb7c111f259b.png)

The Requirements tab shows:

-   **Framework name**: Each framework the control maps to (e.g., "SOC 2 Trust Services Criteria", "CIS AWS Foundations Benchmark")
-   **Framework description**: Brief overview of what the framework covers
-   **Specific requirement**: The exact requirement within that framework (e.g., "CC6.1 | Logical and Physical Access Security")
-   **Edit Requirements button**: Add or remove framework mappings for this control
-   **Remove buttons**: Quickly unmap this control from a specific requirement

This view is useful for:

-   **Understanding control coverage**: See which compliance requirements this control helps satisfy
-   **Managing mappings**: Add this control to additional framework requirements or remove outdated mappings
-   **Cross-framework visibility**: Identify controls that satisfy multiple standards simultaneously
-   **Audit preparation**: Document which technical controls support each compliance requirement

### Framework Management

Track control coverage across multiple security and compliance frameworks simultaneously:

![Frameworks Dashboard](/assets/images/frameworks-dashboard-0c4990112700ccc9d2a948205b6c5f0b.png)

The Frameworks page shows:

-   **All available frameworks**: JupiterOne provides out-of-the-box CIS benchmarks including AWS, Azure, GCP, Microsoft 365, GitHub, Oracle Cloud Infrastructure, and Kubernetes, with additional frameworks available based on customer demand
-   **Total controls per framework**: How many controls are defined for each framework
-   **Passing controls**: How many controls are currently passing out of the total (for example, "6 passing out of 51")
-   **Framework descriptions**: Overview of what each framework covers

> **NOTE**
> 
> If you need a framework that is not listed, click **Request a new Framework** on the framework selection page to submit a request. JupiterOne will prioritize framework additions based on customer demand and configure controls relevant to your specific integrations.

Clicking into any framework provides detailed information about:

-   Framework requirements and their hierarchical structure
-   Which controls map to each requirement
-   Control test status for that specific framework
-   Gaps where requirements lack control coverage

#### Framework Details

Click on any framework from the Frameworks page to view comprehensive details:

![CIS Framework Details](/assets/images/cis-framework-details-a70058cba4d7cb134e8cbb5a4a0c2239.png)

The framework detail page shows:

-   **Framework overview**: Description and purpose of the framework
-   **Compliance metrics**: Total controls, passing controls, and overall compliance percentage
-   **Requirements list**: All requirements within the framework, organized hierarchically
-   **Control mappings**: For each requirement, see which controls provide coverage
-   **Control status**: Current pass/fail status for each mapped control
-   **Gap analysis**: Quickly identify requirements that lack control coverage

#### Matrix View

Frameworks whose requirements are organized into two or more sections also get a **Matrix** tab on the framework detail page. The matrix lays the framework out as a grid — one column per section, one cell per requirement — so you can see where a framework is failing at a glance instead of scanning a list. For a tactic-and-technique framework such as MITRE ATT&CK, this is the familiar technique-matrix view.

Each cell is colored by the health of the requirement's controls, with the exact counts printed in the cell as a second channel alongside the color:

-   **Compliance lens** (default): cells shade from green to red by the share of measured controls that are failing.
-   **Coverage lens**: cells shade by how many of the requirement's controls are actually measured — answering "what do I detect?" rather than "what is failing?".
-   **Not measured**: requirements whose controls have no test results yet render as dashed, uncolored cells in either lens.

Cells also carry markers for states worth spotting at a glance:

-   **Manual attestation**: at least one control passes solely on a valid attestation (see [Control Attestations](#control-attestations))
-   **Draft**: the requirement has controls in the draft lifecycle state
-   **Stale**: a live control has not been evaluated in the last two days

Click any cell to open that requirement in the Requirements tab. Section columns are collapsible from their headers, which also show each section's passing/failing distribution.

## Working with Frameworks

### Understanding Control-to-Requirement Mapping

Controls in CCM can map to requirements across multiple frameworks. This allows you to:

-   Reuse a single control definition across multiple compliance standards
-   See which frameworks a control helps satisfy
-   Understand the breadth of coverage provided by your control library
-   Identify opportunities to consolidate duplicate controls

## Creating and Managing Controls

### Creating a New Control

To create a new control in CCM:

1.  Navigate to a framework requirement in **Manage** mode
2.  Click **Add a control**
3.  Define the control properties:
    -   **Title**: A clear, descriptive name for the control
    -   **Identifier**: A reference code for sorting and filtering (for example, "IAM-001")
    -   **Catalog**: A logical grouping (for example, "CIS Controls v8"). Select an existing catalog or create a new one.
    -   **Description**: What the control validates and why it matters (JupiterOne AI can generate this from the title)
    -   **Remediation**: Steps to take when the control is failing (JupiterOne AI can generate this)
    -   **Exception Process**: How to handle approved exceptions for this control
    -   **MITRE technique**: The MITRE ATT&CK technique this control relates to (for example, "T1078"). Optional.
    -   **Owner**: The JupiterOne user responsible for maintaining and responding to this control
4.  Map the control to framework requirements
5.  Create control tests (J1QL queries) that validate the control

#### AI-Assisted Authoring

When you create a new control, JupiterOne AI can accelerate the process by generating content from your title:

1.  Enter a descriptive title for your control
2.  Click **Draft control with AI** — JupiterOne AI auto-generates the **Description**, **Remediation** steps, **Identifier**, and **Source Catalog**
3.  Review and edit any generated field — AI suggestions are not mandatory

JupiterOne AI uses context from the linked requirement to improve the quality of its suggestions.

> **NOTE**
> 
> AI-assisted generation is available when creating a new control. When editing an existing control, you update fields manually.

![AI-assisted control authoring](/assets/images/ai-assisted-control-authoring-95382d4e6218653a23c068e30f0b0170.png)

### Creating Control Tests

Control tests are the core of CCM's automated validation. Each test:

1.  **Contains a J1QL query** that runs against your JupiterOne asset graph
2.  **Defines expected outcomes** — whether the results returned are **Compliant assets** or **Non-compliant assets**
3.  **Runs automatically** on a regular schedule
4.  **Updates the control status** based on whether expectations are met

#### AI-Assisted Test Creation

You do not need J1QL expertise to create control tests. JupiterOne AI can generate queries from a natural language description:

> **NOTE**
> 
> AI-assisted query generation is available when creating a new control test. When editing an existing test, you update the query manually.

1.  From a control, click **New control test**
2.  Enter a descriptive title for what you want to test
3.  Select the test type: **Compliant assets** or **Non-compliant assets**
4.  Click **Generate query** — JupiterOne AI generates a J1QL query based on your title and the control context, and automatically runs it so you can review matching entities
5.  Save the test

**Mirror test creation:** After you save a test, CCM prompts you to add the corresponding inverse test with the test type pre-selected. For example, if you save a Non-compliant assets test, it prompts you to create a Compliant assets test. This ensures comprehensive coverage with minimal effort.

![AI-generated control test query](/assets/images/ai-generated-control-test-18266e9f767bc4a5baaebf2f636c563e.png)

### Managing Existing Controls

From the Controls list, you can:

-   **Search and filter** controls by status, resource group, framework, or active/inactive state; use **More filters** for lifecycle state, effectiveness, attested status, catalog, and org units
-   **View control details** by clicking on any control
-   **Edit control tests** to refine validation logic
-   **Update framework mappings** to map controls to additional requirements
-   **Review test results** to understand why a control is failing
-   **Assign an owner** to establish accountability for each control

### Control Catalogs

A catalog is a namespace for your controls. It groups controls by their origin or purpose, making it easier to organize and filter a large control library.

**Examples of catalogs:**

-   "CIS Controls v8" — controls based on the CIS benchmark
-   "Internal Security Policy" — controls defined by your organization
-   "AWS Hardening" — controls specific to your AWS environment

When you create or edit a control, the **Catalog** field behaves like a tag selector. You can select an existing catalog or type a new name to create one. A control belongs to exactly one catalog.

Use catalogs to:

-   **Organize by source**: Separate controls that come from different standards or internal teams
-   **Filter your library**: Quickly find all controls within a specific catalog
-   **Manage at scale**: When your control library grows beyond a few dozen controls, catalogs prevent the list from becoming unmanageable

### Control Lifecycle

Every control in CCM moves through a defined lifecycle that provides enterprise-grade governance for your control library.

**Lifecycle states:**

| State | Purpose |
| --- | --- |
| **Draft** | Control is being developed. This is the default state for new controls. |
| **Review** | Control is ready for validation by your team. |
| **Live** | Control is active and affects compliance scoring. |
| **Retired** | Control is no longer active but preserved for audit history. |

**Key behaviors:**

-   Only **Live** controls are evaluated during compliance scoring
-   Every state transition is recorded in an audit trail with optional notes
-   You can filter your control library by lifecycle state (under **More filters** > **State**)
-   Only **Live** controls count toward your entitlement limits
-   Controls in **Draft** or **Review** allow you to develop and validate without affecting your compliance posture

To transition a control, click the lifecycle badge on the control detail page, select the target state, and optionally add a note explaining the reason for the transition.

![Control lifecycle management](/assets/images/control-lifecycle-d8f9ea98afd76a6a0d4af4defd77df9e.png)

### Integration Awareness

CCM automatically detects which integrations a control test queries and provides real-time feedback on eligibility.

-   When you author a control test, the UI shows which integrations provide data for your query
-   If no matching entities exist for a test (for example, you have no AWS integrations but the test queries `aws_s3_bucket`), the test shows **No Datapoints**
-   Tests with no datapoints are skipped during evaluation — they do not produce false failures

This prevents confusion when a test queries data from an integration you have not configured.

![Integration awareness](/assets/images/integration-awareness-747872826a2d1d51b7393e186d2226dc.png)

### Control Effectiveness

CCM provides visual status indicators so you can instantly understand whether your controls are working.

**Control test statuses:**

-   **No Datapoints** — The test query returned no matching entities. This replaces false failures when data is unavailable.
-   Control tests that are effective (passing) are not decorated with a special status.

**Control statuses:**

-   **No Control Tests** — The control has no tests configured.
-   **No Datapoints** — All of the control's tests lack datapoints.
-   Controls with at least one passing test that has datapoints show standard pass/fail results.
-   **Attested** — The control is covered by a valid attestation. It reports as **Pass** with an **Attested** note in the Effectiveness column. See [Control Attestations](#control-attestations).

Status rolls up from the test level to the control level, and from the control level to the requirement level. You can see at every layer of your compliance hierarchy where attention is needed.

![Control effectiveness indicators](/assets/images/control-effectiveness-67e05918940c54c15e0c90ea53977d39.png)

## Control Attestations

Introduced in [CCM 1.4](/features/ccm/ccm-1-4.md), **attestations** let you justify a control's compliance using evidence that lives outside its automated tests - a vendor SOC 2 report, a risk acceptance, or a manual process - for a bounded period of time. A control covered by a valid attestation is reported as **Pass** (with an **Attested** note) instead of failing, and it automatically re-fails when the attestation expires.

Use an attestation when a control is genuinely satisfied but no automated test can prove it - rather than leaving the control failing or faking a test.

### Creating an attestation

From the detail page of a **live** control, in the **Control tests and attestations** section, choose **Add an attestation** (you need control-edit permission). An attestation captures:

| Field | Description |
| --- | --- |
| **Subject** | A short title for the justification (e.g. "Vendor SOC 2 Type II report") |
| **Description** | Supporting detail, in markdown |
| **Expiry date** | When the justification lapses and the control re-evaluates |
| **Owner** | The JupiterOne user responsible for renewing it |
| **Document link** | Optional link to supporting evidence (http/https) |

Attestations take effect immediately - there is no approval workflow. You can edit (renew/reassign) or revoke an attestation at any time. All create, edit, and revoke activity is retained in the audit trail independently of the control, so the record of _why_ a control was attested survives revocation, expiry, or deletion of the control.

![Create an attestation](/assets/images/attestation-create-modal-88aa9096a4a88b6bd70b9590151f5aa5.png)

### The combined Control tests and attestations view

A control's detail page shows a single **Control tests and attestations** section, with attestations listed **above** the control tests. A failing test always fails the control - an attestation never masks it - so the section calls out the two cases that need explaining: a control _passing by attestation_ (a valid attestation with no contributing test), and a control _failing despite an attestation_ (a failing test you still need to fix or archive).

This keeps the justification and the underlying test results visible together: an attestation never silently hides a failing test.

![Passing by attestation: a valid attestation carries a control that has no contributing test](/assets/images/attestation-passing-by-attestation-3e9f4077103c7d1c1e4008f8d2e6c0be.png)

![Failing despite an attestation: a failing control test still fails the control, with the way out called out above the tests](/assets/images/attestation-control-combined-c30a459431b2beac830849a4860f5f4a.png)

### Attested status

A control that passes **solely** by a valid attestation - it has no contributing control test - reports as **Pass**, with an **Attested** marker in the Effectiveness column. (A control that already passes on its tests stays a plain **Pass**; a control with a failing test still **Fails**.) Attested controls:

-   count as **passing** in framework scorecards, requirement rollups, control counts, and the daily digest;
-   can be isolated with the **Attested** filter on the controls list, so you can always see which controls are passing by attestation rather than by test;
-   are never a _hidden_ failure - an expired attestation fails the control.

![Controls list showing an Attested control - Pass status with an Attested effective status](/assets/images/attestation-controls-list-b378ce48ec9b1a833fd990693d769621.png)

### How attestations affect control status

A control's status weighs its control tests and its attestations **together** - an attestation never overrides a failing test. Revoked attestations are removed and never count. The result for every combination is:

| Control tests | Attestations | Control status |
| --- | --- | --- |
| None contributing | None (or only revoked) | Not evaluated |
| None contributing | At least one valid attestation | **Pass** _(Attested)_ |
| Passing | None or valid | **Pass** |
| Failing | Any (valid or not) | **Fail** |
| Any | Any non-revoked attestation expired | **Fail** |

**The rules in plain terms:**

-   A **failing** control test always **Fails** the control - an attestation never masks it. To pass a control whose test is failing, fix the failing test, or archive the test if it no longer applies and let a valid attestation carry the control.
-   **Attested** is reserved for a control that passes _solely_ by a valid attestation, with no contributing test. A control that already passes on a test stays a plain **Pass**.
-   If **any** non-revoked attestation has **expired**, the control **Fails** - even over passing tests. One lapsed justification fails the control, so an expiry is never overlooked. (Example: a control "all vendors have a current SOC 2 report" with one attestation per vendor - if any lapses, the control fails.)
-   **Revoking** an attestation removes it; the control reverts to whatever its tests, or any remaining attestations, indicate.

### Expiry and renewal

Because expiry is a time event rather than a change you make, CCM re-evaluates attested controls on a recurring schedule (within 24 hours), in addition to recomputing immediately whenever an attestation is created, edited, or revoked. A control whose only attestation lapses returns to failing automatically - even a control with no tests, which nothing else would re-evaluate.

To renew an attestation before it lapses, **Edit** it from the control's **Control tests and attestations** section and extend the expiry date. Each attestation shows its current state (active, expiring soon, expired, or revoked), so you can spot the ones that need attention.

### Expiry reminder emails

CCM proactively reminds attestation owners about expiries instead of relying on them to check each control:

-   **Weekly attestation digest** - each attestation owner receives a weekly email listing the attestations they own that have **already expired** (the control is failing now, shown first) and those **expiring within the next 30 days** (renew before the control re-fails). Every entry links to the control where you renew it, and shows the attestation's subject and expiry date. The email is sent only when an owner has something expiring or expired; revoked attestations are excluded. It also links to the **Attested** controls filter so you can review everything currently passing by attestation.
-   **Daily digests** - the Control Owner and OU contact [daily digests](/features/ccm/ccm-1-3.md#daily-digest-emails) now also count the controls that are **passing by attestation**, so attested coverage is visible alongside the passing and failing totals.

To stop receiving reminders for an attestation, renew it (extend the expiry) or revoke it if it no longer applies.

## Exemptions

An **exemption** excludes specific entities from a control test's results. They stay in your graph and the test's query still finds them, but the test stops counting them - they are left out of the totals the test's status is computed from.

Each exempted entity is its own exemption. The ones you file together are kept as a single **decision** that shares one justification, reason, and expiry, so a control test's exemptions read as the handful of calls someone made rather than as a list of entities.

Where an attestation justifies a whole control for a bounded period, an exemption removes the entities you name from one of its tests and leaves that test to go on catching everything else. Use one when a test's query is right but keeps returning a result you have already reviewed and accepted - a bastion host that is deliberately reachable from the internet, or a known test account the query will always match.

> **NOTE**
> 
> Exemptions on control tests are rolling out progressively and are not yet enabled for every account. If you do not see the **Exempt** action on a test's results, contact your JupiterOne account team.

### What an exemption does

-   Each exempted entity is removed from the test's results before they are counted, so it is not part of the totals the test's status is computed from.
-   The entity remains in your graph, unchanged. An exemption is a statement about one test, not about the asset.
-   The exempted entities are kept and shown separately, so the set you excluded stays reviewable and downloadable.
-   The change takes effect on the test's **next evaluation**. Nothing re-evaluates at the moment you create the exemption, so a control that is failing now goes on failing until its test next runs.

### Creating an exemption

You need control-edit permission - the same permission that lets you attest a control.

1.  Open the control and, in **Control tests and attestations**, select the test whose results you want to work from.
    
2.  On **Historic results**, choose the evaluation to work from and expand the query whose results contain the entities to exempt.
    
3.  Select the rows you want to exempt, then click **Exempt**.
    
4.  Complete the exemption:
    
    -   **Justification**: Required. Why these entities do not count. This is the record an auditor or a colleague reads later, so write it for them.
    -   **Reason**: One of Risk accepted, Not applicable, False positive, or Compensating control.
    -   **Expires on**: Optional. The exemption applies through the end of the day you choose. Leave it empty for an exemption that never expires.
5.  Click **Exempt entities**.
    

The justification, reason, and expiry apply to the whole selection, so exempting twelve rows files one decision covering twelve entities rather than twelve separate ones.

Exemptions take effect without an approval workflow, and every create and revoke is retained in the audit trail independently of the test - so the record of _why_ an entity was exempted survives revoking the exemption or deleting the test.

### Reviewing and revoking

Each control test has an **Exemptions** tab listing everything currently exempt from it, grouped into the decisions that created them, newest first, each showing its reason, justification, who filed it, when, and its expiry. Viewing the tab needs only read access; revoking needs control-edit permission.

Revoking puts the entity back into the test's results from the next evaluation onwards. Revoke a whole decision at once, or expand it and revoke individual entities.

Under each query's results on **Historic results**, an **Exempted results** section lists the entities that evaluation held back, with its own download. That section reports what happened on that particular run: revoking an exemption never rewrites the evaluations it already applied to.

An expired exemption is not deleted. It stays on the **Exemptions** tab marked as expired, so a control test that starts failing again is always explainable - you can see which exemption lapsed and when.

### Which control tests can accept exemptions

An exemption attaches to **an entity in the results**, so a test whose query returns something other than entities - counts, deduplicated values, or a graph - gives it nothing to attach to. When a test runs such a query the **Exempt** action appears but is disabled, and hovering over it explains why. This is a property of the query, not a permission or licensing limit - rewriting the query so it returns entities makes the test exemptable.

| The test's query | Why it cannot accept exemptions |
| --- | --- |
| Aggregates its results, with `count()`, `avg()`, `sum()`, or similar | A row is a summary of many entities, so no single entity can be excluded from it. |
| Uses `FIND UNIQUE` | A row stands for every entity sharing that value, not for one of them. |
| Uses `RETURN TREE` | A graph result has no rows. Removing vertices from it would leave relationships pointing at nothing. |
| Has a `RETURN` that names only values, and no entity | The results carry property values, with no entity identity to key an exemption on. |

An exemption can only target entities the query's `RETURN` actually names. `FIND Host THAT HAS UserAccount RETURN Host.displayName, Host._id` traverses to user accounts in order to select hosts, but only hosts come back - so hosts can be exempted from that test and user accounts cannot.

### Exemptions apply test by test

An exemption attaches to the test you filed it on, not to the control above it. A control with more than one test - the **Compliant assets** and **Non-compliant assets** pair that CCM prompts you to create together, for instance - is exempted test by test, and exempting an entity from one leaves the others counting it.

In practice, exemptions belong on **Non-compliant assets** tests, where excluding an accepted finding is the point. Exempting from a **Compliant assets** test removes the entity from the evidence that the control is satisfied, which is rarely what you want.

### Live results are never filtered

A control test's **Live results** tab runs its query against the graph as it is now, unfiltered. Entities you have exempted still appear there, even though the stored results the control's status is computed from leave them out. Exempt from **Historic results**, and read **Live results** as what the query matches today rather than as the test's outcome.

### Limitations to plan around

**A test can hold at most 100 unexpired exemptions**, and you can exempt at most 100 entities at a time. Expired exemptions do not count toward the limit, and re-exempting an entity replaces its existing exemption rather than using up another slot. Needing more than a hundred is usually a sign the query is matching more than it should, and narrowing it is the better answer.

**An exemption is lost if the entity's identity changes.** An exemption is keyed to the graph identity of the entity it covers, which derives from the integration instance that ingested the entity together with the entity's key. Removing an integration and adding it back gives every entity it ingests a new identity, which detaches every exemption created from those entities at once. If you need to reconfigure an integration, edit the existing configuration rather than deleting it and adding it again. An integration version that changes the format of its entity keys has the same effect.

A detached exemption is never misapplied to a different entity - it simply stops applying, the entity is counted again, and the control test can start failing again. But nothing announces it: the exemption keeps showing as Active on the **Exemptions** tab. The **Exempted results** of the most recent evaluation are what tell you which exemptions a run actually applied.

> **WARNING**
> 
> Do not rely on exemptions against unified device or unified identity entities. A unified entity is rebuilt whenever a new correlation arrives - JupiterOne creates a new combined entity and discards the previous one - so an exemption against one detaches on its own schedule, and you will not be told when. Where a test can be written against the underlying `Host`, `Device`, or `User` entities instead, exempting those is durable, because their identity comes from the integration that ingested them rather than from correlation.

**One machine can need several exemptions.** A query written against an entity class returns one row for every source that reported the asset, not one row per real-world thing. A single laptop known to your cloud provider, your CMDB, and your endpoint agent appears as three rows, and all three need exempting for the laptop to stop counting. Select all the rows for that asset and exempt them together, which files them as one decision.

## Getting Started

### Step 1: Create or Import a Framework

1.  Switch to **Manage** mode using the toggle in the CCM navigation
2.  Navigate to **Frameworks** under the **Controls** tab in the nav bar
3.  Click **Add a framework**
4.  Choose one of the following options:
    -   **Use Common Framework**: Select an out-of-the-box CIS benchmark. If you need a framework that is not listed, click **Request a new Framework** to submit a request.
    -   **Create your own Framework**: Enter a title and description to build a custom framework directly
    -   **Upload Your Own Framework** (Beta): Import a PDF file
    -   **Paste Framework JSON**: Manually paste JSON configuration
5.  Select who has access to the framework by choosing a [resource group](/features/admin/access-controls.md#resource-groups). Resource groups control which users and groups can view and manage the framework. If you do not select a resource group, the framework is accessible to all users with CCM permissions.
6.  Add requirements to your framework, each with an identifier, priority, and description

### Step 2: Understand Your Control Library

1.  From the Controls page, review the list of existing controls
2.  Click on a control to see:
    -   What it validates (control description)
    -   How it validates (J1QL queries in control tests)
    -   What frameworks it maps to (Requirements tab)
    -   Current test results
    -   Lifecycle state and effectiveness

### Step 3: Create Your First Control

1.  From within a requirement, click **Add a control**
2.  Enter a title and click **Draft control with AI** — JupiterOne AI generates the description, remediation steps, identifier, and source catalog
3.  Review and edit the AI-generated content as needed
4.  Click **New control test** to add validation logic
5.  Describe what you want to test and click **Generate query** — JupiterOne AI generates and runs the J1QL query
6.  Review the results, then save

### Step 4: Manage the Control Lifecycle

1.  New controls start in **Draft** state
2.  When the control is ready for review, transition it to **Review**
3.  After validation, move the control to **Live** to include it in compliance scoring
4.  Add notes at each transition for your audit trail

### Step 5: Map Controls to Framework Requirements

1.  From a control detail page, click the **Requirements** tab
2.  Click **Edit Requirements** to add framework mappings
3.  Select the framework and specific requirement(s) this control satisfies
4.  Save your mappings

### Step 6: Monitor and Refine

1.  Return to the Overview Dashboard regularly to track control health
2.  Switch to **View** mode to review control status and identify controls that need attention
3.  Investigate non-compliant controls to understand root causes
4.  Refine control test queries based on false positives or misses
5.  Expand your control library to cover additional requirements

## Best Practices

To maximize the value of Continuous Control Monitoring:

### Start with Your Governance Framework

-   Begin with controls that are already defined in your IRM or governance system
-   Map those controls to framework requirements in CCM
-   Use CCM to automate the evidence collection and validation for those controls

### Design Effective Control Tests

-   **Write specific queries**: Focus on precise validation criteria rather than broad checks
-   **Use negative tests**: Often easier to detect violations (what shouldn't exist) than prove compliance
-   **Combine multiple tests**: Use both positive and negative tests for comprehensive coverage
-   **Test your queries first**: Run J1QL queries manually in the Query Builder before adding them as control tests
-   **Handle exceptions**: Consider using tags or properties to exclude known exceptions from test results

### Organize Controls Strategically

-   **Group by technology domain**: Separate controls for AWS, Azure, GCP, SaaS applications
-   **Map to multiple frameworks**: Reuse controls across frameworks where applicable
-   **Use consistent naming**: Follow a naming convention for easier management (e.g., "5.6 (AWS) | Control Name")
-   **Document control intent**: Write clear descriptions explaining what the control validates and why

### Integrate with Your Workflow

-   **Connect to your IRM**: Use JupiterOne's API to feed control status back to ServiceNow, Archer, or other governance platforms
-   **Set up alerts**: Configure alerts for critical control failures that need immediate attention
-   **Schedule reviews**: Regularly review control test results with your security and platform teams
-   **Track trends**: Monitor control compliance over time to identify systemic issues

### Scale Gradually

1.  Start with 10-20 critical controls for your most important framework
2.  Validate that tests are accurate and provide meaningful results
3.  Expand coverage to additional frameworks and control areas
4.  Refine test logic based on false positives or missed violations

---

Source: /features/ccm/custom-framework-json-upload

# Custom Framework JSON Upload

JupiterOne allows you to import custom compliance frameworks by pasting a JSON document directly in the UI. This is useful when you have an internal security policy, a regulatory framework, or any custom standard that is not available out of the box.

This guide documents the full JSON schema, all supported fields, and provides examples to help you build your framework JSON.

## How to Import

1.  Navigate to **Frameworks** under the **Controls** tab in the navigation bar
2.  Click **New Framework** in the top right
3.  Select **Paste Framework JSON**
4.  Paste your JSON document
5.  Click **Continue** to import

## JSON Schema Overview

A framework JSON document has three levels of nesting: the **framework** itself contains **requirements**, each requirement contains **controls**, and each control can optionally contain **control tests**.

```json
{
  "name": "Framework Name",
  "description": "Framework description",
  "requirements": [
    {
      "section": "Section Name",
      "displayName": "Requirement Name",
      "description": "Requirement description",
      "controls": [
        {
          "displayName": "Control Name",
          "controlTests": [
            {
              "name": "Test Name",
              "query": "FIND ... AS x RETURN x",
              "resultsAre": "GOOD"
            }
          ]
        }
      ]
    }
  ]
}
```

## Field Reference

### Framework (Top Level)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | Yes | The name of the framework (e.g., "ACME Internal Security Policy v2") |
| `description` | string | Yes | A description of what the framework covers |
| `requirements` | array | Yes | Array of requirement objects |

### Requirement

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `displayName` | string | Yes | The display name shown in the UI (e.g., "1.2 - Ensure MFA is enabled") |
| `description` | string | Yes | Detailed description of the requirement |
| `section` | string | No | Groups requirements into named sections in the UI. All requirements with the same `section` value are displayed together under that section heading. See [Requirement Sections](#requirement-sections) |
| `sequence` | string | No | Sort order identifier (e.g., "1.2", "2.1.3"). Used to order requirements in the UI |
| `title` | string | No | User-facing title. If provided, overrides `displayName` for the stored title. If omitted, `displayName` is used |
| `identifier` | string | No | An external identifier for the requirement (e.g., a regulation section number or internal policy ID) |
| `priority` | string | No | Priority level. One of: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW` |
| `controls` | array | Yes | Array of control objects. Can be an empty array `[]` if controls have not been defined yet |

### Control

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `displayName` | string | Yes | The name of the control |
| `description` | string | No | Description of what the control checks. Should be specific enough to write a test against |
| `sourceId` | string | No | A unique identifier for the control. Controls with the same `sourceId` across multiple requirements are automatically deduplicated and shared |
| `state` | string | No | The lifecycle state of the control. One of: `DRAFT`, `REVIEW`, `LIVE`, `RETIRED`. Defaults to `LIVE` if not provided |
| `catalog` | string | No | The catalog or standard this control belongs to (e.g., "CIS", "NIST") |
| `identifier` | string | No | An external identifier for the control (e.g., "CIS 1.2", "AC-2") |
| `owner` | string | No | Email address of the control owner |
| `remediation` | string | No | Instructions for how to remediate when this control fails. Supports markdown |
| `exceptionProcess` | string | No | Description of the exception process for this control. Supports markdown |
| `mitreTechnique` | string | No | A MITRE ATT&CK technique ID this control relates to (e.g., "T1078" or the sub-technique "T1059.001") |
| `controlTests` | array | No | Array of control test objects. Can be omitted or set to `null` if tests have not been defined yet |

### Control Test

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | Yes | A descriptive name for this test query |
| `query` | string | Yes | A J1QL query that returns entities to evaluate |
| `resultsAre` | string | Yes | Either `GOOD` or `BAD` (see below) |

#### Understanding `resultsAre`

-   **`GOOD`** — Results from this query represent **compliant** entities. If the query returns results, that is a positive signal.
-   **`BAD`** — Results from this query represent **non-compliant** entities. If the query returns results, that indicates a failure.

A common pattern is to define two tests per control: one `GOOD` query that finds compliant resources, and one `BAD` query that finds non-compliant resources.

## Control State Lifecycle

Controls follow a lifecycle with the following valid transitions:

```text
DRAFT → REVIEW → LIVE ↔ RETIRED
          ↕
        DRAFT
```

| State | Description |
| --- | --- |
| `DRAFT` | Control is being authored and is not yet active |
| `REVIEW` | Control is under review before going live |
| `LIVE` | Control is active and being evaluated. This is the default for imported controls |
| `RETIRED` | Control is no longer active |

> **NOTE**
> 
> When you import a framework, controls default to the `LIVE` state unless you explicitly set a different `state` value. You can transition control states after import through the UI.

## Control Deduplication

If the same control appears in multiple requirements, JupiterOne automatically deduplicates it. Deduplication works in two ways:

-   **By `sourceId`**: If two controls across different requirements share the same `sourceId`, they are treated as the same control and linked to both requirements.
-   **By `displayName`**: During import, controls with the same `displayName` are also deduplicated. The first occurrence is used if there are any differences.

This means you can reference the same control in multiple requirements without creating duplicates.

## Requirement Sections

Use the `section` field to group related requirements under a common heading in the framework UI. All requirements that share the same `section` value are displayed together under that heading.

This is useful for large frameworks where requirements span multiple domains. For example, a framework covering both identity and data protection can use sections to organize requirements by domain rather than relying on naming conventions or sequence numbering alone.

```json
{
  "name": "Enterprise Security Framework",
  "description": "Grouped by security domain.",
  "requirements": [
    {
      "section": "Identity & Access",
      "displayName": "Enforce MFA for all users",
      "description": "All users with console access must have MFA enabled.",
      "sequence": "1",
      "identifier": "IAM-01",
      "controls": []
    },
    {
      "section": "Identity & Access",
      "displayName": "Rotate access keys within 90 days",
      "description": "Active access keys must be rotated regularly.",
      "sequence": "2",
      "identifier": "IAM-02",
      "controls": []
    },
    {
      "section": "Data Protection",
      "displayName": "Encrypt S3 buckets at rest",
      "description": "All S3 buckets must have default encryption configured.",
      "sequence": "3",
      "identifier": "DP-01",
      "controls": []
    }
  ]
}
```

If `section` is omitted, requirements appear ungrouped in the framework view.

## Examples

### Minimal Framework

A valid framework with just requirements and no controls or tests:

```json
{
  "name": "ACME Security Policy",
  "description": "Internal security controls for ACME Corp.",
  "requirements": [
    {
      "displayName": "1.1 - Enable MFA for all users",
      "description": "All users with console access must have MFA enabled.",
      "controls": []
    },
    {
      "displayName": "1.2 - Rotate access keys",
      "description": "Access keys should be rotated every 90 days.",
      "controls": []
    }
  ]
}
```

You can add controls and tests later through the UI.

### Framework with Controls and Tests

```json
{
  "name": "ACME Cloud Security Standard",
  "description": "Cloud infrastructure security controls for ACME Corp.",
  "requirements": [
    {
      "section": "Identity & Access Management",
      "displayName": "1.1 - Ensure MFA is enabled for all IAM users",
      "description": "All IAM users with console access must have MFA enabled to prevent unauthorized access.",
      "sequence": "1.1",
      "identifier": "IAM-001",
      "priority": "CRITICAL",
      "controls": [
        {
          "displayName": "IAM Users Have MFA Enabled",
          "description": "Verify that all IAM users with console passwords have at least one MFA device assigned.",
          "sourceId": "iam-mfa-check",
          "catalog": "CIS AWS",
          "identifier": "CIS 1.10",
          "owner": "security-team@acme.com",
          "remediation": "Enable MFA for the user via the IAM console:\n1. Go to **IAM > Users**\n2. Select the user\n3. Click **Security credentials**\n4. Click **Assign MFA device**",
          "exceptionProcess": "Submit a request to the Security team with business justification.",
          "mitreTechnique": "T1078",
          "controlTests": [
            {
              "name": "IAM users with MFA enabled",
              "query": "FIND aws_iam_user WITH mfaEnabled = true AS user RETURN user",
              "resultsAre": "GOOD"
            },
            {
              "name": "IAM users without MFA enabled",
              "query": "FIND aws_iam_user WITH mfaEnabled != true AND passwordEnabled = true AS user RETURN user",
              "resultsAre": "BAD"
            }
          ]
        }
      ]
    },
    {
      "section": "Identity & Access Management",
      "displayName": "1.2 - Rotate access keys within 90 days",
      "description": "Access keys should be rotated regularly to limit the impact of compromised credentials.",
      "sequence": "1.2",
      "identifier": "IAM-002",
      "priority": "HIGH",
      "controls": [
        {
          "displayName": "Access Keys Rotated Within 90 Days",
          "description": "Ensure all active access keys have been rotated within the last 90 days.",
          "controlTests": [
            {
              "name": "Access keys rotated within 90 days",
              "query": "FIND aws_iam_access_key WITH active = true AND createdOn > date.now - 90 days AS key RETURN key",
              "resultsAre": "GOOD"
            },
            {
              "name": "Access keys older than 90 days",
              "query": "FIND aws_iam_access_key WITH active = true AND createdOn < date.now - 90 days AS key RETURN key",
              "resultsAre": "BAD"
            }
          ]
        }
      ]
    }
  ]
}
```

### Shared Controls Across Requirements

In this example, the "Encryption at Rest Enabled" control (with `sourceId` `encryption-at-rest`) appears in two requirements. JupiterOne creates the control once and links it to both:

```json
{
  "name": "Data Protection Standard",
  "description": "Controls for protecting data at rest and in transit.",
  "requirements": [
    {
      "displayName": "2.1 - Encrypt S3 buckets",
      "description": "All S3 buckets must have default encryption configured.",
      "sequence": "2.1",
      "controls": [
        {
          "displayName": "Encryption at Rest Enabled",
          "sourceId": "encryption-at-rest",
          "description": "Verify that storage resources have encryption enabled.",
          "controlTests": [
            {
              "name": "Encrypted S3 buckets",
              "query": "FIND aws_s3_bucket WITH encrypted = true AS bucket RETURN bucket",
              "resultsAre": "GOOD"
            }
          ]
        }
      ]
    },
    {
      "displayName": "3.1 - Encrypt EBS volumes",
      "description": "All EBS volumes must be encrypted.",
      "sequence": "3.1",
      "controls": [
        {
          "displayName": "Encryption at Rest Enabled",
          "sourceId": "encryption-at-rest",
          "description": "Verify that storage resources have encryption enabled.",
          "controlTests": [
            {
              "name": "Encrypted EBS volumes",
              "query": "FIND aws_ebs_volume WITH encrypted = true AS vol RETURN vol",
              "resultsAre": "GOOD"
            }
          ]
        }
      ]
    }
  ]
}
```

### Controls with State and Metadata

Use `state` to import controls in different lifecycle stages:

```json
{
  "name": "Phased Rollout Framework",
  "description": "Framework demonstrating controls in different lifecycle states.",
  "requirements": [
    {
      "displayName": "1.1 - Production-ready control",
      "description": "This control is fully validated and active.",
      "controls": [
        {
          "displayName": "Active Control",
          "state": "LIVE",
          "catalog": "Internal",
          "identifier": "SEC-001",
          "owner": "compliance@acme.com",
          "controlTests": [
            {
              "name": "Check for compliant resources",
              "query": "FIND Host WITH encrypted = true AS h RETURN h",
              "resultsAre": "GOOD"
            }
          ]
        }
      ]
    },
    {
      "displayName": "1.2 - Control under development",
      "description": "This control is still being authored.",
      "controls": [
        {
          "displayName": "Draft Control",
          "state": "DRAFT",
          "catalog": "Internal",
          "identifier": "SEC-002"
        }
      ]
    }
  ]
}
```

## Validation

The JSON is validated on upload. The following rules apply:

-   `name` and `description` are required at the top level
-   Every requirement must have `displayName`, `description`, and a `controls` array
-   Every control must have a `displayName`
-   Every control test must have `name`, `query`, and `resultsAre` (either `GOOD` or `BAD`)
-   Extra properties are allowed and will not cause validation errors—they are passed through and stored

### Common Validation Errors

| Error | Cause | Resolution |
| --- | --- | --- |
| "Framework JSON and name are required" | Missing the JSON body or framework name | Ensure both are provided when uploading |
| "Invalid frameworkJson" | The JSON structure does not match the expected schema | Check that all required fields are present and correctly typed |

## Tips for Writing Control Tests

-   **Use the Query Builder first**: Test your J1QL queries in JupiterOne's Query Builder before adding them to your framework JSON to verify they return the expected results.
-   **Pair GOOD and BAD tests**: Define both a positive and negative test for comprehensive coverage. The `GOOD` test shows what is compliant, and the `BAD` test shows what needs attention.
-   **Use specific filters**: Write precise `WITH` clauses to avoid false positives. For example, `FIND aws_iam_user WITH mfaEnabled != true AND passwordEnabled = true` is better than `FIND aws_iam_user WITH mfaEnabled != true` because it excludes programmatic users without console access.
-   **Use the `AS` and `RETURN` pattern**: Queries should follow the `FIND <entity> WITH <filters> AS <alias> RETURN <alias>` pattern for best results.

---

Source: /features/insights-and-alerts/alert-rule-action-config-entity-tag-template-example

# Alert Rule Action Config Example with Entity Tag Values

This page demonstrates how to define an action config template within a JupiterOne alert rule that references entity tag values, such as:

```text
DisplayName: {{item.displayName}} - Tag: {{item['tag.owner_email']}}
```

This is useful when you want to include specific tag values from your entities in alert notifications or actions (e.g., emails, Slack messages, Jira tickets).

> **Note:** In JEXL Syntax, when accessing a property from an object that has a period in its name (like 'tag.name'), you need to use bracket notation instead of dot notation. Dot notation will try to interpret the part after the dot as a nested property.

## Example: Send Email with Entity Tag Value

Below is a sample alert rule configuration that sends an email for all results, including the entity's display name and the value of the `owner_email` tag.

```json
{
  "name": "entities-with-owner-email-tag",
  "description": "Alert on entities and include their owner email tag in the notification.",
  "notifyOnFailure": true,
  "triggerActionsOnNewEntitiesOnly": false,
  "ignorePreviousResults": true,
  "pollingInterval": "ONE_DAY",
  "templates": {
    "emailBody": "DisplayName: {{item.displayName}} - Tag: {{item['tag.owner_email']}}"
  },
  "outputs": [
    "alertLevel"
  ],
  "labels": [],
  "question": {
    "queries": [
      {
        "query": "FIND aws_s3_bucket WITH [tag.owner_email] != undefined",
        "name": "query0",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "condition": [
          "AND",
          [
            "queries.query0.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "type": "SET_PROPERTY",
          "targetProperty": "alertLevel",
          "targetValue": "MEDIUM"
        },
        {
          "type": "SEND_EMAIL",
          "body": "Entities with owner email tag:<br><br>{{ queries.query0.data | mapTemplate('emailBody') | join('<br>') }}",
          "recipients": [
            "security-team@company.com"
          ]
        }
      ]
    }
  ],
  "tags": [],
  "remediationSteps": null
}
```

### Explanation

-   The `templates.emailBody` field defines a template string that references both the entity's display name and the `owner_email` tag value.
-   In the `SEND_EMAIL` action, the body uses `mapTemplate('emailBody')` to apply this template to each result.
-   The J1QL query finds all `aws_s3_bucket` entities that have a `tag.owner_email` defined.
-   The resulting email will list each entity with its display name and the value of its `owner_email` tag.

You can adapt this pattern for other actions (Slack, Jira, etc.) and other tag keys as needed.

---

Source: /features/insights-and-alerts/alert-rule-action-config-examples

# Alert Rule Action Configuration Examples

Quickly enable actions in your rules with these JupiterOne alert rule configuration examples. These are designed to provide guidance for our most commonly used actions to quickly get your workflows into action.

##### Send Email For All Results:

![Email Example](/assets/images/send_email-68f60760f94cf409cd2798515dbbff05.png)

```json
{
  "id": "ca2c8bfb-c850-44de-b80c-eeef6f16ee1f",
  "collectionId": null,
  "name": "s3-buckets-not-allow-public-read-write-access",
  "description": "S3 buckets should not allow public read or write access to the bucket ACL policy.",
  "version": 5,
  "lastEvaluationStartOn": 1729719748559,
  "specVersion": 1,
  "notifyOnFailure": true,
  "triggerActionsOnNewEntitiesOnly": false,
  "ignorePreviousResults": true,
  "pollingInterval": "ONE_WEEK",
  "templates": {
    "emailBody": "({{itemIndex+1}} of {{itemCount}})Display Name: {{item.displayName}}  ARN: {{item._key}} Link:{{item.webLink}} <br><br>"
  },
  "outputs": [
    "alertLevel"
  ],
  "labels": [],
  "question": {
    "queries": [
      {
        "query": "FIND aws_s3_bucket WITH ignorePublicAcls != true AND restrictPublicBuckets != true THAT ALLOWS AS grant Everyone WHERE grant.permission = 'READ_ACP' or grant.permission = 'WRITE_ACP'",
        "name": "query0",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "questionId": null,
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "condition": [
          "AND",
          [
            "queries.query0.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "id": "8a60b644-ccb5-4727-af0e-03573e5b9cd2",
          "type": "SET_PROPERTY",
          "targetValue": "HIGH",
          "targetProperty": "alertLevel"
        },
        {
          "id": "c39abde5-b74a-42c3-be02-a559fa541ec5",
          "type": "SEND_EMAIL",
          "body": "Please review the following results: <br><br>{{ queries.query0.data | mapTemplate('emailBody') | join(' ') }}",
          "recipients": [
            "email_address@jupiterone.com"
          ]
        }
      ]
    }
  ],
  "state": null,
  "tags": [],
  "remediationSteps": null
}
```

##### Jira Ticket For All Results:

![Jira Ticket Example 1](/assets/images/jira_ticket_1-dbf8c2f55807ec143171cde806a76f00.png)

![Jira Ticket Example 2](/assets/images/jira_ticket_2-e20b36c9a9da1247798851ba423885c8.png)

```json
{
  "id": "4dc6e222-f11d-41c6-a495-5059d02cadaa",
  "collectionId": null,
  "name": "eks_publicly_accessible",
  "description": "Checks if Amazon EKS endpoints are publicly accessible.",
  "version": 13,
  "lastEvaluationStartOn": 1730482765679,
  "specVersion": 1,
  "notifyOnFailure": true,
  "triggerActionsOnNewEntitiesOnly": false,
  "ignorePreviousResults": true,
  "pollingInterval": "ONE_WEEK",
  "templates": {
    "jiraTicketBody": "Display Name: {{item.displayName}} ({{item.arn}}) Active Status: {{item.status}}, Tags: {{item.tags}}"
  },
  "outputs": [
    "alertLevel"
  ],
  "labels": [],
  "question": {
    "queries": [
      {
        "query": "FIND aws_eks_cluster WITH vpcEndpointPublicAccess = true",
        "name": "query0",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "questionId": null,
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "condition": [
          "AND",
          [
            "queries.query0.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "id": "1b72deaf-8692-4b9a-aca6-1f4cc370c48d",
          "type": "SET_PROPERTY",
          "targetProperty": "alertLevel",
          "targetValue": "CRITICAL"
        },
        {
          "id": "2c586ecf-4b0a-4245-b556-865156962e7e",
          "type": "CREATE_ALERT"
        },
        {
          "integrationInstanceId": "1993ff4d-18bb-488a-8966-dde76a4c3669",
          "id": "8ac582c8-033f-499f-be4e-ced993004876",
          "type": "CREATE_JIRA_TICKET",
          "entityClass": "Issue",
          "summary": "{{alertRuleDescription}}",
          "issueType": "Task",
          "project": "PROS",
          "additionalFields": {
            "description": {
              "type": "doc",
              "version": 1,
              "content": [
                {
                  "type": "paragraph",
                  "content": [
                    {
                      "type": "text",
                      "text": "{{alertWebLink}}\n\n**Affected Items:**\n\n* {{queries.query0.data|mapTemplate('jiraTicketBody')|join('\n* ')}}"
                    }
                  ]
                }
              ]
            },
            "priority": {
              "name": "High",
              "id": "2"
            }
          }
        }
      ]
    }
  ],
  "state": null,
  "tags": [],
  "remediationSteps": null
}
```

##### Slack Message For All Results:

![Slack Example](/assets/images/send_slack-818a358d57b6a22ecc556c9060196ef4.png)

```json
{
  "id": "5821ab03-e2cd-4d79-9067-13c0c8f07fdc",
  "collectionId": null,
  "name": "aws-iam-access-keys-greater-than-180-days",
  "description": "All active AWS IAM access keys that were created more than 180 days ago",
  "version": 6,
  "lastEvaluationStartOn": 1729814129144,
  "specVersion": 1,
  "notifyOnFailure": true,
  "triggerActionsOnNewEntitiesOnly": false,
  "ignorePreviousResults": true,
  "pollingInterval": "DISABLED",
  "templates": {
    "accessKey": "({{itemIndex+1}}) Key: {{item.displayName}} Created On: {{item._createdOn}}"
  },
  "outputs": [
    "alertLevel"
  ],
  "labels": [],
  "question": {
    "queries": [
      {
        "query": "FIND aws_iam_access_key WITH active = true AND createdOn < date.now - 180 days",
        "name": "query0",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "questionId": null,
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "condition": [
          "AND",
          [
            "queries.query0.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "id": "739bc275-d45d-4157-a2e8-1bcff26ae55b",
          "type": "SET_PROPERTY",
          "targetProperty": "alertLevel",
          "targetValue": "HIGH"
        },
        {
          "integrationInstanceId": "ad8db463-af8e-4f55-aec2-406ac563f331",
          "id": "630864c5-a43d-4571-9cc0-188d64b5a1b4",
          "type": "SEND_SLACK_MESSAGE",
          "channels": [
            "#jupiterone-alerts"
          ],
          "body": "*Affected Items:* \n\n- {{queries.query0.data|mapTemplate('accessKey')|join('\n- ')}}"
        },
        {
          "id": "829b4bfd-5fae-4e41-9427-ffcdc4b92322",
          "type": "CREATE_ALERT"
        }
      ]
    }
  ],
  "state": null,
  "tags": [],
  "remediationSteps": null
}
```

##### For Each Action to Create Jira Tickets:

![For Each Jira Action](/assets/images/for_each-93abbddc2da2f146ff3055e971a248bd.png)

```json
{
  "id": "94a92bf2-5d06-495c-b260-e5c372be3cd7",
  "collectionId": null,
  "name": "AWS S3 Bucket Publicly Accessible Alert",
  "description": null,
  "version": 17,
  "lastEvaluationStartOn": 1730287835953,
  "specVersion": 1,
  "notifyOnFailure": true,
  "triggerActionsOnNewEntitiesOnly": false,
  "ignorePreviousResults": true,
  "pollingInterval": "ONE_DAY",
  "templates": {},
  "outputs": [
    "alertLevel"
  ],
  "labels": [],
  "question": {
    "queries": [
      {
        "query": "FIND aws_s3_bucket WITH ignorePublicAcls != true AND restrictPublicBuckets != true THAT ALLOWS AS grant Everyone WHERE grant.permission = 'READ_ACP' or grant.permission = 'WRITE_ACP'",
        "name": "query0",
        "version": "v1",
        "includeDeleted": false
      }
    ]
  },
  "questionId": null,
  "operations": [
    {
      "when": {
        "type": "FILTER",
        "condition": [
          "AND",
          [
            "queries.query0.total",
            ">",
            0
          ]
        ]
      },
      "actions": [
        {
          "id": "e696b537-9617-4332-8509-de78b8926c56",
          "type": "SET_PROPERTY",
          "targetValue": "INFO",
          "targetProperty": "alertLevel"
        },
        {
          "id": "c1514c00-c6eb-497a-98c4-c9a76cecf7b1",
          "type": "FOR_EACH_ITEM",
          "items": "{{queries.query0.data}}",
          "itemRef": "result",
          "actions": [
            {
              "integrationInstanceId": "1993ff4d-18bb-488a-8966-dde76a4c3669",
              "type": "CREATE_JIRA_TICKET",
              "entityClass": "Issue",
              "summary": "AWS S3 Bucket Publicly Accessible Alert",
              "issueType": "Task",
              "project": "PROS",
              "autoResolve": true,
              "resolvedStatus": "Closed",
              "additionalFields": {
                "description": {
                  "type": "doc",
                  "version": 1,
                  "content": [
                    {
                      "type": "paragraph",
                      "content": [
                        {
                          "type": "text",
                          "text": "[Alert Link]({{alertWebLink}})\n\n**Affected Item:** {{result.entity.displayName}}\n\nARN: {{result.entity._key}}\n\nOwner: {{result.properties.owner}}\n\n[Link to affected item]({{result.properties.webLink}})"
                        }
                      ]
                    }
                  ]
                },
                "priority": {
                  "name": "High",
                  "id": "2"
                }
              }
            }
          ]
        }
      ]
    }
  ],
  "state": null,
  "tags": [],
  "remediationSteps": null
}
```

---

Source: /features/insights-and-alerts/alert-rule-packs

# Alert Rule Packs

Aside from [creating alert rules from scratch](/features/insights-and-alerts/alerts.md#creating-alert-rules), JupiterOne offers the ability to import rule packs that consist of pre-configured alert rules. All packs are aimed in assisting with continued surveillance over changes and areas of interest in your environment.

![JupiterOne importing a rule pack](/assets/images/import-rule-pack-c136937df04b15a7fdae0b47a676dfb8.png)

JupiterOne offers managed rule packs for the following CSPs and use cases:

-   AWS
-   Azure
-   Google Cloud Provider
-   Common Alerts
-   Compliance
-   Critical Assets
-   Device Management
-   Dev Ops
-   Integrations Monitoring
-   Toxic Combinations

JupiterOne also offers managed security content providing these detection examples:

-   AWS Threat
-   Endpoint Security
-   CTEM Attack Paths
-   Gitlab Malicious Version
-   MITRE ATT&CK: AWS Privilege Escalation
-   MITRE ATT&CK: Google Cloud Privilege Escalation
-   MITRE ATT&CK: Execution
-   MITRE ATT&CK: Initial Access
-   MITRE ATT&CK: Lateral Movement

We continue to release more managed security content for our customers to leverage for detections and gaining valueable insights into their attack surface.

> **INFO**
> 
> For more information on rule packs offered by JupiterOne, check out our [GitHub repo](https://github.com/JupiterOne/jupiterone-alert-rules/tree/main/rule-packs).

### Importing JupiterOne Managed Rule Packs

To import any of the rule packs for use with Alerts:

1.  Navigate to **Alerts** and select the **Rules** tab.
2.  Select **Import rules** above the table.
3.  By default, you should be in the **JupiterOne managed packs** tab. Choose the **Resource group** that the imported rules will be created in.
4.  Under **Available packs**, select the pack(s) you would like to use and press **Import rules** to install them.

You can expand any pack with the drop-down arrow to view its individual rules, and select specific rules instead of importing the entire pack.

> **NOTE**
> 
> JupiterOne periodically makes updates to the managed rule packs, and we suggest occasionally re-importing your rule packs in order to ensure you have the latest batch of rules associated with each pack. This can be accomplished via the same flow as mentioned above, as if you were installing the pack for the first time.

Over time, we are also introducing new rule packs to be leveraged within your workspace as well to accommodate additional updates to our platform.

### Custom rule packs

In addition to JupiterOne's built-in rule packs, you are able to upload your own custom rule packs in JSON format.

By following the example files within the [Rule Packs repo](https://github.com/JupiterOne/jupiterone-alert-rules/tree/main/rule-packs), you can similarly create your own files of unique rules that suit your specific use case to get the most out of JupiterOne Alerts.

> **INFO**
> 
> See our [Alert Rules API documentation](/api/alert-rules.md) for additional information for managing alerts via API.

To import a custom JSON rule file:

1.  Navigate to **Alerts** and select the **Rules** tab.
2.  Select **Import rules** above the table.
3.  Choose **Custom rule pack (JSON)**, paste your JSON into the window, and press **Import rules**.

Once imported, your rules will evaluate on the provided polling interval. You can also manually initiate an evaluation on a rule by selecting **Evaluate now** from its row actions. This will cause it to run immediately rather than wait until the polling interval.

---

Source: /features/insights-and-alerts/alerts

# Alerts

JupiterOne Alerts is a powerful tool that enables you to automatically monitor your workspace through the use of _rules_. By configuring rules, you are able to execute and leverage J1QL queries that run on a particular interval to run and look for findings on their designated interval. When these rules run a query and find results, you are notified by an alert, which can be configured to be sent through various channels of your choosing.

![JupiterOne Alerts main view](/assets/images/alerts-view-f0cbeab05e7e58b61df15be8ac106b10.png)

By using Alerts, you can begin to embed JupiterOne into your existing security workflows. For example, if a security finding requires remediation, you could configure that alert to create a corresponding Jira ticket to then be addressed. Depending on severity, it could also send a Slack or email notification to the appropriate team. By creating custom rules, you can curate the alert behavior to your specific needs.

> **INFO**
> 
> In addition to custom alerts, JupiterOne offers pre-configured rule packs that provide rules built around various tools and use cases. [Read more about rule packs](/features/insights-and-alerts/alert-rule-packs.md#importing-jupiterone-managed-rule-packs)

## Creating Alert Rules

To create a single rule for alerts:

1.  Navigate to the Alerts and select the Rules tab.
    
2.  Click **New rule**. This opens the full-page rule editor.
    
3.  Provide the following details for the new custom rule:
    
    -   **Name**: Name for the alert rule.
    -   **Resource group**: The resource group the rule belongs to, which governs who can access it.
    -   **Description**: Brief description of the rule.
    -   **Severity**: The level of severity for the particular alert (Info, Low, Medium, High, Critical)
    -   **Evaluation interval**: The interval for which the system re-evaluates the rule (Disabled, 1 week, 1 day, 12 hours, 8 hours, 4 hours, 1 hour, 30 minutes, 15 minutes). Intervals shorter than your plan allows appear disabled.
    -   **Rule tags**: Key/value labels used to organize and filter your rules.
    -   **Notify on evaluation failure**: Sends a notification when the rule fails to evaluate.
    -   **Query**: The J1QL query used to monitor changes to trigger the alert.
    
    ---
    
    Tip: ORDER BY Best Practice: It is discouraged to use the `ORDER BY` J1QL keyword within the query powering an Alert Rule as it may cause unexpected rule evaluation failures and slower performance.
    
    ---
    
4.  In the **Action trigger conditions** section, choose when the configured actions should run. Three options are available:
    
    -   **All query results, when results have changed**: Actions run with all query results, but only when the results differ from the previous evaluation.
    -   **Newly discovered results, when results have changed**: Actions run only for results that were not present in the previous evaluation. This is the option to use for change detection.
    -   **All query results, every evaluation**: Actions run with all query results on every evaluation, without comparing to previous results.
5.  Select the appropriate **Actions** for the rule to take when action trigger conditions are met. By default it will send a JupiterOne Alert.
    

> **NOTE**
> 
> Some configuration options may vary depending on your workspace plan with JupiterOne.

> **NOTE**
> 
> Rules that have failed to successfully run in over 30 days and have not received any updates will automatically be disabled and moved to the "System Disabled" state.

> **TIP**
> 
> Want to detect when data in your graph has changed? See our guide on [Detecting Data Changes with Alert Rules](/features/insights-and-alerts/detecting-data-changes.md) to learn how to create alerts that trigger when entities are updated or modified in your environment.

### Additional configuration

JupiterOne offers additional actions and flexibility around building alerts into workflows outside of JupiterOne. You can configure more complex actions such as sending an Alert notification to a designated Slack channel, or creating a Jira ticket based on an alert.

#### Actions

When creating a rule, you can specify any of the following actions to be made when the alert is triggered:

-   **Tag Entities**: This action runs on every rule evaluation, even when "Newly discovered results" is selected. You can choose between two operations:
    
    -   **Set Tag**: Tags all entities returned by the query with the specified tag value
    -   **Unset Tag**: Removes the specified tag from all entities that were previously tagged by this rule. If another rule also tags that property, the property takes that rule's value instead of being cleared; otherwise it reverts to the value it had before any rule tagged it, or is removed if it had none.
    
    **Note**: When multiple rules tag the same property on the same entity, **the rule that most recently changed the value wins**. Re-applying a value a rule already set does not reclaim the property — only changing the asserted value takes it over.
    
    This is resolved per property: one rule can own `tag.owner` while another owns `tag.environment` on the same entity. When two rules contest one property, they settle on whichever changed it last rather than alternating.
    
    If the winning rule stops tagging the property, the value falls back to the rule that set it before, and to the source integration's value when no rule tags it. (Previously the first rule to tag a property held it and later rules were ignored, so a stale rule could block a live one.)
    
-   **Email**: You provide the email addresses to alert and what you want in the email message.
    
-   **Slack**: You must first configure the Slack integration for JupiterOne by following [these instructions](/integrations/directory/slack.md). Ensure that you specify the channel in the format #channel.
    
    -   Troubleshooting note: If you are having trouble with Slack messages not sending, ensure that the JupiterOne Slack integration has been set up with the correct permissions. The JupiterOne Slack integration must have the `chat:write` and `chat:write.public` permissions to send messages to Slack. Additionally, you will want to ensure that the Slack integration has been authorized.
-   **JIRA**: You must first configure the JIRA integration for JupiterOne by following [these instructions](/integrations/directory/jira.md). When you create a rule that triggers the creation of a Jira ticket, you provide the following:
    
    -   **Summary**: title of the Jira ticket
    -   **Description**: JupiterOne automatically lists the affected entities and the associated query, but you can edit this field to contain other information.
    -   **Project**: ID of the Jira project to which you want to assign the ticket.
    -   **Issue Type**: type of issue you want the Jira ticket to be, such as task or bug.
    -   **Entity Class**: (mandatory field) the class of the new ticket entity that you want to assign to the ticket, such as vulnerability or policy. Integrations Instance: select the Jira instance from the dropdown menu.
    -   **Additional Fields**: you can add any other of the Jira ticket fields if you want to return that information.
    -   **Update content on changes**: When enabled, each time the action runs JupiterOne updates the Jira ticket it already created for this rule (for example, refreshing the list of affected entities) instead of opening another ticket.
    -   **Auto-Resolve**: Automatically closes Jira tickets when there are no more results that match the alert rule. For example, whenever the rule goes from zero results to >0 results, JupiterOne will open a new Jira ticket. Whenever the query returns an empty result set, the previously opened ticket will be marked as Resolved via the Jira integration. You must provide a Resolved Status for the Jira ticket to be automatically closed. Note: this will not close any Jira tickets upon alert dismissal. [Read more about the JupiterOne alert rule schema](/api/alert-rules.md#rule-definition-reference)
    
    **Note**: By default — when neither **Update content on changes** nor **Auto-Resolve** is enabled — the JIRA action creates a **new** Jira ticket every time it runs (that is, on each evaluation where the rule matches results). Enable **Update content on changes** to keep a single ticket for the rule and refresh it in place; this is the reliable way to avoid duplicates. **Auto-Resolve** on its own is not a substitute: without **Update content on changes**, if the ticket's summary or additional field values change between evaluations — for example a templated date, entity name, or result count — the previously opened ticket is resolved and a replacement is opened on that run.
    
-   **ServiceNow**: Select the integration instance from the dropdown menu and enter the content for the request body. The message body is sent to the `/api/now/table` incident endpoint. Go to the REST API Explorer page in your ServiceNow deployment to learn about additional fields. The request automatically assigns the number property to be `j1:{rule-instance-id}`.
    

This reference link shows the default/common fields on Incident records via the Table API which can be defined within the Request Body contained in the JupiterOne Alert Rule Action: [https://www.servicenow.com/docs/bundle/yokohama-api-reference/page/integrate/inbound-rest/concept/c\_TableAPI.html#d248908e3139](https://www.servicenow.com/docs/bundle/yokohama-api-reference/page/integrate/inbound-rest/concept/c_TableAPI.html#d248908e3139)

-   **SNS**: The AWS account you want to send to must be configured as an AWS Integration, and the J1 IAM role for the AWS account you want to publish to must have the `SNS:Publish` permission.
    
-   **SQS**: The AWS account you want to send to must be configured as an AWS Integration, and the J1 IAM role for the AWS account you want to publish to must have the `SQS:SendMessage` permission.
    
-   **Send to S3**: Uploads alert data as a JSON file to an S3 bucket. The AWS account you want to send to must be configured as an AWS Integration, and the J1 IAM role for the AWS account must have the `S3:PutObject` permission for the target bucket. You can control the contents of the JSON file that gets uploaded. For example:
    
    ```json
    {
      "description": "{{alertWebLink}}\n\n**Affected Items:**\n\n* {{queries.query0.data|mapProperty('displayName')|join('\n* ')}}"
    }
    ```
    
    This allows you to customize what information is included in the uploaded file, using template variables to include alert details, query results, and formatted entity data.
    
-   **Webhook**: Sends a message to the specified webhook URL.
    
-   **Tines trigger**: Pushes data from a JupiterOne query to a Tines action workflow.
    
-   **Send to Google BigQuery**: Streams alert data to a Google BigQuery table.
    
-   **For each**: Runs a set of nested actions once per entity returned by the query results.
    

#### Templates

You can also use templates when adding rules. The template goes inside any property under the operations property for a rule. Templates can contain JavaScript-like syntax that have input variables automatically inserted for usage. See the [alert rule schema](/api/alert-rules.md#rule-definition-reference) for more information about the templates property.

### Managing alerts

The **Alerting** tab on the Rules page lists every rule that is currently firing. Selecting a rule opens its detail page, where you can review the query, its results over time, and the full evaluation history.

![JupiterOne Alert activity view](/assets/images/alerts-activity-49cacf560392451c5f14b1fa10330592.png)

From a rule's row actions, you can also edit the rule associated with the alert and dismiss the alert. Dismissing an alert will stop it from showing until the next evaluation produces results.

### Understanding the Findings column

The **Findings** column in the Rules table shows the number of results behind a rule's **currently active alert** — not a running total for the rule. The count comes from the active alert's most recent evaluation, so it is only populated while a rule is in the **Alerting** state.

A rule shows an em dash (—) in the Findings column when it has no active alert. This is expected in several cases:

-   **The rule has no JupiterOne Alert action.** Findings live on an alert, and an alert is only created by a JupiterOne Alert action. A rule that only tags entities, creates a Jira ticket, or sends a webhook (with no alert action) will never show a findings count, even when it is doing work on every evaluation.
-   **The rule's trigger conditions weren't met**, so no alert was created (for example, the query returned no results, or results haven't changed since the last evaluation).
-   **The alert was dismissed or resolved.** Once an alert leaves the active state, its rule returns to an em dash.

In other words, the Findings column mirrors the **Alerting** tab: only rules that are actively firing display a count.

## Rule row actions

Each row in the Rules table has an **Enabled** toggle and a set of action icons that appear when you hover over the row. The available actions depend on your role-based access control (RBAC) permissions; you'll see a tooltip explaining any action you don't have permission to use.

![JupiterOne Alert Rules Table Actions](/assets/images/alert-rules-table-actions-68550acc14fd63a011d452bf2f8b5fbf.png)

### Available actions

-   **Copy link**: Copies a direct link to the rule. Available to users with **read** access.
-   **Edit**: Opens the rule editor. Available to users with **update** access.
-   **Evaluate now**: Manually triggers a full rule evaluation, running all queries and actions outside the scheduled polling interval. Available to users with **update** access.
-   **Dismiss alert**: Dismisses the active alert for a firing rule. Shown only on the **Alerting** tab. Available to users with **update** access.
-   **Delete**: Permanently removes the rule from your workspace. This action cannot be undone. Available to users with **delete** access.

The **Enabled** toggle is a column on the table (not one of the hover action icons). It enables or disables the rule and requires **update** access. When a rule has failed to evaluate for an extended period, the system disables it automatically and its **Evaluation** column shows **System disabled**.

> **NOTE**
> 
> Evaluation history is no longer a row action. To review past runs, open the rule and use the **Evaluation history** tab (see below).

## Rule Evaluation History

You can also view the history of rule evaluations whether they've created an alert or not. When you click into a rule from the Rules page, the rule's configuration appears in a collapsible panel at the top, with **Evaluation history** and **Relationships** tabs below it. The **Evaluation history** tab shows you the following information:

![JupiterOne Alert activity view](/assets/images/rule-evaluation-history-26a34fd89e01a69aa4d22bb9bb1c2d0e.png)

-   The results of the query(ies) associated with the rule configuration, as well as the evaluation duration.
    -   If there were new entities found compared to the rule's last successful evaluation, you can toggle to view only the new entities. Note that if the query has changed between evaluation runs, the results may all be considered new.
-   Whether the condition to proceed to running actions was met.
    -   The default condition on a rule is met when the number of the first query's results is greater than 0.
-   The actions that were taken, if any, and the status of those actions.

> **INFO**
> 
> From a query's results in the **Evaluation history** tab you can also [exempt individual entities](/features/insights-and-alerts/rule-exemptions.md), excluding them from the rule's pass/fail calculation and from the actions it takes.

-   If there were action failures, there are logs to help troubleshoot the issue.

---

Source: /features/insights-and-alerts/detecting-data-changes

# Detecting Data Changes with Alert Rules

You can trigger alerts in JupiterOne when data in your graph has changed! While many alerts focus on the number of results changing, JupiterOne allows you to detect when entities in your environment have been recently updated or created by leveraging timestamp-based queries.

## How It Works

The key to detecting changes in your graph is to:

1.  **Write a J1QL query** that looks for entities with recent timestamp updates using time-based filters
2.  **Configure the alert rule** to trigger when these entities appear in the query results

By using `DATE.now - [time unit]` in your queries, you can identify entities whose `lastUpdatedOn` (or `_createdOn`) timestamp falls within a recent time window. When you set the alert rule's trigger condition to activate "when entities that did not exist during the previous rule evaluation appear in the question results", JupiterOne will fire an alert each time an entity's timestamp update makes it "newly" match your query.

**Important**: This approach detects _that_ something has changed in your environment, but does not tell you exactly what properties were modified. For specific change details, you'll need to check your source system logs.

## Important Limitations

Before implementing data change detection, understand these key limitations:

-   **Entity dependency**: You need entities that come with timestamp properties like `lastUpdatedOn`. JupiterOne does not track this information in our metadata - it relies on the source system (like AWS) to provide these timestamps.
    
-   **Timestamp-based detection only**: This method can only target timestamp properties (like `lastUpdatedOn` or `_createdOn`). You cannot identify when specific individual properties have changed.
    
-   **No property-level change details**: The alert will tell you _that_ an entity has changed, but not _what_ changed. To determine which specific properties were updated, you need to check the source system's logs (such as AWS CloudTrail).
    
-   **Source system limitations**: Not all integrations or entity types provide reliable timestamp properties. Check your specific integration documentation to confirm timestamp availability.
    

This is best used for broad change detection across your environment rather than granular property monitoring. For detailed change tracking, combine JupiterOne alerts with your source system's native change logs.

## Example Queries

**Detecting recently modified CloudTrail resources:**

```j1ql
FIND aws_cloudtrail_resource WITH lastUpdatedOn > DATE.now - 1 hour
```

**Detecting new users created in the last 14 days:**

```j1ql
FIND jupiterone_user WITH _createdOn > DATE.now - 14 day
```

**Detecting recently updated data stores:**

```j1ql
FIND DataStore WITH lastUpdatedOn > DATE.now - 6 hours
```

## Configuration Tips

-   **Use appropriate time windows**: Choose time intervals that align with your alert evaluation frequency. For example, if your rule runs every hour, use a time window slightly larger than 1 hour to avoid missing updates.
    
-   **Leverage entity properties**: Most JupiterOne entities have `_createdOn` and `lastUpdatedOn` properties that track when the entity was first ingested and last modified.
    
-   **Combine with other filters**: You can combine time-based filters with other conditions to create more targeted alerts:
    

```j1ql
FIND DataStore WITH classification='critical' AND lastUpdatedOn > DATE.now - 2 hours
```

This approach provides a way to get notifications when changes occur in your environment, enabling you to stay informed about activity across your infrastructure and applications.

## Getting Started

To create a change detection alert for your environment:

1.  Navigate to **Alerts** and select the **Rules** tab
2.  Click **New rule**
3.  Configure your rule with a time-based J1QL query as shown in the examples above
4.  Set the trigger condition to **Newly discovered results, when results have changed** so actions run only for entities that appear in results for the first time
5.  Configure your desired actions (email, Slack, Jira ticket creation, etc.)
6.  Set an appropriate polling interval that aligns with your time window

Remember: This will alert you that _something_ has changed, but you'll need to investigate further to determine exactly what changed.

For more information on creating alert rules, see the main [Alerts documentation](/features/insights-and-alerts/alerts.md).

---

Source: /features/insights-and-alerts/insights

# Insights

JupiterOne's Insights dashboards enable you to visualize your data in a variety of meaningful ways. JupiterOne offers both a comprehensive set of managed dashboards that provide immediate value. With the ability to customize and curate your own dashboards and widgets, you are able to parse your data and visualize it as you see fit.

All dashboards are powered by [JupiterOne's query language, J1QL](/j1ql.md). By leveraging queries, you can visualize the query results in a variety of ways–allowing you to make powerful representations of your data quickly.

## Accessing Insights

By navigating to the **Insights** section of your JupiterOne workspace, you will find a list of JupiterOne's managed dashboards. These dashboards come pre-configured to provide a baseline of useful visualizations that can be built upon. Note that the list of managed boards is filtered down to show you only those boards that relate to your account's configured integrations (See Managed Dashboard Prerequisites below).

![JupiterOne Insights overview](/assets/images/insights-landing-93056d4c463cb907f2ddf25569a1340a.png)

### Managed Dashboard Prerequisites

By default, JupiterOne filters the list of managed dashboards that you can see to the ones that relate to your account's configured integrations. If you have the AWS integration enabled, then you will see all of the dashboards that relate to AWS and cloud computing.

If you'd like to see all managed dashboards, even the ones that do not relate to your integrations, you can change the filter at the top of the dashboards list page.

![JupiterOne Insights prerequisite filter](/assets/images/insights-prereq-filter-e6a377081895892e8329d0b846f0f0a8.png)

#### Satisfying Prerequisites

Almost every managed dashboard has a set of integrations or integration types that an account should have in order for them to gain insights from a particular dashboard.

You can see that this account meets all of the requirements for the Data Protection dashboard. It needed to have either an AWS, Google Cloud, or Azure integration set up, and it has all three.

![JupiterOne Insights prerequisites met](/assets/images/insights-prereq-met-ccb183e8543653b39017712179a2955a.png)

In comparison, you can see that this account does not meet the requirements for the Toxic Combinations dashboard. It needs to have the following integrations in order for this dashboard to provide useful information to the user, one of three cloud integrations and an endpoint agent or vulnerability scanner integration.

![JupiterOne Insights prerequisites met](/assets/images/insights-prereq-not-met-9e313113aeeaaa62f0432ed59ead0203.png)

### Creating dashboards

When creating Insights dashboards, there are two main options: Creating a **Team dashboard** or creating a **Personal dashboard**. Team dashboards are accessible to all members of your workspace, while a Personal dashboard is only visible to you. Team dashboards can further be limited to a specific resource group.

#### To create a new dashboard:

At the top right of the dashboards list page, click **Create dashboard** and choose whether you want to add a personal or team board. You can also select a resource group to limit access via RBAC permissions.

#### Widget options:

When creating a dashboard, there are several options for widgets to choose from. This allows you to utilize the most impactful visual representation for your data. Below are the following supported dashboard widgets:

-   **Number**: A metric chart visualization that shows one large stat value. You are able to configure color coded thresholds that will help you tell a story of good vs bad results.
-   **Pie Chart**: The pie chart displays values from one or more queries, as they relate to each other, in the form of slices of a pie. The arc length, area and central angle of a slice are all proportional to the slices value, as it relates to the sum of all values.
-   **Line Chart**: The line chart is created by plotting a series of several points and connecting them with a straight line.
-   **Bar Chart**: The bar chart visualization allows you to view categorical data to analyze your queries with a specified x and y axis. You are able to run multiple queries and visualize the bar chart in stacked format.
-   **Matrix Chart**: The matrix chart is used for analyzing and displaying the relationship between data sets. The matrix diagram shows the relationship between two, three, or four groups of information.
-   **Table**: The tables chart present data in as close to raw form as possible. Tables are meant to be read, so they are ideal when you have data that cannot easily be presented visually, or when the data requires more specific attention.
-   **Graph**: The graph chart displays a tree graph of query results. This chart is best used to visualize specific relationships between entities.
-   **Status**: The status chart displays a visual summary of correlating queries. This chart is best used to show positive or negative results based on if relationships are present in query results.

#### Trend Widgets:

Insights, in addition to its point in time widget options, provides several options to visualize trends through widgeting. These widget types can be found in the widget selection process under `Trend Widgets`. The trend widgets collect the query result on a daily interval. As J1 collects the data for your query over time you are able to track and visualize the data trend between a (1W | 1M | 3M | 1Y) interval.

-   **Number**: The metric chart visualization shows one large stat value. In the trend version of this chart you are able to track the value through a spark line to see if the result is getting larger or smaller over time.
-   **Pie Chart**: The pie chart displays values from one or more queries, as they relate to each other, in the form of slices of a pie. The arc length, area and central angle of a slice are all proportional to the slices value, as it relates to the sum of all values. This type of chart is best used when you want a quick comparison of a small set of values in an aesthetically pleasing form. In the trend version of this chart you are able to track the value change of each slice value as well as the total value through a a spark line to see if the data set is getting larger or smaller over time.
-   **Line Chart**: The line chart is created by plotting a series of several points and connecting them with a straight line.
-   **Bar Chart**: The bar chart visualization allows you to view categorical data to analyze your queries with a specified x and y axis. You are able to run multiple queries and visualize the bar chart in stacked format. This chart is best suited for categorizing your results. In the trend version of the chart you are able to visualize the value change of each categorical result through a %Change indicator and a reference category bar of the result value from the previous time period selected.
-   Area Chart is coming soon! Today the best way to bring an Area Chart Trend to Insights is through a Question.

_Currently, widget previews are enabled for trend charts, but they show the non-trend version of the chart._

_Query variables are not supported in Trend Widgets at this time_

#### Adding charts widgets to an existing dashboard

Aside from creating completely new dashboards within Insights, you are also able to add charts to an existing dashboard.

> **NOTE**
> 
> Not all dashboards can have additional widgets added to them. Depending on your [user permissions](/features/admin/access-controls.md), you may or may not be able to add widgets to existing team dashboards. JupiterOne managed dashboards do not support additional widgets. You can duplicate or clone a managed dashboard to edit it.

#### Adding Markdown blocks

You can also add markdown-based widget blocks within a dashboard. This can be useful in bringing in external information, such as text, images, or links to additional resources. Anything supported by markdown can be embedded within this widget and added within a dashboard.

**To add a markdown widget**, select **Add markdown** option from a dashboard's additional options menu. It will open a markdown editor for you to input your content.

![JupiterOne Insights dashboard with a markdown widget featuring an image of a cute kitten](/assets/images/md-widget-e21d2262f325058c92c8debeafc788e7.png)

---

Source: /features/insights-and-alerts/managing-insights-dashboards

# Dashboard Management

From within the Insights section, there are several options for managing your dashboard views and organizing dashboards effectively.

### Rearranging dashboard widgets

When viewing a dashboard you can rearrange the widgets both by adjusting their size and their positioning:

-   **To move a widget**: Click and drag at the top center of the widget's border and drag it to the desired location.
-   **To resize a widget**: Click on the lower right corner and drag the widget corner to expand or shrink the widget as desired.

### Bookmarking and Favorites

Each user can favorite their own dashboards. To favorite a dashboard, click the star button in the dashboard table row or the star button in the top of the dashboard's header.

Your favorited dashboards rise to the top of the dashboards list, so the ones you use most are always easy to find. Favorites are per user — the dashboards you favorite affect only your own list and don't change what other users see.

### Deleting and duplicating dashboards

Dashboards can be duplicated for personal or team spaces. This allows the ability to further customize an existing dashboard while leaving the original dashboard intact.

**To duplicate a dashboard**, select the **three dots icon** in the dashboard header and select **Duplicate** from the drop-down. Choose whether you wish to duplicate the dashboard as a **Personal** or **Team** dashboard.

You can also delete dashboards and remove them from your workspace by selecting Delete under the three dot icon menu.

> You can only delete personal and team dashboards and will be _unable_ to delete the J1 Managed Dashboards.

### Exporting dashboards and widgets

You can export entire dashboards or individual widgets from a dashboard by clicking the **three dots icon** in the top right of either the dashboard or individual widget window.

**To export a widget or dashboard**, select **Export** and choose the desired file format. For dashboards you can export as either PDF or Schema representations, and for widgets, depending on the type of widget you can export as either CSV or PNG.

### Top Level data filters for dashboards

When viewing a dashboard you can filter the widget data simply by applying data scope filters to the board:

-   **To add a filter**: Click on the Filter icon in the Header of any Insights dashboard add a `Metadata` field, `Property`, or even a `tag`. The filter inputs will prepopulate with the data that exists in your J1 Graph, once selected the input values will be selectable from the input value dropdown.
-   **To change a filter**: Click on the Filter icon and use the filter modal to update the filters you have applied.
-   **To remove a filter**: Remove via the filter modal. This feature is available for all J1 dashboard users, the filters are saved at the User level. Currently, this feature is not applicable for charts that are using daily trend collection.

---

Source: /features/insights-and-alerts/rule-exemptions

# Exemptions

An **exemption** excludes specific entities from a rule's results. They are still in your graph and the query still finds them, but the rule stops counting them: they are left out of the result totals the rule's condition is evaluated against, and they trigger none of the actions the rule would otherwise have taken.

Each exempted entity is its own exemption. The ones you file together are kept as a single **decision** that shares one justification, reason, and expiry.

Use an exemption when a rule's query is right but keeps returning a result you have already looked at and decided is fine—a bastion host that is deliberately reachable from the internet, or a known test account the query will always match. Exempting it stops the rule alerting on that one entity while it goes on catching everything else, so you do not have to narrow the query or turn the rule off.

## What an exemption does

Exempting an entity has five effects:

-   Each exempted entity is removed from the rule's results before they are counted, so it is not part of the totals the rule's condition is evaluated against.
-   The rule takes no action on it. No alert, no notification, no Jira or ServiceNow ticket, no webhook.
-   The entity remains in your graph, unchanged. An exemption is a statement about one rule, not about the asset.
-   The exempted entities are kept and shown separately, so the set you excluded is always reviewable and downloadable.
-   The change takes effect on the rule's **next scheduled evaluation**. Nothing re-evaluates at the moment you create the exemption.

> **NOTE**
> 
> Because exemptions apply at evaluation time, a rule that is currently alerting continues to alert until it next runs. To see the effect immediately, trigger the rule on demand.

An exemption applies to **the whole rule**, not to one query within it. If a rule runs three queries, exempting an entity removes it from all three. You cannot exempt an entity from a rule's finding query while still counting it in a supporting query.

## Creating an exemption

You need permission to update the rule.

1.  Navigate to **Alerts** and select the **Rules** tab, then open the rule.
    
2.  Select the **Evaluation history** tab and choose the evaluation whose results you want to work from.
    
3.  Expand the query whose results contain the entities to exempt.
    
4.  Select the rows you want to exempt, then click **Exempt**.
    
5.  Complete the exemption:
    
    -   **Justification**: Required. Why these entities do not count. This is the record other people read later, so write it for them.
    -   **Reason**: One of Risk accepted, Not applicable, False positive, or Compensating control.
    -   **Expires on**: Optional. Leave it empty for an exemption that never expires.
6.  Click **Exempt entities**.
    

The justification, reason, and expiry apply to the entire selection. Selecting twelve rows and exempting them files one decision covering twelve entities, rather than twelve separate decisions.

A selected row is skipped if it does not name exactly one entity. If some of your selection is skipped for that reason, the dialog tells you how many before you confirm.

> **NOTE**
> 
> A rule can hold at most **100 unexpired exemptions**, and you can exempt at most 100 entities at a time. Exempting beyond that is refused, and the message tells you how many the rule already has.
> 
> Expired exemptions do not count toward the limit, and re-exempting an entity that is already exempt replaces its existing exemption rather than using up another slot.
> 
> If you find yourself near the limit, that is usually a sign the query is matching more than it should. Narrowing the query is a better answer than exempting a hundred entities one by one.

## Which rules can accept exemptions

Not every rule can take exemptions, and this is the single most important thing to understand about the feature.

An exemption attaches to **an entity in the results**. Some queries return something other than entities—counts, deduplicated values, or a graph—so there is nothing for an exemption to attach to. When a rule runs such a query, the **Exempt** action appears but is disabled, and hovering it explains why.

This is a property of the query the rule runs. It is not a permission problem, not a licensing limit, and not a defect. Rewriting the query so it returns entities makes the rule exemptable.

### Query shapes that cannot accept exemptions

| The rule's query | Why it cannot accept exemptions |
| --- | --- |
| Aggregates its results, with `count()`, `avg()`, `sum()`, or similar | A row is a summary of many entities, so no single entity can be excluded from it. |
| Uses `FIND UNIQUE` | A row stands for every entity sharing that value, not for one of them. |
| Uses `RETURN TREE` | A graph result has no rows. Removing vertices from it would leave relationships pointing at nothing. |
| Has a `RETURN` that names only values, and no entity | The results carry property values, with no entity identity to key an exemption on. |
| Has no query at all | There are no results. |

A rule can also be refused temporarily when JupiterOne cannot determine what its query returns—because the saved question behind it could not be loaded, or the query itself could not be read. The tooltip says which.

A rule can accept exemptions only when **every** query it runs can. A rule that mixes an entity-returning query with an aggregating one cannot take exemptions, because an exemption would apply to the first query and silently miss the second—leaving a condition that reads the second query's total still counting the entity you exempted.

### Entities a query traverses but does not return

An exemption can only target entities the query's `RETURN` actually names.

Consider `FIND Host THAT HAS UserAccount RETURN Host.displayName, Host._id`. The query traverses to user accounts in order to select hosts, but only hosts come back in the results. You can exempt a host from this rule. You cannot exempt a user account from it, because no user account appears in the results. To exempt user accounts, the query has to return them.

## Reviewing what you exempted

Under each query's results in **Evaluation history**, an **Exempted results** section lists the entities that evaluation held back, with a count and its own download. The two halves of the run are recorded together, so you can always see what a rule counted alongside what it did not.

This section reports what happened on that particular run. Revoking an exemption does not rewrite the runs it already applied to, and past evaluations are never edited.

Very large result sets are not rendered in the table. Download the exempted set instead.

The justification, reason, author, and expiry belong to the exemption rather than to any one run, so they are not shown here. They are on the rule's [Exemptions tab](#managing-a-rules-exemptions).

### Downloading each set separately

The included results and the exempted results each have their own download, in both CSV and JSON.

### Referencing exempted results in an action template

A rule's actions can report what it held back, not just what it acted on. Each of the rule's queries carries its exempted rows alongside its results, and the template editor offers both in its completion list:

-   `queries.<name>.exemptions` — the rows an exemption withheld from that query, shaped like the rows in `queries.<name>.data`.
-   `queries.<name>.exemptionsTotal` — how many rows it withheld.

So a notification can account for both halves of the run:

```text
{{queries.query0.total}} results, {{queries.query0.exemptionsTotal || 0}} held back by an exemption:

* {{queries.query0.exemptions|mapProperty('displayName')|join('\n* ')}}
```

Both are **absent rather than empty** on a rule with nothing exempt, and an absent value is not blank: dropped into a sentence it renders the literal word `undefined`. So `Held back: {{queries.query0.exemptionsTotal}}` reads `Held back: undefined` on a rule with nothing exempt, which is why the example above appends `|| 0`. Do the same anywhere you want a number every time.

A list needs no such guard. `mapProperty` yields nothing from an absent value, so the line renders empty.

Previewing the action does not resolve either one. The preview runs the query as written, with no exemption filter applied, so it reports both as known only when the rule runs rather than reporting them as empty.

See [Query reference variables](/api/alert-rules.md#query-reference-variables) for the full set of query variables a template can reference.

## Managing a rule's exemptions

The **Exemptions** tab on the rule detail page, alongside **Evaluation history** and **Relationships**, lists everything currently exempt from that rule.

Exemptions are grouped into the decisions that created them, newest first. Each decision shows its reason, justification, who filed it, when, and its expiry, together with what it covers—for example, "3 entities · 2 active, 1 expired". Expand a decision to see the individual entities, each with a **Status** of Active or Expired.

Expired exemptions are listed alongside active ones rather than being hidden. An exemption that quietly disappeared when it lapsed would leave you to work out for yourself why a rule started alerting again.

Viewing the tab does not require permission to change the rule, so anyone with read access can review what is exempt. Revoking does require permission to update the rule.

> **NOTE**
> 
> A decision is described by what it covers **now**, not by how many rows were originally selected. Exempting an entity again under a later decision moves it to that newer decision, so revoking the older one can clear fewer entities than its header once showed. The confirmation and the result both tell you the number actually revoked.

Entity names on this tab are the ones recorded when the exemption was filed, and are not refreshed from the graph. A name can therefore lag what the entity is called today.

> **INFO**
> 
> This tab describes the exemptions you filed, not whether they still match anything. **Status** distinguishes active from expired only—an exemption whose entity the rule no longer returns still reads as Active.
> 
> To see what a rule actually held back, use the **Exempted results** section of its most recent evaluation. An exemption on this tab that is missing from that set is no longer doing anything.

## Expiry

An exemption with an expiry date stops applying after that date, and the entity starts counting again on the next evaluation.

An expired exemption is **not deleted**. It stays on the rule's **Exemptions** tab marked as expired, so a rule that starts alerting again is always explainable—you can see which exemption lapsed and when. Exempting again, or extending the expiry, brings it back into effect.

Exemptions take effect as soon as they are created. There is no approval workflow in this release.

## Revoking an exemption

Revoking an exemption puts the entity back into the rule's results from the next evaluation onwards.

From the **Exemptions** tab, click **Revoke decision** to revoke a whole decision at once, or expand it, select individual entities, and revoke only those. Revoking part of a decision leaves the rest of it in place.

A revoked entity is reported as newly discovered on that next run, because the rule compares each run against the previous run's results.

Revoking always works, even on a rule that has since been edited into a shape that can no longer accept new exemptions. Exemptions never become permanently stuck.

## Limitations to plan around

### An exemption can be lost if the entity's identity changes

An exemption is keyed to the graph identity of the entity it covers. That identity is derived from the integration instance that ingested the entity together with the entity's key, so anything that changes either one detaches the exemption. A detached exemption stops applying, and the entity starts counting again.

> **WARNING**
> 
> **Removing an integration and adding it back breaks every exemption created from entities that integration ingested, all at once.** Re-adding an integration creates a new integration instance, which gives every entity it ingests a new identity. The exemptions do not follow.
> 
> If you need to reconfigure an integration, edit the existing configuration rather than deleting it and adding it again.

Other cases that detach an exemption:

-   **An integration version changes the format of its entity keys.** Affects every exemption created from that integration's entities.
-   **A placeholder entity created by a mapper is later ingested by a real integration.**

These cases do **not** affect an exemption:

-   The integration runs again and re-ingests the entity.
-   The entity is deleted and later re-ingested by the same integration instance.
-   The rule is edited, renamed, retagged, or rescheduled. Exemptions attach to the rule itself and survive its edits.

A detached exemption is never misapplied: it stops matching rather than matching something else, so the entity is simply counted again. But nothing announces it. The exemption keeps showing as Active on the **Exemptions** tab, and the only signal is the run itself—the entity reappears in the rule's results and drops out of that evaluation's **Exempted results**.

### Exemptions are not durable on unified devices and identities

> **WARNING**
> 
> Do not rely on exemptions against [`UnifiedDevice`](/features/assets/device-unification.md) or [`UnifiedIdentity`](/features/assets/identity-unification.md) entities.
> 
> A unified entity is rebuilt whenever a new correlation arrives: JupiterOne creates a new combined entity and discards the previous one. That is routine operation, not an unusual event, so an exemption on a unified device or identity detaches on its own schedule and the entity starts counting again.

The exemption is never misapplied to a different entity, but it will need re-creating and nothing will tell you when—it stops applying while still showing as Active. Nothing prevents you from creating one, so treat it as temporary rather than as a standing decision.

Where a rule can be written against the underlying `Host`, `Device`, or `User` entities instead, exempting those is durable, because their identity comes from the integration that ingested them rather than from correlation.

[`UnifiedVulnerability`](/reference/unified-vulnerability.md) entities are **not** affected. Their identity is derived from the CVE, so it is stable.

### One machine can need several exemptions

A query written against an entity class returns one row for every source that reported the asset, not one row per real-world thing.

`FIND Host WITH diskEncryption != true` returns a separate row for each system that reported that host. A single laptop known to your cloud provider, your CMDB, and your endpoint agent appears as three rows, and all three need exempting for the laptop to stop counting.

This is not new behavior—that query already returns three rows and the rule already counts three—but exempting is usually the moment it becomes visible. Select all the rows for that asset and exempt them together, which files them as one decision.

## Managing exemptions through the API

Everything above is available on the public GraphQL API: creating exemptions in bulk, revoking them, reading a rule's exemptions, checking whether a set of results can be exempted, and downloading either result set. See [Exemptions](/api/alert-rules.md#exemptions) in the alert rules API reference.

The JupiterOne Terraform provider does not manage exemptions.

---

Source: /features/insights-and-alerts/security-content-release-notes

# Security Content Release Notes

### June 2025

Published a new 'Kubernetes CIS Benchmark' Managed Rule Pack

NOTE: Dependencies to keep in mind: Kubernetes managed integration or similar container orchestration integration that ingests Kubernetes resources

-   kubernetes-cis-5.1.1-cluster-admin-role-usage
-   kubernetes-cis-5.1.2-minimize-access-to-secrets
-   kubernetes-cis-5.1.3-minimize-wildcard-use
-   kubernetes-cis-5.1.4-minimize-pod-create-access
-   kubernetes-cis-5.1.5-no-default-service-account-use
-   kubernetes-cis-5.1.6-sa-tokens-only-where-necessary
-   kubernetes-cis-5.1.7-avoid-system-masters-group
-   kubernetes-cis-5.1.8-limit-bind-impersonate-escalate
-   kubernetes-cis-5.1.9-minimize-pv-create-access
-   kubernetes-cis-5.1.10-minimize-node-proxy-access
-   kubernetes-cis-5.1.11-minimize-csr-approval-access
-   kubernetes-cis-5.1.12-minimize-webhook-config-access
-   kubernetes-cis-5.1.13-minimize-sa-token-creation-access
-   kubernetes-cis-5.2.1-policy-control-mechanism
-   kubernetes-cis-5.2.2-minimize-privileged-containers
-   kubernetes-cis-5.2.3-minimize-hostpid-containers
-   kubernetes-cis-5.2.4-minimize-hostipc-containers
-   kubernetes-cis-5.2.5-minimize-hostnetwork-containers
-   kubernetes-cis-5.2.6-minimize-allowprivilegeescalation-containers
-   kubernetes-cis-5.2.7-minimize-root-containers
-   kubernetes-cis-5.2.8-minimize-net-raw-capability
-   kubernetes-cis-5.2.9-minimize-added-capabilities
-   kubernetes-cis-5.2.10-minimize-capabilities-assigned
-   kubernetes-cis-5.2.11-minimize-windows-hostprocess
-   kubernetes-cis-5.2.12-minimize-hostpath-volumes
-   kubernetes-cis-5.2.13-minimize-hostports
-   kubernetes-cis-5.3.2-namespaces-network-policies
-   kubernetes-cis-5.4.1-secrets-as-files
-   kubernetes-cis-5.4.2-external-secret-storage
-   kubernetes-cis-5.6.1-administrative-boundaries-namespaces
-   kubernetes-cis-5.6.2-seccomp-profile-docker-default
-   kubernetes-cis-5.6.3-apply-security-context
-   kubernetes-cis-5.6.4-default-namespace-not-used

[https://github.com/JupiterOne/jupiterone-alert-rules/blob/main/rule-packs/kubernetes-cis.json](https://github.com/JupiterOne/jupiterone-alert-rules/blob/main/rule-packs/kubernetes-cis.json)

### February 2025

Published a new 'SBOM & App Security' Managed Rule Pack

NOTE: Dependencies to keep in mind: GitHub, Snyk, SonarCloud, or similar managed integration, and potentially a custom J1 Integration for CycloneDX or similar SBOM Generating Tool

-   sbom-code-modules-in-code-repos-with-finding
-   sbom-workloads-defined-by-code-repo-with-finding
-   sbom-all-module-versions-used
-   sbom-nested-sboms
-   sbom-commonly-used-code-modules
-   sbom-recently-merged-PRs-for-repos-with-critical-findings
-   sbom-repositories-with-active-findings
-   sbom-package-dependencies-flows
-   sbom-package-dependencies

[https://github.com/JupiterOne/jupiterone-alert-rules/blob/main/rule-packs/jupiterone-sbom.json](https://github.com/JupiterOne/jupiterone-alert-rules/blob/main/rule-packs/jupiterone-sbom.json)

### January 2025

Addition to JupiterOne Questions Library for Lansweeper integration. Checks basic configuration best practices. These will be useful for gaining more insight into your lansweeper environment.

-   integration-question-lansweeper-inactive-hosts
-   integration-question-lansweeper-hosts-outside-of-allowed-ip-range
-   integration-question-lansweeper-list-operating-system-types
-   integration-question-lansweeper-users-with-bad-status
-   integration-question-lansweeper-out-of-date-operating-systems

Additions to "MITRE ATT&CK: AWS Privilege Escalation" rule pack

-   integration-question-aws-search-for-secrets-in-lambda-functions

Addition to JupiterOne Questions Library. This question will allow an AWS user to search for keywords to ensure that there are no AWS exposed secrets in lambda function metadata. This will also enable a user to turn the question into an alert. [https://ask.us.jupiterone.io/question/a4db06a7ae955bc6c22896c651bd5cb7f0cc32e8?search=lambda&tagFilter=all](https://ask.us.jupiterone.io/question/a4db06a7ae955bc6c22896c651bd5cb7f0cc32e8?search=lambda&tagFilter=all)

-   privileges-unused-for-90-days

Addition to existing 'AWS Config' rule pack. Checks for aws role privileges that have been unused for 90 days or greater. It is recommended to review results returned and remove unused privileges.

-   aws-public-facing-resources-list

Addition to existing 'AWS Threat' rule pack. This alert returns all AWS resources that are public facing. Useful for delta detection and trending over time.

-   aws-high-privilege-lambda-function-wildcard
-   aws-high-privilege-lambda-function-lambda:\*
-   aws-high-privilege-lambda-function-get-policy
-   aws-high-privilege-lambda-function-get-function
-   aws-high-privilege-lambda-function-get-function-configuration
-   aws-high-privilege-lambda-function-list-functions

---

Source: /features/insights-and-alerts/vulns-and-findings

# Vulnerabilities and Findings

JupiterOne offers a dedicated view for highlighting vulnerabilities and findings within Alerts. This surfaces and consolidates findings and vulnerabilities imported from your configured integrations based on `Finding` class entities.

![JupiterOne Vulnerabilities and Findings](/assets/images/vulns-and-finds-overview-4526756aa2230b906aa670b270b7c6b7.png)

## Accessing Vulnerabilities and Findings

Vulnerabilities and findings now live in their own **Vulnerabilities** section in the left navigation, rather than behind a button on the Alerts page.

> **NOTE**
> 
> The steps below describe the legacy Vulnerabilities and Findings table. This experience is being reworked as part of the dedicated Vulnerabilities section, so the **Edit Query**, **Filters** tab, and **Exception** controls may differ from what you see today.

### Updating the query

By selecting **Edit Query**, you are able to adjust the query used to populate the Findings table. This will allow you to further tune the desired information that appears.

### Filtering results

With the Filters tab, you are able to filter the data to only display particular entity types, severities, or source accounts.

### Reviewing Findings

From the table, you are able to sort and adjust the findings by Type, Severity, Title/Description, Open since date, and the Source Account.

![JupiterOne finding expanded view](/assets/images/finding-expanded-2f19fc7a81c4b1df7a7c874ad7dd4af7.png)

To view a finding, simply select it from within the table. This will allow you to view the graph finding, query, and its associated metadata.

### Marking exceptions

You are able to mark findings for exception when relevant. To do so, find the entry within the table you'd like to mark as an exception, and select the **Exception** button on the right of the table.

Additionally, you are able to sort and view all exceptions with the **Show Exceptions** filter.

---

Source: /features/insights-and-alerts/whats-new-in-insights

# Insights Release Notes

**Release date: July 7, 2026**

A few improvements to Insights dashboards in the new JupiterOne app.

## What is new

| Change | What it means for you |
| --- | --- |
| Faster dashboards | The dashboards list and individual dashboards load noticeably faster |
| Compact number formatting | Number and Pie charts now display large values in a compact form — `234k` instead of `234,000`, `1.23m` instead of `1,230,000` — formatted for your locale |
| Refreshed chart styling | Charts are built on a new charting library, so you may notice small visual differences such as axis tick intervals |
| Trend timespan moved to the widget header | The trend timespan selector now lives in the widget header, giving charts more room and matching their non-trend counterparts |
| Public links in the new app | Open an existing public dashboard link in the new app by changing `apps` to `app` in the URL |

## Faster dashboards

Loading is noticeably quicker — both the dashboards list and individual dashboards open faster than before.

## Compact number formatting

Number and Pie charts now display large values in a compact form instead of writing them out in full. A value of `234,000` shows as `234k`, and `1,230,000` shows as `1.23m`, so big numbers stay readable at a glance and fit cleanly within the widget.

Numbers are formatted for your locale, so the separators and notation match your region — a user in Europe sees the format conventions for their locale rather than the US format.

## Refreshed chart styling

Charts are now built on a new charting library. Everything works the way it did before, but you may notice small visual differences — for example, the tick intervals on the x and y axes.

> **INFO**
> 
> If you run into any issues with how a chart renders, let us know.

## Trend timespan selector moved to the widget header

The trend timespan selector (1W, 1M, 3M, 1Y) now lives in the widget header instead of inside the chart area. This gives the chart more room to display your data and makes trend widgets look more like their non-trend counterparts.

## Open public links in the new app

Public dashboard links now work in the new JupiterOne app. To open an existing public link in the new app, change `apps` to `app` in the URL:

-   Current: `https://apps.us.jupiterone.io/...`
-   New app: `https://app.us.jupiterone.io/...`

That's the only change needed — the rest of the link stays the same.

---

Source: /features/insights-and-alerts/whats-new-in-rules-and-alerts

# Rules and Alerts Release Notes

**Release date: June 23, 2026**

JupiterOne has rebuilt Rules and Alerts on its modern app foundation. Everything you relied on before is still here, and the rebuild brought a few improvements worth calling out.

## What is new

| Change | What it means for you |
| --- | --- |
| Unified Rules page | Your rules and your firing alerts now share one page with **All rules** and **Alerting** tabs - no jumping between separate pages to connect an alert to its rule |
| Single rule detail page | Configuration, alert information, evaluation history, and relationships for a rule now live on one page |
| Jira tickets from live fields | The **Create Jira ticket** action pulls the real field definitions from your Jira instance, so you pick valid values instead of hand-writing JSON |
| Clearer action preview and test | Previewing and testing an action now opens in a dedicated view with room for the full rendered action and the test result |
| Live evaluation view | The rule detail page shows an evaluation as it runs, in real time |

## Rules and alerts now live on one page

Your rules and your firing alerts now share a single **Rules** page with two tabs:

-   **All rules** — every rule in your workspace.
-   **Alerting** — only the rules that are currently firing, surfaced highest-severity first.

Each firing rule sits right alongside its alert, so you can see what's alerting and why without jumping between separate pages.

![The Rules page showing the All rules and Alerting tabs, with rules and their firing alerts in one table](/assets/images/unified-rules-table-b7db74a57c2c797b01d4db903f5f587d.png)

## A single rule detail page

Every rule now has one detail page that brings its configuration, alert information, evaluation history, and relationships together in one place. When a rule is firing, its alert details sit right alongside the rule itself, so you no longer have to move between a separate alert view and the rule that produced it.

The **Evaluation history** tab shows results over time as a chart you can click through run by run. For any run, you can drill into the breakdown — queries (with downloadable result tables), conditions, actions, and outputs — and open the full logs for any action that ran.

![Rule detail page showing rule configuration and alert details up top, with the Evaluation history tab and its results-over-time chart and evaluation breakdown below](/assets/images/rule-detail-evaluation-history-4a7f746ec9af9d178276d6a739fc5d90.png)

You can also collapse the summary at the top of the page to give the evaluation details more room. When you're focused on a specific run's breakdown, collapse the rule configuration and alert summary to bring the chart and step-by-step breakdown front and center.

![Rule detail page with the top summary collapsed, giving the evaluation history chart and breakdown more room](/assets/images/rule-detail-collapsed-metadata-ae676ee671b1c31dcc605f929173453a.png)

## Build Jira tickets from real Jira fields

When you configure a **Create Jira ticket** action, the editor now pulls the live field definitions from your Jira instance for the issue type you choose. Instead of hand-writing JSON, you pick from the actual options that issue type accepts — dropdowns for single-select fields, checklists for multi-select fields, and text or number inputs for the rest.

This means the values you set are real and valid up front, with far less guesswork.

> **INFO**
> 
> If a field can't be loaded — for example, the connected Jira account lacks the required permission, or the instance isn't Jira Cloud — the editor tells you why and you can still set additional fields as JSON.

## A clearer way to preview and test actions

Previewing and testing an action while building a rule isn't new — but it now opens in a dedicated view that's much easier to read and work with.

-   **Preview** renders the action's template against a small sample of your rule's real query results — so you can confirm the message, ticket, or payload looks right with live data filled in.
-   **Test** executes the action against its live integration with that sample data and reports success or the failure reason. Test is available for webhook, Jira, and Slack actions.

Open it from **Preview** on the action you're editing. The view has room for the full rendered action and the test result, and closing it returns you to your configuration where you left it.

## Watch an evaluation run live

When a rule is evaluating — whether you just selected **Evaluate now** or a scheduled run is underway — the rule detail page shows the evaluation happening in real time. Instead of a static page you have to refresh, you'll see a live indicator and placeholder steps that fill in as the run progresses, then settle into the completed results when it finishes.

---

Source: /features/integrations/data-out-1-0

# Data Out 1.0 Release Notes

**Release date: May 19, 2026**

Data Out 1.0 launches a first-class outbound integration surface in JupiterOne. Workspace admins can authorize a Jira connection in three guided steps, stand up named workflow instances that route J1 events to a specific project + issue type, and watch every outbound delivery in a unified Jobs log. CCM users can turn any failing control into a tracked Jira ticket with a single click - and the resulting ticket is linked back from the control detail panel so closing the loop is one tap away.

## What is new in Data Out 1.0

| Feature | What it means for you |
| --- | --- |
| Top-level Data Out surface | Two new tabs - **Connections** and **Instances** - under the Integrations module, with a clean separation between getting data into J1 and getting it out |
| Jira provider (live) | Authenticate Jira workspaces via Atlassian API token, see "coming soon" placeholders for ServiceNow and Asana |
| Guided Connection wizard | Two steps to authorize a Jira workspace (Connect + Verify) plus an optional Configure + Test pass to spin up the first instance in the same flow |
| Add Jira instance wizard | A 3-step Stepper modal (Select Connection -> Configure -> Test) that creates a named instance scoped to a Jira project + issue type, with an optional in-wizard test ticket |
| Instance lifecycle controls | Edit, Stop, and Delete instances from a single hover row; per-instance detail page with summary metrics and a focused jobs table |
| Per-instance Jobs table | Every outbound delivery for an instance is recorded on its detail page, with status, timestamps, and per-job error messages for triage |
| CCM Create ticket | A prominent **Create ticket** action on every failing CCM control test, opening a 4-field modal (Workflow / Title / Description / Assignee) and dropping a ready-to-go ticket into Jira |
| Linked Jira issues + View in Jira | Tickets created from CCM appear inline on the originating control detail panel, with a one-click **View in Jira** link |
| Full-admin gate | Connection and instance configuration is locked to full admins so credentials and routing stay under tight control |

## Top-level Data Out surface

Data Out is now its own destination in the J1 left navigation under Integrations. Two tabs split the responsibility cleanly: **Connections** is for credentials, and **Instances** is for routing - with execution history surfaced on each instance's detail page.

![Data out tabs - Connections and Instances](/assets/images/data-out-tabs-overview-53e3ff3531c872543aae8edfbe501e29.png)

The Connections tab presents the provider catalog. Jira ships live with a green **Connected** badge once you finish the wizard; ServiceNow and Asana are surfaced as **Coming soon** placeholders so customers know they are coming without us blocking the rollout on them.

![Data out Connections tab with Jira (Connected), ServiceNow (Coming soon), Asana (Coming soon)](/assets/images/connections-tab-providers-29dcfdbab6f6e86ef38f194c899b1a7a.png)

> **TIP**
> 
> Use the **Connections** tab as the single source of truth for "is this credential still good?" - the **Authorization status** badge on each connection card flips to **Needs reauthorization** the moment a token expires.

## Guided Jira connection wizard

Authorizing Jira is now a two-step Stepper experience. The Connect step captures the Atlassian site, account email, and API token; the Verify step proves the credentials work by listing the Jira projects we can read with them.

![Connection wizard Step 1 - Connect: Connection name, Host name, Email, API Token](/assets/images/connection-wizard-connect-39b9d953fceea4528547c70af2fce043.png)

![Connection wizard Step 2 - Verify: Your connection is working! with project list](/assets/images/connection-wizard-verify-ec2378139b42051aa7c12384d57515b2.png)

In the new-connection flow, the wizard continues directly into the Add Jira instance Configure + Test steps, so an admin finishes with a working connection **and** a first running workflow in a single pass. See the [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md) guide for the end-to-end walkthrough.

## Add Jira instance wizard

Standing up an instance is a 3-step Stepper modal: pick a connection, configure the workflow, and (optionally) send a test ticket through it.

![Add Jira instance Step 1 - Select Connection](/assets/images/add-instance-step1-select-connection-d21a0efb8403be67ce526fd95c93a8b7.png)

The Configure step is where you tell Data Out which Jira project and issue type the instance writes to. The **Data in Jira integration** field links the instance to a project J1 already ingests, so the **Issue type** dropdown is populated from the project's real metadata.

![Add Jira instance Step 2 - Configure: Workflow name, Data in Jira integration, Issue type](/assets/images/add-instance-step2-configure-4300422dfe84c46c63c372728f52c403.png)

The Test step lets you confirm the round-trip before you trust the instance with real CCM tickets. It posts a real Jira ticket with a Summary and Description you can edit.

![Add Jira instance Step 3 - Test: Send a test payload to verify the workflow is running](/assets/images/add-instance-step3-test-59e2ead3b0f88a29ef0b3aa585706f4f.png)

See the [Create an instance](/integrations/data-out/create-instance.md) guide for the full walkthrough.

## Instance lifecycle and the Instances tab

The Instances tab groups every running instance by provider with **N instances / N active** badges per group. Hovering a row reveals **Stop**, **Edit**, and **Delete** actions on the right edge.

![Instances tab grouped by provider with Jira instances](/assets/images/instances-tab-3b5c2f3ab86408aca7a5c6e44177ebc4.png)

Clicking an instance opens a per-instance detail page with eight headline metrics (Status / Last run / Last updated / Lifetime tasks / Jobs succeeded / Jobs failed / Data in integration / Issue type) plus a focused per-instance Jobs table.

![Instance detail page with summary header and per-instance jobs table](/assets/images/instance-detail-page-1e9050638080568892d8dcfbc44a7fa7.png)

See the [Manage instances](/integrations/data-out/manage-instances.md) guide for the full reference.

## CCM Create ticket

The flagship producer experience in 1.0 is the **Create ticket** action on every failing CCM control test. From the control detail panel, click **Create ticket** to open a 4-field modal: pick a Workflow, edit the prefilled Title and Description, optionally assign a teammate, and click Create.

![CCM Create ticket modal with Workflow, Title, Description, and Assignee fields](/assets/images/create-ticket-modal-d6303c087312c4cf37c3c67e61c8da53.png)

The Description editor renders rich markdown (headings, lists, links, tables) and converts cleanly to Jira wiki markup on submit, so the resulting Jira ticket reads naturally:

![Resulting Jira ticket: Control failure title, Failing control tests description, Reporter and Assignee populated](/assets/images/jira-ticket-created-7c6d2be5daca9b99f974115384bbe98a.png)

In 1.0 the modal exposes only the four fields above. Project, issue type, priority, labels, and other Jira-side configuration are determined by the selected Workflow - so admins can pre-bake routing decisions and let CCM users focus on the message they want to land.

After Create ticket succeeds, the originating control detail panel surfaces a **Linked Jira issues** section listing every ticket created from that control, each with a **View in Jira** external link.

See the [Create a Jira ticket from a failing CCM control test](/integrations/data-out/create-ticket-from-ccm.md) guide for the full round-trip.

## Per-instance Jobs table

Every outbound delivery for an instance is recorded on the instance's detail page (`Data out > Instances > {Workflow name}`) with **Job ID**, **Status**, **Started**, **Completed**, and **Error message** columns. The same page surfaces lifetime success and failure counts so admins can spot a degraded instance at a glance.

See the [Manage instances - Per-instance Jobs table](/integrations/data-out/manage-instances.md#per-instance-jobs-table) guide for the full reference.

## Permissions

Data Out 1.0 is admin-first by design:

-   **Connections** and **Instances** tabs require the **full admin** role
-   The **Create ticket** modal in CCM is available to any user who can open the control detail panel - but if no Active workflow exists, non-admins see "Ask an admin to set up a data-out ticketing workflow."
-   **View in Jira** links inherit the user's existing Jira project permissions in Atlassian

## Getting started

If you are a workspace admin setting up Data Out for the first time:

1.  Read the [Data Out overview](/integrations/data-out/overview.md) to orient yourself
2.  Mint an API token and follow [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md)
3.  Continue into [Create an instance](/integrations/data-out/create-instance.md) and send a test ticket
4.  Tell your CCM users they can now click **Create ticket** on failing controls - link them to the [Create a ticket from CCM](/integrations/data-out/create-ticket-from-ccm.md) walkthrough

---

Source: /features/jupiterone-ai

# JupiterOne AI

JupiterOne AI brings artificial intelligence capabilities directly into the JupiterOne platform, helping you work faster and more effectively with your security data. Rather than requiring deep knowledge of query syntax or data models, you can interact with your asset graph using natural language.

## Capabilities

JupiterOne AI includes several capabilities designed to accelerate common security and IT workflows:

| Capability | Description |
| --- | --- |
| [AI Chatbot](/features/jupiterone-ai/ai-capabilities.md#ai-chatbot) | Ask questions about your security posture, assets, and compliance in natural conversation |
| [Natural language search](/features/jupiterone-ai/ai-capabilities.md#natural-language-search) | Convert plain English questions into J1QL queries |
| [AI Entity Summary](/features/jupiterone-ai/ai-capabilities.md#ai-entity-summary) | Get auto-generated, human-readable summaries of any entity in your graph |
| [AI Remediation Recommendations](/features/jupiterone-ai/ai-capabilities.md#ai-remediation-recommendations) | Receive step-by-step vulnerability remediation guidance tailored to your environment |
| [AI Control Authoring](/features/jupiterone-ai/ai-capabilities.md#ai-control-authoring) | Generate compliance control descriptions, remediation steps, and exception processes |

For detailed usage instructions and prompt tips for each capability, see the [capabilities guide](/features/jupiterone-ai/ai-capabilities.md).

## Security and privacy

JupiterOne AI is built with enterprise security requirements in mind. All AI processing occurs within JupiterOne's own AWS infrastructure.

### Model and infrastructure

JupiterOne AI is powered by **large language models developed by Anthropic**, accessed through **AWS Bedrock**. This means:

-   **Your data stays within JupiterOne's AWS account.** All requests to the AI model are routed through AWS Bedrock within JupiterOne's own AWS infrastructure. No customer data is sent to third-party AI providers or external endpoints.
-   **Your data is not used to train AI models.** AWS Bedrock does not use customer inputs or outputs to train, improve, or fine-tune foundation models. Your queries, data, and results remain private.
-   **Enterprise-grade security.** AWS Bedrock provides encryption in transit and at rest, and is covered by AWS compliance certifications including SOC 2, ISO 27001, and HIPAA eligibility.

### What data does JupiterOne AI access?

The data available to JupiterOne AI depends on which capability you are using:

-   **Natural language search:** JupiterOne AI uses your question along with knowledge of the JupiterOne data model and J1QL syntax to generate queries.
-   **AI Chatbot:** The chatbot can execute J1QL queries on your behalf and reason about the results. It has access to the same data your user account can access in JupiterOne.
-   **AI Entity Summary:** The AI receives the properties of the specific entity you are viewing to generate a summary.
-   **AI Remediation Recommendations:** The AI receives vulnerability details (CVE information, severity scores, affected asset metadata) to generate remediation steps.
-   **AI Control Authoring:** The AI receives the control context you provide to generate compliance documentation.
-   **Asset criticality:** The AI receives a summary of your environment—asset classes and types, property names and values, asset counts, and integration and account names—along with any policy text you provide, to propose criticality levels and the queries that fill them. See [Asset criticality](/features/assets/asset-criticality.md).

> **INFO**
> 
> JupiterOne AI does not have access to data outside of what is available in your JupiterOne account. It cannot access your source systems (such as AWS, GitHub, or Okta) directly — it only works with the data already ingested into JupiterOne.

## Frequently asked questions

**What large language model does JupiterOne AI use?**

JupiterOne AI uses various Anthropic large-language models, accessed through AWS Bedrock. Different capabilities use different model sizes optimized for their specific task — for example, entity summaries use a smaller, faster model while the chatbot and remediation recommendations use a more capable model.

**Is my data used to train AI models?**

No. AWS Bedrock does not use customer inputs or outputs to train or improve foundation models. Your data remains private and is never shared with model providers.

**Can JupiterOne AI build dashboards or create alert rules automatically?**

JupiterOne AI currently focuses on querying, analysis, and recommendations. It does not create or modify platform configurations such as dashboards, alert rules, or integrations. For automated platform interactions using AI tools, see the [JupiterOne MCP Server](/integrations/jupiterone-mcp-server.md).

**Who can use JupiterOne AI?**

JupiterOne AI capabilities are available to all users within your JupiterOne account. Access to specific capabilities may vary based on your account plan and feature availability.

**Can JupiterOne AI be disabled for my account?**

Yes. If your organization requires that AI features be disabled, contact your JupiterOne account team to configure this setting for your account.

## Related topics

-   [JupiterOne AI capabilities](/features/jupiterone-ai/ai-capabilities.md)
-   [J1QL overview](/j1ql.md)
-   [JupiterOne MCP Server](/integrations/jupiterone-mcp-server.md)

---

Source: /features/jupiterone-ai/ai-capabilities

# JupiterOne AI capabilities

JupiterOne AI provides several capabilities that help you work with your security data more efficiently. This page covers how to use each capability and provides tips for getting the best results.

## AI Chatbot

The AI Chatbot provides a conversational interface for interacting with your JupiterOne data. You can ask questions about your security posture, investigate assets, explore relationships, and get answers in natural language.

### Using the AI Chatbot

1.  Select **Ask AI** in the top right of the app.
2.  Enter your question in the chat input field.
3.  The chatbot processes your question, and may execute J1QL queries on your behalf to gather relevant data.
4.  Review the response, which includes both the answer and any queries that were run.

In supported views, the assistant is context-aware — when you have an entity open in the inspector or an active query result, it has context of what you're looking at and can link you directly to specific entities in its responses.

The chatbot maintains conversation context within a session, so you can ask follow-up questions without repeating background information.

> **NOTE**
> 
> Chat conversations are not persisted between sessions. If you close or navigate away from the chat, the conversation history is not retained.

### Example prompts

-   "What are my most critical unpatched vulnerabilities?"
-   "Show me all AWS S3 buckets that are publicly accessible"
-   "Which users have admin access to production environments?"
-   "How many new assets were added in the last 7 days?"
-   "What integrations are currently failing?"

> **TIP**
> 
> Be specific in your questions. Instead of "What is my security posture?" try "What are my open critical vulnerabilities that have been unpatched for more than 30 days?" The more context you provide, the more accurate the response.

### Providing feedback

Each chatbot response includes feedback options. Use these to indicate whether a response was helpful. Your feedback helps improve the accuracy of future responses.

---

## Natural language search

Natural language search converts your plain text questions into JupiterOne Query Language (J1QL), so you can find information without needing to know query syntax.

### Using natural language search

1.  Enter your question in the search bar. Any input that doesn't start with `FIND` defaults to AI mode.
2.  Press **Enter**.
3.  JupiterOne AI returns several query candidates based on your question — pick the one that best matches your intent.
4.  Review and edit the query if needed, then run it.

If you want to write J1QL directly, start your input with `FIND` and the search bar switches to J1QL mode with autocomplete.

![JupiterOne AI natural language search showing Ask AI in the search bar](/assets/images/ask-ai-searchbar-37db52f8c9df49bf5009f2a5eb23a11f.png)

### Example queries

| Natural language question | Generated J1QL |
| --- | --- |
| "What new S3 buckets were created in the last week?" | `FIND aws_s3_bucket WITH createdOn > date.now-7days` |
| "Show me all IAM users created in the last week" | `FIND aws_iam_user WITH createdOn > date.now-7days` |
| "Which EC2 instances are running without encryption?" | `FIND aws_instance THAT !USES aws_kms_key` |

> **NOTE**
> 
> Natural language search generates queries based on JupiterOne's data model. The generated query may not always match your exact intent — review and edit the query before running it for best results.

### Tips for better results

-   **Be specific about time ranges.** "Recently" is ambiguous — use "in the last 7 days" or "since January" instead.
-   **Use entity names when you know them.** "AWS S3 buckets" generates better results than "storage."
-   **Ask one question at a time.** Complex multi-part questions may not translate well into a single query.
-   **Review the generated query.** Edit the J1QL if the AI misinterpreted your intent before running it.

---

## AI Entity Summary

AI Entity Summary generates a human-readable explanation of any entity in your JupiterOne graph. Instead of reading through raw properties, you get a concise summary that highlights what the entity is and any noteworthy attributes.

### Using AI Entity Summary

1.  Navigate to any entity detail page in JupiterOne.
2.  The AI-generated summary appears automatically, providing a 50-100 word description of the entity.

The summary includes:

-   What the entity is and its role in your environment
-   Notable properties or configurations
-   Any unusual or noteworthy attributes that may require attention

### Example

For an AWS EC2 instance, the summary might read:

> This is a production Linux EC2 instance (t3.large) running in us-east-1a. It was launched 45 days ago and is currently running. The instance has a public IP address assigned and is associated with a security group that allows inbound SSH from 0.0.0.0/0, which may warrant review.

---

## AI Remediation Recommendations

AI Remediation Recommendations provide step-by-step guidance for resolving vulnerabilities identified in your environment. The recommendations are tailored to the specific vulnerability, affected assets, and the integration source that detected the issue.

### Using AI Remediation Recommendations

1.  Navigate to a vulnerability in JupiterOne.
2.  Remediation recommendations are generated automatically.
3.  Review the generated guidance, which includes:
    -   **Recommended actions** — numbered, actionable remediation steps
    -   **Vulnerability details** — CVSS score, EPSS percentile, exploit maturity
    -   **Affected assets** — grouped by type and source integration
    -   **Cautions** — safety warnings and testing recommendations

### What the recommendations include

AI Remediation Recommendations are context-aware and vary based on how the vulnerability was detected:

-   **SBOM-sourced vulnerabilities:** Package manager commands (npm, pip, maven, apt, yum) with specific version upgrade targets
-   **AWS Inspector findings:** AWS Systems Manager Patch Manager procedures or OS-level patching commands
-   **Endpoint detection (CrowdStrike, Tenable, Qualys):** Standard OS update procedures and patch deployment guidance
-   **General vulnerabilities:** Vendor advisory monitoring, defense-in-depth measures, and compensating controls

> **WARNING**
> 
> Always test remediation steps in a non-production environment before applying them to production systems. Verify that the recommended actions are applicable to your specific configuration before proceeding.

### Tips for using remediation recommendations

-   **Check the affected asset list.** The recommendations are based on a sample of affected entities — verify applicability across your full environment.
-   **Review version-specific guidance.** When upgrade targets are provided, confirm the target version is compatible with your application dependencies.
-   **Use the urgency indicators.** Vulnerabilities with active exploits (KEV catalog, public exploits) should be prioritized.

---

## AI Control Authoring

AI Control Authoring helps you create and complete compliance control documentation. When authoring controls in JupiterOne, the AI can generate descriptions, remediation steps, and exception processes based on the control context you provide.

### Using AI Control Authoring

1.  Navigate to **Compliance** > **Controls**.
2.  Create or edit a control.
3.  Use the AI assist option to generate content for fields such as:
    -   **Control description** — a clear explanation of what the control requires
    -   **Remediation steps** — guidance for addressing control failures
    -   **Exception process** — documentation for handling exceptions to the control
4.  Review and edit the generated content before saving.

### Tips for control authoring

-   **Provide a clear control name and identifier.** The more context the AI has about the control's purpose, the better the generated content.
-   **Specify the framework context.** Indicate which compliance framework (SOC 2, ISO 27001, CIS) the control relates to for more relevant output.
-   **Review and customize.** AI-generated control content is a starting point — always review and adjust to match your organization's specific policies and terminology.

---

## General tips for working with JupiterOne AI

-   **Start simple, then refine.** Begin with straightforward questions and add detail as needed.
-   **Use JupiterOne terminology.** Refer to entities, classes, and types using JupiterOne's data model terminology for more accurate results. For example, use "aws\_instance" rather than "virtual machine."
-   **Provide context.** Include relevant details like time ranges, specific asset types, or severity levels.
-   **Iterate.** If the first response is not quite right, rephrase your question or provide additional context rather than starting over.

## Related topics

-   [JupiterOne AI overview](/features/jupiterone-ai.md)
-   [J1QL overview](/j1ql.md)
-   [JupiterOne MCP Server](/integrations/jupiterone-mcp-server.md)
-   [Compliance controls](/features/ccm/continuous-control-monitoring.md)

---

Source: /features/jupiterone-ai/whats-new-in-ai-assistant

# AI Assistant Release Notes

**Release date: October 2026**

The JupiterOne AI assistant is now part of every page. It sees the page you are on, so you can ask about what is in front of you without explaining it first. It answers questions about how JupiterOne works from the JupiterOne documentation, and it can take you to the page you need. Every page offers its own suggested questions, and the assistant can stay beside your work, move out of the way while it thinks, or open as a full page.

> **INFO**
> 
> **No.** The new assistant is on for every account. Select **Ask AI** at the top of any page to start.

## What is new in the AI assistant

| Feature | What it means for you |
| --- | --- |
| **Three ways to work** | Keep the assistant in a side panel beside the page and drag it to the width you want, tuck it away while it works and watch its progress on the **Ask AI** button, or open the conversation as a full page |
| **Sees your screen** | The assistant reads the page you are on, including the query behind it, the active filters, and the rows on screen, so you can ask "what am I looking at?" |
| **Suggested questions on every page** | A new conversation starts with three or four questions written for the page you are on |
| **Knows JupiterOne** | Questions about features, concepts, and how JupiterOne unifies your data are answered from the JupiterOne documentation |
| **Takes you there** | Ask for a page, and the assistant opens it. On the page you are on, it can apply a filter or sort for you |
| **Feedback on every response** | Rate any finished response, and add a comment that tells us what to fix |
| **Download chat** | Save the conversation as a Markdown file with **Download chat** under the latest answer |

## Three ways to work

The assistant keeps one conversation, and you choose where it shows:

-   **Side panel.** Select **Ask AI** to open the assistant beside the page. The page stays usable while you talk to the assistant.
-   **Tucked away.** Select **X**, or drag the panel's left edge to the right past its narrowest width, to tuck the assistant away while it works. The **Ask AI** button shows what the assistant is doing as it happens, then reads **View response** when the answer is ready. Select it to open the panel on the answer.
-   **Full page.** Select **Open as page**, or drag the panel's left edge to the left past its widest width, to give the conversation the whole page. Select **Return to side panel** to bring it back beside your work.

Drag the panel's left edge to make the side panel wider or narrower. The conversation moves between these views as it is. Nothing restarts.

## The assistant sees your screen

The assistant knows which page you are on and what it shows: the page's title, the J1QL query behind the view, the filters you applied, and a sample of the rows on screen. Ask about what you see in your own words:

-   "What am I looking at?"
-   "Why is this control failing?"
-   "Which of these assets should I look at first?"

On an entity, **Explain this entity** gives you a plain-language summary of the entity you have open.

## Suggested questions on every page

Every page starts a new conversation with suggested questions. The assistant writes three or four questions for each page from what that page shows, so the suggestions are ones it can help with there. Select a suggestion to start, or type your own question.

## Ask how JupiterOne works

The assistant answers product questions from the [JupiterOne documentation](https://docs.jupiterone.io), so its answers follow how JupiterOne actually works. Ask it to explain a feature, a concept, or the mechanics behind what you see:

-   "How does JupiterOne unify devices that come from several integrations?"
-   "What is the difference between a rule and an alert?"
-   "How do I set up an integration for my AWS organization?"

## The assistant takes you there

Ask the assistant to take you somewhere, and it opens the page. When the page you want is the one you are on, it can apply a filter or sort for you instead. You can also press **⌘K** (**Ctrl+K** on Windows and Linux) and type a page's name to go there directly.

-   "Take me to my failing controls."
-   "Open the integrations page."
-   "Show only the critical findings on this page."

## Feedback on every response

Every finished response shows a thumbs up and a thumbs down. Select one to rate the response, and add a comment if you want to tell us what worked or what went wrong. Your feedback goes straight to the team building the assistant.

## What data the assistant uses

The assistant uses three sources:

-   **The page on your screen:** the page's title, the query behind the view, the filters you applied, and a limited sample of the rows on screen.
-   **The JupiterOne documentation:** the public pages at [docs.jupiterone.io](https://docs.jupiterone.io).
-   **Your conversation:** the questions you ask and the answers in the same conversation.

The assistant sees only what your user account can see in JupiterOne. For how JupiterOne AI processes your data, see [Security and privacy](/features/jupiterone-ai.md#security-and-privacy).

## Getting started

1.  Select **Ask AI** at the top of any page
2.  Select one of the suggested questions, or ask your own question about the page you are on
3.  Select **Open as page** for more room, or **Collapse assistant** to keep working while it answers
4.  Rate the response with the thumbs up or thumbs down

For the full list of JupiterOne AI capabilities, see [JupiterOne AI capabilities](/features/jupiterone-ai/ai-capabilities.md).

---

Source: /features/vulnerability-management

# Unified Vulnerability Management

JupiterOne Unified Vulnerability Management (UVM) takes the raw output of every vulnerability scanner you run and turns it into a short list of remediation plans, routed to the right team. You see one row per vulnerability per asset across all sources, you prioritize using a risk score you control, and you act on plans rather than triaging a million findings.

UVM is also the system of record for what happens next. Every vulnerability on every asset carries a [lifecycle state](/features/vulnerability-management/vulnerability-lifecycle.md) — open, awaiting verification, fixed, mitigated, exempted — tracked in one place across all of your scanners, verified against scanner evidence, and synchronized with Jira in both directions.

UVM is designed for security analysts who triage findings, security leaders who need a defensible prioritization model, and the service owners who actually apply the fixes.

## Overview

Unified Vulnerability Management enables your team to:

-   **Deduplicate vulnerability findings** across infrastructure scanners, cloud-native tools, and endpoint platforms into a single row per vulnerability per asset
-   **Prioritize using a transparent, layered risk score** that combines technical impact and exploitation likelihood with asset context and control evidence, with a model and threshold you configure
-   **Group prioritized vulnerabilities into remediation plans** that share a common fix, so your teams act on dozens of plans instead of thousands of CVEs
-   **Route cases to the team that owns the affected assets** through organizational unit ownership, with AI-generated remediation context attached
-   **Track the lifecycle of every vulnerability per asset** — claim fixes and have scanners verify them, record false positives, and see every state change on an attributed timeline
-   **Manage exemptions with expiry dates** — accept risk or mark vulnerabilities non-exploitable with a justification, and review each exemption when it expires instead of losing track of it
-   **Synchronize with Jira in both directions** — ticket closures propose lifecycle states in JupiterOne, and case progress writes back to the ticket
-   **Report remediation outcomes to leadership** from an executive dashboard built on daily snapshots
-   **Ask the AI assistant** to sort, filter, and navigate the UVM views in natural language

![Unified Vulnerability Management landing page with summary metrics, the prioritization funnel, and the vulnerabilities table](/assets/images/uvm-overview-c2c88797961777540d91d71a6276a624.png)

The summary header on every UVM page shows:

-   **Overall risk score** — the average CVSS score across your prioritized vulnerabilities (0–10)
-   **Unresolved vulnerabilities** — total deduplicated vulnerabilities still open
-   **Critical findings** — count of critical-severity vulnerabilities, broken down by how many are prioritized and how many lack a plan
-   **Active remediation cases** — count of cases currently routed to your service teams

## The prioritization funnel

Every UVM view is a stage in a single funnel. You start with raw findings on the left and end with team-routed cases on the right. The Sankey diagram at the top of every UVM page shows the live shape of the funnel for your environment, including which scanners are contributing to each stage.

The four stages are:

| Stage | What it contains | What it answers |
| --- | --- | --- |
| **Source** | Raw findings, one row per scanner per asset per CVE | Which vulnerabilities did each tool report? |
| **Unified** | Deduplicated vulnerabilities, one row per CVE per asset, with all reporting sources rolled up | What is the real, unique set of vulnerabilities I have? |
| **Prioritized** | Unified vulnerabilities whose risk score exceeds your configured threshold | Which vulnerabilities should I work on first? |
| **Remediation plans** | Prioritized vulnerabilities grouped by a common fix, routed to owning teams as cases | What is the smallest set of actions that addresses the most risk? |

Each stage is a tab in the UVM navigation. You can click any node in the Sankey diagram to filter the underlying table to that segment of the funnel.

## Source vulnerabilities

The **Source** tab shows raw findings exactly as your scanners report them. One row exists for every (scanner, asset, CVE) tuple. This is the data ingestion layer of UVM — the same vulnerability seen by three scanners on one host appears as three rows here.

Use this view when you need to:

-   Audit which scanner reported a specific finding
-   Compare coverage between tools
-   Investigate why a finding does or does not appear in the Unified view

**Columns:** Vulnerability, CVE, Asset, Source, CVSS, Source severity, Age, Remediation plan.

**Filters:** Source (scanner integration), CVSS range, Severity, Age. The Search field matches against CVE identifier, vulnerability title, and asset name.

> **NOTE**
> 
> The **Source severity** column shows severity exactly as the reporting scanner rated it. The Unified and Prioritized views show a normalized severity derived from CVSS, so the same finding can carry different severities in the Source view and the unified views.

The **Remediation plan** column links each finding to the plan that addresses it, when one exists. Findings without a plan show an em dash.

## Unified vulnerabilities

The **Unified** tab is where deduplication happens. JupiterOne aligns vulnerability data from every configured scanner against a single ontology and collapses duplicate findings into one row per CVE per asset. The **Sources** column shows which scanners reported each finding.

![Unified Vulnerabilities tab showing deduplicated CVEs with EPSS, KEV indicators, and source attribution chips](/assets/images/unified-view-84d74b988a2e1c7fdc28c3ce754e0bba.png)

**Columns:** Vulnerability, CVE, Asset, Severity, CVSS, EPSS, KEV, Sources, State.

**Filters:** Severity, CVSS range, Source, Age, State.

The **State** column shows where each vulnerability stands in its [lifecycle](/features/vulnerability-management/vulnerability-lifecycle.md). By default the Unified and Prioritized views show your active work: vulnerabilities in closed states (Fixed, Mitigated, Accepted risk, Non-exploitable, and False positive) are hidden. Use the **State** filter to view them — closed vulnerabilities are archived by filter, not moved to a separate page.

### EPSS and KEV

The Unified view enriches every CVE with:

-   **EPSS** — The Exploit Prediction Scoring System probability, expressed as a percentage. This is the likelihood that the vulnerability will be exploited in the wild in the next 30 days, sourced from FIRST.org and updated weekly. The exact data refresh date is shown above the table.
-   **KEV** — A chip indicating that the CVE appears in CISA's Known Exploited Vulnerabilities catalog. KEV CVEs have confirmed in-the-wild exploitation.

> **TIP**
> 
> Sort by EPSS descending to see the vulnerabilities most likely to be exploited soon. Combine the **KEV** filter with the **Severity = Critical** filter for a focused view of CVEs that are both severe and actively exploited.

### Source attribution

Each row shows a chip for every scanner that reported the underlying finding. A CVE seen by CrowdStrike, SentinelOne, Tenable, and Wiz on the same host appears as one row in this view with four source chips. Click any row to inspect the underlying raw findings.

UVM ships with first-class support for the following scanner integrations:

-   CrowdStrike Falcon
-   Qualys VMDR
-   SentinelOne
-   Tenable.io
-   Wiz

Findings from Software Bill of Materials (SBOM) ingestion also appear as a source chip on affected assets.

## Prioritized vulnerabilities

The **Prioritized** tab shows the subset of unified vulnerabilities whose risk score exceeds the prioritization threshold you have configured. This is the working list for your security analyst.

![Prioritized Vulnerabilities tab showing CVEs with risk scores, owner teams, and context columns](/assets/images/prioritized-view-9193d2b4da359eb76c77e2728e339872.png)

**Columns:** CVE, Owner team, Asset, Risk, Severity, CVSS, EPSS, KEV, Context.

**Filters:** Team, Severity, CVSS, Context, Source, Age.

### What "prioritized" means

A vulnerability is prioritized when its **Risk** score meets the prioritization threshold — 90% by default. The **Risk** column shows scores on a 0–10 scale, so with the default threshold a vulnerability needs a score of at least 9.0 to appear here. You can adjust the scoring model and the threshold from the [Risk configuration](/features/vulnerability-management/risk-scoring.md) panel.

### Owner team

The **Owner team** column shows which organizational unit (OU) owns the affected asset. This drives where the case is routed when a remediation plan is created. OUs are configured once and shared across JupiterOne — see [Organizational Units](/features/admin/organizational-units.md) for how OUs are derived, how to set owner and routing metadata, and how to filter by OU.

### Context

The **Context** column surfaces asset-level signals that influenced the risk score, including the asset's [criticality level](/features/assets/asset-criticality.md) and whether it is reachable from the public internet.

## Remediation plans

The **Remediation plans** tab is where your team takes action. A plan groups multiple prioritized vulnerabilities that share a common fix — for example, all CVEs resolved by patching Apache ActiveMQ to 5.18.3.

![Remediation Plans tab with plan cards showing severity, case coverage, risk reduction, and CVEs covered](/assets/images/plans-view-1b626ddb8261d3b0ae509472d5b7fdcf.png)

Each plan card shows:

-   **Title** — A descriptive action statement (for example, "Upgrade Apache ActiveMQ to 5.18.3+ or 5.17.6+")
-   **Owner team** — The organizational unit responsible for the plan, or an em dash if no owner is assigned
-   **Severity** — The highest severity across the plan's CVEs
-   **Matched by product name** — How the plan was grouped. UVM groups vulnerabilities by Common Platform Enumeration (CPE), using the product name resolved from each finding.
-   **Case coverage** — Percentage of affected assets covered by a routable case
-   **Risk reduction** — The total risk score reduction your environment achieves when this plan is completed
-   **CVEs covered** — Number of unique CVEs addressed by this plan
-   **Highest CVSS** — The most severe CVSS score among the plan's CVEs

**Filters:** Severity, CVSS (sortable by Highest CVSS), Age.

Each plan card also lists its cases with their derived status. Use the **By plan** / **By case** pivot to switch the tab between plan cards and a flat list of cases, filterable by team and case status.

### Plan detail

Click any plan card to open the plan detail panel.

![Plan detail panel showing the AI-generated remediation summary, risk metrics, and affected assets](/assets/images/plan-detail-0030556e45780c0ab8d2556150532a95.png)

The plan detail panel provides:

-   **Remediation summary** — An AI-generated description of the vulnerability, its impact, and why the plan should be prioritized
-   **Plan metrics** — Risk reduction, CVEs covered, CVEs in KEV, Highest CVSS, Highest EPSS
-   **Stat tabs** — Counts and lists for **Assets**, **Cases**, and **CVEs** included in the plan
-   **AI remediation steps** — Step-by-step fix instructions generated for this specific plan
-   **Properties**, **Tags**, **Metadata**, and **Raw Data** tabs for the underlying graph entity

The plan persists as a graph entity in your JupiterOne account, so you can query plans with J1QL alongside the rest of your asset data.

## AI Assistant

The **Ask AI** button in the UVM header opens the AI Assistant sidebar. The assistant operates on the current UVM view and helps you sort, filter, and navigate without writing queries.

![AI Assistant sidebar with suggested prompts including &#39;Which plan should I start with for the most impact?&#39;](/assets/images/ai-assistant-5a82656fe545a7d1896dfc22ea9a30a3.png)

The assistant supports natural-language commands such as:

-   "Sort by EPSS descending"
-   "Filter to plans addressing critical vulnerabilities"
-   "Which plan should I start with for the most impact?"
-   "How are plans created, and what do confidence levels mean?"

When the assistant references a specific entity in its response, click the reference to open the entity inspector with full context.

> **NOTE**
> 
> The AI Assistant is in beta. Responses can occasionally be incorrect, and very large contexts can slow the response. JupiterOne does not use your workspace data to train its models.

## Getting started

### Step 1: Confirm your scanner integrations are configured

UVM aggregates findings from your configured integrations. From **Integrations**, confirm that at least one of the following is configured and syncing:

-   CrowdStrike Falcon
-   Qualys VMDR
-   SentinelOne
-   Tenable.io
-   Wiz

You can see how many findings each scanner is contributing by hovering any source node in the Sankey diagram on the UVM landing page.

### Step 2: Set up asset criticality

Asset criticality is a major lever in the risk score. To make sure your most important assets surface near the top of the Prioritized view:

1.  Navigate to **Assets > Asset criticality**
2.  Select **Set up for me** to have the agent propose criticality levels and the queries that fill them, or **Start from our policy** to build them from your classification policy
3.  Review the proposal, then click **Preview changes** and **Apply setup**

Your levels apply on the next hourly run. See [Asset criticality](/features/assets/asset-criticality.md) for the full setup and review flow.

### Step 3: Set your scoring model and prioritization threshold

1.  Open the **Risk configuration** panel by selecting the edit (pencil) icon on the Overall risk score card
2.  Review the layered scoring defaults: the threat blend of technical impact and exploitation likelihood, the KEV floor, and the context multipliers for your asset criticality levels and publicly exposed assets
3.  Adjust the model to match your organization's risk priorities. For example, raise the multipliers for your most critical levels if asset criticality should dominate, or enable the controls layer once your CCM controls carry MITRE ATT&CK technique mappings.
4.  Set the **Prioritization threshold**. A lower threshold widens the Prioritized view; a higher threshold tightens it.
5.  Click **Apply changes**

### Step 4: Confirm case routing is configured

1.  From the Risk configuration panel, select the **Cases — Ownership assignment** namespace you use for team routing
2.  Confirm each organizational unit in that namespace has an owner email and ticketing workflow configured
3.  Open the **Plans** tab and confirm that plans show owner teams (rather than em dashes) on the cards you intend to route

### Step 5: Configure the Jira status mapping

1.  For each Jira project and issue type you route cases to, map case statuses to Jira statuses and resolutions, and Jira resolutions to lifecycle states
2.  Verify each mapping with one test round trip — see [Configure the status mapping](/features/vulnerability-management/cases-and-jira.md#configure-the-status-mapping) for why this step matters
3.  Confirm the analysts who will manage the lifecycle have graph-write permission — state transitions require it

### Step 6: Create your first tickets

1.  Open the **Plans** tab and sort by **Highest CVSS** or **Risk reduction**
2.  Open the highest-priority plan
3.  Review the AI-generated remediation summary and steps
4.  Confirm the affected assets and the owning teams
5.  Create tickets for the plan's cases — UVM has already partitioned the assets by owning team, one case per team

### Step 7: Adopt the lifecycle

1.  Have remediation owners select **Mark remediated** after applying a fix (or close the Jira ticket as Patched) so every fix goes through verification
2.  Record risk acceptances and false positives as [lifecycle states](/features/vulnerability-management/vulnerability-lifecycle.md) with justifications, instead of closing tickets around them
3.  Make the **Inbox** part of your team's weekly routine — verification confirmations, expiring exemptions, and ticket disagreements all wait there

### Step 8: Monitor progress

-   The **Active remediation cases** count on the summary header tracks open cases
-   The **Critical findings** card shows how many critical-severity vulnerabilities lack a plan
-   Open the Plans tab regularly to review case coverage and apply new plans as new vulnerabilities surface
-   Open the [Executive dashboard](/features/vulnerability-management/executive-dashboard.md) to baseline time to remediate, reopens by fix confidence, and accepted risk once your first snapshots accrue

## Best practices

### Start narrow, then widen

Begin with the default risk configuration and a small top criticality level. Work through the top-of-funnel plans for those assets before widening your most critical levels or lowering the prioritization threshold. This produces a manageable Prioritized list and gives your team a clear early win.

### Use plans, not individual findings

The Plans view is the right working list for most teams. A plan represents the smallest action that addresses the most risk, and one case routed to one team replaces dozens of duplicate tickets across owners. Investigate individual findings only when a plan is unclear or when you need to audit a specific scanner result.

### Tune the model, not the threshold

The fastest way to change which vulnerabilities surface as prioritized is to adjust the scoring model, not the threshold. Raising the exploitation likelihood weight in the threat layer favors in-the-wild exploitation; raising the multipliers for your most critical levels favors business-critical assets. The threshold should change only when you want to widen or tighten the size of the Prioritized view.

### Watch the Sankey diagram

The Sankey diagram at the top of every UVM page is your fastest signal that something is wrong upstream. Sudden drops in source contributions, missing scanners, or unusually wide gaps between Unified and Prioritized stages usually point to integration or configuration issues rather than vulnerability changes.

### Claim fixes so they verify

Prefer **Mark remediated** (or closing the ticket as Patched) over **Mark fixed**. Claimed fixes come back scanner-confirmed; closes without a standing claim are recorded as assumed, and any fixed vulnerability that genuinely disappeared and then returns reopens automatically. The **Reopens by fix confidence** panel on the executive dashboard will show you which habit your team has.

### Record exemptions in JupiterOne, not in tickets

When a vulnerability will not be remediated (accepted risk, non-exploitable, false positive), record it as a [lifecycle state](/features/vulnerability-management/vulnerability-lifecycle.md) with its justification rather than closing a ticket around it. Exemptions in JupiterOne carry an approver and an expiry date, survive rescans, and come back for review when they lapse — a note in a closed ticket does none of that.

### Work the Inbox, not the whole list

The Inbox holds everything that actually needs a human decision: fixes ready to confirm, claims that did not hold, exemptions coming due, and ticket disagreements. A short weekly pass through the Inbox keeps the lifecycle honest without anyone re-triaging the full vulnerability list.

## Related topics

-   [What's new in UVM 2.0](/features/vulnerability-management/uvm-2-0.md)
-   [The vulnerability lifecycle](/features/vulnerability-management/vulnerability-lifecycle.md)
-   [Risk scoring](/features/vulnerability-management/risk-scoring.md)
-   [Cases and Jira sync](/features/vulnerability-management/cases-and-jira.md)
-   [Executive dashboard](/features/vulnerability-management/executive-dashboard.md)
-   [Permissions](/features/vulnerability-management/permissions.md)
-   [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md)
-   [Smart classes](/features/assets/smart-classes.md)
-   [JupiterOne AI](/features/jupiterone-ai.md)

---

Source: /features/vulnerability-management/cases-and-jira

# Cases and Jira sync

A remediation **case** is a unit of work scoped to a single owning team. UVM generates cases automatically: each plan's affected assets are partitioned by their owning organizational unit, producing one case per unit — plus an Unassigned case for assets with no owning unit. What you create is the Jira ticket for a case. Each case carries:

-   The plan's AI-generated remediation summary and step-by-step instructions
-   The list of affected assets in that unit's scope
-   The risk reduction the team will deliver by completing the case

Tickets are created and updated through [Data Out](/integrations/data-out/overview.md), JupiterOne's outbound integration surface — not through the inbound Jira integration you may use to ingest projects. Each [organizational unit](/features/admin/organizational-units.md)'s routing configuration names its owner and its ticketing workflow, and that workflow instance determines the Jira project and issue type the team's tickets land in.

## Case status is derived, never set

A case reflects the lifecycle states of its constituent vulnerabilities — you never set a case status directly. Work the vulnerabilities, or work the ticket, and the case follows:

| Case status | When |
| --- | --- |
| **Open** | At least one constituent vulnerability is Open, or the constituents are in a mix of states |
| **Awaiting verification** | Every constituent vulnerability is Awaiting verification |
| **Resolved** | Every constituent vulnerability is closed |

When a case's vulnerabilities share an outcome, a closure reason is derived from it: a case whose vulnerabilities are all awaiting verification reads as Patched, and a resolved case derives Compensating control in place, Accepted risk, or False positive. Vulnerabilities resolved as Fixed or Non-exploitable, or a mix of resolutions, yield no closure reason — which matters for the outbound sync below.

## Jira sync, in both directions

**Outbound — case to ticket.** Case progress updates the linked Jira ticket. An open case keeps the ticket in progress, and a case that moves to awaiting verification adds a comment rather than transitioning the ticket, because the fix is not yet confirmed. A resolved case transitions the ticket to done with the matching resolution when it has a closure reason — Accepted risk, Compensating control in place, or False positive. A case resolved by fixes, or with mixed resolutions, instead posts a comment asking the assignee to close the ticket: an automatic close with no resolution would echo back through the inbound mapping and reopen the case. A case that reopens from resolved transitions the ticket back to in progress.

**Inbound — ticket to lifecycle states.** When a linked ticket closes in Jira, its resolution translates into a proposed transition for the case's constituent vulnerabilities:

| Jira resolution | Proposed lifecycle state |
| --- | --- |
| Fixed, Patched, or Done | **Awaiting verification** — the close is a claim, and the vulnerabilities close as Fixed when scanners confirm |
| Won't Do or Accepted Risk | **Accepted risk**, with a 90-day expiry |
| Not Exploitable | **Non-exploitable**, with a 180-day expiry |
| False Positive | **False positive** |
| Mitigated | No change — a mitigation requires a linked control, which a ticket cannot name. When the vulnerability already carries a stored decision, the conflict is flagged in the Inbox. |
| Any unmapped resolution | No change — the closure is ignored until you add the resolution to the status mapping |

Ticket closures never override a decision a person made in JupiterOne. A conflicting closure is refused and surfaces as a [Ticket disagreement](/features/vulnerability-management/vulnerability-lifecycle.md#the-inbox) in the Inbox, and reopening a ticket only withdraws a claim the ticket itself made — it never revokes a settled decision.

## Set up the sync

The sync is delivered by Data Out workflow instances, so setup spans a few surfaces. Work through them in this order:

1.  **Create a Jira connection.** From **Integrations** > **Data Out** > **Connections**, authorize your Jira workspace with an Atlassian site, account email, and API token. See [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md).
2.  **Create a workflow instance for each Jira project and issue type** your cases route to. The instance is what actually writes and updates tickets — creating a ticket for a case requires selecting an instance, so no instance means no ticket. See [Create an instance](/integrations/data-out/create-instance.md).
3.  **Confirm case routing.** Each [organizational unit](/features/admin/organizational-units.md) needs an owner and a ticketing workflow in its routing configuration — the selected workflow instance determines which Jira project and issue type the team's tickets land in.
4.  **Configure the status mapping** for each project and issue type (below).
5.  **Verify with a test round trip** before relying on the sync — see the warning below, and [Test an instance](/integrations/data-out/test-instance.md).

## Configure the status mapping

You configure the mapping between case statuses, Jira statuses, and Jira resolutions per Jira project and issue type, so the sync speaks each project's workflow. Both directions are covered by the same mapping: which Jira status and resolution each case status writes outbound, and which lifecycle state each Jira resolution proposes inbound.

> **WARNING**
> 
> JupiterOne cannot validate your Jira workflow at configuration time. If a mapped transition is not allowed in the target project's workflow, the update fails silently on the Jira side — the ticket stays put while the case in JupiterOne moves on. After configuring a mapping, verify it with one test round trip: create a case, resolve its vulnerabilities, confirm the ticket transitions with the expected resolution, then close a ticket in Jira and confirm the proposed state appears in JupiterOne.

## Troubleshoot sync failures

When a ticket did not appear, did not transition, or a closure did not reach JupiterOne:

-   **Check the instance's Jobs table first.** Every outbound delivery is recorded on the Data Out instance's detail page with status, timestamps, and per-job error messages. See [Troubleshooting Data Out](/integrations/data-out/troubleshooting.md).
-   **A resolved case whose ticket stayed open** is often by design: a case resolved by fixes posts a comment asking the assignee to close the ticket rather than transitioning it (see the outbound direction above).
-   **A ticket that will not transition** usually means the mapped Jira status is not reachable from the ticket's current status in that project's workflow — fix the mapping or the Jira workflow, then re-test.
-   **A closure that made no state change** may be an unmapped resolution (ignored until you add it to the status mapping for that project and issue type) or a conflict with a decision made in JupiterOne (surfaces as a Ticket disagreement in the [Inbox](/features/vulnerability-management/vulnerability-lifecycle.md#the-inbox) when the vulnerability carries a stored decision).

---

Source: /features/vulnerability-management/emerging-threats

# Emerging threats

EARLY ACCESS

Emerging threats answers a narrow question: of everything happening in the vulnerability landscape right now, what changed recently enough to deserve your attention today?

> **NOTE**
> 
> Emerging threats is rolling out progressively and is not yet enabled for every account. If you do not see it under Vulnerability Management, contact your JupiterOne account team.

It is a threat intelligence view, not an inventory view. Nothing on it is scoped to your environment — it reports on the CVE itself, drawing on public and commercial threat intelligence sources. Use it to decide whether a CVE is worth reacting to, then use [Unified Vulnerability Management](/features/vulnerability-management.md) to find out whether you are affected.

The view has two screens:

-   **The emerging threats list** — up to ten CVEs currently trending, ranked. The card is headed **Top 10 emerging threats**.
-   **The threat brief** — a full assessment of a single CVE. Open one from the list, or search for any CVE by identifier.

## The emerging threats list

The list shows threats that recently **got worse**. It is not the most severe CVEs, and it is not the newest ones.

### How trending is ranked

Ranking blends how recently a CVE crossed an escalation threshold with how dangerous it is, and lifts anything under confirmed active exploitation.

The escalation thresholds are:

| Escalation | What it means |
| --- | --- |
| **Public exploit** | Working proof-of-concept exploit code became publicly available |
| **Weaponized** | A reliable, packaged exploit exists — no longer just a proof of concept |
| **Exploited in the wild** | Exploitation against real targets has been confirmed |
| **Added to KEV** | The CVE was added to CISA's or VulnCheck's Known Exploited Vulnerabilities catalog |

Because the rank keys on _transitions_ rather than on state, the list behaves differently from a severity-sorted feed:

-   A CVE that has been exploited steadily for years drops off — nothing about it changed this week.
-   An old, unremarkable CVE that picks up its first ransomware campaign today surfaces to the top.

Recency is one input to the rank, not the sort order. You cannot re-sort the list, and rows are always shown in the engine's ranked order.

### What each row tells you

Every row carries its own labels, so nothing on the list depends on a legend:

-   The **CVE identifier** and, where a CPE record identifies one, the affected vendor and product.
-   The **escalations it has reached**, as chips. A chip you do not see means that escalation has not happened, or is not recorded.
-   **No scanner coverage**, when no commercial scanner ships a check for the CVE. See [Scanner coverage gaps](#scanner-coverage-gaps).
-   **Why it ranked** — the escalation that drove it onto the list, and how many days ago that happened. A CVE that ranked without a recent escalation says so.
-   Its **threat tier**.

## Threat tiers

Every ranked CVE and every brief carries one of four tiers. The tier is a stance on the whole CVE, and it is the same value in both places.

| Tier | Read it as |
| --- | --- |
| **Act now** | Confirmed, dangerous, and moving. Treat as time-sensitive. |
| **Elevated** | Escalating and worth planning around, but not an emergency today. |
| **Monitor** | Nothing yet demands action. Keep it in view. |
| **Low** | No meaningful exploitation signal. |

## The threat brief

A brief opens with the verdict: the tier, a headline judgement, and a short narrative translating the intelligence into a decision. When automatable exploitation is a factor — meaning the exploit lends itself to mass, unattended use — the brief calls that out as a separate note, because it amplifies impact without changing the tier.

Below the verdict sit four reference metrics:

| Metric | What it reports |
| --- | --- |
| **CVSS base score** | The published severity score and rating |
| **EPSS percentile** | How this CVE's exploitation probability ranks against every other scored CVE. This is the percentile, not the probability itself. |
| **Exploit maturity** | None known, proof of concept, commercial, or weaponized |
| **KEV** | Whether the CVE appears in CISA KEV or VulnCheck KEV |

A metric with no published value reads **Not scored**. The brief never substitutes a guess for a missing number.

### Brief sections

The rest of the brief is organized into eight sections.

**Remediation guidance** — how urgently to remediate, scored on CISA's four Stakeholder-Specific Vulnerability Categorization (SSVC) decision points. The resulting timeline is CISA's benchmark from Binding Operational Directive 26-04 (June 2026): binding for federal civilian agencies, and a useful yardstick for everyone else. Where the timeline depends on whether the affected asset is internet-facing, both branches are shown so you can pick the one that describes your deployment. When two intelligence sources disagree about a decision point, the disagreement is surfaced on the row it affects rather than resolved silently.

**Exploitation timeline** — how the threat matured, and how quickly defenders responded. The stages are disclosure, scanner checks shipping, public proof of concept, weaponized exploit, in-the-wild exploitation, and KEV listing. A filled dot happened; an outlined one has not. The stages are in a fixed order, so dates can legitimately read out of order — a CVE exploited in the wild before any scanner check shipped is common, not an error. A stage can also be marked as happened with an unknown date.

**What it is** — the published description, its CWE weakness classification, and a summary of the affected product and version footprint.

**Who is using it** — exploitation activity broken out by actor class: threat actors, ransomware, botnets, and public exploit repositories. Each class reports how much activity was observed, and — for threat actors, ransomware, and botnets — when it was first and most recently seen. Where named detail exists, you can open it in a side panel: specific actors with attribution country, ransomware families, botnets, and the exploit repositories themselves.

**Can the ecosystem see it** — per-scanner coverage: whether a check exists for this CVE and when it shipped. A patch and an EPSS score are useless if your scanner has no check.

**Fix and mitigation** — published patch and mitigation references.

**Detection and investigation** — whether detection tooling covers the CVE, and how it maps to detection frameworks and controls. If a public exploit needs no credentials and no user interaction, this section says so prominently.

**Sources and provenance** — when the brief was assessed, which sources were consulted, the underlying references, and source attribution.

Sections with no data available say so explicitly. An absent section is an absence of published intelligence, not an absence of risk.

## Scanner coverage gaps

A **no scanner coverage** flag means no commercial scanner ships a check for that CVE. This matters more than it first appears: if no check exists, the CVE will not appear in your scan results whether or not you are affected. A clean scan is not evidence of absence.

Two things to know about how the flag is derived:

-   It is computed from commercial scanners only. An open-source tool may well have a check for a CVE that is flagged as uncovered.
-   The absence of the flag is not a promise of coverage — it only means there is no known commercial blind spot.

## Data freshness

The two screens are refreshed differently, on purpose:

-   **The list** is a snapshot, refreshed periodically rather than live. The header carries an "as of" timestamp so you always know how current the ranking is.
-   **A brief** is assessed when you open it, because freshness is the whole point of an emerging threat. The assessment time appears in the brief's **Sources and provenance** section.

---

Source: /features/vulnerability-management/executive-dashboard

# Executive dashboard

The **Executive dashboard** reports remediation outcomes over time. It is built on daily snapshots of your environment, so leadership sees progress — not a live list of findings. Panels include:

-   **Open vulnerabilities over time** — the trend of your active exposure
-   **Current exposure by severity**
-   **Time to remediate by OU** — median days per organizational unit, reported as two separate measures (see below)
-   **Reopens by fix confidence** — confirmed-fix regressions and assumed-fix reopens, separately
-   **Accepted risk over time** and **Accepted risk by OU** — the exposure your business is explicitly carrying
-   **Open exposure by OU**

Charts support drill-downs, organizational unit and time window filters, and CSV download. The **Historical trends** and **Historical records** views are point-in-time records from the daily snapshots. Rows in Historical records open the live entity inspector where the snapshot captured the entity identifier, but the values in the row remain what was true on the snapshot date. Panels populate as snapshots accrue, so a newly enabled account fills in over its first days.

## Time to remediate is two numbers, on purpose

The dashboard never blends remediation speed into a single headline:

-   **Verified** — from first observation to a scanner-confirmed fix. This is the audit-grade remediation clock, and claiming a fix does not stop it — only verification does.
-   **Disposition** — from first observation to any closed state, including exemptions and false positives. This measures decision velocity.

Reported together, the two numbers keep an uncomfortable question answerable: are we fixing vulnerabilities, or closing them? The **Reopens by fix confidence** panel is the check on the same discipline — assumed fixes that keep coming back are visible as exactly that.

---

Source: /features/vulnerability-management/permissions

# Permissions

Access to Unified Vulnerability Management is governed by the [App Level Permissions](/features/admin/access-controls.md#app-level-permissions) layer of JupiterOne's [role-based access control](/features/admin/access-controls.md) system. Two permissions decide whether a user can open UVM at all, and a small set of additional permissions decides what that user can change once inside.

## Opening UVM requires two permissions

Reaching the vulnerability pages is not a single permission. A user needs **both** of the following.

**1\. Permission to open the app** — any one of:

| Permissions grid row | Level | Permission string |
| --- | --- | --- |
| **Vulnerabilities** | Read-only | `accessVulnerabilities` |
| **Vulnerabilities** | Admin | `adminVulnerabilities` |
| **Full Admin Access** | Read-only | `fullReadAccess` |
| **Full Admin Access** | Admin | `accessAdmin` |

**2\. Permission to read graph data** — any one of:

| Permissions grid row | Level | Permission string |
| --- | --- | --- |
| **Shared: Graph Data** | Read | `readGraph` |
| **Full Admin Access** | Read-only | `fullReadAccess` |
| **Full Admin Access** | Admin | `accessAdmin` |

The vulnerability screens are built almost entirely from graph queries. A user who holds **Vulnerabilities** access but no graph read permission reaches the pages and sees empty tables, because the permission controls the door and graph read controls the data behind it.

> **NOTE**
> 
> Your account also needs the Unified Vulnerability Management entitlement. If **Vulnerabilities** does not appear in the navigation for a user who holds the permissions above, confirm the entitlement with your JupiterOne representative.

## What each action requires

Every action below also requires app access and graph read, described above. The permissions listed here are what each action needs in addition.

| Action | Additional permissions required |
| --- | --- |
| View vulnerabilities, remediation plans, the executive dashboard, and emerging threats | None — app access and graph read are enough |
| Change a vulnerability's [lifecycle state](/features/vulnerability-management/vulnerability-lifecycle.md), individually or in bulk | **Full Admin Access: Admin**, or both **Vulnerabilities: Admin** and **Shared: Graph Data: Write** |
| Edit the [risk configuration](/features/vulnerability-management/risk-scoring.md) — scoring weights and plan priority thresholds | **Vulnerabilities: Admin** or **Full Admin Access: Admin** |
| Edit the [Jira status mapping](/features/vulnerability-management/cases-and-jira.md) | **Vulnerabilities: Admin** or **Full Admin Access: Admin** |
| Rebuild remediation plans on demand, or bulk-delete plans | **Vulnerabilities: Admin** or **Full Admin Access: Admin** |
| Create a Jira ticket from a remediation case | **Vulnerabilities: Admin** or **Full Admin Access: Admin** |
| Create a Jira ticket from a compliance control | **Full Admin Access: Admin** |

Two of these deserve elaboration:

-   **Lifecycle changes need both halves.** Changing a vulnerability's state writes to the graph, so a vulnerability admin without graph write sees the status controls disabled. Graph write on its own does not confer authority over vulnerability decisions either. Users who triage vulnerabilities need **Vulnerabilities: Admin** and **Shared: Graph Data: Write** together.
-   **Ticket creation is scoped to remediation cases.** A vulnerability admin can create the Jira ticket for a remediation case, and needs no **Shared: Graph Data: Write** to do it — unlike a lifecycle change, which records the vulnerability's new state in the graph. The permission reaches no further: ticketing a compliance control still requires **Full Admin Access: Admin**, and so does configuring Data Out itself — creating, editing, enabling, disabling, or deleting a ticketing workflow instance, and managing the Jira and ServiceNow connections behind it. A vulnerability admin can send a case's ticket but cannot change where it goes. **Vulnerabilities: Read-only** cannot create tickets at all; a read-only user sees the ticketing workflows configured for the account, but creating a ticket is a write.

Read access to configuration is deliberately broader than write access. Anyone who can open UVM can read the risk configuration and the Jira status mapping — the risk configuration opens as a read-only view with a banner, and the status mapping page hides its **Save** and **Restore defaults** controls rather than disabling them.

## Granting the permissions

The two vulnerability permissions appear as the **Vulnerabilities** row in the App Access section of the permissions grid, in the same read-only and admin pair as every other JupiterOne app. Only an account administrator can grant them.

1.  Navigate to **Settings > User groups**
2.  Select the group you want to edit
3.  In the App Level Permissions section, set the level on the **Vulnerabilities** row
4.  On the **Shared: Graph Data** row, set **Read** for users who view vulnerabilities, or **Write** for users who change vulnerability states
5.  Select **Save group**

Grant **Vulnerabilities: Read-only** to users who need to browse vulnerabilities, plans, and dashboards. Grant **Vulnerabilities: Admin** to users who also act on vulnerabilities, and pair it with **Shared: Graph Data: Write** so that lifecycle changes succeed.

> **NOTE**
> 
> Permissions are evaluated at login. A user whose group permissions change needs to sign out and sign back in before the change takes effect.

Granting the vulnerability permissions takes nothing away from existing administrators. Anyone with **Full Admin Access: Admin** retains every UVM action.

## Troubleshooting

| Symptom | Cause | Resolution |
| --- | --- | --- |
| **Vulnerabilities** appears in the navigation, but every table is empty | The user holds a vulnerability permission but no graph read permission | Add **Shared: Graph Data: Read** (or **Full Admin Access: Read-only**) to the group |
| **Vulnerabilities** does not appear in the navigation at all | The account lacks the UVM entitlement, or the user holds none of the four permissions that open the app | Confirm the entitlement, then add **Vulnerabilities: Read-only** along with a graph read permission |
| The lifecycle status controls are disabled when vulnerabilities are selected | The user holds **Vulnerabilities: Admin** but not **Shared: Graph Data: Write** | Add **Shared: Graph Data: Write**. Hovering the disabled control shows a tooltip naming what is missing |
| The Jira status mapping page has no **Save** button | Working as designed — the controls are hidden, not disabled, without **Vulnerabilities: Admin** or **Full Admin Access: Admin** | Add **Vulnerabilities: Admin** |
| **Assets > Asset criticality** shows **Access denied** | Asset criticality is part of the Assets app, so **Vulnerabilities: Admin** does not grant it. It requires **Assets: Admin** with **Shared: Graph Data: Read**, or **Full Admin Access: Admin**, even to view | Set the **Assets** row to Admin, then have the user sign out and sign back in |
| The risk configuration opens, but every field is locked | Working as designed — it is a read-only view for anyone without **Vulnerabilities: Admin** | Add **Vulnerabilities: Admin** |
| A group permission changed, but the user sees no difference | The user has not signed out since the change, or only one of the two required halves was granted | Confirm both the **Vulnerabilities** and **Shared: Graph Data** levels, then have the user sign out and sign back in |
| A user can change vulnerability states but cannot create a ticket for a case | The user holds **Vulnerabilities: Read-only** rather than **Vulnerabilities: Admin**, or has not signed out since the level changed | Set the **Vulnerabilities** row to Admin, then have the user sign out and sign back in |
| A vulnerability admin can ticket a remediation case but not a compliance control | Expected — ticketing a compliance control requires **Full Admin Access: Admin** | No group-level change grants control ticketing to a vulnerability admin today |
| Ticket creation is refused for one particular case | The case covers an entity the user cannot see in the graph under their query policy | Widen the group's [Data Layer RBAC](/features/admin/access-controls.md#data-layer-rbac) query policy, or have a user with broader data access create the ticket |

## Related topics

-   [Role-Based Access Control (RBAC)](/features/admin/access-controls.md)
-   [IAM operations](/api/iam-operations.md) — the permission strings above are set through the `abacPermissions` field
-   [Unified Vulnerability Management](/features/vulnerability-management.md)
-   [The vulnerability lifecycle](/features/vulnerability-management/vulnerability-lifecycle.md)
-   [Risk scoring](/features/vulnerability-management/risk-scoring.md)
-   [Cases and Jira sync](/features/vulnerability-management/cases-and-jira.md)

---

Source: /features/vulnerability-management/risk-scoring

# Risk scoring

Risk scoring is fully configurable from the **Risk configuration** panel, which you open by selecting the edit (pencil) icon on the **Overall risk score** card.

## The risk score model

UVM scores every unified vulnerability with a layered model:

```text
Risk = Threat × Context × Controls
```

Each layer answers one question, in order: how dangerous is this vulnerability, how much does it matter on this asset, and is anything already containing it? The model is layered, bounded, and zero-preserving — context can amplify a real threat but never creates risk where there is none, and control evidence can only reduce a score that exists. The configuration panel walks a worked example through each enabled layer as you adjust settings, so you can see the effect of every change on a real score.

Every signal that feeds the score enters at exactly one layer:

| Signal | Where it enters | Effect |
| --- | --- | --- |
| **CVSS** | Threat | Technical impact, blended with EPSS |
| **EPSS** | Threat | Exploitation likelihood, blended with CVSS |
| **KEV** | Threat | A floor applied after the blend |
| **Asset criticality** | Context | Multiplier on the threat score, set per criticality level |
| **Public exposure** | Context | Multiplier on the threat score |
| **Control evidence** | Controls | Discount on the final score (off by default) |

## Layer 1: Threat

The threat layer is a weighted blend of **Technical impact** (from CVSS) and **Exploitation likelihood** (from EPSS), each normalized to a 0–1 value first:

```text
Threat = (CVSS weight × Technical impact) + (EPSS weight × Exploitation likelihood)
```

-   **Technical impact** is the CVE's CVSS impact subscore normalized to 0–1 (divided by its 6.05 maximum). When a CVE reports no impact subscore, the CVSS base score divided by 10 is used instead.
-   **Exploitation likelihood** is the CVE's EPSS probability, which is already a 0–1 value.
-   The two weights default to **0.50 each** and always sum to 1. A factor that is unavailable for a CVE contributes zero — the KEV floor below is the backstop that keeps actively exploited CVEs with missing or low EPSS data from scoring under your threshold.

A CVE listed in CISA's Known Exploited Vulnerabilities catalog is floored at a high threat value (0.90 by default on the 0–1 threat scale, configurable) regardless of its EPSS score. Many actively exploited CVEs carry low EPSS probabilities, and the KEV floor keeps confirmed exploitation from being scored below your threshold.

## Layer 2: Context

The context layer applies multipliers for what the vulnerability sits on:

| Signal | Default multiplier |
| --- | --- |
| **Asset criticality level** | One multiplier per level, set in **Risk configuration** |
| **Publicly exposed asset** | ×1.2 |

Each level you define in [Asset criticality](/features/assets/asset-criticality.md) has its own multiplier. The most critical level carries the highest multiplier, and you edit the multipliers in the context section of the **Risk configuration** panel. The criticality and exposure multipliers multiply together, so a critical asset that is also publicly exposed outranks an asset that is only one of the two.

An asset with no criticality level and no public exposure is scored exactly neutrally (×1.0). Unlike a weighted average, context can never dilute severity—an unclassified asset costs a vulnerability nothing.

## Layer 3: Controls

The controls layer can apply a small discount (10 percent by default) while a vulnerability is mitigated by currently passing, technique-relevant control evidence — a [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md) control test on the affected asset whose MITRE ATT&CK technique matches the vulnerability. Missing evidence never lowers a score, and the moment no relevant control passes, the full score returns on the next evaluation.

This layer is off by default. Enable it once your CCM controls carry MITRE ATT&CK technique mappings.

## A worked example

Consider a CVE with a CVSS base score of 9.8, no impact subscore reported, and an EPSS probability of 0.10, found on an asset at your most critical level that is not publicly exposed. Suppose that level's multiplier is ×1.5, with default settings everywhere else:

1.  **Threat** — technical impact is 9.8 ÷ 10 = 0.98, and exploitation likelihood is 0.10. The blend is (0.50 × 0.98) + (0.50 × 0.10) = **0.54**. The CVE is not in the KEV catalog, so no floor applies.
2.  **Context** — the criticality level's multiplier applies: 0.54 × 1.5 = **0.81**.
3.  **Controls** — the layer is off, so the score stands at **0.81**.

At 0.81 the vulnerability falls below the default 0.90 threshold and is not prioritized — a severe-but-unlikely-to-be-exploited CVE on an important asset. Now suppose CISA adds the CVE to the KEV catalog: the threat blend is floored at 0.90 before context applies, so the score becomes min(0.90 × 1.5, 1) = **1.0**, and the vulnerability is prioritized. That is the model working as intended — confirmed exploitation outranks a low EPSS estimate.

## Prioritization threshold

The **Prioritization threshold** sets the minimum score a vulnerability must reach to appear in the Prioritized view. The default is 90% (a score of 0.90). Score displays vary by surface: the Prioritized table shows scores on a 0–10 scale, and the entity inspector shows the same score on a 0–100 scale. Lower the threshold to widen the working list; raise it to focus on only the highest-risk vulnerabilities.

## Querying risk scores

The J1QL function [`j1.riskScore(uv, ud)`](/j1ql/scalar-functions.md#j1riskscore) returns the risk score of a vulnerability on a device, on the same 0–100 scale as the entity inspector, so you can filter, sort, and aggregate on it in your own queries.

## Plan priority thresholds

UVM assigns each remediation plan a priority of **Critical**, **High**, **Medium**, or **Low** based on how much risk reduction the plan delivers. The thresholds are expressed in standard deviations from the mean risk reduction across all plans, so they adapt to the shape of your environment.

| Priority | Default threshold | Approximate share |
| --- | --- | --- |
| **Critical** | +1.5 standard deviations | Top ~7% of plans |
| **High** | +0.5 standard deviations | Top ~31% of plans |
| **Medium** | \-0.5 standard deviations | Middle ~31% of plans |
| **Low** | Below medium threshold | Remaining plans |

You can adjust each threshold independently. UVM enforces the ordering rule that the Critical threshold must be greater than or equal to High, which must be greater than or equal to Medium.

## Case routing namespace

The **Cases — Ownership assignment** setting controls which Hierarchical Resource Group namespace is used to determine asset ownership. When UVM creates a case for a remediation plan, it looks up the owning organizational unit in the selected namespace and routes the case to the team responsible for that unit. The panel shows the count of organizational units available in each namespace.

> **TIP**
> 
> Click **Reset to defaults** at the bottom of the panel to return the scoring model and thresholds to JupiterOne's recommended starting configuration. The ownership namespace keeps its saved value.

## Asset criticality and public assets

Two graph-derived signals—an asset's criticality level and its public exposure—feed directly into the risk score and appear in the **Context** column of the Prioritized view.

### Asset criticality

An asset's criticality level comes from [Asset criticality](/features/assets/asset-criticality.md), where you define ordered levels and the J1QL queries that fill them. JupiterOne writes each asset's level to its `j1.criticality` and `j1.normalizedCriticality` properties, and the risk score applies that level's multiplier.

Risk scoring reads the level from the unified device. Setups proposed by the asset criticality agent already classify unified devices. When you write your own queries for devices, select unified devices so the level reaches the risk score, for example:

```j1ql
FIND UnifiedDevice THAT IS Host WITH tag.Environment = 'production'
```

> **NOTE**
> 
> The `tag.crownJewel` property no longer affects the risk score, and smart classes were not migrated into asset criticality. To weight your most important assets, set up [asset criticality](/features/assets/asset-criticality.md), or contact your Customer Success team to have your smart classes migrated.

### Public assets

An asset is treated as publicly exposed when JupiterOne resolves its **public** property to `Public`. UVM merges signals from multiple sources to compute this property, including cloud provider configuration, network scanners, and external attack surface tools.

When sources disagree about an asset's exposure, the property resolves to `Conflicting`, which is a diagnostic state. Investigate conflicting assets to confirm their true exposure and update integrations as needed.

---

Source: /features/vulnerability-management/uvm-1-0

# UVM 1.0 Release Notes

**Release date: May 2026**

UVM 1.0 introduces JupiterOne's Unified Vulnerability Management product. You can now take raw findings from every scanner you run, deduplicate and prioritize them on the graph, and route remediation cases to the teams that own the affected assets.

## What is new

| Feature | What it means for you |
| --- | --- |
| **The prioritization funnel** | A four-stage workflow — Vulnerabilities → Unified → Prioritized → Plans — visible as a live Sankey diagram on every UVM page |
| **Vulnerability unification** | One row per CVE per asset, deduplicated across every configured scanner, with full source attribution |
| **EPSS and KEV enrichment** | Exploitation probability from FIRST.org and CISA's Known Exploited Vulnerabilities catalog on every CVE |
| **Configurable risk scoring** | A transparent composite score combining CVSS, EPSS, crown jewel status, and public exposure — weights you own |
| **CPE-based remediation plans** | Prioritized vulnerabilities grouped by common fix, so teams act on a short list of plans instead of thousands of CVEs |
| **AI-generated plan content** | Every plan ships with an AI-written remediation summary and step-by-step fix instructions |
| **Ownership-based case routing** | Cases route to owning teams in Jira through Hierarchical Resource Groups |
| **AI Assistant** | Sort, filter, and navigate UVM views in natural language |

## Supported scanner integrations

UVM 1.0 ships with first-class support for CrowdStrike Falcon, Qualys VMDR, SentinelOne, Tenable.io, and Wiz. SBOM-sourced findings are also recognized.

## Getting started

1.  Confirm at least one supported scanner integration is configured and syncing
2.  Tag your business-critical assets with `tag.crownJewel`
3.  Open **Vulnerabilities** in the navigation and review the default risk configuration
4.  Open the **Plans** tab and create cases for the top remediation plans
5.  Confirm cases arrive in the correct Jira projects

For full feature documentation, see [Unified Vulnerability Management](/features/vulnerability-management.md).

---

Source: /features/vulnerability-management/uvm-2-0

# UVM 2.0 Release Notes

**Release date: August 2026**

UVM 1.0 turned raw scanner findings into a prioritized, team-routed list of remediation plans. UVM 2.0 makes JupiterOne the system of record for what happens next. Every vulnerability on every asset now carries a lifecycle state — open, remediated, exempted, mitigated, or closed — tracked in one place across all of your scanners, verified against scanner evidence, and synchronized with Jira in both directions. You no longer log into five consoles to answer "what is the status of this vulnerability?", and your decisions are never silently overwritten by a rescan.

## What is new

| Feature | What it means for you |
| --- | --- |
| **Vulnerability lifecycle tracking** | Eight lifecycle states per vulnerability per asset — one source of truth for vulnerability status across every scanner you run |
| **Verified fixes** | **Mark remediated** claims a fix; JupiterOne verifies the claim against scanner evidence and distinguishes claimed-and-confirmed fixes from assumed ones |
| **Exemption management** | Accept risk or mark a vulnerability non-exploitable with a justification and an expiry date. Exemptions expire to a review queue — never silently, and never straight back to open. |
| **Control-backed mitigations** | Link a mitigation to a passing Continuous Control Monitoring control. If the control later fails or is deleted, the vulnerability reopens automatically. |
| **The Inbox** | A single decision queue for everything that needs a human: vulnerabilities your scanners no longer observe, claimed fixes still being detected, expiring exemptions, and ticket disagreements — with bulk actions |
| **Bidirectional Jira sync** | Closing a Jira ticket proposes the matching lifecycle state in JupiterOne, and case progress writes back to Jira — with a configurable status mapping per project and issue type |
| **Executive dashboard** | Historical reporting on remediation outcomes: open vulnerabilities over time, time to remediate by team, reopens by fix confidence, and accepted risk over time |
| **Layered risk scoring** | A new Threat × Context × Controls model with a KEV floor replaces the additive weighted blend from UVM 1.0 |

## The vulnerability lifecycle

The centerpiece of UVM 2.0 is the lifecycle state machine. JupiterOne tracks two things independently for every vulnerability on every asset: what your scanners currently observe, and what your team has decided. Scanner evidence never silently overwrites a human decision — a rescan reopens a fixed vulnerability, but it never reopens a false positive, an accepted risk, or a mitigation.

For the full model — the eight states, verification, exemptions, and what happens when a scanner detects a closed vulnerability again — see [The vulnerability lifecycle](/features/vulnerability-management/vulnerability-lifecycle.md).

## The Inbox

The **Inbox** is the analyst work queue for UVM 2.0. Nothing in the lifecycle changes silently: scanner signals arrive here as proposals for a human to confirm, in bulk. Sections include vulnerabilities **no longer observed** by any scanner (bulk mark fixed), **claimed but still observed** fixes (bulk reopen), **expiring exemptions**, and **ticket disagreements** where a Jira closure conflicted with a decision made in JupiterOne.

## Bidirectional Jira sync

Remediation owners live in Jira, so the ticket is now a first-class way to drive the lifecycle. When a linked ticket closes, its Jira resolution translates into the matching vulnerability state — a ticket resolved as Patched enters verification rather than closing outright, and a ticket resolved as Won't Do proposes an accepted-risk exemption with an expiry date. In the other direction, case progress updates the Jira ticket's status and resolution. You configure the mapping per Jira project and issue type.

## Executive dashboard

UVM 2.0 adds daily snapshots and a dedicated executive dashboard, so leadership sees remediation progress rather than raw findings: open vulnerabilities over time, current exposure by severity, time to remediate by organizational unit (verified fixes and dispositions reported separately), reopens by fix confidence, and accepted risk over time. Historical views are point-in-time records and support CSV download.

## Layered risk scoring

UVM 2.0 replaces the additive weighted risk score from UVM 1.0 with a layered model:

```text
Risk = Threat × Context × Controls
```

-   **Threat** blends technical impact (CVSS) with exploitation likelihood (EPSS). A CVE listed in CISA's Known Exploited Vulnerabilities catalog is floored at a high threat score regardless of EPSS.
-   **Context** applies bounded multipliers for crown jewel assets and public exposure. Context can amplify a real threat but never creates risk where there is none, and untagged assets are scored neutrally.
-   **Controls** can apply a small discount when a vulnerability is mitigated by currently passing, technique-relevant control evidence. Missing evidence never lowers a score. This layer is off by default.

If you tuned score weights in UVM 1.0, review the new configuration — the old sum-to-one weight sliders no longer exist. See [Configure risk scoring](/features/vulnerability-management/risk-scoring.md).

## Upgrading from UVM 1.0

UVM 2.0 is enabled per account on a coordinated schedule. Two things to know:

> **WARNING**
> 
> As part of enablement, existing remediation plans and cases are regenerated on the new lifecycle model. Plan and case history from UVM 1.0 does not carry over — export anything you need before your scheduled enablement, and expect plan and case identifiers to change. Your JupiterOne account team coordinates the timing with you.

-   Vulnerability findings, unified vulnerabilities, and risk configuration are unaffected.
-   Lifecycle states start fresh: every observed vulnerability begins as **Open** until your team or your tickets act on it.

## Supported scanner integrations

Scanner support is unchanged from UVM 1.0: CrowdStrike Falcon, Qualys VMDR, SentinelOne, Tenable.io, and Wiz, plus SBOM-sourced findings. UVM tracks vulnerabilities on unified devices — servers, laptops, and cloud instances. Application-level weaknesses without a CVE and ephemeral container workloads are not yet in scope.

## Getting started with 2.0

1.  Confirm your scanner integrations are syncing and your [risk configuration](/features/vulnerability-management/risk-scoring.md) reflects the new layered model
2.  Confirm your analysts have graph-write permission — vulnerability state transitions require it
3.  Configure the Jira status mapping for each project and issue type you route cases to, and verify a test ticket round-trips
4.  Make the **Inbox** part of your team's weekly routine — it is where verification, expiring exemptions, and ticket disagreements wait for a decision
5.  Open the **Executive dashboard** after your first week of snapshots to baseline time to remediate and accepted risk

For full feature documentation, see [Unified Vulnerability Management](/features/vulnerability-management.md).

---

Source: /features/vulnerability-management/vulnerability-lifecycle

# The vulnerability lifecycle

Every unified vulnerability carries a lifecycle state on each affected asset. The state answers "where does this stand?" — untouched, claimed as fixed, exempted, mitigated, or closed — and it lives in JupiterOne rather than in any single scanner console. You no longer reconcile status across five tools, and you no longer lose a risk acceptance because a scanner ran again.

Two ideas explain almost everything about how the lifecycle behaves. Read the next two sections once and the rest of the model follows.

## Evidence and decisions are tracked separately

For every vulnerability on every asset, JupiterOne records two independent things:

-   **What scanners observe** — is at least one configured scanner currently reporting this vulnerability on this asset? This is evidence. It updates automatically as your integrations run, and nobody can edit it.
-   **What your team has decided** — the lifecycle state. This is a decision. It changes only through an explicit action by a person, a translated Jira ticket closure, or one of a small set of automatic rules described below.

Keeping the two apart is what makes the lifecycle trustworthy in both directions. A scanner that keeps reporting a vulnerability you marked as a false positive does not overturn your decision — the evidence is still recorded and visible, but the decision stands. Equally, a decision never erases evidence: the raw findings remain in the **Source** tab, exactly as reported.

When a state change surprises you, ask which of the two records moved. Almost every "why did this happen?" question about the lifecycle is answered by that distinction.

> **INFO**
> 
> The lifecycle state belongs to a (vulnerability, asset) pair, not to the CVE. The same CVE can be Fixed on one host, an accepted risk on a second, and still Open on a third — the state of one never bleeds into another. Bulk actions exist so that deciding per asset does not mean clicking per asset.

## The eight lifecycle states

The vocabulary is small, and it has a shape: one working state, one verification gate, one attention state, and five closed states that each answer "why is this closed?" differently.

| Role | State | Meaning |
| --- | --- | --- |
| Working | **Open** | A scanner reports it and no decision has been made yet. Every vulnerability starts here — and returns here if a decision is revoked or contradicted by evidence. |
| Verification gate | **Awaiting verification** | Someone claimed a fix, and JupiterOne is waiting for scanners to confirm it. Confirmed fixed when the scanner stops seeing it. Not closed yet. |
| Attention | **Review required** | An exemption expired. A person must re-affirm it, revoke it, or close the vulnerability another way. Never counted as closed. |
| Closed | **Fixed** | The vulnerability is gone from the asset. |
| Closed | **Mitigated** | The vulnerability is still present, but a compensating control contains it. |
| Closed | **Accepted risk** | The vulnerability is real, and the business accepts it for a defined period. |
| Closed | **Non-exploitable** | The vulnerability is present but cannot be exploited in this environment, for a defined period. |
| Closed | **False positive** | The scanner was wrong. |

Who moves it:

Scanner reports itMark remediatedRe-openConfirm fixed (Inbox)Mark fixedDetected again — reopensMark mitigatedControl failsMark false positiveAccept riskMark non-exploitableExpiresExpiresRe-affirmRe-openOpenAwaiting verificationFixedMitigatedFalse positiveAccepted riskNon-exploitableReview required

Action someone takes Happens automatically

Select any state to see what it asserts, its ways in and out, and what happens when a scanner detects it again.

Solid transitions are actions someone takes — you in JupiterOne, or a translated ticket closure. Dashed transitions happen automatically, and each one stays visible: automatic reopens are recorded as system actions on the vulnerability's lifecycle timeline, and expired exemptions wait in Review required rather than changing silently.

## Claim a fix, then let the scanner verify it

JupiterOne does not take anyone's word that a vulnerability is gone — including yours. Remediation is a claim, and scanner evidence is the verification:

1.  Apply the fix, then select **Mark remediated**. The state moves to Awaiting verification. This is a claim, not a close.
2.  Your scanners keep running on their normal schedule. As long as any scanner still reports the vulnerability, it stays in Awaiting verification.
3.  When every scanner has stopped reporting it for 14 days and the asset itself is still reporting in, the vulnerability appears in the Inbox under **No longer observed**. Confirming it there closes the vulnerability as Fixed with fix confidence **confirmed** — a claim that evidence validated.
4.  If scanners still report the vulnerability 14 days after the claim, it appears in the Inbox under **Claimed, still observed**, so you can reopen it or investigate the failed fix instead of believing a fix that did not work.

You can also select **Mark fixed** to close a vulnerability immediately. JupiterOne records fix confidence with every close: **confirmed** when a claim was standing (the vulnerability was Awaiting verification when it closed), **assumed** when nobody had claimed a fix. Either way, a fixed vulnerability that resurfaces after it had genuinely disappeared reopens automatically. The [executive dashboard](/features/vulnerability-management/executive-dashboard.md) reports reopens split by fix confidence, so verified remediation and optimistic closing never blur together.

> **TIP**
> 
> **Mark remediated** and **Awaiting verification** are about the fix, not the work. Claim a fix after you apply it — not when you pick up the task. Work-in-progress tracking belongs in the linked Jira ticket; JupiterOne reflects the ticket on the case.

## When a scanner detects a closed vulnerability again

Each closed state is a different kind of claim, and each answers to the referee that can actually test it:

-   **Fixed** claims the vulnerability is gone. A scanner can prove that wrong, so Fixed — and only Fixed — reopens on re-detection.
-   **Mitigated** claims a control contains it. Scanners are expected to keep seeing a mitigated vulnerability (the control limits exploitability; it does not remove the finding), so re-detection means nothing here. The health of the linked control is the referee instead.
-   **Accepted risk**, **Non-exploitable**, and **False positive** are human judgments. No scan result can prove a judgment wrong, so scanners never touch these states. Time and people are the referees: exemptions expire into review.

| Closed as | Scanner detects it again | Linked control fails | Exemption expires |
| --- | --- | --- | --- |
| **Fixed** | Reopens automatically | — | — |
| **Mitigated** | Stays mitigated (expected) | Reopens automatically | — |
| **Accepted risk** | Stays accepted | — | Moves to Review required |
| **Non-exploitable** | Stays non-exploitable | — | Moves to Review required |
| **False positive** | Stays false positive | — | — |

The automatic reopen is deliberately narrow: it fires only for Fixed, and only when the vulnerability had genuinely disappeared (quiet for at least 14 days) and then came back — a regression, not scanner noise. Reopens are evaluated several times a day and record a system-attributed entry, with a justification, on the vulnerability's lifecycle timeline.

## Exemptions expire to review, never to silence

Two states are exemptions, and both carry an expiry date:

-   **Accepted risk** — requires a justification; JupiterOne records the acting user as the approver. Default expiry: 90 days.
-   **Non-exploitable** — requires a justification. Default expiry: 90 days, with 180 days as a one-click preset. Non-exploitable closures arriving from a Jira ticket default to 180 days.

When an exemption expires, the vulnerability moves to **Review required**. It does not silently reopen, and it does not quietly stay closed — it waits, visibly, for a person. The lapsed exemption is preserved so the reviewer can see exactly what was approved, by whom, and why. From Review required you can:

-   **Re-affirm** — renew the same exemption with a fresh expiry date, defaulting to the original exemption's duration
-   **Re-open** — return the vulnerability to Open
-   Close it another way — Fixed, a different exemption, or False positive

Exemptions approaching expiry appear in the Inbox under **Expiring soon** before they lapse.

## Mitigations follow their control

**Mark mitigated** requires linking a [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md) control that is currently passing — you cannot mitigate against a control that is already failing. From then on, the vulnerability answers to that control:

-   If the control starts failing, is retired, or is deleted, the vulnerability reopens automatically, and the lifecycle timeline shows which control lapsed.
-   If the control recovers, the vulnerability does not re-mitigate automatically — a person re-asserts the mitigation.
-   **Switch control** relinks an existing mitigation to a different passing control without reopening it.

Because a mitigated vulnerability is still present by definition, scanner re-detection has no effect on it.

## Who changes state, and who wins

Three actors can change a lifecycle state, in strict order of authority — person, then ticket, then automation:

-   **People in JupiterOne** hold the highest authority. State transitions require graph-write permission and are recorded with the acting user. No ticket or automatic rule ever overrides a decision a person made in JupiterOne.
-   **Linked Jira tickets** propose transitions through the [resolution mapping](/features/vulnerability-management/cases-and-jira.md). A ticket closure that conflicts with a person's decision is refused and surfaces in the Inbox as a **Ticket disagreement**, where you choose **Adopt ticket** or **Keep J1**.
-   **Automation** — exemption expiry, control regression, and the re-detection reopen — acts only in the narrow cases described above and never overrides a person.

Every transition, from any actor, is recorded on the vulnerability's lifecycle timeline: who, when, from and to which state, and the justification. Bulk actions record one entry per vulnerability under a shared batch, so audits reconstruct exactly what happened. There is no undo for bulk actions — each one shows a confirmation with the exact count — and, for Mark fixed, the per-row confidence — before it applies, and every applied change can be reversed through a normal transition.

## Common questions

**I marked a vulnerability as a false positive, and the scanner still reports it. Why does JupiterOne still show my decision?** Because that is the design. Judgments answer to people, not scanners. The finding remains visible in the **Source** tab, and the observation is recorded on the pair, but your decision stands until a person changes it. If the scanner keeps reporting it, fix the detection at the scanner — JupiterOne will not churn your triage.

**Why did a Fixed vulnerability reopen on its own?** A scanner observed it again after it had been gone for at least 14 days. Fixed is the only state that reopens on re-detection, the reopen is recorded as a system action with a justification on the lifecycle timeline. If it reopens repeatedly, the fix is not holding — check the reopen history on the lifecycle timeline.

**My Jira ticket is Done, but the vulnerability shows Awaiting verification. Is the sync broken?** No — this is verification working. Ticket closures resolved as Patched or Done are treated as claims, exactly like **Mark remediated**, and once scanners stop seeing the vulnerability, the Inbox proposes the confirmed close. A closed ticket whose vulnerability keeps being detected appears under **Claimed, still observed** in the Inbox.

**Why can I not accept risk on a vulnerability that is Awaiting verification?** A pair either awaits fix verification or carries an exemption — never both. Select **Re-open** to withdraw the claim first, then raise the exemption from Open.

**A vulnerability disappeared from my scanners, but its state never changed. Why?** JupiterOne proposes; you decide. Vulnerabilities your team has acted on move to the Inbox under **No longer observed** for a bulk **Mark fixed** — they are not closed behind your back. Vulnerabilities nobody ever acted on simply leave the views when their findings disappear, because there was no decision to preserve.

**Two scanners report the same CVE on one asset. One of them stopped seeing it. Will the vulnerability verify as fixed?** No. Evidence is the union of all sources — a vulnerability counts as observed while any scanner still reports it. One source going quiet (or being removed) never closes anything on its own.

## Query lifecycle states with J1QL

Lifecycle states are graph entities, so everything above is queryable. For example, to list every accepted risk:

```text
FIND VulnerabilityState WITH resolution = 'RISK_ACCEPTED'
```

Internal values are uppercase (`OPEN`, `IN_PROGRESS`, `RESOLVED`, `REVIEW_REQUIRED` for `status`; `FIXED`, `MITIGATED`, `RISK_ACCEPTED`, `NOT_EXPLOITABLE`, `FALSE_POSITIVE` for `resolution`), while the UI shows the display labels described above — `IN_PROGRESS` displays as Awaiting verification. A vulnerability nobody has acted on has no state entity yet and is treated as Open.

## The Inbox

The **Inbox** is the decision queue for the vulnerability lifecycle. Scanner signals, expiring exemptions, and ticket conflicts all land here as proposals for a person to confirm — in bulk, with full context — rather than as silent state changes.

| Section | What lands here | The action |
| --- | --- | --- |
| **Needs decision today** | Exemptions at or past their expiry date | **Re-affirm** per row, or open the vulnerability to re-open it or close it another way |
| **Expiring soon** | Exemptions approaching expiry | Re-affirm early, or let them come due |
| **Ticket disagreements** | Jira closures that conflicted with a decision made in JupiterOne | **Adopt ticket** or **Keep J1** |
| **No longer observed** | Vulnerabilities your team has acted on that no scanner has reported for 14 days, on assets that are still reporting in | Bulk **Mark fixed** — each row shows whether the close will be confirmed or assumed |
| **Claimed, still observed** | Fixes claimed more than 14 days ago that scanners still detect | Bulk **Reopen**, or investigate the failed fix |
| **Asset not reporting** | Quiet vulnerabilities — open or claimed — whose asset has not been inventoried by any source for 7 days | Informational — verification cannot proceed until the asset reports again |

Bulk actions are atomic per batch and capped at 100 vulnerabilities per action, and every row records its own lifecycle timeline entry. The bulk **Mark fixed** button shows the confidence split before you commit — for example, "Mark fixed (4) — 1 confirmed · 3 assumed".

---

Source: /integrations

# Integrations Overview

With over 180 integrations, JupiterOne partners and integrates with industry leading technologies to bring you end-to-end cyber asset visibility, context, and automation across every dimension of your digital universe.

## Getting started with integrations

Start by connecting JupiterOne with other tools to populate relevant data within your JupiterOne workspace.

[

![](/icons/illustrations/cloud-upload.svg)![](/icons/illustrations/cloud-upload.svg)

Add an integration

Start visualizing your data by setting up your first integration with JupiterOne.





](/integrations/add-an-integration.md)[

![](/icons/illustrations/gear.svg)![](/icons/illustrations/gear.svg)

Integration settings

Explore universal integration settings for configuration within JupiterOne.





](/integrations/settings.md)[

![](/icons/illustrations/strategy.svg)![](/icons/illustrations/strategy.svg)

Instance Management

Learn how to manage existing integration instances in your JupiterOne workspace.





](/integrations/instance-management.md)[

![](/icons/illustrations/tree.svg)![](/icons/illustrations/tree.svg)

On-premise Collector

Understanding and deploying the Collector for behind-the-firewall integrations.





](/integrations/development/collector.md)[

![](/icons/illustrations/cloud-upload.svg)![](/icons/illustrations/cloud-upload.svg)

Data Out

Send JupiterOne findings, alerts, and failing CCM control tests to Jira and other external systems.





](/integrations/data-out/overview.md)

## Featured integrations

Explore our leading integrations and learn how to configure them within your workspace.

[

![](/icons/integration-svgs/aws3.svg)![](/icons/integration-svgs/aws3.svg)

AWS

Learn to configure the AWS integration and review its data model.





](/integrations/directory/aws.md)[

![](/icons/integration-svgs/azure.svg)![](/icons/integration-svgs/azure.svg)

Azure

Set up Azure within JupiterOne and view the Azure data model.





](/integrations/directory/azure.md)[

![](/icons/integration-svgs/github3.svg)![](/icons/integration-svgs/github3.svg)

GitHub

Integrate GitHub with JupiterOne and view the GitHub data model.





](/integrations/directory/github.md)[

![](/icons/integration-svgs/gsuite.svg)![](/icons/integration-svgs/gsuite.svg)

Google Workspace

Connect Google Workspace to JupiterOne and easily query your Google Workspace data.





](/integrations/directory/google.md)[

![](/icons/integration-svgs/microsoft-365.svg)![](/icons/integration-svgs/microsoft-365.svg)

Microsoft 365

Integrate Microsoft 365 and JupiterOne and view the Microsoft 365 data model.





](/integrations/directory/microsoft-365.md)[

![](/icons/integration-svgs/slack.svg)![](/icons/integration-svgs/slack.svg)

Slack

Add JupiterOne to your Slack workspace, and review the Slack data model.





](/integrations/directory/slack.md)

---

Source: /integrations/add-an-integration

# Add an integration

JupiterOne loves data, and the more data you provide, the more powerful JupiterOne's capabilities become. One of the main ways for JupiterOne to ingest data is by enabling integrations with your organizations tooling and infrastructure.

## Getting started

Configuring your integrations within JupiterOne will allow you regularly pull in relevant data points from the enabled integrations—allowing you to monitor, query, and review the data ingested by JupiterOne.

Integrations support the ability to have several instances of an integration configured simultaneously. This allows for segmenting data that is ingested from an integration between instance Ids.

> **INFO**
> 
> Aside from ingesting data from integrations, JupiterOne also support the ability to upload data directly (like via CSV or API). See our [nifty guide for importing your data into JupiterOne](https://community.askj1.com/kb/articles/1164-importing-your-data-into-jupiterone).

## Adding an integration instance

Once you're ready to begin integrating JupiterOne with your tools of choice, you will need to create an integration instance for whichever integration you wish to configure.

> **NOTE**
> 
> Along with pre-configured integration solutions, you have the ability to create custom integrations. You can [find more info about custom integrations here](/integrations/development/overview.md).

#### To create an integration instance:

1.  Navigate to the **Integrations** tab from the JupiterOne dashboard.
    
2.  Select your integration of choice.
    
3.  From within the integration-view, click to **Add instance**.
    
4.  Provide the necessary credentials for the integration.
    
    > **INFO**
    > 
    > All integrations share a set of common configuration fields in addition to integration-specific fields. [Read more about the shared configuration fields](/integrations/settings.md).
    > 
    > Alternatively, [refer to our integration-specific installation guides](/integrations.md) within the integration directory for more info on integration-specific fields.
    
5.  Click **Create** at the bottom of the page once all the necessary fields have been provided.
    

#### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

---

Source: /integrations/data-out/configure-jira-connection

# Configure a Jira connection

A **Connection** is the credential set Data Out uses to talk to your Jira workspace. Before you can create instances or fire **Create ticket** from CCM, you need at least one Connected Jira connection.

In 1.0, Jira connections authenticate using an **Atlassian API token**. You will:

1.  Mint an API token in your Atlassian account
2.  Open the Data Out Connections tab and start a new Jira connection
3.  Walk through the **Connect** and **Verify** steps in the wizard
4.  (Create flow only) continue into **Configure** and **Test** to stand up your first instance

## Prerequisite: mint an Atlassian API token

JupiterOne does not store your Atlassian password. Instead, you generate an API token scoped to the Atlassian account that owns the Jira projects you want to write to.

1.  Sign in to [id.atlassian.com](https://id.atlassian.com/manage-profile/security/api-tokens) with the Atlassian account you want JupiterOne to act as
    
2.  Click **Create API token**
    
3.  Give the token a recognisable **Name** (we suggest `JupiterOne Data Out Integration API Token`)
    
4.  Pick an **Expires on** date - Atlassian limits tokens to a maximum of one year
    
5.  Click **Create**, then immediately copy the token value - Atlassian only shows it once
    
    ![Atlassian Account Security: Create an API token dialog](/assets/images/atlassian-create-api-token-7ec2c4e498d5ba9a1df6035c1c5f2869.png)
    

> **TIP**
> 
> Set a calendar reminder one week before the **Expires on** date. When the token expires, Data Out will mark the connection as **Needs reauthorization** and instances backed by that connection will start failing. See [Re-authorize a connection](#re-authorize-a-connection) for the recovery flow.

## Open the Connection wizard

1.  In the JupiterOne left navigation, open **Integrations > Data out**
    
2.  The default tab is **Connections**
    
3.  Find the **Jira** card and click **Connect** (or **View ->** if you already have at least one Jira connection)
    
    ![Connections tab showing the Jira, ServiceNow, and Asana provider cards](/assets/images/connections-tab-providers-29dcfdbab6f6e86ef38f194c899b1a7a.png)
    
4.  The Jira provider page opens. Click **\+ Add a new Jira connection** (top-right) to open the wizard
    

## Step 1 - Connect

The Connect step captures four fields. You will paste the API token you minted above into the last one.

![Connection wizard: Connect step with Connection name, Host name, Email, and API Token fields](/assets/images/connection-wizard-connect-39b9d953fceea4528547c70af2fce043.png)

| Field | What to enter |
| --- | --- |
| **Connection name** | A friendly label that helps admins recognise this credential set, for example `Organization Jira Connection` or `ACME Cloud Jira`. The name appears wherever connections are referenced in Data Out. |
| **Host name** | Your Atlassian site URL **without** the `https://` prefix, for example `your-company.atlassian.net`. |
| **Email** | The email address of the Atlassian user who owns the API token. |
| **API Token** | The token value you copied from id.atlassian.com. Click the eye icon on the right to reveal the value and confirm you pasted the full string. |

Click **Next** (in create mode) or **Update connection** (when editing an existing connection).

## Step 2 - Verify

JupiterOne uses the credentials to confirm the API token is valid and to read a sample of Jira projects visible to that account. If you see "Your connection is working!" plus a list of project names, the token is good and the account has the read permissions Data Out needs.

![Connection wizard: Verify step with success message and a list of accessible projects](/assets/images/connection-wizard-verify-ec2378139b42051aa7c12384d57515b2.png)

-   If you are **editing** an existing connection, click **Finish** - your connection is saved
-   If you are **creating** a new connection, click **Next** to continue into the instance setup steps below

If verification fails, head to [Troubleshooting](/integrations/data-out/troubleshooting.md#connection-fails-to-verify) for common causes.

## Steps 3 and 4 - Configure and Test (create flow only)

When you create a brand-new connection, the wizard continues directly into the same **Configure** and **Test** steps that the [Add Jira instance](/integrations/data-out/create-instance.md) wizard uses, so you finish with a working connection **and** a first running instance in one pass.

These steps are documented in detail on the [Create an instance](/integrations/data-out/create-instance.md) page. Briefly:

-   **Configure** - name the workflow, optionally pick a **Data in Jira integration** to scope it to one project, and pick the **Issue type** to file under
-   **Test** - send a test payload to confirm the round-trip works, or click **Finish** to skip the test

Click **Finish** at the end of the Test step. The new connection appears on the Jira provider detail page with a green **Connected** badge, and the first instance shows up in the connection's instance table.

## Authorization status

Each connection carries an **Authorization status** badge that tells you whether the credentials are still good.

| Badge | What it means | What to do |
| --- | --- | --- |
| **Connected** (green dot) | Credentials are valid; instances backed by this connection can run | Nothing - you are good |
| **Needs reauthorization** | The most recent run failed authentication (token revoked, expired, or the Atlassian account lost project access) | Mint a new API token and follow [Re-authorize a connection](#re-authorize-a-connection) |
| **Failed** | Persistent authentication failure | Same recovery as **Needs reauthorization** - the difference is just the count of consecutive failures |

The badge is visible on the provider catalog card (Connections tab) and on the per-provider detail page next to each connection name.

## Edit an existing connection

1.  Open **Data out > Connections > Jira**
2.  Find the connection card and click the kebab menu (`...`) on the right of the connection header
3.  Click **Edit**
4.  The wizard opens directly on the **Connect** step with your existing values populated. The API Token field is masked - leave it as-is to keep the current token, or paste a fresh value to rotate it
5.  Step through **Verify** and click **Finish**

In edit mode, the wizard skips the **Configure** and **Test** steps because you are not creating a new instance - just updating credentials.

## Re-authorize a connection

When the badge says **Needs reauthorization**, the most common cause is an expired or revoked Atlassian API token. To recover:

1.  Mint a fresh API token at [id.atlassian.com](https://id.atlassian.com/manage-profile/security/api-tokens) using the same Atlassian account
2.  Open **Data out > Connections > Jira**
3.  Click the kebab menu next to the failing connection and choose **Edit**
4.  Paste the new token into the **API Token** field on the Connect step
5.  Click **Next**, confirm Verify is green, and click **Finish**

Existing instances backed by this connection will pick up the new credentials on their next run - you do not need to recreate them.

## Delete a connection

Deleting a connection deletes any instances that depend on it.

1.  Open **Data out > Connections > Jira**
2.  Click the kebab menu next to the connection and choose **Delete**
3.  Confirm the action

If the connection has dependent instances, JupiterOne will surface them in the confirmation dialog so you can decide whether to proceed. Deletion is irreversible. To stop a single instance without removing its connection, use **Stop** on the instance row instead - see [Manage instances](/integrations/data-out/manage-instances.md#row-actions).

---

Source: /integrations/data-out/create-instance

# Create an instance

An **Instance** (also called a **Workflow**) is the named delivery target that tells Data Out where to send a Jira ticket. Each instance ties together:

-   A **Connection** (which Atlassian site + which credentials)
-   A **Data in Jira integration** (optional - which Jira project the instance writes to)
-   An **Issue type** (the Jira issue type new tickets are filed under)

You can create as many instances per connection as you need - one per Jira project / issue-type pair is a common pattern.

## Prerequisites

-   At least one **Connected** Jira connection. See [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md) if you have not authorized one yet
-   (Recommended) A **Data in Jira** integration that already ingests the target project. This lets the wizard scope the instance to the project URL rather than asking you to type it. If you skip this, the field defaults to `None` and you can still create an instance

## Open the Add Jira instance wizard

You can start the wizard from two places:

-   **Provider detail page** - open **Data out > Connections > Jira** and click **\+ Add instance** on the connection card you want to attach to. This pre-selects the connection so the wizard skips Step 1
-   **Instances tab** - open **Data out > Instances**, find the Jira section, and click **\+ Add instance** on the right of the section header. This opens the wizard at Step 1 so you can choose which connection to use

The Add Jira instance wizard is a three-step Stepper modal: **Select Connection -> Configure -> Test**.

## Step 1 - Select Connection

Choose which Jira connection this instance should use. The step lists every Jira connection in your workspace with a green **Connected** badge.

![Add Jira instance: Select Connection step listing four available connections](/assets/images/add-instance-step1-select-connection-d21a0efb8403be67ce526fd95c93a8b7.png)

-   Click a card to select it - the selected card gets a blue outline
-   Click **Next** to advance

> **INFO**
> 
> If you started the wizard from a connection card's **\+ Add instance** button (rather than from the global Instances tab), the wizard auto-selects that connection and starts at Step 2 instead. You can always go back to Step 1 from the Stepper if you change your mind.

## Step 2 - Configure

Configure tells the instance which Jira project to write to and what issue type to use.

![Add Jira instance: Configure step with Workflow name, Data in Jira integration, and Issue type fields](/assets/images/add-instance-step2-configure-4300422dfe84c46c63c372728f52c403.png)

| Field | What to enter |
| --- | --- |
| **Workflow name** | A friendly label for this instance, for example `Jira Project: PROS Issue Type: Task`. The name is what admins see in the Instances tab and what producers (like the CCM Create ticket modal) use to identify the routing target. Pick something descriptive - both the project key and the issue type are useful. |
| **Data in Jira integration** | Optional. Dropdown of existing **Data in** Jira integrations in this workspace. Selecting one scopes the instance to that integration's Jira project so the **Issue type** dropdown can be populated from the project's real metadata, and so created tickets can be linked back to the data J1 already knows about. Defaults to `None`. |
| **Issue type** | The Jira issue type that this instance files tickets under. The dropdown is searchable - start typing to filter (for example, `pros` filters to issue types whose project key starts with `PROS`). The format `Project : Issue Type` indicates which Jira project each issue type belongs to (for example, `ProServe : Task`). |

> **TIP**
> 
> If you do not see the Jira project you expect in the **Data in Jira integration** dropdown, you have not yet ingested it via a Jira **data in** integration. See [Add an integration](/integrations/add-an-integration.md) for the steps to set one up. You can still create the instance without selecting a project here, but you will be choosing issue types from the union of all projects the Atlassian account can see.

When the three fields are filled in, click **Next** to continue to Test.

## Step 3 - Test

The Test step lets you fire a real Jira ticket at the project + issue-type combination you just configured, so you can confirm the round-trip works before relying on the integration. The instance is already created at this point - the test step is purely a validation gate.

![Add Jira instance: Test step with Summary and Description fields and Send test / Finish buttons](/assets/images/add-instance-step3-test-59e2ead3b0f88a29ef0b3aa585706f4f.png)

| Field | What to enter |
| --- | --- |
| **Summary** | The Jira issue **Summary** field. Defaults to a value like `Test PROS:Task ticket to be created` - safe to leave as-is for a smoke test, or edit to something distinctive so you can find it easily in Jira. |
| **Description** | The Jira issue **Description** field. Defaults to `testing ticket description`. |

You have two terminal actions:

-   **Send test** posts the test payload to the connected Jira project. A new ticket appears in Jira under the configured project and issue type. Use this for the first instance you stand up so you have a known-good baseline. **Remember to delete the test ticket from Jira afterward** to keep the project clean
-   **Finish** closes the wizard without sending a test payload. Use this if you have already validated this connection + project pair and just need a second instance pointing at the same place

Either way, the instance is now Active and visible on the Instances tab.

For a deeper walkthrough of how to interpret a successful or failing test, see [Test your instance](/integrations/data-out/test-instance.md).

## After Save: where to find the new instance

The new instance appears in three places:

-   **Provider detail page** (`Data out > Connections > Jira`) - in the connection card's instance table, with columns **Instance / Status / Last run / Successful / Failed jobs / Project issue type**
    
    ![Provider detail page with the new instance row](/assets/images/provider-detail-jira-42432efccc1466b7c4a360f3e31cee93.png)
    
-   **Instances tab** (`Data out > Instances`) - same table, grouped by provider with `N instances / N active` badges
    
-   **Instance detail page** - click the instance name in either of the above tables to open the per-instance detail view (Status, Last run, Lifetime tasks, Jobs succeeded, Jobs failed, plus the per-instance Jobs table). See [Manage instances](/integrations/data-out/manage-instances.md#instance-detail-page) for what you can do from there
    

## Use an instance for organizational unit routing

Every Jira and ServiceNow instance is also selectable as a **Ticketing workflow** on an organizational unit (OU) and as the **Default ticketing workflow** on an OU namespace, under **Settings** > **Organizational Units**. This is how vulnerability case tickets are routed to the team that owns the affected asset. See [Ticketing workflows and routing](/features/admin/organizational-units.md#ticketing-workflows-and-routing).

## What is not configured on the instance in 1.0

In 1.0, the only fields stored on the instance itself are the three on the **Configure** step (Workflow name, Data in Jira integration, Issue type). Per-ticket fields like **Title**, **Description**, **Assignee**, and any custom Jira fields are entered at the moment a ticket is created - either by the producer (such as the [CCM Create ticket modal](/integrations/data-out/create-ticket-from-ccm.md)) or by the test payload above. There is no per-field mapping editor or templated defaults configuration on the instance in this release.

---

Source: /integrations/data-out/create-ticket-from-ccm

# Create a Jira ticket from a failing CCM control test

The flagship Data Out 1.0 producer experience is the **Create ticket** action on every failing CCM control. From the control detail panel, you pick an active Jira workflow (instance), review and edit the prefilled Title and Description, optionally assign someone, and click **Create ticket**. The ticket lands in Jira immediately and is linked back from the control detail panel for easy follow-through.

This page walks the entire round-trip in five steps, then covers what to do when nothing happens (no admin set up a workflow yet, or your role does not allow you to create one).

> **NOTE**
> 
> The label you see in the modal is **Workflow**, and the label you see on the Instances tab is **Instance**. They refer to the same object - they are interchangeable in 1.0.

## Prerequisites

-   At least one **Active** Jira instance. If none exist, see [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md) and [Create an instance](/integrations/data-out/create-instance.md) first
-   You can be a regular user to **see** existing tickets and Linked Jira issues, but you must be a **full admin** to create the underlying instance. The Create ticket modal itself is available to any user who can open the control detail panel; if no instance is configured, the modal shows a role-aware empty state (see [Empty states](#empty-states))
-   A control test in the **Failing** state to act on

## Step 1: Find a failing control

1.  From the JupiterOne left navigation, open **Compliance > Controls**
    
2.  The **Controls** view defaults to **All controls**. The header summary cards at the top show your overall health (`Overall controls status`, `Failing controls`, `High priority failing controls`, `Impacted frameworks`)
    
3.  Use the second filter dropdown to filter to **Fail**
    
4.  Click any row in the failing-controls table to open the control's detail panel on the right
    
    ![Compliance &gt; Controls Status filtered to Fail](/assets/images/ccm-controls-status-failing-2157863bdb42a04ea365813dd57d9d26.png)
    

## Step 2: Review the control and open the modal

The detail panel shows the control's summary, last-test metadata, framework mappings, and the **Linked Jira issues** section listing every prior ticket created from this control (each with its own **View in Jira** link). At the bottom of the panel is a prominent full-width **Create ticket** button.

![Failing control detail panel with Linked Jira issues section and Create ticket CTA](/assets/images/ccm-control-detail-create-ticket-button-5516143fb24e2cf177c413a11aeefb7b.png)

Click **Create ticket**. The Create ticket modal opens.

> **INFO**
> 
> Existing **Linked Jira issues** rows do **not** block creating another ticket. Tickets stack chronologically and each one is independently created in Jira. Use the existing rows as context (a colleague may have already filed it) before deciding to file again.

## Step 3: Fill the four fields

The Create ticket modal has exactly four fields in 1.0. Project, issue type, and any Jira-side custom fields are determined by the **Workflow** you select - they are not exposed in this modal in this release.

![Create ticket modal with Workflow, Title, Description, and Assignee fields](/assets/images/create-ticket-modal-d6303c087312c4cf37c3c67e61c8da53.png)

| # | Field | Behavior |
| --- | --- | --- |
| 1 | **Workflow** | Required. Dropdown of every **Active** Jira workflow (instance) in your workspace. If exactly one exists, it is preselected. The Workflow you pick determines the Jira project, issue type, and connection that will receive the ticket. |
| 2 | **Title** | Required. Single-line text input. Prefilled with `Control failure: {control name}` - for example, \`Control failure: 8.11a (AWS) |
| 3 | **Description** | Optional. Rich-markdown editor with a toolbar covering H1-H4, bold, italic, strike, inline code, code blocks, blockquotes, ordered and bullet lists, horizontal rules, links, and tables. Prefilled from the control's description text plus a list of failing tests. The markdown is converted to Jira wiki markup on submit so headings, lists, and links render natively in Jira. |
| 4 | **Assignee** | Optional. Searchable dropdown of Jira users resolved from the selected Workflow's connection. Until you pick a Workflow, the placeholder reads "Select a workflow to see list of assignees". Leave empty to file the ticket unassigned. |

## Step 4: Click Create ticket

When the four fields are filled in to your liking, click **Create ticket** at the bottom-right of the modal. JupiterOne POSTs the payload to the Workflow's underlying webhook and the modal closes when the call completes. A confirmation toast surfaces on success; on failure, the modal stays open with the error so you can correct and retry.

What is **not** in this modal in 1.0 - intentionally:

-   **Project** picker - determined by the Workflow's `Data in Jira integration` field
-   **Issue type** picker - determined by the Workflow's `Issue type` field
-   **Priority**, **Labels**, **Severity**, and other Jira fields - not exposed in 1.0

If you need to change which project or issue type a ticket files under, switch which Workflow you pick from the dropdown - or have an admin [create a new instance](/integrations/data-out/create-instance.md) targeting the project + issue type you need.

## Step 5: Confirm in CCM and jump to the Jira ticket

After Create ticket succeeds, two surfaces update.

### Linked Jira issues on the control detail panel

The control detail panel that originated the modal now lists the new ticket in the **Linked Jira issues** section, along with any prior tickets created for the same control. Each row shows the ticket title and a **View in Jira** external-link button.

![Linked Jira issues section on the control detail panel showing a created ticket](/assets/images/linked-jira-issues-section-cd736447432b6bc79fba10132067117d.png)

The list is reverse-chronological - the most recent ticket is at the top. Tickets are not deduplicated automatically; if your team only wants one open ticket per control at a time, encourage the team to check this section before clicking Create ticket again.

### View in Jira

Click **View in Jira** on any row to open that ticket directly in Atlassian. You should see:

-   **Title** prefixed with `Control failure:`
-   **Description** rendered with a **Failing control tests** heading and a bulleted list of the specific failing tests with entity counts (the markdown from the modal converts cleanly to Jira wiki markup)
-   **Reporter** set to the JupiterOne user who clicked Create ticket
-   **Assignee**, if you picked one in the modal
-   **Priority** and **Issue Type** populated from the Workflow's underlying configuration

![Resulting Jira ticket: Control failure title, Failing control tests description, Assignee and Reporter set](/assets/images/jira-ticket-created-7c6d2be5daca9b99f974115384bbe98a.png)

For the underlying outbound delivery record (status, timing, error message), open the originating Workflow's instance detail page (`Data out > Instances > {Workflow name}`) - the call you just made appears at the top of the per-instance Jobs table. See [Per-instance Jobs table](/integrations/data-out/manage-instances.md#per-instance-jobs-table).

## Empty states

If you click **Create ticket** but no Active Jira workflow exists, the modal renders an empty state instead of the four-field form. The message changes based on your role.

| Role | What you see | What to do |
| --- | --- | --- |
| **Full admin** | "No data-out ticketing workflow configured yet" + a **Go to connections** CTA pointing at `Data out > Connections` | Click the CTA. Follow [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md) end-to-end. Once a workflow is Active, return to the failing control and click Create ticket again. |
| **Non-admin** | "Ask an admin to set up a data-out ticketing workflow." | Notify a workspace admin. They can use the link above to set up the first workflow. |

The same empty state appears when every Jira workflow in the workspace has been **Stopped** - the Workflow dropdown only lists **Active** instances.

## Failure handling

If Jira rejects the ticket (for example, the project requires a custom field not provided, or the API token expired between when the workflow was created and when you clicked Create ticket), the modal surfaces the error inline and stays open. Your typed values are preserved. Common follow-ups:

-   **API token expired** - have an admin [re-authorize the connection](/integrations/data-out/configure-jira-connection.md#re-authorize-a-connection), then retry
-   **Required custom field missing** - put the missing context into the **Description** field and retry
-   **Project archived** - have an admin [edit the instance](/integrations/data-out/manage-instances.md#edit-an-instance) to point at a current project, or pick a different Workflow

For a fuller list, see [Troubleshooting](/integrations/data-out/troubleshooting.md).

---

Source: /integrations/data-out/manage-instances

# Manage instances

Once you have one or more instances configured, the **Instances** tab is your day-to-day operations view. From there you can scan health across providers, change the configuration of an instance, stop an instance temporarily, or remove one entirely. Clicking an instance name opens a per-instance detail page with deeper status and a focused Jobs table.

## The Instances tab

Open **Data out > Instances**. Instances are grouped by provider in collapsible sections. Each section header shows the provider's vendor brand and two badges: **N instances** (total in the group) and **N active** (currently running).

If you have not created any instances yet, the tab shows an empty state instead of provider groups:

![Instances tab empty state before any outbound destinations exist](/assets/images/instances-empty-state-31a5d9daf4bac20eefbbfec8fec1a06d.png)

Once at least one instance exists, the tab lists them under each provider:

![Instances tab grouped by provider with Jira instances](/assets/images/instances-tab-3b5c2f3ab86408aca7a5c6e44177ebc4.png)

Within each group, a table lists every instance with:

| Column | What it shows |
| --- | --- |
| **Instance** | The Workflow name configured on the instance. Click to open the [instance detail page](#instance-detail-page). |
| **Status** | **Active** when the instance is enabled; greys out when stopped. |
| **Last run** | Relative timestamp of the most recent job, for example `8 minutes ago` or `3 days ago`. |
| **Successful** | Count of jobs in the **Succeeded** terminal state. Lifetime count, not a rolling window. |
| **Failed jobs** | Count of jobs in the **Failed** terminal state. A red value here is a triage signal. |
| **Project issue type** | Compact label of the configured Jira project + issue type, for example `PROS--Task` (project key `PROS`, issue type `Task`). |

A **Status** filter dropdown above the table lets you narrow the list to **All**, **Active**, or **Stopped** instances. The **\+ Add instance** button on the right of the section header opens the [Add Jira instance wizard](/integrations/data-out/create-instance.md) for that provider.

## Row actions

Hover over a row to reveal three icons on the right edge: **Stop**, **Edit**, and **Delete**.

![Instance row hover state showing Stop, Edit, and Delete icons](/assets/images/instance-row-actions-df3816615bf0a2004c06f964c02bcdad.png)

| Icon | Action | Effect |
| --- | --- | --- |
| **Stop** (yellow octagon) | Pauses the instance. New CCM Create ticket calls and producer webhook events for this instance return immediately without creating a Jira ticket. The instance row Status flips to **Stopped**. | Reversible - hover again to see a **Start** action that re-enables it. |
| **Edit** (pencil) | Opens the [Edit workflow modal](#edit-an-instance) | Reversible - changes apply on save. |
| **Delete** (trash) | Permanently removes the instance | **Not reversible**. Confirm in the dialog. Existing Jobs records are retained for audit but no new jobs can be created against this instance. |

## Edit an instance

Clicking the **Edit** (pencil) icon on a row opens the **Edit workflow** modal.

![Edit workflow modal with Workflow name, Data in Jira integration, and Issue type fields](/assets/images/instance-edit-workflow-4a37fd728288016f8ac0c4d66eb492dc.png)

The fields match Step 2 of the [Add Jira instance wizard](/integrations/data-out/create-instance.md#step-2---configure):

| Field | What you can change |
| --- | --- |
| **Workflow name** | Update the friendly label. The new name appears immediately in the Instances tab and in the CCM Create ticket modal's Workflow dropdown. |
| **Data in Jira integration** | Re-target the instance to a different Jira project URL. Useful when a project key is renamed in Jira, or when you want to re-point an existing instance at a different project. |
| **Issue type** | Change the Jira issue type new tickets are filed under. The dropdown is searchable - start typing the project key (for example, `pros`) to narrow the list. |

Click **Save changes** to apply. The next CCM Create ticket call against this instance will use the new configuration.

> **INFO**
> 
> Editing an instance does **not** change the underlying Connection. To rotate credentials or repoint an instance to a different Atlassian site, edit the **Connection** instead via [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md#edit-an-existing-connection).

## Stop versus Delete

Use **Stop** when you want to temporarily disable an instance - for example, while you investigate a string of failures, or when the target Jira project is undergoing maintenance. Stop is reversible and preserves the instance's history.

Use **Delete** only when the instance is no longer needed. Deletion is irreversible. If a producer (such as the CCM Create ticket modal) has been pointed at the deleted instance, the next call will fall back to the workflow picker - admins will need to choose a different instance.

## Instance detail page

Click any instance name to open its detail page. The breadcrumb shows the path: `Data out > Instances > {Workflow name}`.

![Instance detail page with summary header and per-instance jobs table](/assets/images/instance-detail-page-1e9050638080568892d8dcfbc44a7fa7.png)

### Summary header

The header surfaces eight metrics at a glance:

| Metric | What it means |
| --- | --- |
| **Status** | **Active** or **Stopped**. |
| **Last run** | Timestamp of the most recent job. |
| **Last updated** | When the instance configuration was last edited (Workflow name, project, issue type). |
| **Lifetime tasks** | Total number of jobs this instance has produced over its lifetime. |
| **Jobs succeeded** | Lifetime count of jobs in **Succeeded** state. |
| **Jobs failed** | Lifetime count of jobs in **Failed** state. |
| **Data in integration** | The Jira project URL the instance is scoped to (`https://{site}/jira/software/projects/{KEY}`). |
| **Issue type** | The compact `Project--IssueType` identifier the instance writes under. |

### Per-instance Jobs table

Below the header is a Jobs table scoped to this instance only. Use it as the first stop when triaging a single instance's recent activity.

| Column | What it shows |
| --- | --- |
| **Job ID** | Unique identifier of the outbound delivery, for example `j-AaD9zzYn-DBYwFH-CD`. Useful for cross-referencing in support tickets. |
| **Status** | Terminal state: **Succeeded** or **Failed**. |
| **Started** | Relative timestamp when the job began. |
| **Completed** | Relative timestamp when the job reached its terminal state. |
| **Error message** | Short failure reason for jobs in the **Failed** state, for example `Webhooks: new ...`. Empty for **Succeeded** jobs. |

A search box and an **All statuses** filter let you narrow the table when an instance has many jobs.

For triage tips on common error messages and stuck jobs, see [Troubleshooting](/integrations/data-out/troubleshooting.md).

### Top-right kebab menu

The kebab (three-dot) menu in the top right of the detail page offers the same actions as the row hover: **Stop**, **Edit**, **Delete**. Use this when you have already drilled into the instance and want to take an action without going back to the list.

## Permission model

In 1.0, every action on the Instances tab and instance detail page (view, create, edit, stop, delete) requires the **full admin** role. Non-admins do not see the Data Out left-nav entry. See [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md#prerequisite-mint-an-atlassian-api-token) for the upstream prerequisite.

---

Source: /integrations/data-out/overview

# Data Out overview

**Data Out** is the JupiterOne surface that pushes events out of J1 and into the systems where your security and engineering teams already work. In the 1.0 release, Data Out powers automated and on-demand Jira ticket creation - including a one-click **Create ticket** action on every failing Continuous Control Monitoring (CCM) control test.

Data Out lives under **Integrations** in the J1 left navigation and is organized into two tabs.

![Data out tabs - Connections and Instances](/assets/images/data-out-tabs-overview-53e3ff3531c872543aae8edfbe501e29.png)

## What you can do with Data Out 1.0

-   Authorize one or more **Jira** connections using an Atlassian API token
-   Stand up named **instances** that route J1 events to a specific Jira project + issue type
-   Send a real test ticket from the wizard to confirm the round-trip before you rely on the integration
-   Click **Create ticket** on any failing CCM control test to file a Jira ticket with a prefilled title and description, then jump straight to the ticket via **View in Jira**
-   Watch every outbound delivery on each instance's detail page and drill in on failures via the **Error message** column

> **NOTE**
> 
> In 1.0 the **Workflow** label you see in the Create ticket modal and the **Instance** label you see on the Instances tab refer to the same object. The two terms are used interchangeably across the product and these docs.

## How Data Out is organized

Data Out is laid out as two top-level tabs. The default landing tab is **Connections**.

![Connections tab - provider catalog with Jira (Connected), ServiceNow and Asana (Coming soon)](/assets/images/connections-tab-providers-29dcfdbab6f6e86ef38f194c899b1a7a.png)

| Tab | What it does |
| --- | --- |
| **Connections** | Catalog of outbound providers. Add or edit the credentials Data Out uses to authenticate to an external system. Jira is live in 1.0; ServiceNow and Asana are surfaced as **Coming soon**. |
| **Instances** | Lists every named instance (workflow) you have running, grouped by provider, with status, last-run time, success and failure counts, and project / issue-type metadata. Click any instance to open its detail page and see the per-instance Jobs table that lists every outbound delivery for that instance. |

## Glossary

| Term | Meaning |
| --- | --- |
| **Connection** | A set of credentials that authorize JupiterOne to talk to an external system (for example, an Atlassian site + email + API token for a Jira workspace). One Jira workspace usually needs one Connection. |
| **Instance** (also called **Workflow**) | A named delivery target that combines a Connection with a target context. For Jira, the target context is a **Data in Jira integration** (which scopes you to a Jira project) and an **Issue type**. You can have many instances per connection. |
| **Job** | The record of a single outbound delivery for an instance - one row per outbound POST to the target system, including the resulting external ticket key on success or the error on failure. Jobs surface in the per-instance Jobs table on each instance's detail page. |
| **Provider** | The external system that Data Out talks to. 1.0 ships **Jira** as the live provider. ServiceNow and Asana are coming soon. |

## Prerequisites

Before you can configure Data Out:

-   You must be a **full admin** in the JupiterOne workspace. Connections and Instances are admin-only surfaces in 1.0
-   You need an Atlassian account with permission to create issues in at least one Jira project on your target site
-   You need to be able to mint an Atlassian **API token** for that account at [id.atlassian.com](https://id.atlassian.com/manage-profile/security/api-tokens)

> **INFO**
> 
> The Jira **Data in** integration is a separate, optional input. If you have it configured, the Instance wizard can scope an instance to a specific Jira project URL it has already discovered. You can still create instances without a Data in Jira integration. See [Add an integration](/integrations/add-an-integration.md) for setting up data ingestion.

## Get started

The fastest path to your first ticket is the four-step quick start below. Follow them in order; each page picks up where the previous one left off.

1.  **[Configure a Jira connection](/integrations/data-out/configure-jira-connection.md)** - mint an Atlassian API token and authorize J1 to talk to your Jira site
2.  **[Create an instance](/integrations/data-out/create-instance.md)** - pick the connection, choose a Jira project + issue type, and (optionally) send a test payload
3.  **[Test your instance](/integrations/data-out/test-instance.md)** - send a real `[TEST]` ticket and confirm it lands in Jira
4.  **[Create a ticket from a failing CCM control test](/integrations/data-out/create-ticket-from-ccm.md)** - the flagship 1.0 use case: turn any failing control into a tracked Jira ticket in three clicks

After you have a working instance, the reference pages cover ongoing operations:

-   **[Manage instances](/integrations/data-out/manage-instances.md)** - edit, stop, delete, and inspect instance details (including the per-instance Jobs table that records every outbound delivery)
-   **[Troubleshooting](/integrations/data-out/troubleshooting.md)** - common failure modes and how to fix them
-   **[Route tickets by organizational unit](/features/admin/organizational-units.md#ticketing-workflows-and-routing)** - assign an instance to each organizational unit (and a default per namespace) so vulnerability case tickets go to the owning team's project

---

Source: /integrations/data-out/test-instance

# Test your instance

Sending a test payload through a new instance is the fastest way to confirm everything is wired correctly: the connection has the right token, the configured Jira project exists and accepts the issue type, and JupiterOne can write to it. We strongly recommend running a test on every instance before you let it serve real CCM tickets.

## When to test

-   **Right after creating an instance** - the [Add Jira instance wizard](/integrations/data-out/create-instance.md) ends on a Test step for exactly this reason
-   **After re-authorizing a connection** - to confirm the new API token still has write access to the project
-   **After changing a Jira project's permissions or issue-type configuration** - to catch breakage before a real CCM ticket fails

## Test from the wizard

The cleanest test path is the **Test** step of the [Add Jira instance wizard](/integrations/data-out/create-instance.md#step-3---test). It walks you through Summary and Description, posts a real ticket, and lets you confirm in Jira immediately.

![Add Jira instance: Test step with Summary, Description, Send test, and Finish](/assets/images/add-instance-step3-test-59e2ead3b0f88a29ef0b3aa585706f4f.png)

| Field | Default | What to do |
| --- | --- | --- |
| **Summary** | `Test PROS:Task ticket to be created` (varies by configured issue type) | Edit to something distinctive so the ticket is easy to find in Jira, for example `[J1 Data Out test - 2026-05-18]`. |
| **Description** | `testing ticket description` | Optional. Add any context you want included in the test ticket body. |

Click **Send test** to fire the payload at the configured Jira project + issue type. After Send:

-   A new ticket appears in Jira against the project the instance is scoped to, with the issue type the instance is configured for
-   Open the ticket in Jira and confirm the Summary and Description landed as expected
-   **Delete the test ticket** in Jira once you have verified - test tickets count toward project clutter and can confuse downstream automation

If you do not need to send a test (for example, you just verified an identical instance pointing at the same project), click **Finish** to close the wizard without sending.

## What success looks like

When the test succeeds, two surfaces update:

-   The instance row's **Successful** count on the Instances tab (and on the connection card's instance table on the provider detail page) increments by 1
-   The instance's **Last run** timestamp updates to "just now"

![Provider detail page showing instance with success and failure counts](/assets/images/provider-detail-jira-42432efccc1466b7c4a360f3e31cee93.png)

You can also open the instance detail page and find the test job at the top of the per-instance Jobs table with status **Succeeded**. See [Manage instances](/integrations/data-out/manage-instances.md#instance-detail-page).

## What failure looks like

If the test payload fails, the **Failed jobs** count on the instance row increments by 1 and the **Last run** timestamp shows the failure time. The instance Status remains **Active** - a single failed job does not deactivate the instance.

To see the error message:

1.  Click the instance name to open the instance detail page
    
2.  The most recent job appears at the top of the Jobs table with status **Failed** and an **Error message** column
    
    ![Instance detail page with two failed jobs and Webhooks: new ... error messages](/assets/images/instance-detail-page-1e9050638080568892d8dcfbc44a7fa7.png)
    
3.  Common causes:
    
    -   **Authentication failure** - the API token expired, was revoked, or the Atlassian account lost project access. Connection-level recovery is documented at [Re-authorize a connection](/integrations/data-out/configure-jira-connection.md#re-authorize-a-connection)
    -   **Issue type not present in the project** - the configured issue type is not enabled in the target Jira project. Edit the instance and pick an issue type that is enabled for the project, or have your Jira admin enable the issue type in the project's issue scheme
    -   **Project archived or moved** - the Jira project was archived in Atlassian or its key changed. Update the **Data in Jira integration** field to point at the new project
    -   **Required custom field missing** - the project requires a custom field that the test payload does not provide. In 1.0, the test payload is fixed to Summary + Description; if the project requires more, file a normal ticket through the [CCM Create ticket flow](/integrations/data-out/create-ticket-from-ccm.md) where you can fill the description with the missing context

For a fuller list of failure modes, see [Troubleshooting](/integrations/data-out/troubleshooting.md).

## Re-running a test on an existing instance

In 1.0, the wizard's **Test** step is the only test surface. To re-test an existing instance:

1.  Open **Data out > Instances** (or the provider detail page)
2.  Find the instance row, hover, and click the **Edit** (pencil) icon
3.  The [Edit workflow modal](/integrations/data-out/manage-instances.md#edit-an-instance) opens. Change nothing if you just want to re-test, or update fields as needed
4.  Save - the next CCM Create ticket call (or webhook event) is the next live exercise of the instance. Watch the **Successful** and **Failed jobs** counts on the row, or open the instance detail page to see the per-job result

A Send-test button on the existing-instance edit modal is on the roadmap; for now, the wizard's Test step is the simplest dedicated way to send a synthetic payload.

---

Source: /integrations/data-out/troubleshooting

# Troubleshooting Data Out

Use this page as a symptom-first index. Find the line that matches what you are seeing, follow the link, and you should be back to a working state in a few minutes.

## Connection problems

### Connection fails to verify

**Symptom**: You filled in Connection name, Host name, Email, and API Token on the [Connect step](/integrations/data-out/configure-jira-connection.md#step-1---connect), clicked **Next**, and the Verify step shows an error instead of "Your connection is working!".

**Most likely causes**:

-   **Wrong Host name format** - the field expects the bare Atlassian site (`your-company.atlassian.net`), not a full URL. Strip any `https://` prefix or trailing path
-   **Email/token mismatch** - the token belongs to a different Atlassian account than the email you entered. Mint a fresh token from the [exact account](https://id.atlassian.com/manage-profile/security/api-tokens) whose email you typed in
-   **Token revoked** - check `id.atlassian.com/manage-profile/security/api-tokens`. If the token name does not appear, it has been revoked
-   **Atlassian site is on the wrong region or has SSO-only access** - confirm in Atlassian admin that API token authentication is allowed for your site

Mint a new token, edit the connection, paste the new value into **API Token**, and re-step through Verify.

### Authorization status reads "Needs reauthorization"

**Symptom**: The connection card on **Data out > Connections > Jira** shows a yellow **Needs reauthorization** badge.

**Cause**: The most recent run failed authentication. Almost always an expired or revoked API token, or the underlying Atlassian account losing access to all configured Jira projects.

**Fix**: Follow [Re-authorize a connection](/integrations/data-out/configure-jira-connection.md#re-authorize-a-connection). If a fresh token still fails Verify, the Atlassian account itself has lost project access - have a Jira admin restore it.

### "I cannot find the kebab menu to edit a connection"

The kebab menu (`...`) sits at the right end of the connection header on the per-provider detail page (`Data out > Connections > Jira`), not on the provider catalog card. If you are on the catalog page (the one with Jira / ServiceNow / Asana cards) and want to edit, click the Jira card's **View ->** button first.

## Instance problems

### Test ticket does not appear in Jira

**Symptom**: You clicked **Send test** on the [Test step](/integrations/data-out/test-instance.md#test-from-the-wizard) of the Add Jira instance wizard. The wizard reports success, but no ticket appears in the configured project.

**Diagnosis**:

1.  Open **Data out > Instances**, find the new instance, and check the **Successful** count. If it incremented to 1, Jira accepted the payload - the ticket exists somewhere
2.  Confirm which project the instance writes to by clicking the instance name and reading the **Data in integration** field on the detail page
3.  In Jira, navigate to that project and search for the test Summary text. Test tickets often land in the project's default backlog rather than its Active sprint

If **Successful** stayed at 0 and **Failed jobs** incremented, the payload was rejected - see [A job failed](#a-job-failed) below.

### Issue type is missing from the dropdown

**Symptom**: On the Configure step, the **Issue type** dropdown does not contain the issue type you expect for the project you picked.

**Cause**: The Jira project's **Issue scheme** does not include that issue type. Issue types in Jira are scoped to schemes, and a project only sees the issue types its scheme allows.

**Fix**: Have a Jira admin add the issue type to the project's issue scheme in Atlassian, then reopen the wizard. The dropdown re-fetches when you re-open Configure.

### Instance is Active but no tickets are being created

**Symptom**: Status reads **Active**, **Last run** is hours or days ago, and **Successful** + **Failed jobs** counts are not changing.

**Diagnosis**:

-   Confirm a producer is calling the instance. In 1.0, the primary producer is the [CCM Create ticket](/integrations/data-out/create-ticket-from-ccm.md) modal - if no one has clicked Create ticket on a failing control, the instance has nothing to do
-   Check that the instance is **Active**, not **Stopped**. Stopped instances accept calls but return immediately without creating a Jira ticket
-   Confirm CCM users see your instance in the Workflow dropdown of the Create ticket modal. If they do not, the instance may have been stopped, or they may be looking at a different workspace

## Job problems

### A job failed

**Symptom**: A job in the [per-instance Jobs table](/integrations/data-out/manage-instances.md#per-instance-jobs-table) on an instance's detail page shows status **Failed** with an **Error message** like `Webhooks: new ...`, `401`, `403`, or a Jira validation message.

**Fix**: Decode the **Error message** column using the table below.

| Message starts with | Likely cause | Where to fix |
| --- | --- | --- |
| `Webhooks: new ...` | The outbound webhook that backs the instance failed to execute. Almost always a transient issue or an upstream Jira project mis-configuration. | Re-check the configured **Data in integration** + **Issue type** in the [Edit workflow modal](/integrations/data-out/manage-instances.md#edit-an-instance). If both are valid, retry the original CCM Create ticket call. |
| `401` / `Unauthorized` | The connection's API token is invalid (revoked or expired). | [Re-authorize the connection](/integrations/data-out/configure-jira-connection.md#re-authorize-a-connection). |
| `403` / `Forbidden` | The Atlassian account lost permission to write to the configured Jira project. | Have a Jira admin restore project permissions for the account, or repoint the instance via [Edit](/integrations/data-out/manage-instances.md#edit-an-instance). |
| `404` / `not found` | The configured project or issue type no longer exists. | [Edit the instance](/integrations/data-out/manage-instances.md#edit-an-instance) and pick a current project + issue type. |
| Validation error referencing a field name | The Jira project requires a field that the producer did not supply. | Re-fire the CCM Create ticket call, including any required information in the **Description** field. |

### A job is stuck

**Symptom**: A job has been **Started** for several minutes without reaching a terminal state.

**Diagnosis**:

-   Refresh the instance detail page - the row may have already completed and the UI is stale
-   Check the connection status (`Data out > Connections > Jira`). If the connection flipped to **Needs reauthorization** while the job was in flight, the job will move to **Failed** as soon as the retry exhausts

If a job remains stuck for more than 15 minutes, contact JupiterOne support with the **Job ID** (the `j-...` value from the per-instance Jobs table) - the underlying outbound delivery may need to be cancelled manually.

## CCM Create ticket problems

### The Workflow dropdown is empty

**Symptom**: You clicked **Create ticket** on a failing control. The modal opens but the Workflow dropdown shows no options.

**Cause**: There are no **Active** Jira instances in the workspace. Either none have been created, or every existing instance has been **Stopped**.

**Fix (admin)**: Click the **Go to connections** CTA in the modal's empty state, follow [Configure a Jira connection](/integrations/data-out/configure-jira-connection.md), and create at least one instance.

**Fix (non-admin)**: The modal's empty state reads "Ask an admin to set up a data-out ticketing workflow." - flag a workspace admin.

### "I do not see the Create ticket button on a control"

**Symptom**: A control is failing but the bottom of its detail panel does not show a Create ticket CTA.

**Causes**:

-   The control's status is **Passing** rather than **Failing**. The Create ticket CTA is only shown on failing controls
-   Your role does not allow ticket creation. Contact an admin
-   The Data Out feature is not enabled on your workspace. Contact JupiterOne support

### "The Linked Jira issues section is empty after I clicked Create ticket"

**Symptom**: You clicked Create ticket and the modal closed without an error, but the Linked Jira issues section on the control detail panel is still empty.

**Diagnosis**:

1.  Refresh the control detail panel - the Linked Jira issues list updates after the call completes
2.  Open the originating Workflow's instance detail page (`Data out > Instances > {Workflow name}`) and look for the most recent row in the per-instance Jobs table. If it is **Succeeded**, the ticket was created in Jira - the control panel may simply be stale; refresh it
3.  If the most recent job is **Failed**, the ticket never made it into Jira. Read the **Error message** column and follow [A job failed](#a-job-failed)

### Created tickets land in the wrong Jira project

**Symptom**: Tickets are landing in a Jira project, but not the one you expected.

**Cause**: The Workflow you picked in the dropdown is configured against a different project than you assumed.

**Fix**: Open **Data out > Instances**, click the Workflow name, and confirm the **Data in integration** and **Issue type** fields. To repoint:

-   For a one-off correction, pick a different Workflow on the Create ticket modal next time
-   For a permanent change, [edit the instance](/integrations/data-out/manage-instances.md#edit-an-instance) - update **Data in Jira integration** and **Issue type** as needed, then save

## Still stuck?

If none of the above resolves your issue, gather the following information before contacting [JupiterOne Support](https://support.jupiterone.io):

-   The Job ID of the failing job (from the per-instance Jobs table on the instance detail page)
-   A copy of the **Error message** column value for that job
-   The Workflow name of the affected instance
-   The control identifier (if the symptom is on the CCM side)
-   A screenshot of the **Authorization status** badge on the connection card

Support can correlate the Job ID with the underlying outbound delivery to pinpoint where the call dropped.

---

Source: /integrations/data-sources

# Data Source Configuration

## Overview

Each JupiterOne integration ingests multiple data sets. Each data set we call a Data Source. This feature allows users to define which **Data Sources** are **enabled** or **disabled** at multiple levels, providing flexibility while maintaining control. The configuration follows a structured hierarchy:

1.  **Integration Defaults** – Prescribed by the integration itself.
2.  **Organization Overrides** – Organization-wide settings that modify the defaults for an integration (**applied only during instance creation**).
3.  **Instance-Specific Overrides** – Final configuration at the individual instance level.

---

## Defaults and Overrides in Detail

### 1\. Integration Defaults

-   Each integration defines a set of **Data Sources**. Some **Data Sources** may be **enabled by default**, while others are **disabled**.
-   These defaults are applied when a new integration instance is created.
-   New **Data Sources** that are added to an existing integration will be **disabled by default**.

### 2\. Organization Overrides (Applied at Instance Creation)

-   Integration admins can configure **Data Sources** defaults to override the integration level defaults.
    
-   Look for the cog icon in the top left corner next to the Integration name to set these Organization level defaults.
    
    ![Org level overrides](/assets/images/data-sources-3-9c9036314a9fab0728bf8af29aaba6de.png)
    
-   These overrides **only take effect when a new instance is created**.
    
-   After creation, organization settings **do not** affect existing instances.
    

### 3\. Parent Instance Overrides (Applied at Child Instance Creation)

-   Some integrations, like **AWS**, _**GCP**_, or **Azure**, support **parent-child instances**.
-   A parent instance can specify its own **Data Source** configuration.
-   These parent instance settings **are copied to the children when they are created**.
-   Once a child instance is created, changes to the parent do **not** affect it.

### 4\. Instance-Specific Overrides

-   After an instance is created, the user can modify **Data Source** settings as desired.

---

## Example Scenarios

| Layer | Data Source: `AWS Glacier Service` | Data Source: `AWS EC2 Instances` |
| --- | --- | --- |
| **Integration Default** | Disabled | Enabled |
| **Organization Override** _(applied at creation)_ | Enabled | No Change |
| **Parent Instance Override** _(applied at creation, if applicable)_ | Disabled | No Change |
| **Instance-Specific** | Not Changed | Disabled |
| **Final Result** | **Enabled** | **Disabled** |

---

## Key Notes

-   **Organization Overrides and Parent Instance Overrides are only applied when an instance is created.**
-   **Instance-specific settings are always adjustable within the inherited constraints.**

---

Source: /integrations/development/collector

# Overview

The JupiterOne Collector enables you to ingest data from on-premise and self-hosted applications within your network, providing secure and flexible integration options. Collectors are deployed within your infrastructure and registered to JupiterOne, allowing you to control what resources are accessed and how data is transmitted.

## Collector Overview

JupiterOne Collectors can be deployed in two primary ways:

-   **Docker-based Collector**: Best for dedicated VMs or single-host deployments.
-   **Kubernetes-based Collector**: Best for organizations already using Kubernetes.

Each collector instance is capable of running multiple integrations and can be managed centrally from the JupiterOne console.

## Choosing a Deployment Option

| Feature | Docker-based Collector | Kubernetes-based Collector |
| --- | --- | --- |
| **Environment** | Dedicated VM/host | Kubernetes cluster |
| **Installation** | Docker commands | Helm chart |
| **Scalability** | Single instance | Multiple pods/replicas |
| **Management** | Direct container management | Kubernetes-native (CRDs, operators) |
| **Best for** | Simple deployments, legacy systems | Cloud-native environments, multi-tenant |
| **High Availability** | Limited | Native Kubernetes HA features |

-   If you want a simple, VM-based deployment, choose the **[Docker-based Collector](/integrations/development/collector/docker.md)**.
-   If you are running in a Kubernetes environment, choose the **[Kubernetes-based Collector](/integrations/development/collector/kubernetes.md)**.
-   If your hosts can't reach GitHub: on Kubernetes, use a [private registry](/integrations/development/collector/kubernetes.md#private-registry-configuration); otherwise, [run integrations without a Collector](/integrations/development/collector/run-without-collector.md).

## Next Steps

-   [Deploy with Docker](/integrations/development/collector/docker.md)
-   [Deploy with Kubernetes](/integrations/development/collector/kubernetes.md)

For more information on architecture, security, and frequently asked questions, see the sections below.

## Architecture Notes

The JupiterOne Collector is built as an extension of the JupiterOne platform, with configuration all managed from within the JupiterOne application. The Collector registers itself in your environment and will communicate with the JupiterOne platform to pull its configuration and job queue. There is no requirement for the JupiterOne cloud service to have access into your network, allowing for secure data collection.

### Docker-based Architecture

The Docker-based collector orchestrates a container runtime environment for the workloads, with very straightforward installation requirements. It is a lightweight custom container orchestration tool, running the same integration workloads as in the JupiterOne cloud service.

### Kubernetes-based Architecture

The Kubernetes Integration Operator leverages native Kubernetes features, using Custom Resource Definitions (CRDs) to manage integration workloads as standard Kubernetes pods. This approach provides better scalability and integrates seamlessly with existing Kubernetes tooling and practices.

In normal operation the JupiterOne collector will be:

-   Sending regular heartbeats to the JupiterOne platform
-   Reading from its dedicated job queue

Once an integration task is scheduled for a Collector to run it will appear on the Collectors job queue. This job will provide the collector with all the details required to configure and launch the integration task. This task will be created as a one-time container that will run the integration workload.

## Security Considerations

By running JupiterOne Collectors in your own infrastructure, you are entering into a shared responsibility model for the security of that infrastructure. Whilst we at JupiterOne do everything we can to protect your data and configurations, it is the customer's responsibility to ensure that the collector host machine is secure.

The following recommendations should be reviewed and considered:

-   Ensure that the host OS and container runtime are kept up to date.
-   Ensure that access to the collector host machine is properly managed.

The collector stores the private key used for encryption of the job configs in `/etc/.j1config/`. This directory is set to be readable only by root, but depending on how you operate the container runtime these permissions should be reviewed.

> **CAUTION**
> 
> If this key is accessed the integration jobs for the collector can be decrypted, potentially allowing the credentials used for the integrations to be read. It's important that all integration accounts are minimal read-only accounts where possible.

## FAQ

#### Q: Can I run the Collector using EKS, ECS, or OpenShift?

Yes! The JupiterOne Integration Operator now supports running collectors in Kubernetes environments including EKS, ECS, and OpenShift. There are two deployment options:

1.  **Kubernetes Integration Operator**: Use the Helm chart to deploy the operator in your Kubernetes cluster. This is the recommended approach for Kubernetes environments.
2.  **Docker-based Collector**: For non-Kubernetes environments, use the traditional Docker-based collector on a dedicated VM.

#### Q: Does J1 Collector do network scanning?

No, the JupiterOne collector does not do any additional scanning in your environment. The JupiterOne Collector can only run integration jobs that already exist.

What the Collector does give is the ability for JupiterOne and the community to build new integration types that would not have been possible from a saas-only integration workload.

#### Q: The integration I want to configure doesn't have a collector option

Not all integrations are compatible with collectors, either because of the way they're built (e.g., the AWS integration and its use of AWS roles for authentication), or because the integration has not been packaged and tested yet.

If there is an integration that you would want to run on a collector that isn't currently compatible, please [contact us](mailto:support@jupiterone.com).

#### Q: What network connectivity is required?

The collector needs to be able to reach the following domains:

-   `ghcr.io`, `pkg-containers.githubusercontent.com` and `github.com`. The GitHub package registry where the collector and integration images are hosted.
-   `*.jupiterone.io`, where the collector registers, sends it heartbeats, reads the integration job queue, and finally sends the data collected by the integration jobs. This can be optionally restricted to the region specific instance, such as `*.us.jupiterone.io` or `*.eu.jupiterone.io`.
-   Whatever domains the integration itself needs to connect to, for example your local vSphere instance.

#### Q: Do all features of all integration work?

No, there are some limitations when the integration is running on a JupiterOne collector, but generally these limitations don't impact real use cases. For example, you may find that some integrations offer the ability to "Test Credentials", this operation will only work if the integration target is reachable from the JupiterOne Cloud infrastructure, in which case you're probably not going to run that integration in a collector.

There may also be issues with some of the authentication methods, for example where the integration authenticates based on a shared trust between JupiterOne infrastructure and the target of the integration.

#### Q: Can I run the JIRA integration (e.g., create tickets)

No, the JupiterOne Collector only runs ingest based integration workloads, it does not include any action/alert based integrations at this time.

#### Q: I installed a J1 Collector but I don’t see it registered in my JupiterOne console

This indicates that the JupiterOne Collector was unable to start or register with JupiterOne. The first step is to review the logs produced by the JupiterOne collector components.

Running the command `docker ps --all` will show which containers ran (or are running). You can expect to find references to an "installer", "runner" and "daemon" containers. Please use `docker logs <CONTAINER_ID>` to retrieve the logs associated with the containers and review, attaching the logs to a support case, if required.

> **CAUTION**
> 
> Please be sure to redact any sensitive details prior to sending.

---

Source: /integrations/development/collector/docker

# Docker based Collector

The Docker-based JupiterOne Collector is designed for deployment on a dedicated Linux VM or host using Docker Engine. This guide covers requirements, installation, and management.

## System Requirements

|  |  |
| --- | --- |
| **Operating System** | Any modern 64-bit systemd linux distribution should work. The JupiterOne Collector has been specifically tested against the following Operating Systems using the official Docker Engine:
-   Ubuntu Server 22.04 LTS
-   Ubuntu Server 23.04
-   RedHat Enterprise Linux 9.4
-   RedHat Enterprise Linux 8.9

 |
| **Container Runtime** | Whilst any docker compatible container runtime should work (e.g., podman), only the official Docker engine has been tested and certified to work. See [Docker installation instructions here](https://docs.docker.com/engine/install/). There are specific notes later in this document if you wish to use `podman` instead of Docker, see [Podman Container Runtime](#podman-container-runtime). |
| **Docker Engine Version** | **Minimum:** Docker Engine 24.0. **Recommended:** 28.x or 29.x.  
  
Any release at or above the minimum is supported. JupiterOne's own testing covers Docker Engine 24.0, 26.1, 27.5, 28.5, 29.0, 29.1, and 29.8.  
  
Docker Engine 29 and later also require Collector images `daemon-v1.5.0` and `runner-v1.6.2` or later. If your Collector is older than that, update the Collector **before** you upgrade Docker Engine, because an older Collector cannot update itself once Docker Engine 29 is installed. See [Upgrading Docker Engine](#upgrading-docker-engine). |
| **CPU** | 4 vCPU  
  
The CPU requirement is dependent on the integration workload, but 4 vCPU is a good starting point. |
| **RAM** | 2 GB minimum, 8 - 12 GB recommended.  
  
Most integration jobs operate with <1GB of RAM but the memory requirement will depend on the number of entities being handled. Some very large integration instances, those handling millions of entities, may require 10GB+ of available memory. |
| **Networking** | The Collector needs to be able to connect to JupiterOne's services at `*.us.jupiterone.io` or `*.eu.jupiterone.io` over `HTTPS/443`.  
  
The JupiterOne Collector host also needs connectivity to the integration target; e.g., if running an Active Directory integration, it will need connectivity to your local LDAP port of your AD servers.  
  
The container images are pulled from the GitHub package registry at `ghcr.io`. The container images are all signed by JupiterOne, this requires connectivity to the cosign signing service also hosted at github.  
  
If your hosts can't reach GitHub, see [Run integrations without a Collector](/integrations/development/collector/run-without-collector.md). |
| **Storage** | 50 GB available local storage.  
  
JupiterOne integrations running on the Collector do not themselves need persistent storage. Only the JupiterOne Collector itself requires persistent storage to maintain a configuration file.  
The Collector host should have sufficient local storage to hold logs for the various services. |

## Container Runtime

We recommend using the official Docker Engine. The installation instructions depend on the host OS, and can be found here: [https://docs.docker.com/engine/install/](https://docs.docker.com/engine/install/)

> **NOTE**
> 
> You do not need to install Docker Desktop features. For Ubuntu you would use these instructions: [https://docs.docker.com/engine/install/ubuntu/](https://docs.docker.com/engine/install/ubuntu/)

You can confirm you have a working container runtime environment on your host machine using a test command:

```text
sudo docker run hello-world
```

Which should produce the following output: ![Example docker run result](/assets/images/docker-example-cbe20b17c73ab4d888c0b8b906f08fab.png)

This confirms that the docker engine is running and able to pull and launch containers. At this point you are ready to deploy a collector.

## Deploying a Collector

To set up a collector, you will need a JupiterOne account.

1.  Navigate to **Integrations > Collectors**, choose **New collector**. Provide a name for the new collector and select **Create**:

![Creating a collector in JupiterOne](/assets/images/create-collector-4aab5e3106ac5e90bf6ab786543485f4.png)

2.  Take the terminal command and run it in your new collector instance.

> **NOTE**
> 
> You may need to prefix the command with `sudo` depending on how your permissions are configured and your current user.

![Kicking off the collector setup process in JupiterOne](/assets/images/collector-config-984cb17ea178f4182d47cf59ceb1c916.png)

Example command:

```text
docker run -e JUPITERONE_AUTH_TOKEN='...' -e JUPITERONE_COLLECTOR_ID='...' -e JUPITERONE_ACCOUNT_ID='...' -e JUPITERONE_API_BASE_URL='...' -v /etc/.j1config:/etc/.j1config -v /var/run/docker.sock:/var/run/docker.sock ghcr.io/jupiterone/collector-scripts/installer:latest
```

-   `docker run` is the command to run the installer container.
-   `-e` are environment variables for authentication and configuration.
-   `-v` are volume mounts for configuration and Docker socket access.

Running this command on your Collector host will kick off the process to setup the collector.

3.  Confirm the collector is running using `docker ps`. You should see two containers running (daemon and runner):

![Using the docker ps command to confirm collector is running](/assets/images/docker-confirm-2b1702cb1a83ed3af26c8597dadc0adf.png)

-   **Daemon**: Manages local state, upgrades, and health checks.
-   **Runner**: Manages the job queue and launches integration jobs.

To check which versions these are running later, see [Upgrading the Collector](#upgrading-the-collector).

4.  Examine the logs of the runner to ensure it's successfully connecting to JupiterOne:

![Examining runner logs to ensure success in connecting to JupiterOne](/assets/images/docker-log-ffc908ea84163b1bea2099f143536b1a.png)

At this point the collector is set up and running. You will see the collector as "Active" in the collector overview after a few minutes:

> **NOTE**
> 
> The collector containers are running with a restart policy of "unless-stopped", so they will restart automatically on failure, and will start automatically when the container runtime (re)starts, i.e. at system reboot time.

![JupiterOne Collecter status Active in the JupiterOne dashboard](/assets/images/collector-success-5be149749e24bb8224a7107d06bacc8d.png)

## Assigning an Integration

Assigning an integration job to a collector first requires that there are collectors registered and available. Once collectors are available, the process for defining an integration job and assigning it to a collector is straightforward.

For integrations that are collector compatible, complete the integration configuration as normal. During configuration, you'll notice there's an additional option to choose where the integration should run.

Select **Collector** on the integration instance, and choose the corresponding collector for which you'd like the integration to run.

![Choosing run on Collector within the JupiterOne integration instance configuration](/assets/images/integration-location-caff09d6752d5364027ed190220e03c0.png)

## Upgrading the Collector

The Collector keeps itself up to date. The daemon checks for new Collector versions every few minutes and replaces the daemon and runner containers automatically, so no action is normally required.

### Checking which version is running

Run:

```text
sudo docker ps
```

In the **IMAGE** column, the part after the final `:` is the version. For example, `ghcr.io/jupiterone/collector-scripts/runner:runner-v1.6.6` is running `runner-v1.6.6`.

The daemon and the runner are versioned separately, so check both. Version numbers increase over time and are compared from left to right: `runner-v1.6.6` is newer than `runner-v1.6.2`, and `runner-v1.10.0` would be newer than either.

> **NOTE**
> 
> After the Collector has updated itself, the daemon container is named `daemon-` followed by a unique identifier rather than simply `daemon`. This is expected.

### Reinstalling the Collector

If the Collector is not running, or its version is not updating, reinstall it by re-running the installer command from **Integrations > Collectors**. Reinstalling brings both the daemon and the runner to the current version.

Before you reinstall, remove the existing containers so that their names are free.

First list the Collector's containers. They are the ones whose image name contains `collector-scripts`:

```text
sudo docker ps -a --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}' | grep collector-scripts
```

Then remove them by the names shown in the first column, for example:

```text
sudo docker rm -f runner daemon
```

> **CAUTION**
> 
> Remove only the container names that the command above listed. Do not match on the words "runner" or "daemon" on their own, because your own containers may have names that contain them.

## Upgrading Docker Engine

> **CAUTION**
> 
> **Check the Collector version before you upgrade Docker, not after.**
> 
> To run Docker Engine 29 or later, the Collector must already be running `daemon-v1.5.0` and `runner-v1.6.2` or later. An older Collector cannot communicate with Docker Engine 29 at all, and because it needs Docker in order to update itself, it cannot recover on its own. You would have to reinstall it by hand.
> 
> Check the versions first, as described in [Checking which version is running](#checking-which-version-is-running).

Docker Engine and the tools that drive it agree on an API version when they connect. Newer Docker Engine releases stop supporting older API versions, which is why a Collector older than your Docker Engine can lose the ability to talk to it.

Once the Collector is up to date, upgrading Docker Engine in place is supported. The daemon and runner containers restart automatically afterwards.

1.  **Confirm the Collector is up to date.** Check that the daemon and runner are running `daemon-v1.5.0` and `runner-v1.6.2` or later. If either is older, reinstall the Collector before you continue.
    
2.  **Check that `DOCKER_API_VERSION` is not set.** This variable pins the Collector to one specific Docker API version. If it is set, the Collector cannot adapt to the upgraded engine and will fail to start. Check both the running container and the host configuration:
    
    ```text
    sudo docker inspect runner --format '{{range .Config.Env}}{{println .}}{{end}}' | grep DOCKER_API_VERSION
    sudo grep -r DOCKER_API_VERSION /etc/environment /etc/profile.d/ /etc/systemd/system/docker.service.d/ 2>/dev/null
    ```
    
    No output from either command means the variable is not set, and you can continue. If either command prints a line, remove `DOCKER_API_VERSION` from the file it names and from the installer command, then reinstall the Collector.
    
3.  **Upgrade Docker Engine** using the [instructions for your host OS](https://docs.docker.com/engine/install/).
    
4.  **Confirm the Collector recovered.** After the Docker service restarts, check that both containers are running again:
    
    ```text
    sudo docker ps
    ```
    
    The Collector returns to "Active" in **Integrations > Collectors** within a few minutes.
    

> **NOTE**
> 
> Restarting the Docker service stops any integration job that is running at that moment, and that job is reported as failed. The job runs again normally at its next scheduled interval. To avoid a failed job, upgrade Docker Engine between scheduled integration runs.

## Podman Container Runtime

If you prefer to use `podman` instead of Docker, follow these steps:

1.  Install the `podman-docker` and `podman-remote` packages:

```text
sudo dnf install -y podman-docker podman-remote
```

2.  Enable the podman socket:

```text
sudo systemctl enable --now podman.socket
```

3.  Create the JupiterOne configuration directory:

```text
sudo mkdir -p /etc/.j1config/
```

4.  Use the installer command, replacing `docker` with `podman` and adding the `--privileged` flag:

```text
sudo podman run --privileged -e JUPITERONE_AUTH_TOKEN='...' -e JUPITERONE_COLLECTOR_ID='...' -e JUPITERONE_ACCOUNT_ID='...' -e JUPITERONE_API_BASE_URL='...' -v /etc/.j1config:/etc/.j1config -v /var/run/docker.sock:/var/run/docker.sock ghcr.io/jupiterone/collector-scripts/installer:latest
```

> **CAUTION**
> 
> The `--privileged` flag is required to allow the collector to manage the container runtime when using `podman`. Review the security implications of running the collector with these privileges.

## Removing a Collector

1.  Remove the collector from the JupiterOne console using the "Delete Collector" option.
2.  On the collector host machine, stop and remove the collector daemon and runner containers. See [Reinstalling the Collector](#reinstalling-the-collector) for the commands.

If you try deleting a collector that has integrations configured you will see a message like the following:

![Removing a JupiterOne Collector](/assets/images/remove-collector-63d06a577a5a9cefa985a57abbb23e43.png)

## Troubleshooting

### The Collector stops working after a Docker Engine upgrade

If integration jobs start failing and the Collector no longer shows as Active in **Integrations > Collectors** after Docker Engine has been upgraded, this usually means Docker was upgraded before the Collector was. Reinstalling the Collector resolves it.

To confirm, check the runner logs:

```text
sudo docker logs runner
```

If that reports `No such container`, the container has a different name on this host. List the Collector's containers and use the name shown:

```text
sudo docker ps -a --format 'table {{.Names}}\t{{.Image}}' | grep collector-scripts
```

An error similar to the following means the Collector is older than the Docker Engine now installed on this host:

```text
Error response from daemon: client version 1.41 is too old.
Minimum supported API version is 1.44, please upgrade your client to a newer version
```

The Collector cannot update itself in this state, so reinstall it manually.

First list the Collector's containers. They are the ones whose image name contains `collector-scripts`:

```text
sudo docker ps -a --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}' | grep collector-scripts
```

Then remove them by the names shown in the first column, for example:

```text
sudo docker rm -f runner daemon
```

> **CAUTION**
> 
> Remove only the container names that the command above listed. Do not match on the words "runner" or "daemon" on their own, because your own containers may have names that contain them.

Then re-run the installer command from **Integrations > Collectors**.

If the error persists, confirm that `DOCKER_API_VERSION` is not set, as described in [Upgrading Docker Engine](#upgrading-docker-engine).

### The runner or daemon container does not start

If a stopped `daemon` or `runner` container is left on the host, a new container cannot be created with the same name, and you will see an error similar to:

```text
Conflict. The container name "/runner" is already in use
```

Remove the stopped containers, then re-run the installer command from **Integrations > Collectors**.

First list the Collector's containers. They are the ones whose image name contains `collector-scripts`:

```text
sudo docker ps -a --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}' | grep collector-scripts
```

Then remove them by the names shown in the first column, for example:

```text
sudo docker rm -f runner daemon
```

> **CAUTION**
> 
> Remove only the container names that the command above listed. Do not match on the words "runner" or "daemon" on their own, because your own containers may have names that contain them.

## Known Limitations

-   Unable to migrate integration jobs between collectors.
-   Integration jobs may run in parallel if multiple jobs are assigned.
-   Limited high availability (single node).

---

Source: /integrations/development/collector/kubernetes

# Kubernetes based Collector

The JupiterOne Integration Operator is a Kubernetes-native solution for running JupiterOne integrations within your Kubernetes cluster. It manages Custom Resource Definitions (CRDs) for integration management and provides a scalable approach for organizations already using Kubernetes.

## Prerequisites

### Cluster Requirements

-   Kubernetes 1.16+
-   Helm 3+

### JupiterOne Requirements

-   **Account ID** — found at `/settings/account-management`
-   **API Token** — create one at `/settings/account-api-tokens` or `/settings/api-tokens` with the following permissions. If using a personal token (`/settings/api-tokens`), your user account must have these permissions assigned.

| Permission | Required | When |
| --- | --- | --- |
| **Collector** Create/Read/Update/Delete | Yes | Always |
| **Shared: Graph Data** Read/Write | Yes | Always |
| **Integration** Create/Read/Update/Delete | No | Only if creating Integrations via Helm |

Permission screenshots

![Set kubernetes collector permissions](/assets/images/kubernetes-collector-perm-f039c69a98394bba48d331d94d147993.png)

![Set kubernetes data graph permissions](/assets/images/kubernetes-data-graph-perm-5a90a547e0a719e3d9a681b976013d83.png)

![Set kubernetes integration permissions](/assets/images/kubernetes-integration-perm-756800c96ba053678b5add727c2ef30a.png)

## Installation

> **TIP**
> 
> Can't reach GitHub from your cluster? Follow [Private Registry Configuration](#private-registry-configuration) instead.

Installation is handled by two helm charts

1.  **Kubernetes Operator** This chart installs the controllers that manage the CRDs. This chart can be upgraded independently of the Integration Runner.
2.  **Integration Runner** This chart installs a Custom Resource `integrationrunner` that tells the operator to create a new collector and register with JupiterOne.

### Kubernetes Operator

First, we need to install the operator which manages all the CRDs.

1.  **Add the JupiterOne Helm Repository**:
    
    ```bash
    helm repo add jupiterone https://jupiterone.github.io/helm-charts
    helm repo update
    ```
    
2.  **Create a Namespace**:
    
    ```bash
    kubectl create namespace jupiterone
    ```
    
3.  **Install the Integration Operator**:
    
    ```bash
    helm install integration-operator jupiterone/jupiterone-integration-operator --namespace jupiterone
    ```
    

### Integration Runner

To install the Integration runner, you need to provide your API token. You can choose from two options for managing the API token secret:

> **NOTE**
> 
> The runner will create a Collector with the same name.

This is the simplest method. The Helm chart will automatically create a Kubernetes Secret in the same namespace with your API token.

**Parameters:**

-   `runnerName`: The name of the Runner.
-   `apiToken`: Your API token. This will be created as a Secret in Kubernetes.
-   `accountID`: Your JupiterOne Account ID.
-   `jupiterOneEnvironment` (_optional_): The JupiterOne environment. This defaults to `us`. This can be found by inspecting the URL when accessing the UI such as `<environment>.jupiterone.io`.

**Installation command:**

```bash
helm install <runnerName> jupiterone/jupiterone-integration-runner --namespace jupiterone --set apiToken=<apiToken> --set accountID=<accountID>
```

This method references an existing Kubernetes Secret instead of creating one. Use this option if you manage secrets using external processes such as Sealed Secrets, External Secrets Operator, or other secret management tools.

> **NOTE**
> 
> The Secret _must_ have a key of `token` in order to work properly.

**Parameters:**

-   `runnerName`: The name of the Runner.
-   `secretAPITokenName`: The name of the existing Kubernetes Secret.
-   `accountID`: Your JupiterOne Account ID.
-   `createSecret`: Must be set to `false` so the Helm chart does not attempt to create the Secret.
-   `jupiterOneEnvironment` (_optional_): The JupiterOne environment. This defaults to `us`. This can be found by inspecting the URL when accessing the UI such as `<environment>.jupiterone.io`.

**Installation command:**

```bash
helm install <runnerName> jupiterone/jupiterone-integration-runner --namespace jupiterone --set createSecret=false --set secretAPITokenName=<tokenName> --set accountID=<accountID>
```

## Verification

After installation, the runner should register with JupiterOne within 30 seconds.

```bash
kubectl get integrationrunner -n jupiterone
```

Expected output:

```bash
NAME     STATE     DETAIL   REGISTRATION   AGE
runner   running            registered     2m38s
```

## Reading Secrets from AWS Secrets Manager

By default, the runner API token and integration configuration are read from Kubernetes Secrets. If you run on AWS, you can instead source them from **AWS Secrets Manager** so that credentials never live in the cluster or in Git.

Two credentials support this:

-   **Runner API token** — set `apiTokenSource` on the `IntegrationRunner`.
-   **Integration configuration** — set `secretSource` on the `IntegrationInstance`.

Both are backward compatible with the existing `secretAPITokenName` / `secretRef` fields, which continue to reference Kubernetes Secrets. The new fields take precedence when both are set, so existing installations are unaffected.

### Secret format

The value stored in AWS Secrets Manager must be a JSON object.

-   For the **API token**, include a `token` key:
    
    ```json
    { "token": "<your-jupiterone-api-token>" }
    ```
    
-   For **integration configuration**, each key/value is merged into the integration config (overriding matching keys in `config`):
    
    ```json
    { "clientId": "abc", "clientSecret": "s3cret" }
    ```
    

### Granting the operator access

The operator loads AWS credentials from the default credential chain. On EKS, the recommended approach is [IRSA](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html): associate the operator's ServiceAccount with an IAM role by adding an annotation.

```bash
kubectl annotate serviceaccount -n jupiterone <operator-service-account> \
  eks.amazonaws.com/role-arn=arn:aws:iam::<account-id>:role/<role-name>
```

The role needs, at minimum, `secretsmanager:GetSecretValue` on the referenced secrets (and `kms:Decrypt` on the KMS key if the secret is encrypted with a customer-managed key):

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "secretsmanager:GetSecretValue",
      "Resource": "arn:aws:secretsmanager:*:<account-id>:secret:jupiterone/*"
    }
  ]
}
```

### Example: runner API token

```yaml
apiVersion: integrations.jupiterone.io/v1
kind: IntegrationRunner
metadata:
  name: runner
  namespace: jupiterone
spec:
  accountId: <account-id>
  syncIntervalSeconds: 30
  apiTokenSource:
    provider: awsSecretsManager
    awsSecretsManager:
      secretId: arn:aws:secretsmanager:us-east-1:123456789012:secret:jupiterone/api-token
```

### Example: integration configuration

```yaml
apiVersion: integrations.jupiterone.io/v1
kind: IntegrationInstance
metadata:
  name: my-integration
  namespace: jupiterone
spec:
  collectorName: runner
  integrationDefinitionName: <integration>
  config:
    nonSensitiveValue: "example"
  secretSource:
    provider: awsSecretsManager
    awsSecretsManager:
      secretId: jupiterone/my-integration-creds
```

### Fields

Both `apiTokenSource` and `secretSource` share the same shape:

| Field | Required | Description |
| --- | --- | --- |
| `provider` | Yes | `awsSecretsManager` or `kubernetes`. |
| `awsSecretsManager.secretId` | Yes (for `awsSecretsManager`) | ARN or name of the secret. |
| `awsSecretsManager.region` | No | AWS region of the secret. Defaults to the operator's region. |
| `awsSecretsManager.versionStage` | No | Version stage to retrieve. Defaults to `AWSCURRENT`. |
| `kubernetes.name` | Yes (for `kubernetes`) | Name of the Kubernetes Secret, in the same namespace. |

> **NOTE**
> 
> Resolved values are cached in-memory to avoid calling AWS Secrets Manager on every reconcile. The cache duration is controlled by the operator's `ASM_CACHE_TTL_SECONDS` environment variable (default `60`; set to `0` to disable caching).

> **NOTE**
> 
> For an `IntegrationInstance`, the resolved configuration is sent to JupiterOne when the integration instance is created, so it is also stored server-side. AWS Secrets Manager keeps the secret out of your cluster and Git; it is not end-to-end encryption.

## Private Registry Configuration

Use this when your cluster cannot pull images from `ghcr.io` (GitHub), for example because all images must be scanned and served from your own registry. Follow these steps **instead of** [Installation](#installation).

> **NOTE**
> 
> Your cluster still needs outbound access to the JupiterOne API and to the systems each integration collects from. Images come from your registry; charts come from the `.tgz` files saved in step 1.

In the steps below, replace `myregistry.example.com` with your registry address. Do not include `https://`. The address can include a path, for example `myregistry.example.com:5000/mirror`; if it does, use only the host and port (`myregistry.example.com:5000`) for `crane auth login` and `--docker-server`.

Depending on your registry:

-   **Private certificate authority:** the machine that runs step 1 and every node must trust it. On macOS add it to the Keychain; on Linux use `update-ca-certificates`. On nodes, also restart containerd (or set `ca` in containerd's `hosts.toml`). The operator itself does not need it.
-   **Harbor:** create the project (the first part of the path, e.g. `mirror`) before step 1; otherwise `crane copy` fails with `401 Unauthorized`. A project robot account with push and pull works for both steps.
-   **Username with `$`** (e.g. a Harbor robot account `robot$mirror+jupiterone`): put it in single quotes, `-u 'robot$mirror+jupiterone'`, or the shell drops part of it.

### 1\. Copy and check the images and charts

On a machine that **can** reach GitHub, with [Helm](https://helm.sh/docs/intro/install/), [crane](https://github.com/google/go-containerregistry/blob/main/cmd/crane/README.md) and [cosign](https://docs.sigstore.dev/cosign/system_config/installation/) installed, open a terminal in an **empty folder** and log in to your registry:

```bash
read -rs PW   # type your registry password (not shown), then press Enter
echo "$PW" | crane auth login myregistry.example.com -u <username> --password-stdin   # host and port only
```

Then edit the first two lines and run the rest. It copies the Helm charts, the operator image and one image per integration you run, and checks each integration image:

```bash
REGISTRY=myregistry.example.com
INTEGRATIONS=(jira)        # chart names of the integrations you run, e.g. (jira wazuh)

# Charts, saved as .tgz files
helm pull jupiterone-integration-operator jupiterone-integration-runner "${INTEGRATIONS[@]}" \
  --repo https://jupiterone.github.io/helm-charts

# Operator image
OP=$(helm show chart ./jupiterone-integration-operator-*.tgz | awk '/^appVersion/{print $2}')
crane copy ghcr.io/jupiterone/jupiterone-integration-operator:${OP} \
  ${REGISTRY}/jupiterone/jupiterone-integration-operator:${OP}

# Integration images: copy each one, then check the copy is the one JupiterOne signed
for i in "${INTEGRATIONS[@]}"; do
  if crane copy ghcr.io/jupiterone/graph-${i}:latest ${REGISTRY}/jupiterone/graph-${i}:latest &&
    COSIGN_REPOSITORY=ghcr.io/jupiterone/graph-${i}-signatures \
      cosign verify ${REGISTRY}/jupiterone/graph-${i}:latest \
      --certificate-oidc-issuer https://token.actions.githubusercontent.com \
      --certificate-identity-regexp '^https://github\.com/JupiterOne/' > /dev/null; then
    echo "graph-${i} verified"
  else
    echo "graph-${i} FAILED"
  fi
done
```

Every integration must print `graph-<name> verified`. If anything prints an error or `FAILED`, stop and fix it before going on. A `DENIED` or `UNAUTHORIZED` error from `ghcr.io` means that integration's image is not public; contact JupiterOne support.

-   Keep the `jupiterone/graph-<integration>:latest` path unchanged. The operator only swaps `ghcr.io` for your registry.
-   The operator always runs `:latest`. Your copy never updates itself; to update an integration, copy its image again.
-   Set an integration up in the JupiterOne UI and don't know its image? Start a run after step 3, then run `kubectl get integrationinstancejobs -n jupiterone -o 'custom-columns=NAME:.metadata.name,IMAGE:.spec.image'`. For an image `.../graph-X:latest`, rerun the script in the same folder with `INTEGRATIONS=(X)`. The run waits until the image is there.
-   `graph-kubernetes` is not covered here; use [Kubernetes Managed](/integrations/directory/kubernetes-managed.md).

> **WARNING**
> 
> Copy images with `crane copy`, not `docker pull`/`tag`/`push`. Docker copies only one CPU architecture and changes the image, so the check above fails with `no signatures found`.

### 2\. Create the namespace and registry secret

```bash
kubectl create namespace jupiterone

kubectl create secret docker-registry my-registry-secret \
  --namespace jupiterone \
  --docker-server=myregistry.example.com \
  --docker-username=<username> \
  --docker-password=<password>
```

Using External Secrets or Sealed Secrets? Sync the secret into `jupiterone` as type `kubernetes.io/dockerconfigjson` (External Secrets: `target.template.type: kubernetes.io/dockerconfigjson`). An `Opaque` secret is ignored and pulls fail with `no basic auth credentials`.

### 3\. Install the operator and runner

```yaml
# private-registry-values.yaml
controllerManager:
  container:
    image:
      repository: myregistry.example.com/jupiterone/jupiterone-integration-operator  # operator image
  imageRegistry: "myregistry.example.com"   # integration images
  imagePullSecrets:                         # registry login for the operator and every job
    - name: my-registry-secret
  disableImageSignatureCheck: true          # see "About the signature check" below
```

```bash
helm install integration-operator ./jupiterone-integration-operator-*.tgz \
  --namespace jupiterone \
  -f private-registry-values.yaml

helm install <runnerName> ./jupiterone-integration-runner-*.tgz \
  --namespace jupiterone \
  --set apiToken=<apiToken> \
  --set accountID=<accountID>
```

Outside the US, add `--set jupiterOneEnvironment=<environment>` (the `<environment>` in your `<environment>.jupiterone.io` URL). The runner takes the same options as in [Integration Runner](#integration-runner).

Then add integrations as described in [Assigning an Integration](#assigning-an-integration). For the Helm option, install from the `.tgz` file and set `collectorName` to your `<runnerName>`. `helm show values ./<integration>-*.tgz` lists the integration's own settings. If an integration's docs say to run `helm repo add` or `helm repo update`, skip those.

```bash
helm install <integration> ./<integration>-*.tgz \
  --namespace jupiterone \
  --set collectorName=<runnerName> \
  -f <integration>-values.yaml               # the integration's own settings; leave out if none
```

### 4\. Check it works

```bash
kubectl get integrationrunner -n jupiterone   # REGISTRATION should show "registered"
kubectl get pods -n jupiterone \
  -o 'custom-columns=NAME:.metadata.name,IMAGE:.spec.containers[*].image'
```

Every image should start with `myregistry.example.com`. Integration job pods appear once an integration has run; to run one now, start it from the integration instance in the JupiterOne UI.

If `kubectl get pods -n jupiterone` shows `ErrImagePull` or `ImagePullBackOff`, the image is missing from your registry, the secret is wrong, or the nodes don't trust your registry's certificate (`x509: certificate signed by unknown authority`). `kubectl describe pod <pod name> -n jupiterone` shows the exact image it tried.

### About the signature check

Before each job, the operator can check the image's signature. With a private registry it ends up checking the image on `ghcr.io`, not your copy; the check in step 1 covers your copy.

The operator's check needs internet access to:

-   `ghcr.io`, where the signatures are published,
-   `pkg-containers.githubusercontent.com`, where `ghcr.io` serves its files from, and
-   `tuf-repo-cdn.sigstore.dev`, which provides the keys the check trusts.

If any of these is blocked, every job fails the check and never runs: no job pod appears, `kubectl get integrationinstancejobs -n jupiterone` shows `PENDING` or `FAILED` under `VERIFIED` (it keeps retrying), and the operator log shows `Failed to verify image`. That is why step 3 sets `disableImageSignatureCheck: true`. If all three are reachable, you can remove that line. You do not need to copy the signatures to your registry.

## Resource Requests and Limits for Integration Jobs

Many enterprise Kubernetes clusters enforce resource policies using [Kyverno](https://kyverno.io/), [OPA/Gatekeeper](https://open-policy-agent.github.io/gatekeeper/), or similar admission controllers. These policies often require all containers to declare CPU and memory requests and limits. By default, integration job containers created by the operator do not include resource requirements, which may cause job creation to be blocked by such policies.

### Configuration

Configure resource requests and limits for integration job containers using `--set` flags:

```bash
helm install integration-operator jupiterone/jupiterone-integration-operator \
  --namespace jupiterone \
  --set controllerManager.jobResources.requests.cpu=100m \
  --set controllerManager.jobResources.requests.memory=256Mi \
  --set controllerManager.jobResources.limits.cpu=1 \
  --set controllerManager.jobResources.limits.memory=1Gi
```

Or via a values file:

```yaml
controllerManager:
  jobResources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: "1"
      memory: 1Gi
```

When `jobResources` is not set, no resource requirements are applied to integration job containers (the default behavior).

### Verifying

After configuring job resources, trigger an integration run and inspect the created Job:

```bash
kubectl get jobs -n jupiterone -o yaml | grep -A 10 resources
```

### Troubleshooting Job Creation Failures

If integration jobs are not being created, check the `IntegrationInstanceJob` status:

```bash
kubectl get integrationinstancejobs -n jupiterone
```

The `JobCreated` column shows whether the Kubernetes Job was created. If it shows `FAILED`, inspect the full status for the error:

```bash
kubectl get integrationinstancejob <name> -n jupiterone -o jsonpath='{.status}'
```

Common causes:

-   **Admission webhook rejection** — configure `jobResources` to satisfy cluster resource policies.
-   **Image pull failures** — check `imagePullSecrets` configuration.

## Labels, Annotations and Scheduling

Many clusters require labels or annotations on every object, such as a team or cost-center label, or pin workloads to dedicated nodes. The charts support both.

> **NOTE**
> 
> These values need Integration Operator v0.6.0 or later (operator chart 1.6.0 or later) and runner chart 1.2.0 or later. Integration charts need a version that has them: kubernetes-managed 1.0.10 or later; for other integration charts, check that `helm show values` lists `commonLabels`. **Upgrade the operator chart first.** The runner and integration charts write new fields to the operator's CRDs. Against an older CRD, Helm 4 rejects the release (`field not declared in schema`). Helm 3 drops the fields silently, so only the chart's own objects get the labels.

### Labels and annotations on every object

Each chart has `commonLabels` and `commonAnnotations`. They are set on every object the chart creates, and on every object the operator creates for it:

| Chart | Objects |
| --- | --- |
| Integration Operator | Every resource in the chart, including the CRDs and, with `certmanager.enable`, the metrics certificate Secret. The leader-election Lease gets the labels only. Also every object the operator creates for integration runs (see the next row). |
| Integration Runner | The `IntegrationRunner` and its API token Secret (Chart-Assisted). Also every object the operator creates for this runner: its auth Secret, and for each run the run Secret, `IntegrationInstanceJob`, job Secret, `Job` and pod. |
| Integration charts, such as `kubernetes-managed` | The `IntegrationInstance` and its Secret. Also every object the operator creates for this integration's runs. |

Set them in a values file:

```yaml
commonLabels:
  team: security
  cost-center: "1234"
commonAnnotations:
  owner: platform@example.com
```

Pass the same values to each chart you install, or set different ones per chart. On the same key, the more specific chart wins: the integration chart's values override the runner's, and the runner's override the operator's.

-   **Quote numbers.** Helm reads `1234` as a number, not a string. Write `"1234"`.
-   **Keys the charts and the operator manage are skipped.** The charts keep their own labels: `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`, `helm.sh/chart` and `control-plane`. Run objects never take `log-watcher`, `job-name`, `controller-uid`, `batch.kubernetes.io/*` or `integrations.jupiterone.io/*`. `helm.sh/*` and `meta.helm.sh/*` annotations are dropped everywhere.
-   **Invalid entries.** The operator drops an invalid key or value in a runner's labels, and logs it.
-   **When changes apply.** A `helm upgrade` updates the chart's own objects. Objects the operator creates pick up changes on the next integration run. Removing a key does not remove it from objects that already exist.
-   **Not labelled.** Kubernetes Events, the Secrets Helm uses to store releases, and objects Kubernetes creates on its own, such as the default ServiceAccount.

### Integration job pods

The operator chart's `controllerManager.job` values apply to every integration run:

| Value | Applies to |
| --- | --- |
| `labels`, `annotations` | Every object the operator creates for a run. They override `commonLabels` and `commonAnnotations` on the same key. |
| `podLabels`, `podAnnotations` | The job pod. |
| `nodeSelector`, `tolerations`, `affinity` | The job pod's scheduling. |
| `podSecurityContext`, `containerSecurityContext` | The job pod's and container's security context. |

```yaml
controllerManager:
  job:
    podAnnotations:
      sidecar.istio.io/inject: "false"
    nodeSelector:
      pool: tools
    tolerations:
      - key: dedicated
        operator: Equal
        value: tools
        effect: NoSchedule
```

The operator checks these values when it starts. If a label is invalid, or the API server rejects a scheduling or security field, the new operator pod exits and the previous pod keeps running. Run `kubectl rollout status deployment -n jupiterone` after upgrading. Integration images run as root, so namespaces that enforce the `restricted` Pod Security Standard are not supported yet.

Integration charts have `jobLabels`, `jobAnnotations`, `podLabels` and `podAnnotations` for one integration's runs. They override the operator and runner values on the same key. Scheduling can only be set on the operator. If a key is invalid or managed by the operator, it is dropped and reported as an `InvalidJobMetadata` event on the `IntegrationInstance`:

```bash
kubectl get events -n jupiterone --field-selector reason=InvalidJobMetadata
```

### The operator pod

The operator's own Deployment and pod also have their own values. These override `commonLabels` and `commonAnnotations` on the same key.

```yaml
controllerManager:
  deployment:
    labels: {}
    annotations: {}
  pod:
    labels: {}
    annotations: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}
```

On tainted nodes, set `controllerManager.tolerations` for the operator pod as well as `controllerManager.job.tolerations` for the job pods.

## Assigning an Integration

Assigning an integration job to a collector first requires that there are collectors registered and available. Once collectors are available, the process for defining an integration job and assigning it to a collector is straightforward.

For integrations that are collector compatible, complete the integration configuration as normal. During configuration, you'll notice there's an additional option to choose where the integration should run.

Select **Collector** on the integration instance, and choose the corresponding collector for which you'd like the integration to run.

![Choosing run on Collector within the JupiterOne integration instance configuration](/assets/images/integration-location-caff09d6752d5364027ed190220e03c0.png)

You may also choose to setup an integration by using a helm chart. This is supported through the Custom Resource Definition `integrationinstance` which is installed as part of the Kubernetes Operator.

Integrations that support this method will have documentation on how to set this up. See the [Kubernetes Managed integration](/integrations/directory/kubernetes-managed.md) for an example.

> **NOTE**
> 
> Only a subset of integrations can be created through the `integrationinstance` CRD. If the operator does not recognize the `integrationDefinitionName`, the `IntegrationInstance` reports `ValidationFailed` with the message `Failed to find integration definition ID`. Integrations not on that list — including **SBOM for AWS ECR** — must be created with the **Web** option above (run location → Collector), which the runner still executes normally. Only CRD-based _creation_ is limited.

## Updating the Operator

To update to the latest version:

```bash
helm repo update
helm upgrade integration-operator jupiterone/jupiterone-integration-operator --namespace jupiterone
```

## Uninstalling

To remove the operator:

```bash
helm uninstall <runnerName> --namespace jupiterone
helm uninstall integration-operator --namespace jupiterone
kubectl delete namespace jupiterone
```

## Multiple Clusters

Multiple Kubernetes clusters are supported by installing the JupiterOne Integration Operator and Integration Runner Helm charts on each cluster. Each cluster is managed independently by the operator running within that cluster.

To set up multiple clusters:

-   Repeat the installation steps for each cluster where you want to run collectors.
-   Each cluster will have its own Integration Runner and Integration(s) managed separately.

You may use automation tools such as **ArgoCD**, **Flux**, or other GitOps solutions to automate and manage Helm chart deployments across your clusters. This allows you to keep your collector deployments consistent and up to date in all environments.

> **NOTE**
> 
> Each collector is registered independently with JupiterOne, and integration jobs can be assigned to collectors in any cluster as needed.

## ArgoCD

You may use ArgoCD to automate Helm chart deployments in your clusters. The following are example ArgoCD Applications setting up the Integration Operator and Integration Runner.

> **NOTE**
> 
> You may find the current version of the Integration Operator and the Integration Runner by searching the helm repository.
> 
> ```bash
> helm repo update
> helm repo search jupiterone
> ```

### Integration Operator

Replace `<version>` with the version you would like to install.

```yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: jupiterone-integration-operator
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://jupiterone.github.io/helm-charts
    chart: jupiterone-integration-operator
    targetRevision: <version>
  destination:
    namespace: jupiterone
    server: https://kubernetes.default.svc
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
```

### Integration Runner

Replace the `<version>`, `<account-id>` and `<environment>` with your own values.

```yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: jupiterone-integration-runner
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://jupiterone.github.io/helm-charts
    chart: jupiterone-integration-runner
    targetRevision: <version>
    helm:
      values: |
        secretAPITokenName: j1token
        createSecret: false
        accountID: <account-id>
        jupiterOneEnvironment: <environment>
  destination:
    namespace: jupiterone
    server: https://kubernetes.default.svc
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
```

### Integration Instance

You may also setup certain Integrations with Helm charts which are then supported in ArgoCD. Here is an example of setting up the Kubernetes Managed Integration. Replace `<version>` with the value from the latest chart.

```yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: kubernetes-managed
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://jupiterone.github.io/helm-charts
    chart: kubernetes-managed
    targetRevision: <version>
    helm:
      values: |
        collectorName: runner
        pollingInterval: ONE_WEEK
        ingestionSources:
          secrets: false
  destination:
    namespace: jupiterone
    server: https://kubernetes.default.svc
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
```

## Troubleshooting

If pods are not starting or integrations are not running:

-   Check pod logs: `kubectl logs -n jupiterone <pod-name>`
-   Verify CRDs are present: `kubectl get crd | grep jupiterone`
-   Double-check authentication credentials
-   Ensure network connectivity to JupiterOne services

For integrations that assume an AWS IAM role (such as [SBOM for AWS ECR](/integrations/directory/sbom-ecr.md)), a job that starts and then fails with a `Configuration failure` usually means the job pod had no AWS credentials to assume the role. The spawned job pod has no AWS identity unless you give it one. On chart 1.4.0+ (operator v0.4.0+), set `integration.jobServiceAccount.create=true` with an `eks.amazonaws.com/role-arn` annotation so the chart provisions a dedicated, IRSA-annotated ServiceAccount for job pods. See the integration's installation guide for the trust-policy details.

If ingestion source settings from the chart do not take effect, check the `IngestionSourcesApplied` condition: `kubectl get integrationinstance <name> -n jupiterone -o jsonpath='{.status.conditions[?(@.type=="IngestionSourcesApplied")]}'`. On chart 1.5.0+ (operator v0.5.0+), the operator checks the value against the integration's ingestion sources and applies only the valid entries. `Rejected` lists the IDs that were not applied: the ID is not one of the integration's ingestion sources, the source cannot be disabled, or JupiterOne did not store the entry. `UpdateFailed` carries the error and is retried every 30 seconds. If the condition is missing entirely, check that the instance has been created (check the `Ready` condition), then check whether the field reached the resource: `kubectl get integrationinstance <name> -n jupiterone -o jsonpath='{.spec.ingestionSources}'`. If it is empty, either the value is not set (an empty or unset value sets no condition, so also check that your last `helm upgrade` did not pass other values without it), the integration chart is too old to render it (kubernetes-managed before 1.0.9; `helm show values` for that chart does not list `ingestionSources`), or the operator is older than v0.5.0 and its CRD dropped the field. Upgrade whichever is too old, run `helm repo update`, then run `helm upgrade` on the integration chart again, because a value dropped by an older CRD is not restored on its own.

## Known Limitations

-   Unable to migrate integration jobs between collectors.
-   Integration job distribution across multiple pods is still being enhanced.
-   Some integrations may not be compatible with collectors.

---

Source: /integrations/development/collector/run-without-collector

# Run integrations without a Collector

Use this page when you can't run a [Collector](/integrations/development/collector.md), for example because your hosts can't reach GitHub (`ghcr.io`), where the Collector and integration images are published. You download an integration as a file on a machine with internet access, copy it to a Linux host with Docker, and run it there. The data appears in JupiterOne the same way it does with a Collector.

Compared with a Collector, you schedule runs and update integrations yourself.

## What you need

-   **A Linux host with Docker.** It must be able to reach:
    -   the JupiterOne API: `https://api.us.jupiterone.io` (EU accounts: `https://api.eu.jupiterone.io`)
    -   the systems you collect from (Active Directory, vCenter, Trellix ePO, ManageEngine)
-   **A machine with internet access** for downloading the integrations, with Docker 28 or later and [cosign](https://docs.sigstore.dev/cosign/system_config/installation/) installed.
-   **The JupiterOne permission "Update integration".**

The examples on this page cover these integrations. Other integrations work the same way; see [Other integrations](#other-integrations).

| Integration | Image name |
| --- | --- |
| Microsoft Active Directory | `graph-microsoft-active-directory` |
| VMware vSphere | `graph-vsphere` |
| Trellix ePO | `graph-trellix-epo` |
| ManageEngine Endpoint Central | `graph-manage-engine-ec` |

## Step 1. Create the integration in JupiterOne

Do this once for each integration.

1.  Go to **Integrations**, open the integration and select **Add integration instance**. If you can't find the integration, contact JupiterOne support to enable it for your account.
2.  Enter a name.
3.  Set **Where should this run?** to **JupiterOne's servers**.
4.  Set **Polling interval** to **Disabled**.
5.  Fill in the authentication fields with placeholder text, for example `see-host`. The real credentials go on your host in Step 4. Skip **Test credentials**.
6.  Select **Save**.
7.  On the **Summary** tab, copy the **Instance ID**.
8.  On the **API Keys** tab, select **New API Key**, then **Generate**. Copy the key now: it is shown only once and is valid for one year.

> **CAUTION**
> 
> Don't select **Run** for these instances in JupiterOne. The run would fail because JupiterOne's servers can't reach your systems.

## Step 2. Download and check the integration

On the machine with internet access. This example uses Active Directory; for another integration, replace `graph-microsoft-active-directory` with its image name from the table.

1.  Download the integration:
    
    ```bash
    docker pull --platform linux/amd64 ghcr.io/jupiterone/graph-microsoft-active-directory:latest
    ```
    
2.  Check that the image you downloaded is signed by JupiterOne:
    
    ```bash
    IMAGE=$(docker image inspect --format '{{index .RepoDigests 0}}' \
      ghcr.io/jupiterone/graph-microsoft-active-directory:latest)
    COSIGN_REPOSITORY=ghcr.io/jupiterone/graph-microsoft-active-directory-signatures \
      cosign verify "$IMAGE" \
      --certificate-oidc-issuer https://token.actions.githubusercontent.com \
      --certificate-identity-regexp '^https://github\.com/JupiterOne/' > /dev/null && echo verified
    ```
    
    It must print `verified`.
3.  Save it to a file:
    
    ```bash
    docker save --platform linux/amd64 -o graph-microsoft-active-directory.tar \
      ghcr.io/jupiterone/graph-microsoft-active-directory:latest
    ```
    
4.  Copy `graph-microsoft-active-directory.tar` to your Linux host.

If your Linux host has an ARM processor, use `linux/arm64` instead of `linux/amd64` in both commands.

## Step 3. Load the integration on your host

```bash
sudo docker load -i graph-microsoft-active-directory.tar
```

## Step 4. Create a settings file and run each integration

Each integration has its own settings file in `/opt/j1`. The first four lines are the same for every integration:

-   `INTEGRATION_INSTANCE_ID` and `JUPITERONE_API_KEY`: the values from Step 1 for that integration.
-   `JUPITERONE_ACCOUNT`: your account ID, under **Settings > Account management**.
-   `JUPITERONE_API_BASE_URL`: `https://api.us.jupiterone.io`, or `https://api.eu.jupiterone.io` for EU accounts.

```bash
sudo mkdir -p /opt/j1 && sudo chmod 700 /opt/j1
```

### Microsoft Active Directory

```bash
sudo tee /opt/j1/ad.env > /dev/null <<'EOF'
INTEGRATION_INSTANCE_ID=<Instance ID>
JUPITERONE_ACCOUNT=<JupiterOne account ID>
JUPITERONE_API_KEY=<API key>
JUPITERONE_API_BASE_URL=https://api.us.jupiterone.io
LDAP_URL=ldaps://dc1.example.com
BASE_DN=DC=example,DC=com
AD_USERNAME=svc-jupiterone@example.com
AD_PASSWORD=<password>
EOF
sudo chmod 600 /opt/j1/ad.env

sudo docker run --rm --network host --env-file /opt/j1/ad.env \
  ghcr.io/jupiterone/graph-microsoft-active-directory:latest
```

Is your domain controller's certificate issued by your own certificate authority (CA)? Add the CA to `ad.env` on one line, writing each line break as `\n`:

```bash
printf '%s\n' "CA_CERTIFICATE=$(awk 'NF {printf "%s\\n", $0}' /path/to/your-ca.pem)" | sudo tee -a /opt/j1/ad.env > /dev/null
```

### VMware vSphere

```bash
sudo tee /opt/j1/vsphere.env > /dev/null <<'EOF'
INTEGRATION_INSTANCE_ID=<Instance ID>
JUPITERONE_ACCOUNT=<JupiterOne account ID>
JUPITERONE_API_KEY=<API key>
JUPITERONE_API_BASE_URL=https://api.us.jupiterone.io
DOMAIN=vcenter.example.com
LOGIN=<vCenter user>
PASSWORD=<password>
EOF
sudo chmod 600 /opt/j1/vsphere.env

sudo docker run --rm --network host --env-file /opt/j1/vsphere.env \
  ghcr.io/jupiterone/graph-vsphere:latest
```

`DOMAIN` is the vCenter host name only: no `https://` and no path. Is the vCenter certificate issued by your own CA? Pass the CA file in the run command:

```bash
sudo docker run --rm --network host --env-file /opt/j1/vsphere.env \
  -e CA_CERTIFICATE="$(cat /path/to/your-ca.pem)" \
  ghcr.io/jupiterone/graph-vsphere:latest
```

### Trellix ePO

```bash
sudo tee /opt/j1/trellix.env > /dev/null <<'EOF'
INTEGRATION_INSTANCE_ID=<Instance ID>
JUPITERONE_ACCOUNT=<JupiterOne account ID>
JUPITERONE_API_KEY=<API key>
JUPITERONE_API_BASE_URL=https://api.us.jupiterone.io
HOSTNAME=https://epo.example.com:8443
USERNAME=<ePO user>
PASSWORD=<password>
EOF
sudo chmod 600 /opt/j1/trellix.env

sudo docker run --rm --network host --env-file /opt/j1/trellix.env \
  ghcr.io/jupiterone/graph-trellix-epo:latest
```

`HOSTNAME` must start with `https://`. Is the ePO certificate issued by your own CA? Mount the CA file:

```bash
sudo docker run --rm --network host --env-file /opt/j1/trellix.env \
  -v /path/to/your-ca.pem:/etc/ssl/your-ca.pem:ro \
  -e NODE_EXTRA_CA_CERTS=/etc/ssl/your-ca.pem \
  ghcr.io/jupiterone/graph-trellix-epo:latest
```

### ManageEngine Endpoint Central (on-premises)

```bash
sudo tee /opt/j1/manageengine.env > /dev/null <<'EOF'
INTEGRATION_INSTANCE_ID=<Instance ID>
JUPITERONE_ACCOUNT=<JupiterOne account ID>
JUPITERONE_API_KEY=<API key>
JUPITERONE_API_BASE_URL=https://api.us.jupiterone.io
SELECTED_AUTH_TYPE=onPremLocal
ENDPOINT_CENTRAL_ENDPOINT=https://endpointcentral.example.com:8383
ON_PREM_USERNAME=<user>
ON_PREM_PASSWORD=<password>
EOF
sudo chmod 600 /opt/j1/manageengine.env

sudo docker run --rm --network host --env-file /opt/j1/manageengine.env \
  ghcr.io/jupiterone/graph-manage-engine-ec:latest
```

To sign in with an Active Directory account, use `SELECTED_AUTH_TYPE=onPremAD` and add `DOMAIN_NAME=<your AD domain>`. To use an API token, use `SELECTED_AUTH_TYPE=onPremToken` and `ON_PREM_API_TOKEN=<token>` instead of the user name and password.

Is the server's certificate issued by your own CA? Use the same `-v` and `-e NODE_EXTRA_CA_CERTS` lines as for Trellix ePO.

### Other integrations

Most integrations that run on a Collector can run this way, with the same first four lines. Contact JupiterOne support for the image name and settings of any other integration.

## Step 5. Check the result

A run takes from a few seconds to several minutes.

-   **Success:** the output contains `Synchronization finalization result.`, and the instance's **Jobs** tab in JupiterOne shows **Completed**.
-   **Failure:** the output contains `Synchronization job abort result.`, and the **Jobs** tab shows the reason (for example, wrong credentials). Data from earlier runs is kept.

> **NOTE**
> 
> The command finishes with exit code 0 even when the run fails. Check the output or the **Jobs** tab, not the exit code.

Each run fully refreshes the data: records removed from your system are also removed from JupiterOne.

## Step 6. Run on a schedule (optional)

This example runs Active Directory every day at 02:00 and keeps the last run's output in `/var/log/j1-ad.log`. To be alerted when a run fails, have your monitoring check that file for `Synchronization finalization result.`

For another integration, change `ad` and the image name. If you added `-v` or `-e` lines to the run command, add them to the script too.

```bash
sudo tee /opt/j1/run-ad.sh > /dev/null <<'EOF'
#!/bin/sh
docker run --rm --network host --env-file /opt/j1/ad.env \
  ghcr.io/jupiterone/graph-microsoft-active-directory:latest > /var/log/j1-ad.log 2>&1
EOF
sudo chmod 700 /opt/j1/run-ad.sh
echo '0 2 * * * root /opt/j1/run-ad.sh' | sudo tee /etc/cron.d/j1-ad > /dev/null
```

Don't schedule two runs of the same integration at the same time.

## Updating an integration

Repeat Steps 2 and 3. Your settings files and schedules stay the same.

## Renewing the API key

The API key expires after one year. Create a new one on the instance's **API Keys** tab, update `JUPITERONE_API_KEY` in the settings file, and revoke the old key.

## Troubleshooting

| You see | What to do |
| --- | --- |
| `Unable to find image` or Docker tries to download | Repeat Step 3. Check that the image name in `docker run` matches exactly. |
| `UNABLE_TO_VERIFY_LEAF_SIGNATURE` | The server's certificate is issued by your own CA. Add it as shown for that integration. |
| `Provider authentication failed` | Check the user name, password and server address in the settings file. For vSphere with your own CA, pass the CA with `-e CA_CERTIFICATE="$(cat …)"`, not in the settings file. |
| `401` or `Unauthorized` from JupiterOne, and the command exits with code 1 | Check `JUPITERONE_API_KEY` and `JUPITERONE_ACCOUNT`. If needed, create a new key on the instance's **API Keys** tab. |
| No job appears in JupiterOne | Check that the host can reach the address in `JUPITERONE_API_BASE_URL` and that `INTEGRATION_INSTANCE_ID` is correct. |

---

Source: /integrations/development/custom-definitions

# Custom Definitions

A **custom definition** lets you describe an integration that JupiterOne doesn't ship out of the box and run it against your own data — a SaaS provider with no managed integration, an on-premise application, or a proprietary internal tool. You define the metadata once, then create one or more instances that execute on a schedule or push data on demand.

## Definition, instance, and job

These three terms appear throughout the rest of this section. They describe the same integration at three different layers:

-   **Definition** — the _template_. Holds metadata describing the integration: name, type, class, the configuration fields a user must fill in (`configFields`), the authentication fields (`authSections`), the ingestion sources it produces, and the platform features it relies on. A definition is created once and reused.
-   **Instance** — a configured _deployment_ of a definition. An instance binds a definition to specific credentials, a polling interval, an account name, and (optionally) a Collector. One definition can have many instances.
-   **Job** — a single _execution_ of an instance. Each scheduled run, or each manual trigger, is a job. Jobs produce the entities and relationships you see in JupiterOne.

## When to use a custom definition

Reach for a custom definition when:

-   The provider has no JupiterOne managed integration and you need recurring data ingestion.
-   The system is on-premise or behind a firewall and the runner must live inside your network.
-   You're integrating a proprietary or internally-built tool whose API only your team can access.

## Ingestion options

A custom definition supports two ingestion paths. You pick one when you create the definition; you can change later without re-authoring.

| Option | Use when | Continue with |
| --- | --- | --- |
| **Custom File Transfer (CFT)** | Your data is already exported to CSV. Upload files directly; no runner, no API calls. | [Custom File Transfer](/integrations/development/custom-file-transfer.md) |
| **Custom instance** | You'll write code that pushes data to JupiterOne via the Sync API, using the instance's API key. Run that code wherever you want — CI, cron, event handler, on-prem host. | [Custom integration: Code + Sync API](/integrations/development/custom-instance.md) |

## Author a custom definition

To create a custom definition in the JupiterOne app:

1.  Navigate to **Custom Definitions**.
2.  Click **New Custom Definition**.
3.  Fill in the form:
    -   **Icon** — pick or upload an icon shown in the integrations list.
    -   **Integration Name** — display name for this custom integration.
    -   **Integration Type** — autofills from the Integration Name with your account alias appended as a suffix (for example `my-integration-acme`). This is the type string queries and downstream tools see.
    -   **Documentation URL** _(optional)_ — link to your team's docs or the upstream vendor's docs for the data source.
    -   **Description** _(optional)_.
    -   **Category** _(optional)_ — choose from the dropdown.
    -   **Type of custom definition** — pick one:
        -   **CFT** — the definition is set up for [Custom File Transfer](/integrations/development/custom-file-transfer.md). Follow the CFT upload flow after creating.
        -   **Custom instance** — JupiterOne creates a new instance and a new API key. Use the API key + instance ID from your code to push data via the Sync API. See [Custom integration: Code + Sync API](/integrations/development/custom-instance.md).
4.  Click **Create**.

## What's next

[

![](/icons/illustrations/cloud-upload.svg)![](/icons/illustrations/cloud-upload.svg)

Custom File Transfer (CFT)

Upload assets and relationships as CSV files; JupiterOne tracks each upload as an instance of your custom definition.





](/integrations/development/custom-file-transfer.md)[

![](/icons/illustrations/gear.svg)![](/icons/illustrations/gear.svg)

Custom integration: Code + Sync API

Write code that pushes entities and relationships to JupiterOne via the Sync API, using the API key generated for your custom instance.





](/integrations/development/custom-instance.md)

---

Source: /integrations/development/custom-file-transfer

# Custom File Transfer (CFT)

Custom File Transfer is one of the ingestion options you can choose **after** creating a [Custom definition](/integrations/development/custom-definitions.md). Use it when your data is already exported to CSV — JupiterOne ingests the file directly and manages that data via an instance of your Custom definition.

Leverage JupiterOne's Custom File Transfer to ingest assets into JupiterOne and designate the asset's relationships prior to uploading. This integration allows you to import a batch of assets and relationships via CSV file and track and manage each upload within the integration's instances.

You will need to have your assets and relationships in CSV format, and there is a size limitation of 100MB per file. For larger uploads, see our [API documentation](/reference.md).

## CSV File Requirements

To ensure data is correctly ingested, please consider the following:

-   The first row in the CSV must be headers. These headers will be used as the property values for the final entity.
-   We encourage the use of **camelCasing** for headers for consistency with other data in your graph.
-   We encourage the use of **Data Type Tokens** to improve query-ability of your data (see below for more details).
-   If a blank or whitespace header is provided, it will be replaced by `idxN` where N is the numerical index of that column.
-   The number of values in each row must match the number of headers provided on the first row. A mismatch will result in an error.
-   All empty (`,,`) and blank (`,"",`) values will be replaced with `undefined` to improve query-ability of your data.
-   Whitespace (`" "` or `, ,`) values will be maintained.

### Data Type Tokens (optional)

In order for the integration to successfully identify different types of data, the column headers can optionally include a token to identify the columns data type. By providing these data type tokens, JupiterOne will store the data in the correct format allowing for advanced J1QL queries to be written.

#### Supported Data Type Tokens:

-   **\[datetime\]**: With the `[datetime]` token present in the header, **all valid ISO** dates will be parsed and stored ready for queries as a date. To ensure dates are displayed correctly in the JupiterOne app, column header names should end in `On`. Parsed dates will allow queries such as `FIND approvals WITH approvedOn < Date.now - 30days`
-   **\[boolean\]**: With the `[boolean]` token present in the header, the following values will be parsed as true: `true`, `1`, `on`, `yes`. **All other values will be considered** `false`. Parsed booleans will allow for queries such as `FIND approvals WITH approved = true`
-   **\[number\]**: With the `[number]` token present in the header, all valid numbers (int, decimal, negative) will be parsed as a number. If a value is not a number, the value will remain unparsed. Parsed numbers will allow queries such as `FIND approvals WITH count > 50`
-   **\[stringList\]**: When the `[stringList]` token is included in a column header, the corresponding cell value will be split into an array of strings using a comma (`,`) as the delimiter. If no commas are found, the result will be a single-element array containing the entire string.
    -   It is recommended to enclose the full list of comma-separated values in double quotes (`"`). This ensures the list is interpreted as a single CSV field and parsed correctly.
        
    -   For example, if you have an entity property named `webUrls[stringList]`, you can specify the values in the CSV like this:
        
        -   ✅ **Correct:** `"https://www.j1.com,https://www.j1.io"`
        -   ❌ **Incorrect:** `"https://www.j1.com","https://www.j1.io"`

> **NOTE**
> 
> Adding a Data Type Token to the column header name that uniquely identifies each row is **not** supported. The value entered as the **Entity Key Property** should exactly match the value found in the CSV.

##### Example walkthrough

Starting CSV:

```plaintext
id,createDate,description,approvedOn,approved,count,weekdays
1,01/01/2024,Granted access to fix the issue,01/01/2024,true,100,"monday,tuesday"
2,02/11/2014,Test access granted,02/11/2014,testBool,100,"tuesday,wednesday"
```

In this example, `createDate` and `approvedOn` are both dates. `id` and `count` are both numbers. `approved` is a boolean. `id` will not be considered a number, it will be used as the **Entity Key Property** which is explained later in this document.

For the integration to identify them as their appropriate data type, add the data type tokens to the applicable header. For example, `createDate` becomes `createDate[datetime]`.

Tips: Add the data type token after the column header name. For timestamps, renaming the column to end with `On` is preferable for best display support in the JupiterOne app and more consistent with the JupiterOne data model. So for example, `createDate` becomes `createdOn`.

Example with Data Type Tokens:

```plaintext
id,createdOn[datetime],description,approvedOn[datetime],approved[boolean],count[number],weekdays[stringList]
1,02/11/2014,Granted access to fix the issue,02/11/2014 11:30:30,true,100,"monday,tuesday"
2,02/11/2014,Test access granted,02/11/2014,testBool,100,"tuesday,wednesday"
```

Ensure that the date time values are in a valid ISO 8601 format:

```plaintext
id,createdOn[datetime],description,approvedOn[datetime],approved[boolean],count[number],weekdays[stringList]
1,2014-02-11Z,Granted access to fix the issue,2014-02-11T11:30:30Z,true,100,"monday,,tuesday"
2,2014-02-11Z,Test access granted,2014-02-11Z,testBool,100xx,"tuesday,wednesday,"
```

Below is an example of the resulting entities post-processing. If a value is not successfully parsed for the given data type, the value will remain in its original format. The data type token will be removed prior to use as a property name.

```json5
[
  {
    "id": 1,
    "createdOn": 1392076800000, // unix epoch timestamp, will be displayed correctly as ISO timestamp in JupiterOne.
    "description": "Granted access to fix the issue",
    "approvedOn": 1392118230000,
    "approved": true,
    "count": 100,
    "weekdays": ['monday', 'tuesday']
  },
  {
    "id": 2,
    "createdOn": 1392076800000, // unix epoch timestamp, will be displayed correctly as ISO timestamp in JupiterOne.
    "description": "Test access granted",
    "approvedOn": 1392118230000,
    "approved": false, // testBool was parsed as false
    "count": "100xx", // was not parsed
    "weekdays": ['tuesday', 'wednesday']
  }
]
```

## Configuring the integration

Navigate to the **Integrations** tab in JupiterOne and select Custom File Transfer. Click **New Instance** to begin configuring the integration.

For this integration, you will need to have your CSV dataset ready to imported.

### Creating a Custom File Transfer instance

Provide the following when creating an instance for your custom file transfer:

-   The **Account Name** used to identify the account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   Enter the **Dataset Name**. For the first example data set, use: EuropaUsers
    
-   Define the **Entity Key Property**. This is found in the data file. For CSVs, it is the column header. This value should be unique across the entire dataset. Adding a Data Type Token to this column header is not supported.
    
-   Add the **Entity Type**. This will identify the specific type of entity to be created.
    
-   Select the **Entity Class**. This value represents the class of data found in the dataset.
    

> **INFO**
> 
> For more information about JupiterOne `_type` and `_class` values, see our [JupiterOne data model](/data-model/jupiterone-data-model.md).

At this point, the integration is able to upload and ingest the defined dataset into your account. Press **Create** to create the instance and upload your CSV file.

If you wish to add additional datasets, press the **Add Dataset** button.

Additionally, you can add **Direct** and **Mapped Relationships** by selecting the respective **Add relationship** button. You can find additional information on adding relationships below.

#### Adding another data set:

-   Enter the **Dataset Name**, the **Entity Key Property**, and **Entity Type**.
    
-   Select the **Entity Class**.
    

### Defining Relationships

When uploading your file, you can define two kinds of relationships for each dataset:

-   **Direct relationships** connect entities from **datasets in the same Custom File Transfer instance**. Both the source and the target are created from CSV files you upload to this integration — for example, linking Europa Users to Europa User Groups by matching `GroupId` to `Id`.
    
-   **Mapped relationships** connect entities from your CSV upload to entities that **already exist in your JupiterOne account from a different integration**. You do not need to know the target entity's internal key; you describe how to find it by matching a property value — for example, linking Europa Users (from your HR CSV) to ServiceNow CMDB objects (already ingested by the ServiceNow integration) by matching on a manager email property.
    

Common mapped relationship examples elsewhere in JupiterOne include `(Host | Device) -HAS-> Finding`.

#### To define direct relationships:

Press **Add Relationship** under **Direct Relationships** and provide the following:

-   The **Source Property**. The source property indicates what value in the dataset references the target dataset.
-   The **Relationship Class**
-   The **Target Dataset Name**. **This needs to exactly match the inputted value for the target Dataset Name**.
-   The **Target Property**. The target property indicates what value in the dataset that should be referenced by the source dataset.

#### Define Mapped Relationships

A **mapped relationship** is a relationship between two entities that are **not created from the same integration**. Use mapped relationships when your CSV defines one side of the link and the other side already lives in the graph from another data source.

Mapped relationships can have a **FORWARD** or **REVERSE** direction. The direction determines which entity is the **source** and which is the **target** — the relationship arrow always points **from the source to the target**. Both a FORWARD and a REVERSE relationship can exist between the same two entity types when the use case calls for it.

| Direction | Meaning |
| --- | --- |
| **FORWARD** | Source → target |
| **REVERSE** | Target → source (the entity from your CSV is treated as the target) |

When querying mapped relationships in J1QL, use direction arrows to specify which direction you want:

```j1ql
FIND europa_user AS u THAT MANAGES >> service_now_cmdb_object AS c RETURN u.email, c.name LIMIT 10
FIND europa_user AS u THAT MANAGES << service_now_cmdb_object AS c RETURN u.email, c.name LIMIT 10
```

The `>>` syntax returns data for the **FORWARD** direction; `<<` returns data for the **REVERSE** direction.

Using the correct direction when defining mapped relationships in your data **and** when querying them in J1QL can improve query performance by reducing the number of relationship traversals the query engine must evaluate.

##### To define the mapped relationships:

-   Select the **Relationship Class**.
-   Specify the **Direction** (**FORWARD** or **REVERSE**).
-   Enter the **Target Entity Type**.
    
    > **NOTE**
    > 
    > To see what \_types are available in your account, consider running this J1QL query in your account: `FIND * AS e RETURN count(e), e._type`. For this tutorial, use: `service_now_cmdb_object`
    

#### Add Field Mappings

Enter the **Source Property** (a column from your CSV) and **Target Property** (a property on the target entity type in JupiterOne). JupiterOne creates the relationship when the values match.

#### Finalize the integration instance

Click **Create** once all values are provided to finalize the integration. You will then be prompted to upload your CSV files.

## Custom file transfer example

To understand how to set up this integration, the following dataset will be used for a tutorial.

Imagine you want to add **User** and **User Group** data from your HR software, called _Europa_, into JupiterOne.

Here are the two example datasets:

1.  Europa Users (europaUsers.csv)

```text
    Id	Name	Username	Email	GroupId
    1	Jane	jane.c	jane.c@company.com	A
    2	Juan	juan.d	juan.d@company.com	B
    3	Julie	julie.e	julie.e@company.com	C
```

2.  Europa User Groups (europaUserGroups.csv)

```text

    Id	Name
    A	Marketing
    B	Sales
    C	Engineering
```

We can represent both the Europa Users and Europa Groups as assets in the JupiterOne graph.

Further, we can use the native relationship between the Europa Users GroupId property and the Europa Groups Id property to define a direct relationship between the two datasets in this integration.

Finally, we can use the Europa Users `Email` property to define a **mapped relationship** to ServiceNow CMDB objects that already exist in your JupiterOne account from the ServiceNow integration.

#### Define Datasets

-   Enter the Dataset Name as: `EuropaUsers`
-   Enter the **Entity Key Property**. For this tutorial the first column header of the Europa Users dataset we'll use is: `Id`
-   Enter the Entity Type as: `europa_user`.
-   Set the Entity Class as: `User`.

At this point the integration is able to upload and ingest the Europa Users dataset into your account. With the goal of adding Users Groups and relationships, let's keep going:

-   Press the **Add Dataset** button
-   Enter the **Dataset Name**. For the second dataset: `EuropaUserGroups`
-   Enter the **Entity Key Property**. For this tutorial we will use the `Id` column which represents a unique id for each entity.
-   Enter the **Entity Type**. For the second dataset: `europa_user_group`
-   Select the **Entity Class**. For the second: `UserGroup`

Excellent! Both datasets are now defined.

#### Define the direct relationship

The following steps will define the relationship to be built between Users (the source dataset) and User Groups (the target dataset).

User (source) ←HAS→ User Group (target) EuropaUsers.GroupId == EuropaUserGroups.Id

The following steps will build the above relationship:

-   Press **Add Relationship** under **Direct Relationships** and
-   Enter the **Source Property**. For this tutorial, use`GroupId` as the source property. It is found in **EuropaUsers** and references the _Europa User Groups_ dataset.
-   Select the **Relationship Class**. For this tutorial: `Has`
-   Select the **Direction**. For this tutorial: `REVERSE`
-   Enter the **Target Dataset Name**. For this tutorial: `EuropaUserGroups`
-   Enter the **Target Property**. For this tutorial, `Id` is the target property, found in **EuropaUserGroups**. Enter `Id` for this field.

#### Define Mapped Relationship

The following steps define a mapped relationship between `europa_user` entities (from your CSV) and `service_now_cmdb_object` entities (already in JupiterOne from the ServiceNow integration).

**Before — CSV input (EuropaUsers dataset):**

```text
Id  Name  Username  Email                  GroupId
1   Jane  jane.c    jane.c@company.com     A
2   Juan  juan.d    juan.d@company.com     B
```

**Configuration:**

-   Select the **Relationship Class**. For this tutorial, use: `Manages`
-   Select the **Direction**. For this tutorial, use: `FORWARD` (each Europa User is the source; the matched CMDB object is the target)
-   Enter the **Target Entity Type**. For this tutorial, use: `service_now_cmdb_object`

**Add Field Mappings:**

-   **Source Property**: `Email` (column from your Europa Users CSV)
-   **Target Property**: `managerEmail` (property on existing ServiceNow CMDB objects that stores the manager's email address)

**After — resulting relationship in the graph:**

For each Europa User row, JupiterOne looks up an existing `service_now_cmdb_object` whose `managerEmail` matches the CSV `Email` value and creates a relationship:

```text
europa_user (Jane, jane.c@company.com) -MANAGES-> service_now_cmdb_object (Production Server, managerEmail: jane.c@company.com)
europa_user (Juan, juan.d@company.com) -MANAGES-> service_now_cmdb_object (Staging Database, managerEmail: juan.d@company.com)
```

If no matching ServiceNow CMDB object exists for a given email, no relationship is created for that row.

You can verify the results with J1QL:

```j1ql
FIND europa_user AS u THAT MANAGES >> service_now_cmdb_object AS c RETURN u.name, u.email, c.name LIMIT 10
```

And that's it! Click **Create** to finalize the integration instance and upload the CSV files.

### Using `stringList` for Mapped Relationships

In cases where your **Source Property** contains a **comma-separated list of values**, you can enable **multiple mapped relationships** by using the `[stringList]` data type token.

When the **Source Property** includes the `[stringList]` token in its header (e.g., `owners[stringList]`), the integration will automatically create **one mapped relationship per item** in the list.

#### Example

If your dataset contains a field like this:

```csv
owners[stringList]
id-123,id-456,id-789
```

And you've mapped it to a **Target Property** like `ownerId`, JupiterOne will create three mapped relationships, one for each value (`id-123`, `id-456`, `id-789`).

This will result in relationships like:

-   **Entity A HAS → ownerId: id-123**
-   **Entity A HAS → ownerId: id-456**
-   **Entity A HAS → ownerId: id-789**

This is useful when an entity is related to multiple targets and you want each relationship represented individually in your graph.

#### ⚠️ Important Clarification

When defining **Mapped Relationships** in the integration UI, ensure that the **Source Property** field matches **exactly** the name used in your CSV header, including the data type token.

For example:

-   If your CSV header is `owners[stringList]`, you **must** enter `owners[stringList]` as the **Source Property** when creating the mapped relationship in the UI.
    
-   If it doesn't appear in the dropdown list, make sure to select `Add custom option` and manually enter the source property name with the `[stringList]` suffix exactly as it appears in the CSV header.
    
-   Omitting the `[stringList]` suffix in the UI (e.g., using just `owners`) will prevent the system from correctly identifying the data type, which may cause issues.
    

This ensures that the integration correctly interprets the data type and processes the relationships as expected.

### Next steps

Now that your integration instance has been configured, it will begin running the transfer, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

---

Source: /integrations/development/custom-instance

# Custom integration: Code + Sync API

Pick **Custom instance** when you create a [Custom Definition](/integrations/development/custom-definitions.md) and want to feed data into JupiterOne with code you own. JupiterOne creates the instance and a fresh API key — your code pushes entities and relationships against that instance via the [Sync API](/api/sync-jobs/api-reference.md). The runner can live anywhere with outbound HTTPS to JupiterOne: a CI job, a cron'd container, an event handler, an on-prem host.

## What you get from JupiterOne

After you save the definition with **Custom instance** selected, JupiterOne issues:

-   **Instance ID** — a UUID identifying this instance. Pass as `integrationInstanceId` on every Sync API call.
-   **API key** — used to authenticate Sync API calls. Treat as a secret; rotate from the instance page if it leaks.

## The ingestion contract

Every ingestion run follows the same three-step flow against the [Sync API](/api/sync-jobs/api-reference.md):

1.  **Start a job** — `POST /persister/synchronization/jobs` with `source: "integration-external"` and `integrationInstanceId: "<your instance id>"`. JupiterOne returns a `jobId`.
2.  **Upload entities and relationships** — `POST .../upload`, `.../entities`, or `.../relationships` against that `jobId`. Repeat as needed for large datasets.
3.  **Finalize** — `POST .../finalize` to commit. JupiterOne reconciles the dataset against the previous run according to the chosen `syncMode`.

A job left un-finalized stays in `AWAITING_UPLOADS` and never reaches your graph. Always finalize.

## Authentication

Send the API key as a bearer token on every Sync API request:

```http
Authorization: Bearer <YOUR_API_KEY>
```

The instance ID is not secret. Rotate the API key from the instance page if it leaks.

## Sync modes

Pick a `syncMode` per job based on what the data represents:

-   **`DIFF`** _(default)_ — replaces the full dataset in scope. Anything you don't re-upload in this job is deleted on finalize. Use for full polls (snapshot of all current resources).
-   **`PATCH`** — updates existing entities only; never creates or deletes. Use for event-driven pushes where you only know about property deltas on entities that already exist.
-   **`PUT`** — creates and updates entities; never deletes. Use when your source can only show you part of the dataset — a rolling window, an event feed, or one slice per run — so a missing record doesn't mean "deleted". Enabled per account on request; see [PUT](/api/sync-jobs/put.md).
-   **`CROSS_SCOPE`** — for relationships whose endpoints live in different scopes/instances.
-   **`OVERRIDE`** — pin properties on entities created by another integration.

See the [Sync API reference](/api/sync-jobs/api-reference.md) for the full mode reference.

---

## Entity construction

An **entity** is a node in the JupiterOne graph. Every resource you ingest — a user, a host, an application, a finding — becomes one entity. Get the shape right and your data is queryable next to managed integrations; get it wrong and queries miss it.

### Required fields

Every entity must include these five fields. JupiterOne rejects uploads missing any of them.

| Field | Type | Description |
| --- | --- | --- |
| `_key` | string | Unique identifier within your custom integration. Use the source resource's stable unique ID (UUID, ARN, numeric ID). Keep it minimal — no extra prefixes. Max 7000 characters. |
| `_type` | string | The integration-specific type. Combines a resource name with the integration type from your definition: `<resource>_<integration-type>` (for example `invoice_my-billing-acme`). |
| `_class` | string | string\[\] | One or more standard JupiterOne entity classes (`User`, `Device`, `Application`, `Account`, `Finding`, `Vulnerability`, etc.). Pick the closest match from the [data model](/data-model/jupiterone-data-model.md). |
| `name` | string | Required. Even when redundant with class defaults. |
| `displayName` | string | Required. Human-readable label shown in the UI. |

### Property rules

The platform enforces a small set of rules on the rest of the properties.

-   **Primitives only.** Property values must be `boolean`, `string`, `number`, or arrays of those. No nested objects (except `_rawData`). Flatten nested API objects: if your source has `device.os.name`, push `osName: "..."`, not `os: { name: "..." }`.
-   **No mixed-type arrays.** `["a", 1, true]` is rejected.
-   **No properties starting with `_`** other than the platform-reserved ones (`_key`, `_type`, `_class`, `_rawData`, `_fromEntityKey`, `_toEntityKey`, `_mapping`).
-   **No `undefined`.** Omit the property or use `null` instead.
-   **Strings ≤ 4096 characters.** Truncate descriptions, notes, error messages, file paths.
-   **Boolean fields use `is{CamelCase}`** — `isEnabled`, `isAdmin`, `isMfaEnabled`. Never `enabled` or `mfa`.
-   **Date fields use `{action}On`** as **epoch milliseconds** — `createdOn`, `updatedOn`, `lastSeenOn`, `lastLoginOn`. Convert ISO strings to epoch ms before push. Never push ISO strings.
-   **Don't redefine class-inherited properties.** A `Device`\-class entity already has `hostname`, `osType`, `ipAddresses`, `macAddresses`. A `User` entity already has `email`, `firstName`, `lastName`, `username`. Don't add custom-named duplicates. The full list per class is in the [data model](/data-model/jupiterone-data-model.md).
-   **Defaults.** Never default missing strings to `""` — use `null` or omit. Empty strings break filters that test for presence.

### What to include

Pick the **minimum set of properties that offer query value** for security, compliance, or asset inventory. Be selective.

Always include when available:

-   Identifiers — unique ID, name, displayName.
-   Ownership — owner, createdBy, assignedTo.
-   Status — active / enabled / lifecycle state.
-   Timestamps — `createdOn`, `updatedOn`, `lastSeenOn`, `lastLoginOn`.
-   Security-relevant — permissions, roles, MFA status, encryption status, severity, compliance status.
-   Classification — category, type, tags / labels.
-   Network identity (devices/hosts) — hostname, IP addresses, MAC addresses, OS type.

### What to exclude

Always exclude:

-   Secrets — passwords, API keys, tokens, certificates, private keys. Never push as properties or in raw data.
-   Sensitive PII beyond what is needed for identity (SSN, home addresses, phone numbers).
-   Request/response bodies, full stack traces, raw logs.
-   Internal platform IDs with no security meaning (sequence numbers, render hints, template IDs).
-   UI/display-only metadata (locale, timezone, theme).

When in doubt, leave it out. Adding a property later is cheap; removing one is a breaking change for queries, alerts, and compliance mappings.

### JSON example

This is a literal upload payload — exactly what `POST /upload` accepts. The `Application` entity describes a third-party SaaS app discovered in your billing system.

```json
{
  "entities": [
    {
      "_key": "billing-acme:app:00f4a812-1c4f-4d79-9c3c-aaa2efad8e1f",
      "_type": "application_my-billing-acme",
      "_class": "Application",
      "name": "slack",
      "displayName": "Slack",
      "category": "communication",
      "vendor": "Slack Technologies",
      "isSso": true,
      "isMfaEnforced": true,
      "userCount": 142,
      "monthlyCostUsd": 1420.50,
      "createdOn": 1730419200000,
      "lastSeenOn": 1736294400000,
      "owner": "platform-team@example.com",
      "tags": ["sanctioned", "tier-1"]
    }
  ]
}
```

Notes on this payload:

-   `_key` uses the source system's stable UUID (no prefixes other than the integration namespace).
-   `_type` follows the `<resource>_<integration-type>` pattern.
-   `_class: "Application"` is a standard JupiterOne class — properties like `category` and `vendor` are inherited from the class.
-   Booleans use `is{CamelCase}` (`isSso`, `isMfaEnforced`).
-   Dates are epoch ms (`createdOn`, `lastSeenOn`).
-   `userCount` and `monthlyCostUsd` are flat primitives; no nested billing object.

---

## Relationship construction

A **relationship** is an edge between two entities — "team A _owns_ application B," "user X _has assigned_ role Y," "finding F _exploits_ vulnerability V." Relationships are how JupiterOne answers "what does X depend on / connect to" without joins. Without them, your entities are isolated nodes.

### When to use a relationship vs a property

If two entities are linked, push a **relationship**, not a flat foreign-key property. A child entity should not carry a `parentId` field when the relationship already encodes the link.

```text
BAD:    Application { _key: "app1", teamId: "team-42" }
GOOD:   Team --OWNS--> Application
```

The exception: `cveId` on a Finding/Vulnerability. JupiterOne correlates CVEs automatically via that property — do not create a mapped relationship to a `cve` entity.

### Required fields

| Field | Type | Description |
| --- | --- | --- |
| `_key` | string | Unique identifier for this relationship. A common pattern: `<fromKey>|<class>|<toKey>`. |
| `_type` | string | Naming pattern: `<from-type>_<verb>_<to-type>` (for example `team_my-billing-acme_owns_application_my-billing-acme`). |
| `_class` | string | One of the standard JupiterOne relationship classes (see below). Uppercase. |
| `_fromEntityKey` | string | The `_key` of the source entity. Must already exist or be uploaded in the same job. |
| `_toEntityKey` | string | The `_key` of the target entity. Must already exist or be uploaded in the same job. |

### Standard relationship classes

Pick the verb that best matches the real-world relationship. Common options:

| Class | Use for |
| --- | --- |
| `HAS` | Containment / membership (Team HAS User, Account HAS Application). |
| `OWNS` | Ownership (Team OWNS Application). |
| `ASSIGNED` | Assignment (User ASSIGNED Role). |
| `USES` | Use / consumption (Application USES DataStore). |
| `MANAGES` | Management (User MANAGES Team). |
| `IS` | Identity / mapping (User IS Person — typically mapped relationship). |
| `ALLOWS` / `DENIES` | Policy (Role ALLOWS Action). |
| `PROTECTS` | Security control (Service PROTECTS Host). |
| `EXPLOITS` | Findings (Finding EXPLOITS Vulnerability). |

The full list lives in the [data model](/data-model/jupiterone-data-model.md).

### JSON example

This payload connects the `Application` entity from the entity example to a `Team` entity owning it. Both endpoints exist in this same custom integration — a simple direct relationship.

```json
{
  "entities": [
    {
      "_key": "billing-acme:team:engineering",
      "_type": "team_my-billing-acme",
      "_class": "Team",
      "name": "engineering",
      "displayName": "Engineering",
      "memberCount": 42
    },
    {
      "_key": "billing-acme:app:00f4a812-1c4f-4d79-9c3c-aaa2efad8e1f",
      "_type": "application_my-billing-acme",
      "_class": "Application",
      "name": "slack",
      "displayName": "Slack"
    }
  ],
  "relationships": [
    {
      "_key": "billing-acme:team:engineering|owns|billing-acme:app:00f4a812-1c4f-4d79-9c3c-aaa2efad8e1f",
      "_type": "team_my-billing-acme_owns_application_my-billing-acme",
      "_class": "OWNS",
      "_fromEntityKey": "billing-acme:team:engineering",
      "_toEntityKey": "billing-acme:app:00f4a812-1c4f-4d79-9c3c-aaa2efad8e1f"
    }
  ]
}
```

### Mapped relationships (cross-integration)

Use a **mapped relationship** when one endpoint is owned by a different integration — for example, your custom integration creates an `Application` and you want to link it to an `aws_iam_role` already ingested by the AWS integration. You don't know the target's `_key`; you describe how to find it.

```json
{
  "relationships": [
    {
      "_key": "billing-acme:app:slack|uses|aws-iam-role-1",
      "_type": "application_my-billing-acme_uses_aws_iam_role",
      "_class": "USES",
      "_mapping": {
        "sourceEntityKey": "billing-acme:app:00f4a812-1c4f-4d79-9c3c-aaa2efad8e1f",
        "relationshipDirection": "FORWARD",
        "targetFilterKeys": [["_type", "_key"]],
        "targetEntity": {
          "_type": "aws_iam_role",
          "_key": "arn:aws:iam::123456789012:role/SlackProvisioner"
        },
        "skipTargetCreation": true
      }
    }
  ]
}
```

Set `skipTargetCreation: true` when you expect the target to already exist (most common). Set it to `false` only for shared entities like `cve` where JupiterOne should create them on demand.

See [Creating relationships between entities](/features/assets/relationships-across-scopes.md) for the full mapped-relationship reference.

---

## Step-by-step build guide

The end-to-end shape of a custom integration is the same regardless of language: pull data from your vendor, transform it into JupiterOne's entity/relationship JSON, push it through the Sync API in batches, finalize. This guide walks the pieces. Code samples are TypeScript for illustration; any HTTP-capable runtime works.

### 1\. Project setup

Make the JupiterOne credentials available as environment variables on whatever runs your code:

```sh
export JUPITERONE_API_KEY=<your-api-key>
export JUPITERONE_INTEGRATION_INSTANCE_ID=<your-instance-id>
export JUPITERONE_API_BASE=https://api.us.jupiterone.io
```

Add an HTTP client and your vendor API's SDK (or just a fetch library). Keep credentials out of source control.

### 2\. Build a vendor API client

Encapsulate vendor calls behind a small client class. Three things matter:

-   **Authentication** — read the vendor docs. Don't default to `Bearer` — vendors use many patterns: `X-Api-Key`, `Authorization: Basic`, custom headers, OAuth.
-   **Pagination** — handle every page. Common patterns: cursor / `next_page_token`, offset+limit, `Link` header. Stop when the cursor or `hasMore` flag indicates the end.
-   **Typed responses** — define interfaces matching what the API returns. Don't carry `any` types into your converters.

Sketch:

```ts
class VendorClient {
  constructor(private apiKey: string, private baseUrl: string) {}

  async *iterateApplications(): AsyncGenerator<VendorApp> {
    let cursor: string | undefined;
    do {
      const url = new URL(`${this.baseUrl}/v1/apps`);
      url.searchParams.set("limit", "100");
      if (cursor) url.searchParams.set("cursor", cursor);

      const res = await fetch(url, {
        headers: { "X-Api-Key": this.apiKey },
      });
      if (!res.ok) throw new Error(`vendor api ${res.status}`);

      const body: { apps: VendorApp[]; next_cursor?: string } = await res.json();
      for (const app of body.apps ?? []) yield app;
      cursor = body.next_cursor;
    } while (cursor);
  }
}
```

Note the `?? []` guard before iterating — APIs lie about whether arrays are present.

### 3\. Map vendor responses to entities and relationships

Write a small pure function per resource that turns one API object into one JupiterOne entity. Keep these functions free of HTTP, logging, or upload concerns — just data shape transformation.

```ts
const INTEGRATION_TYPE = "my-billing-acme"; // matches your custom definition's Integration Type

function toApplicationEntity(app: VendorApp): JupiterOneEntity {
  return {
    _key: `${INTEGRATION_TYPE}:app:${app.id}`,
    _type: `application_${INTEGRATION_TYPE}`,
    _class: "Application",
    name: app.slug,
    displayName: app.display_name ?? app.slug,
    category: app.category ?? null,
    vendor: app.publisher ?? null,
    isSso: app.sso_enabled === true,
    isMfaEnforced: app.mfa_required === true,
    userCount: app.user_count,
    monthlyCostUsd: app.cost_monthly_usd,
    createdOn: app.created_at ? Date.parse(app.created_at) : undefined,
    lastSeenOn: app.last_active_at ? Date.parse(app.last_active_at) : undefined,
    owner: app.owner_email ?? null,
    tags: app.tags ?? null,
  };
}

function toTeamOwnsAppRelationship(
  team: VendorTeam,
  app: VendorApp,
): JupiterOneRelationship {
  const fromKey = `${INTEGRATION_TYPE}:team:${team.slug}`;
  const toKey = `${INTEGRATION_TYPE}:app:${app.id}`;
  return {
    _key: `${fromKey}|owns|${toKey}`,
    _type: `team_${INTEGRATION_TYPE}_owns_application_${INTEGRATION_TYPE}`,
    _class: "OWNS",
    _fromEntityKey: fromKey,
    _toEntityKey: toKey,
  };
}
```

Validate before transforming. If a record is missing `id` or `slug`, log and skip — don't push partial entities.

### 4\. Push to JupiterOne via the Sync API

Three endpoints, one job lifecycle. Wrap them in a small client.

```ts
class JupiterOneSync {
  constructor(
    private apiBase: string,
    private apiKey: string,
    private instanceId: string,
  ) {}

  private async post<T>(path: string, body: unknown): Promise<T> {
    const res = await fetch(`${this.apiBase}${path}`, {
      method: "POST",
      headers: {
        Authorization: `Bearer ${this.apiKey}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify(body),
    });
    if (!res.ok) throw new Error(`j1 sync ${res.status}: ${await res.text()}`);
    return (await res.json()) as T;
  }

  async startJob(syncMode = "DIFF"): Promise<string> {
    const { job } = await this.post<{ job: { id: string } }>(
      "/persister/synchronization/jobs",
      {
        source: "integration-external",
        integrationInstanceId: this.instanceId,
        syncMode,
      },
    );
    return job.id;
  }

  async upload(
    jobId: string,
    payload: { entities?: object[]; relationships?: object[] },
  ): Promise<void> {
    await this.post(`/persister/synchronization/jobs/${jobId}/upload`, payload);
  }

  async finalize(jobId: string): Promise<void> {
    await this.post(`/persister/synchronization/jobs/${jobId}/finalize`, {});
  }
}
```

### 5\. Wire it together

Pull, transform, batch, upload, finalize:

```ts
const vendor = new VendorClient(
  process.env.VENDOR_API_KEY!,
  "https://api.vendor.com",
);
const j1 = new JupiterOneSync(
  process.env.JUPITERONE_API_BASE!,
  process.env.JUPITERONE_API_KEY!,
  process.env.JUPITERONE_INTEGRATION_INSTANCE_ID!,
);

const jobId = await j1.startJob("DIFF");

const BATCH = 250;
let entities: object[] = [];
let relationships: object[] = [];

async function flush() {
  if (!entities.length && !relationships.length) return;
  await j1.upload(jobId, { entities, relationships });
  entities = [];
  relationships = [];
}

for await (const app of vendor.iterateApplications()) {
  if (!app.id || !app.slug) continue; // skip records missing required fields
  entities.push(toApplicationEntity(app));
  if (app.owner_team) {
    relationships.push(toTeamOwnsAppRelationship(app.owner_team, app));
  }
  if (entities.length >= BATCH || relationships.length >= BATCH) {
    await flush();
  }
}

await flush();
await j1.finalize(jobId);
```

Batch sizes around 250 keep request bodies modest while minimizing round-trips. Compression (`Content-Encoding: gzip`) is supported if you push much larger batches.

### 6\. Run and verify

Run the script. Then in the JupiterOne app:

1.  Open your custom instance — the **Jobs** tab should show the run with `status: FINISHED` and entity / relationship counts.
    
2.  Run a J1QL query to confirm the data is present:
    
    ```text
    FIND * with _integrationInstanceId = "<your-instance-id>"
    ```
    
3.  Open one of the entities and verify the property names match what you intended (boolean fields prefixed `is`, dates as numbers, no nested objects).
    

If `numEntitiesUploaded` is non-zero but the query returns nothing, the job didn't finalize — check that your finalize call returned 200.

---

## Operational tips

-   **Idempotency** — a `DIFF` finalize is the source of truth. If a job fails partway, start a fresh job; don't try to resume.
-   **Validate small, then scale up** — push a handful of entities first, query for them, verify shape. Then loop the full dataset.
-   **Schema drift** — if your source adds new fields, decide deliberately whether to ingest them. Don't blindly forward every API field.
-   **Never delete properties** that you previously pushed without confirming downstream queries are updated. Removed properties are a breaking change.
-   **Concurrency** — when fetching detail-per-entity from a list endpoint, parallelize but respect the vendor's rate limits. Read response headers (`x-ratelimit-*`, `retry-after`) before raising concurrency.
-   **Defensive guards on API arrays** — always `?? []` before iterating arrays from API responses, and `?? ''` (or `?? null`) before interpolating into `_key` strings. The literal text `"undefined"` in a key is always a bug.

## Related references

-   [Sync API reference](/api/sync-jobs/api-reference.md) — full endpoint reference, payload shapes, validation rules.
-   [JupiterOne data model](/data-model/jupiterone-data-model.md) — entity classes, relationship classes, base properties.
-   [Creating relationships between entities](/features/assets/relationships-across-scopes.md) — mapped-relationship deep dive.
-   [Open-source JupiterOne SDK](https://github.com/JupiterOne/sdk) — TypeScript helpers used by JupiterOne's own integrations. Optional; the Sync API is the contract.

---

Source: /integrations/development/j1-collector

# JupiterOne Collector

This page has moved [here](/integrations/development/collector.md).

---

Source: /integrations/development/overview

# Integration Development

Build your own integrations with JupiterOne when no managed integration exists for your data source, or when you need to ingest data from a proprietary or on-prem system.

The high-level flow:

1.  **Author a [Custom Definition](/integrations/development/custom-definitions.md)** — describe the integration in the JupiterOne app: name, type, category, and which ingestion path it uses.
2.  **Pick an ingestion path** — choose how data flows into the instance:
    -   **[Custom File Transfer](/integrations/development/custom-file-transfer.md)** — upload CSV files directly. No code, no runner.
    -   **[Custom integration: Code + Sync API](/integrations/development/custom-instance.md)** — write code that pushes data via the Sync API using the instance's API key.
3.  **Run, query, iterate** — JupiterOne tracks each ingestion as a job on the instance. Data appears in your workspace alongside managed integrations.

[

![](/icons/illustrations/cloud-upload.svg)![](/icons/illustrations/cloud-upload.svg)

Custom Definitions

The concept hub. What a definition is, how instances and jobs relate, and how to author one in the JupiterOne app.





](/integrations/development/custom-definitions.md)[

![](/icons/illustrations/strategy.svg)![](/icons/illustrations/strategy.svg)

Custom File Transfer (CFT)

Upload assets and relationships as CSV files. Use this when your data is already in tabular form.





](/integrations/development/custom-file-transfer.md)[

![](/icons/illustrations/gear.svg)![](/icons/illustrations/gear.svg)

Custom integration: Code + Sync API

Push data via the Sync API from your own runner. Includes guiding principles for entity modeling, naming, and schema design.





](/integrations/development/custom-instance.md)

---

Source: /integrations/directory/1password

# 1password

Visualize 1Password audit logs, vaults, and user activities in the JupiterOne graph. Track audit events, item usage, sign-in attempts, and secrets, and map users to their associated actions and vaults. Monitor changes and unusual behavior through custom queries and alerts.

# 1Password Integration Installation in JupiterOne

## Overview

This guide walks you through how to connect your 1Password Business or Enterprise account with JupiterOne to monitor and manage your security data.

The integration pulls data from 1Password using two components:

1.  **Events API** — retrieves security-related activity (sign-ins, item access, audit events) and sends it to JupiterOne.
2.  **Connect Server** — allows JupiterOne to read vault and item information from your 1Password account.

### Prerequisites

-   A 1Password Business account.
-   Owner or Administrator access in 1Password (required to generate tokens).
-   Access to JupiterOne with permission to configure integrations.

## Set Up in 1Password

You will generate two tokens: one for the Events API and one for the Connect Server.

### Generate an Events API Token

This token lets JupiterOne collect audit events, item usage events, and sign-in attempt events.

1.  Sign in to your account at 1password.com.
2.  Check the URL to identify your region. For example, if your account is at `https://my.1password.com`, your region is `1password.com`.
3.  In the sidebar, select **Integrations**.
4.  On the Integrations page, select the **Directory** tab.
5.  In the **Events Reporting** section, choose your SIEM connector. If JupiterOne is not listed, select **Other**.
6.  Enter a name for the integration and select **Add Integration**.
7.  Configure the bearer token:
    -   **Token Name**: enter a name (for example, "JupiterOne Events").
    -   **Expires After**: optionally set an expiry.
    -   **Events to Report**: enable all three event types — sign-in attempts, item usage events, and audit events.
8.  Select **Issue Token**. Copy the token and save it securely — you will need it in JupiterOne.

Based on your region, use the corresponding **Events API Base URL**:

| Region | Base URL |
| --- | --- |
| `1password.com` | `https://events.1password.com` |
| `ent.1password.com` | `https://events.ent.1password.com` |
| `1password.ca` | `https://events.1password.ca` |
| `1password.eu` | `https://events.1password.eu` |

### Generate a Connect Server Token

The Connect Server lets JupiterOne access vaults and items. You must deploy a 1Password Connect Server in your own infrastructure first.

#### What is a Connect Server?

A lightweight 1Password service you run in your own infrastructure. It exposes a REST API that JupiterOne calls to read vault contents.

1.  Sign in to your account at 1password.com.
2.  Go to **Developer** in the left navigation.
3.  Open the **Connect Servers** tab and select **New Connect Server**.
4.  Enter a name for the server (for example, "JupiterOne").
5.  Select **Add Vaults** and choose the vaults this server should be able to read.
6.  Select **Add Environment**.
7.  Configure the access token:
    -   **Token Name**: enter a name (for example, "JupiterOne Connect").
    -   **Expires After**: optionally set an expiry.
    -   Select the vaults this token should access.
8.  Select **Issue Token**. Copy the token and save it securely.
9.  Follow the [1Password Connect Server deployment guide](https://www.1password.dev/connect/get-started) to deploy the Connect Server in your infrastructure and obtain its **Base URL**.

## Data Volume Configuration

Control how much historical data is ingested from 1Password.

### Ingestion Windows

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Reporting Event Historical days** | Number of days of past event data to ingest. Increasing this value ingests more events and increases data volume in JupiterOne. | 30 | 30, 60, 90, 120 |

## Configure Integration in JupiterOne

1.  In JupiterOne, go to **Integrations** in the left navigation.
    
2.  Find and select the **1Password** integration tile.
    
3.  Select **Add Configuration** and complete the fields:
    
    | Field | Description |
    | --- | --- |
    | **Reporting Event Access Token** | The Events API bearer token you generated above. |
    | **Reporting Event Base Url** | The Events API base URL for your region (see table above). |
    | **Connect Server Base Url** | The URL where your Connect Server is running. Optional — omit if you are not using the Connect Server. |
    | **Connect Server Access Token** | The Connect Server bearer token you generated above. Optional — required only if you provide a Connect Server Base Url. |
    
4.  Select **Create Configuration** to save.
    

JupiterOne will begin pulling data from 1Password on the polling interval you configure.

## Next Steps

Now that your integration instance is configured, it will run on the polling interval you set, populating data in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) to learn more about working with integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (3)

-   `auditevents`
-   `itemusages`
-   `signinattempts`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (14)

-   `https://events.1password.ca/api/v2/auditevents`
-   `https://events.1password.ca/api/v2/itemusages`
-   `https://events.1password.ca/api/v2/signinattempts`
-   `https://events.1password.com/api/v2/auditevents`
-   `https://events.1password.com/api/v2/itemusages`
-   `https://events.1password.com/api/v2/signinattempts`
-   `https://events.1password.eu/api/v2/auditevents`
-   `https://events.1password.eu/api/v2/itemusages`
-   `https://events.1password.eu/api/v2/signinattempts`
-   `https://events.ent.1password.com/api/v2/auditevents`
-   `https://events.ent.1password.com/api/v2/itemusages`
-   `https://events.ent.1password.com/api/v2/signinattempts`
-   `{onePasswordConnectServerBaseUrl}/v1/vaults`
-   `{onePasswordConnectServerBaseUrl}/v1/vaults/{vaultId}/items`

### Licenses

Product licenses or SKUs required in the target environment.

Show Licenses (1)

-   `1Password Business`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (4)

-   [https://www.1password.dev/connect/api-reference](https://www.1password.dev/connect/api-reference)
-   [https://www.1password.dev/connect/get-started](https://www.1password.dev/connect/get-started)
-   [https://www.1password.dev/events-api/get-started](https://www.1password.dev/events-api/get-started)
-   [https://www.1password.dev/events-api/reference](https://www.1password.dev/events-api/reference)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (6)

| Step | Endpoints | Licenses |
| --- | --- | --- |
| Fetch Audit Event Actor Details | \- | \- |
| Fetch Audit Event Aux Details | \- | \- |
| Fetch Audit Event Object Details | \- | \- |
| Fetch Item Usage Users | \- | \- |
| Fetch Secrets | `{onePasswordConnectServerBaseUrl}/v1/vaults/{vaultId}/items` | `1Password Business` |
| Fetch Signin Attempt Target Users | \- | \- |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Audit Event | `one_password_audit_event` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Audit Event Actor Details | `one_password_audit_event_actor_details` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Audit Event Aux Details | `one_password_audit_event_aux_details` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Audit Event Object Details | `one_password_audit_event_object_details` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Item Usage Event | `one_password_item_usage_event` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Item Usage User | `one_password_item_usage_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Secret | `one_password_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Signin Attempt Event | `one_password_signin_attempt_event` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Signin Attempt Target User | `one_password_signin_attempt_target_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vault | `one_password_vault` | [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `one_password_audit_event` | **UPDATED** | `one_password_audit_event_aux_details` |
| `one_password_audit_event` | **UPDATED** | `one_password_audit_event_object_details` |
| `one_password_audit_event_actor_details` | **PERFORMED** | `one_password_audit_event` |
| `one_password_audit_event_actor_details` | **PERFORMED** | `one_password_vault` |
| `one_password_item_usage_user` | **PERFORMED** | `one_password_item_usage_event` |
| `one_password_signin_attempt_target_user` | **PERFORMED** | `one_password_item_usage_event` |
| `one_password_vault` | **HAS** | `one_password_secret` |

### One Password Audit Event

`one_password_audit_event` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountUUID` | `string` |  |  |
| `action` | `string` |  |  |
| `actorAccountUUID` | `string` |  |  |
| `actorType` | `string` |  |  |
| `actorUUID` | `string` |  |  |
| `auxId` | `string` |  |  |
| `auxInfo` | `string` |  |  |
| `auxUUID` | `string` |  |  |
| `city` | `string` |  |  |
| `country` | `string` |  |  |
| `latitude` | `number` |  |  |
| `longitude` | `number` |  |  |
| `objectType` | `string` |  |  |
| `objectUUID` | `string` |  |  |
| `region` | `string` |  |  |
| `sessionDeviceUUID` | `string` |  |  |
| `sessionIP` | `string` |  |  |
| `sessionLoginOn` | `number` |  |  |
| `sessionUUID` | `string` |  |  |

---

### One Password Audit Event Actor Details

`one_password_audit_event_actor_details` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `mspUserAccountId` | `string` |  |  |
| `mspUserType` | `string` |  |  |

---

### One Password Audit Event Aux Details

`one_password_audit_event_aux_details` inherits from [User](/data-model/schemas/User.md)

---

### One Password Audit Event Object Details

`one_password_audit_event_object_details` inherits from [User](/data-model/schemas/User.md)

---

### One Password Item Usage Event

`one_password_item_usage_event` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `action` | `string` |  |  |
| `appName` | `string` |  |  |
| `appVersion` | `string` |  |  |
| `city` | `string` |  |  |
| `country` | `string` |  |  |
| `ipAddress` | `string` |  |  |
| `itemUUID` | `string` |  |  |
| `latitude` | `number` |  |  |
| `longitude` | `number` |  |  |
| `mspAccountUUID` | `string` |  |  |
| `osName` | `string` |  |  |
| `osVersion` | `string` |  |  |
| `platformName` | `string` |  |  |
| `platformVersion` | `string` |  |  |
| `region` | `string` |  |  |
| `usedVersion` | `number` |  |  |
| `userUUID` | `string` |  |  |
| `vaultUUID` | `string` |  |  |

---

### One Password Item Usage User

`one_password_item_usage_user` inherits from [User](/data-model/schemas/User.md)

---

### One Password Secret

`one_password_secret` inherits from [Secret](/data-model/schemas/Secret.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `favorite` | `boolean` |  |  |
| `fileNames` | `array` of `string`s |  |  |
| `lastEditedBy` | `string` |  |  |
| `sectionLabels` | `array` of `string`s |  |  |
| `vaultId` | `string` |  |  |
| `vaultName` | `string` |  |  |
| `version` | `number` |  |  |

---

### One Password Signin Attempt Event

`one_password_signin_attempt_event` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appName` | `string` |  |  |
| `appVersion` | `string` |  |  |
| `category` | `string` |  |  |
| `city` | `string` |  |  |
| `country` | `string` |  |  |
| `details` | `string` |  |  |
| `ipAddress` | `string` |  |  |
| `latitude` | `number` |  |  |
| `longitude` | `number` |  |  |
| `mspAccountUUID` | `string` |  |  |
| `osName` | `string` |  |  |
| `osVersion` | `string` |  |  |
| `platformName` | `string` |  |  |
| `platformVersion` | `string` |  |  |
| `region` | `string` |  |  |
| `sessionUUID` | `string` |  |  |
| `targetUserUUID` | `string` |  |  |
| `type` | `string` |  |  |

---

### One Password Signin Attempt Target User

`one_password_signin_attempt_target_user` inherits from [User](/data-model/schemas/User.md)

---

### One Password Vault

`one_password_vault` inherits from [Vault](/data-model/schemas/Vault.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `attributeVersion` | `number` |  |  |
| `contentVersion` | `number` |  |  |
| `description` | `string` |  |  |
| `itemsCount` | `number` |  |  |
| `type` | `string` |  |  |

---

## Release Notes

-   **2025-10-01** — Added relationships linking audit event actors to the vaults they performed actions on, enabling vault access activity queries.
-   **2025-09-09** — New 1Password integration: ingests audit events, sign-in attempts, and item usage events with actor user relationships; optionally ingests vaults and secrets via the Connect Server API.

---

Source: /integrations/directory/addigy

# Addigy

Visualize Addigy users and policies in the JupiterOne graph, map Addigy users to employees, and monitor changes through queries and alerts.

## Installation

Addigy supports two authentication methods. Choose the one that matches your setup:

-   **Basic** — authenticate with an Addigy admin username and password, plus a generated client ID and secret. Ingests devices and policies.
-   **API Key** — authenticate with an organization ID and an API key generated in the Addigy UI. Ingests devices, policies, and users.

> **NOTE**
> 
> User data (`addigy_user` entities) is only available when using **API Key** authentication.

### Prerequisites

#### Basic authentication

1.  Log in to the [Addigy portal](https://app.addigy.com) as a user with the **Owner** role.
2.  Generate a `client_id` and `client_secret` for the integration. See [Addigy's API documentation](https://support.addigy.com/hc/en-us/articles/4403542544275) for instructions.
3.  Note the username and password of the Addigy admin account you will use.

#### API Key authentication

1.  Log in to the [Addigy portal](https://app.addigy.com).
2.  Locate your **Organization ID** from the organization settings.
3.  Generate an **API Key** in the Addigy UI. See [Addigy's API documentation](https://support.addigy.com/hc/en-us/articles/4403542544275) for instructions.

### Configuration in JupiterOne

To install the Addigy integration in JupiterOne, navigate to the **Integrations** tab and select **Addigy**. Click **New Instance** to begin.

Provide the following:

-   **Account Name** — identifies this Addigy account in JupiterOne. Ingested entities store this value in `tag.AccountName` when the `AccountName` toggle is enabled.
-   **Description** — optional label to help identify the instance.
-   **Polling Interval** — how often the integration runs. Set to `DISABLED` to run manually.

Then select an authentication method and supply the corresponding credentials:

**Basic**

| Field | Description |
| --- | --- |
| **Addigy Username** | Username of the Addigy admin account used to authenticate. |
| **Addigy Password** | Password of the Addigy admin account. |
| **Addigy Client ID** | The `client_id` generated through the Addigy UI. |
| **Addigy Client Secret** | The `client_secret` generated through the Addigy UI. |

**API Key**

| Field | Description |
| --- | --- |
| **Organization ID** | Your Addigy organization ID. |
| **API Key** | The API key generated through the Addigy UI. |

Click **Create** once all values are provided.

### Next steps

Once the instance is created, the integration runs on the polling interval you set, populating JupiterOne with Addigy devices, policies, and (for API Key auth) users. Continue to our [Instance management guide](/integrations/instance-management.md) to learn more about managing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Addigy Device | `addigy_hostagent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Addigy Policy | `addigy_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Addigy User | `addigy_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Host | `addigy_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `addigy_host` | **HAS** | `addigy_hostagent` |
| `addigy_hostagent` | **HAS** | `addigy_policy` |
| `addigy_policy` | **CONTAINS** | `addigy_policy` |
| `addigy_user` | **HAS** | `addigy_policy` |

### Addigy Host

`addigy_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encrypted` | `boolean` |  |  |
| `fileVaultEnabled` | `boolean` |  |  |
| `firewallEnabled` | `boolean` |  |  |
| `isAppleSilicon` | `boolean` |  |  |
| `lastOnline` | `number` |  |  |
| `platform` | `string` |  |  |
| `policyId` | `string` |  |  |
| `systemVersion` | `string` |  |  |
| `totalDiskSpace` | `number` |  |  |
| `totalMemory` | `number` |  |  |
| `user` | `string` |  |  |

---

### Addigy Hostagent

`addigy_hostagent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `string` |  |  |
| `encrypted` | `boolean` |  |  |
| 
`ethernetMacAddress` \*

 | `string` **|** `null` |  |  |
| `fileVaultEnabled` | `boolean` |  |  |
| `firewallEnabled` | `boolean` |  |  |
| `hostname` | `string` |  |  |
| `isAppleSilicon` | `boolean` |  |  |
| `lastOnline` | `number` |  |  |
| `macAddress` | `array` of `string`s |  |  |
| `make` | `string` |  |  |
| `model` | `string` |  |  |
| `platform` | `string` |  |  |
| `policyId` | `string` |  |  |
| `serial` | `string` |  |  |
| `serialNumber` | `string` |  |  |
| `systemVersion` | `string` |  |  |
| `totalDiskSpace` | `number` |  |  |
| `totalMemory` | `number` |  |  |
| 

`user` \*

 | `string` **|** `null` |  |  |
| `wifiMacAddress` | `string` |  |  |

---

### Addigy Policy

`addigy_policy` inherits from [Policy](/data-model/schemas/Policy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `downloadPath` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| `orgid` | `string` |  |  |
| `parent` | `string` |  |  |

---

### Addigy User

`addigy_user` inherits from [User](/data-model/schemas/User.md)

---

## Release Notes

-   **2026-04-08** — Improved OS details display for Addigy device entities, combining OS platform and system version.
-   **2025-04-14** — Added new device properties to Addigy entities including firewall status, FileVault encryption, Apple Silicon detection, total memory, and total disk space.

---

Source: /integrations/directory/adp-workforce-now

# ADP Workforce Now

Visualize ADP Workforce Now workers and departments in the JupiterOne graph, map the employee reporting hierarchy, correlate workers to their user accounts, and monitor changes through queries and alerts.

## Installation

### Prerequisites

-   An **ADP Workforce Now** account with access to the ADP HR APIs.
-   ADP-issued API credentials for a registered API application: an OAuth **Client ID** and **Client Secret**, plus a client **SSL certificate** and its **private key** (PEM).
-   Access to **JupiterOne** with permission to configure integrations.

### Obtain ADP API credentials

The integration authenticates to the ADP Workforce Now APIs using **OAuth 2.0 (client credentials)** together with **mutual TLS** — every request presents a client SSL certificate in addition to a bearer token. ADP issues the required credentials to a registered API application:

-   a **Client ID** and **Client Secret** (the OAuth client credentials), and
-   a client **SSL certificate** and its **private key** (PEM), registered with ADP for the mutual-TLS handshake.

These credentials are provisioned by ADP through the [ADP developer program](https://developers.adp.com/). Work with your ADP representative or ADP's developer documentation to register an API application, obtain the Client ID and Client Secret, and generate the client certificate and key. The application must be granted access to the worker and department data this integration reads — see the [Authorization](/integrations/directory/adp-workforce-now.md?integration-docs=authorization) tab for the specific permissions and endpoints.

The integration issues read-only requests.

### Configure the integration in JupiterOne

To install the ADP Workforce Now integration in JupiterOne, navigate to the **Integrations** tab and select **ADP Workforce Now**. Click **New Instance** to begin configuring your integration.

Creating an ADP Workforce Now instance requires the following:

-   The **Account Name** used to identify the ADP Workforce Now account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
-   **Description** to assist in identifying the integration instance, if desired.
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **Client ID** | Yes | The ADP OAuth client ID for your registered API application. |
| **Client Secret** | Yes | The ADP OAuth client secret for your registered API application. |
| **Client Certificate (PEM)** | Yes | The PEM-encoded client SSL certificate registered with ADP for mutual TLS. Paste the entire file contents, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines. |
| **Client Key (PEM)** | Yes | The PEM-encoded private key paired with the client certificate, for mutual TLS. Paste the entire file contents, including the `-----BEGIN ... PRIVATE KEY-----` header and footer lines. |

#### Advanced

These fields are optional and only needed to override the default ADP endpoints.

| Field | Default | Description |
| --- | --- | --- |
| **API Base URL** | `https://api.adp.com` | Override the ADP API base URL. Leave blank to use the default. |
| **OAuth Token URL** | `https://accounts.adp.com/auth/oauth/v2/token` | Override the ADP OAuth token endpoint. Leave blank to use the default. |

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (2)

-   `Organization/Department Read`
-   `Worker Read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (2)

-   `/hr/v1/validation-tables/departments`
-   `/hr/v2/workers`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://developers.adp.com/apis/api-explorer/hcm-offrg-wfn](https://developers.adp.com/apis/api-explorer/hcm-offrg-wfn)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `adp_wfn_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Department | `adp_wfn_department` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Worker | `adp_wfn_worker` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `adp_wfn_department` | **HAS** | `adp_wfn_worker` |
| `adp_wfn_worker` | **MANAGES** | `adp_wfn_worker` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `adp_wfn_worker` | **IS** | `User` | FORWARD |

### Adp Wfn Account

`adp_wfn_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`clientId` \*

 | `string` | The ADP OAuth client identifier used to authenticate this integration instance. |  |

---

### Adp Wfn Department

`adp_wfn_department` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The ADP client (tenant) id this department belongs to (ADR-015 flat account reference). |  |
| 

`code` \*

 | `string` | The ADP department code (unique within the client). |  |

---

### Adp Wfn Worker

`adp_wfn_worker` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The ADP client (tenant) id this worker belongs to (ADR-015 flat account reference). |  |
| 

`associateOID` \*

 | `string` | The ADP Associate OID — globally unique worker identifier across all of ADP. |  |
| 

`businessEmail` \*

 | `string` **|** `null` | The worker business (work) email address. |  |
| 

`costCenterName` \*

 | `string` **|** `null` | The cost-center name of the primary work assignment. |  |
| 

`departmentCode` \*

 | `string` **|** `null` | The home department code of the primary work assignment; the carrier the department→worker relationship builder resolves against (ADR-004/005). |  |
| 

`departmentName` \*

 | `string` **|** `null` | The home department name of the primary work assignment (flat, for filtering). |  |
| 

`hiredOn` \*

 | `number` **|** `null` | Epoch milliseconds of the original hire date. |  |
| 

`isManager` \*

 | `boolean` **|** `null` | Whether the worker holds a management position (from the primary work assignment managementPositionIndicator). |  |
| 

`jobCode` \*

 | `string` **|** `null` | The job code of the primary work assignment. |  |
| 

`jobTitle` \*

 | `string` **|** `null` | The business/job title of the primary work assignment. |  |
| 

`managerAssociateOID` \*

 | `string` **|** `null` | The ADP Associate OID of the worker's manager (from reportsTo). The manager hierarchy itself is expressed by the MANAGES relationship (ADR-005); this is the graph-key basis that relationship builder resolves against. |  |
| 

`positionId` \*

 | `string` **|** `null` | The position id of the primary work assignment. |  |
| 

`rehiredOn` \*

 | `number` **|** `null` | Epoch milliseconds of the most recent rehire date. |  |
| 

`terminatedOn` \*

 | `number` **|** `null` | Epoch milliseconds of the termination date, if terminated. |  |
| 

`wageLawCoverage` \*

 | `string` **|** `null` | The wage-law coverage code of the primary work assignment (e.g. exempt/non-exempt). |  |

---

---

Source: /integrations/directory/air-lock-digital

# AirLock Digital

Visualize your AirLock Digital application control deployment in JupiterOne — enforcement agents, policy groups and their exceptions, allowlisted applications, application categories, and blocklists — map agents to the hosts they protect, and monitor changes through queries and alerts.

## Installation

This integration connects to your self-hosted AirLock Digital server using the AirLock Digital REST API and ingests enforcement agents, policy groups, allowlisted applications, application categories, and blocklists. The server is usually on your own network, so the integration normally runs on a [JupiterOne Collector](/integrations/development/collector.md) that can reach the server's REST API over HTTPS (default port `3129`).

### Configuration in AirLock Digital

Before you configure the integration in JupiterOne, prepare the following in the AirLock Digital console:

-   The **server URL** of your AirLock Digital server, including the REST API port, in the format `https://server.name:3129`. The JupiterOne Collector must be able to reach it.
    
-   A **user** whose user group grants the REST API roles the integration needs. In the console, go to **Settings**, open the **Users** tab, and under **User Group Management** select the user's group. In the **REST API Roles** section, add the roles for the endpoints below, then click **Save**.
    
    | Endpoint | Needed for |
    | --- | --- |
    | `/v1/blocklist` | Credential validation (always required) and the **Blocklists** data source |
    | `/v1/agent/find` | **Enforcement Agents** |
    | `/v1/group` and `/v1/group/policies` | **Policy Groups** |
    | `/v1/application` | **Allowlist Applications** |
    | `/v1/application/categories` | **Application Categories** |
    
    The integration only calls these read endpoints. It never uses write, delete, or settings endpoints.
    
-   An **API key** for that user. Log in to the console as the user, open the drop-down menu with the user's name, go to **My profile**, and click **Generate API Key**. The user must have the `generate_apikey` permission. The key is displayed only once, so copy it now.
    
-   If the server presents a self-signed or internal-CA TLS certificate, get the **CA certificate** in PEM format so the collector can verify the connection.
    

Once you have obtained the information above, proceed to JupiterOne to finalize the integration.

### Configuration in JupiterOne

To install the AirLock Digital integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **AirLock Digital**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the AirLock Digital account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Server URL** of your AirLock Digital server, for example `https://airlock.example.com:3129`.
    
-   The **API Key** generated above. It is sent in the `X-ApiKey` request header.
    
-   Optionally, a **CA Certificate** to trust a self-signed or internal-CA certificate, or enable **Disable TLS Verification** to skip certificate validation (not recommended).
    
-   Optionally, set **Agent Statuses** to a comma-separated list of the numeric agent status codes reported by `/v1/agent/find` to ingest only agents in those statuses. Leave it empty to ingest all agents.
    
-   Optionally, enable **Include Hidden Policy Groups** to also ingest policy groups marked as hidden. By default, hidden groups are skipped.
    

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default**, so enable the ones you want to ingest.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Enforcement Agents** | AirLock Digital agents deployed on devices, with hostname, domain, OS, IP addresses, agent version, and policy version | `airlock_agent` |
| **Policy Groups** | Policy groups with their mode (audit or enforcement) and their path, publisher, parent-process, and global-process exceptions | `airlock_policy` |
| **Allowlist Applications** | Allowlisted application packages | `airlock_application` |
| **Application Categories** | Allowlist categories and their subcategories | `airlock_application_category` |
| **Blocklists** | Blocklist packages | `airlock_blocklist` |

The relationships between data sources are built only when both sides are enabled:

-   Agent to policy group (`ASSIGNED`) requires **Enforcement Agents** and **Policy Groups**.
-   Policy group to application (`HAS`) requires **Policy Groups** and **Allowlist Applications**.
-   Policy group to blocklist (`HAS`) requires **Policy Groups** and **Blocklists**.

Each enforcement agent is also mapped to an existing `Host` entity in JupiterOne with the same `hostname`, such as a host from your CMDB or another endpoint tool, through a `PROTECTS` relationship. No new `Host` entities are created.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [AirLock Digital REST API reference (v7.0.1+)](https://api.airlockdigital.com/)
-   [AirLock Digital REST API reference (v6.1.2+)](https://documenter.getpostman.com/view/13151680/2sB3dWrS1z)

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (6)

-   `https://<server>:3129/v1/agent/find`
-   `https://<server>:3129/v1/application`
-   `https://<server>:3129/v1/application/categories`
-   `https://<server>:3129/v1/blocklist`
-   `https://<server>:3129/v1/group`
-   `https://<server>:3129/v1/group/policies`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://documenter.getpostman.com/view/13151680/2sB3dWrS1z](https://documenter.getpostman.com/view/13151680/2sB3dWrS1z)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (3)

| Step | | | --- | | | Build Agent Policy Relationships | | | Build Policy Allowlist Application Relationships | | | Build Policy Blocklist Relationships | |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `airlock_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Allowlist Application | `airlock_application` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Application Category | `airlock_application_category` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Blocklist | `airlock_blocklist` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Enforcement Agent | `airlock_agent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Policy Group | `airlock_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Service | `airlock_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `airlock_account` | **PROVIDES** | `airlock_service` |
| `airlock_account` | **HAS** | `airlock_agent` |
| `airlock_account` | **HAS** | `airlock_policy` |
| `airlock_account` | **HAS** | `airlock_application` |
| `airlock_account` | **HAS** | `airlock_application_category` |
| `airlock_account` | **HAS** | `airlock_blocklist` |
| `airlock_agent` | **ASSIGNED** | `airlock_policy` |
| `airlock_policy` | **HAS** | `airlock_application` |
| `airlock_policy` | **HAS** | `airlock_blocklist` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `airlock_agent` | **PROTECTS** | `host` | FORWARD |

### Airlock Account

`airlock_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Airlock Agent

`airlock_agent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentVersion` \*

 | `string` **|** `null` | AirLock enforcement agent client version. |  |
| 

`domain` \*

 | `string` **|** `null` | Machine/AD domain reported by the agent. |  |
| 

`hostname` \*

 | `string` **|** `null` | Hostname the agent reports. |  |
| 

`ipAddress` \*

 | `string` **|** `null` | Public IP address of the agent host as seen by the server. |  |
| 

`osName` \*

 | `string` **|** `null` | OS string reported by the agent (e.g. "Windows 10 x64"). |  |
| 

`platform` \*

 | `string` **|** `null` | Parsed OS platform of the agent host (e.g. windows, linux, darwin). |  |
| 

`policyVersion` \*

 | `string` **|** `null` | Policy version currently applied on the agent. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | Private/local IP address reported by the agent. |  |
| 

`statusCode` \*

 | `number` **|** `null` | Raw agent status code reported by /v1/agent/find (integer). |  |

---

### Airlock Application

`airlock_application` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` | AirLock application id. |  |
| 

`version` \*

 | `string` **|** `null` | Application version string (may be empty). |  |

---

### Airlock Application Category

`airlock_application_category` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`categoryId` \*

 | `string` | AirLock application category id. |  |
| 

`parentCategoryId` \*

 | `string` **|** `null` | Parent category id when this is a subcategory; null for top-level categories. |  |

---

### Airlock Blocklist

`airlock_blocklist` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`blocklistId` \*

 | `string` | AirLock blocklist id. |  |

---

### Airlock Policy

`airlock_policy` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`globalProcessExceptions` \*

 | `array` **|** `null` | Global-process exceptions configured on the policy (gprocesses\[\].name). |  |
| 

`isAuditMode` \*

 | `boolean` **|** `null` | Whether the policy is in audit mode (true) vs enforcement mode (false). This is the "policy mode". |  |
| 

`isGeneralisationEnabled` \*

 | `boolean` **|** `null` | Whether generalisation (learning) mode is enabled (generalisation flag != 0). |  |
| 

`isHidden` \*

 | `boolean` **|** `null` | Whether the group is marked hidden in AirLock. |  |
| 

`isPowershellControlled` \*

 | `boolean` **|** `null` | Whether PowerShell execution control is enabled (powershell flag != 0). |  |
| 

`isPowershellLockdown` \*

 | `boolean` **|** `null` | Whether PowerShell constrained-language lockdown is enabled (pslockdown flag != 0). |  |
| 

`parentGroupId` \*

 | `string` **|** `null` | Parent group id (or sentinel) from /v1/group. |  |
| 

`parentProcessExceptions` \*

 | `array` **|** `null` | Parent-process exceptions configured on the policy (pprocesses\[\].name). |  |
| 

`pathExceptions` \*

 | `array` **|** `null` | Allowed path exceptions configured on the policy (paths\[\].name). |  |
| 

`publisherExceptions` \*

 | `array` **|** `null` | Allowed publisher exceptions configured on the policy (publishers\[\].name). |  |

---

### Airlock Service

`airlock_service` inherits from [Service](/data-model/schemas/Service.md)

---

---

Source: /integrations/directory/alibaba-cloud

# Alibaba Cloud

Visualize Alibaba Cloud resources and monitor changes through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within Alibaba Cloud and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your Alibaba account.

### Configuration on Alibaba Cloud

An **Access Key ID** and **Access Key Secret** are required for the JupiterOne integration to interact with Alibaba Cloud's API.

In order to obtain an Access Key ID/Secret combination for the integration, an administrator of the Alibaba Cloud account will need to create a new RAM user the integration can use. Additionally, the user will need to have `Read Only` access to the account.

To do so, the administrator can:

1.  Navigate to the RAM page in the Alibaba Cloud console.
2.  Select **Create User**. We suggest the name of the user include `JupiterOne`.
3.  Check the **Open API Access** option while creating the new user.
4.  Obtain the Access Key ID/Secret combination that is generated.
5.  Grant the new user the `ReadOnlyAccess` permission.

> **INFO**
> 
> For more information, refer to Alibaba Cloud's documentation for [creating a RAM user](https://www.alibabacloud.com/help/en/resource-access-management/latest/getting-started-create-a-ram-user) or for generating the [Access Key ID and Access Key Secret](https://www.alibabacloud.com/help/en/resource-access-management/latest/accesskey-pairs-create-an-accesskey-pair-for-a-ram-user).

### Ingesting multiple accounts with a Resource Directory (optional)

If your accounts are organized in an [Alibaba Cloud Resource Directory](https://www.alibabacloud.com/help/en/resource-management/resource-directory/product-overview/what-is-a-resource-directory), you can point a single JupiterOne integration instance at the **management account** and have JupiterOne automatically create and maintain a separate integration instance for each member account. There is no need to create a RAM user or an integration instance in every account.

This works by having the management account's RAM user assume a role in each member account:

-   When an account is created in or invited to a Resource Directory, Alibaba Cloud automatically creates a RAM role named `ResourceDirectoryAccountAccessRole` in that member account and grants the management account permission to assume it. This is the role JupiterOne assumes by default. See Alibaba Cloud's [RAM roles in a resource directory](https://www.alibabacloud.com/help/en/resource-management/security-and-compliance/ram-roles-in-a-resource-directory) for details.
-   Create the RAM user and AccessKey (as described above) **in the management account**. In addition to `ReadOnlyAccess`, this user needs permission to view the Resource Directory (for example, `AliyunResourceDirectoryReadOnlyAccess`) and permission to assume the member-account role via STS `AssumeRole`.

To exclude a specific member account from ingestion, add a tag with the key `JupiterOne` and the value `SKIP` to that account in the Resource Directory. JupiterOne skips tagged accounts and does not create an instance for them.

### Configuration in JupiterOne

To install the Alibaba Cloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Alibaba Cloud. Click **New Instance** to begin configuring the integration.

Creating an Alibaba Cloud instance requires the following:

-   The **Account Name** used to identify the Alibaba Cloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the Alibaba Cloud **Access Key ID** and **Access Key Secret** generated for use by JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

#### Resource Directory settings (optional)

To ingest every account in a Resource Directory from this instance (see [Ingesting multiple accounts with a Resource Directory](#ingesting-multiple-accounts-with-a-resource-directory-optional) above), configure the following on the management account's instance:

-   **Configure Resource Directory Accounts** — When enabled, JupiterOne enumerates the accounts in the Resource Directory reachable from this instance's credentials and automatically creates a child integration instance for each account (except those tagged `JupiterOne:SKIP`). Child instances inherit their configuration from this instance. Do not enable this setting together with **Account ID** — the Resource Directory parent must run without an Account ID.
    
-   **Resource Directory ID** — Optionally pin the expected Resource Directory ID. If the ID does not match the directory reachable from this instance's credentials, JupiterOne stops instead of configuring instances against the wrong directory.
    
-   **Auto-delete Removed Accounts** — When enabled, JupiterOne automatically deletes the child instances it created for accounts that have since been removed from the Resource Directory. Defaults to disabled.
    
-   **Role Name to Assume in Member Accounts** — The name of the RAM role JupiterOne assumes in each member account. Defaults to `ResourceDirectoryAccountAccessRole`, which Alibaba Cloud creates automatically in each member account. Override this only if you use a custom role.
    

> **NOTE**
> 
> The **Account ID** field is set automatically on the child instances that the parent creates; you do not need to set it yourself. Child instances are managed automatically — avoid editing them manually.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (30)

-   `alb:DescribeRegions`
-   `alb:ListLoadBalancers`
-   `cdn:DescribeUserDomains`
-   `ecs:DescribeInstances`
-   `ecs:DescribeRegions`
-   `ess:DescribeRegions`
-   `ess:DescribeScalingGroups`
-   `ga:ListAccelerators`
-   `nlb:DescribeRegions`
-   `nlb:ListLoadBalancers`
-   `oss:GetBucketInfo`
-   `oss:ListBuckets`
-   `ram:GetAccountAlias`
-   `ram:ListEntitiesForPolicy`
-   `ram:ListGroups`
-   `ram:ListPoliciesForGroup`
-   `ram:ListPoliciesForRole`
-   `ram:ListPoliciesForUser`
-   `ram:ListRoles`
-   `ram:ListUsers`
-   `ram:ListUsersForGroup`
-   `slb:DescribeLoadBalancers`
-   `slb:DescribeRegions`
-   `sts:GetCallerIdentity`
-   `vpc:DescribeEipAddresses`
-   `vpc:DescribeNatGateways`
-   `vpc:DescribeRegions`
-   `vpc:DescribeVpcAttribute`
-   `vpc:DescribeVpcs`
-   `vpc:DescribeVpnGateways`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (30)

-   `https://alb.aliyuncs.com?Action=DescribeRegions`
-   `https://alb.aliyuncs.com?Action=ListLoadBalancers`
-   `https://cdn.aliyuncs.com?Action=DescribeUserDomains`
-   `https://ecs.aliyuncs.com?Action=DescribeInstances`
-   `https://ecs.aliyuncs.com?Action=DescribeRegions`
-   `https://ess.aliyuncs.com?Action=DescribeRegions`
-   `https://ess.aliyuncs.com?Action=DescribeScalingGroups`
-   `https://ga.cn-hangzhou.aliyuncs.com?Action=ListAccelerators`
-   `https://nlb.cn-hangzhou.aliyuncs.com?Action=DescribeRegions`
-   `https://nlb.{regionId}.aliyuncs.com?Action=ListLoadBalancers`
-   `https://oss.aliyuncs.com/?Action=GetBucketInfo`
-   `https://oss.aliyuncs.com/?Action=ListBuckets`
-   `https://ram.aliyuncs.com?Action=GetAccountAlias`
-   `https://ram.aliyuncs.com?Action=ListEntitiesForPolicy`
-   `https://ram.aliyuncs.com?Action=ListGroups`
-   `https://ram.aliyuncs.com?Action=ListPoliciesForGroup`
-   `https://ram.aliyuncs.com?Action=ListPoliciesForRole`
-   `https://ram.aliyuncs.com?Action=ListPoliciesForUser`
-   `https://ram.aliyuncs.com?Action=ListRoles`
-   `https://ram.aliyuncs.com?Action=ListUsers`
-   `https://ram.aliyuncs.com?Action=ListUsersForGroup`
-   `https://slb.aliyuncs.com?Action=DescribeLoadBalancers`
-   `https://slb.aliyuncs.com?Action=DescribeRegions`
-   `https://sts.aliyuncs.com?Action=GetCallerIdentity`
-   `https://vpc.aliyuncs.com?Action=DescribeEipAddresses`
-   `https://vpc.aliyuncs.com?Action=DescribeNatGateways`
-   `https://vpc.aliyuncs.com?Action=DescribeRegions`
-   `https://vpc.aliyuncs.com?Action=DescribeVpcAttribute`
-   `https://vpc.aliyuncs.com?Action=DescribeVpcs`
-   `https://vpc.aliyuncs.com?Action=DescribeVpnGateways`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (30)

-   [https://www.alibabacloud.com/help/en/auto-scaling/developer-reference/api-ess-2014-08-28-describescalinggroups](https://www.alibabacloud.com/help/en/auto-scaling/developer-reference/api-ess-2014-08-28-describescalinggroups)
-   [https://www.alibabacloud.com/help/en/auto-scaling/developer-reference/api-overview](https://www.alibabacloud.com/help/en/auto-scaling/developer-reference/api-overview)
-   [https://www.alibabacloud.com/help/en/cdn/developer-reference/api-cdn-2018-05-10-describeuserdomains](https://www.alibabacloud.com/help/en/cdn/developer-reference/api-cdn-2018-05-10-describeuserdomains)
-   [https://www.alibabacloud.com/help/en/ecs/developer-reference/api-ecs-2014-05-26-describeinstances](https://www.alibabacloud.com/help/en/ecs/developer-reference/api-ecs-2014-05-26-describeinstances)
-   [https://www.alibabacloud.com/help/en/ecs/developer-reference/api-ecs-2014-05-26-describeregions](https://www.alibabacloud.com/help/en/ecs/developer-reference/api-ecs-2014-05-26-describeregions)
-   [https://www.alibabacloud.com/help/en/global-accelerator/latest/api-ga-2019-11-20-listaccelerators](https://www.alibabacloud.com/help/en/global-accelerator/latest/api-ga-2019-11-20-listaccelerators)
-   [https://www.alibabacloud.com/help/en/nat-gateway/developer-reference/api-vpc-2016-04-28-describenatgateways-natgws](https://www.alibabacloud.com/help/en/nat-gateway/developer-reference/api-vpc-2016-04-28-describenatgateways-natgws)
-   [https://www.alibabacloud.com/help/en/oss/developer-reference/getbucketinfo](https://www.alibabacloud.com/help/en/oss/developer-reference/getbucketinfo)
-   [https://www.alibabacloud.com/help/en/oss/developer-reference/listbuckets](https://www.alibabacloud.com/help/en/oss/developer-reference/listbuckets)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-getaccountalias](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-getaccountalias)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listentitiesforpolicy](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listentitiesforpolicy)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listgroups](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listgroups)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listpoliciesforgroup](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listpoliciesforgroup)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listpoliciesforrole](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listpoliciesforrole)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listpoliciesforuser](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listpoliciesforuser)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listroles](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listroles)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listusers](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listusers)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listusersforgroup](https://www.alibabacloud.com/help/en/ram/developer-reference/api-ram-2015-05-01-listusersforgroup)
-   [https://www.alibabacloud.com/help/en/ram/developer-reference/api-sts-2015-04-01-getcalleridentity](https://www.alibabacloud.com/help/en/ram/developer-reference/api-sts-2015-04-01-getcalleridentity)
-   [https://www.alibabacloud.com/help/en/slb/application-load-balancer/developer-reference/api-alb-2020-06-16-listloadbalancers](https://www.alibabacloud.com/help/en/slb/application-load-balancer/developer-reference/api-alb-2020-06-16-listloadbalancers)
-   [https://www.alibabacloud.com/help/en/slb/application-load-balancer/developer-reference/api-overview](https://www.alibabacloud.com/help/en/slb/application-load-balancer/developer-reference/api-overview)
-   [https://www.alibabacloud.com/help/en/slb/classic-load-balancer/developer-reference/api-slb-2014-05-15-describeloadbalancers](https://www.alibabacloud.com/help/en/slb/classic-load-balancer/developer-reference/api-slb-2014-05-15-describeloadbalancers)
-   [https://www.alibabacloud.com/help/en/slb/classic-load-balancer/developer-reference/api-slb-2014-05-15-describeregions](https://www.alibabacloud.com/help/en/slb/classic-load-balancer/developer-reference/api-slb-2014-05-15-describeregions)
-   [https://www.alibabacloud.com/help/en/slb/network-load-balancer/developer-reference/api-nlb-2022-04-30-describeregions](https://www.alibabacloud.com/help/en/slb/network-load-balancer/developer-reference/api-nlb-2022-04-30-describeregions)
-   [https://www.alibabacloud.com/help/en/slb/network-load-balancer/developer-reference/api-nlb-2022-04-30-listloadbalancers](https://www.alibabacloud.com/help/en/slb/network-load-balancer/developer-reference/api-nlb-2022-04-30-listloadbalancers)
-   [https://www.alibabacloud.com/help/en/vpc/developer-reference/api-vpc-2016-04-28-describeeipaddresses](https://www.alibabacloud.com/help/en/vpc/developer-reference/api-vpc-2016-04-28-describeeipaddresses)
-   [https://www.alibabacloud.com/help/en/vpc/developer-reference/api-vpc-2016-04-28-describeregions](https://www.alibabacloud.com/help/en/vpc/developer-reference/api-vpc-2016-04-28-describeregions)
-   [https://www.alibabacloud.com/help/en/vpc/developer-reference/api-vpc-2016-04-28-describevpcattribute](https://www.alibabacloud.com/help/en/vpc/developer-reference/api-vpc-2016-04-28-describevpcattribute)
-   [https://www.alibabacloud.com/help/en/vpc/developer-reference/api-vpc-2016-04-28-describevpcs](https://www.alibabacloud.com/help/en/vpc/developer-reference/api-vpc-2016-04-28-describevpcs)
-   [https://www.alibabacloud.com/help/en/vpn/sub-product-ipsec-vpn/developer-reference/api-vpc-2016-04-28-describevpngateways-vpns](https://www.alibabacloud.com/help/en/vpn/sub-product-ipsec-vpn/developer-reference/api-vpc-2016-04-28-describevpngateways-vpns)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (7)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Build Group and User Relationships | `ram:ListUsersForGroup` | `https://ram.aliyuncs.com?Action=ListUsersForGroup` |
| Build Policy and Group Relationships | `ram:ListEntitiesForPolicy` | `https://ram.aliyuncs.com?Action=ListEntitiesForPolicy` |
| Build Policy and Role Relationships | `ram:ListEntitiesForPolicy` | `https://ram.aliyuncs.com?Action=ListEntitiesForPolicy` |
| Build Policy and User Relationships | `ram:ListEntitiesForPolicy` | `https://ram.aliyuncs.com?Action=ListEntitiesForPolicy` |
| Fetch RAM Groups' Policies | `ram:ListPoliciesForGroup` | `https://ram.aliyuncs.com?Action=ListPoliciesForGroup` |
| Fetch RAM Roles' Policies | `ram:ListPoliciesForRole` | `https://ram.aliyuncs.com?Action=ListPoliciesForRole` |
| Fetch RAM Users' Policies | `ram:ListPoliciesForUser` | `https://ram.aliyuncs.com?Action=ListPoliciesForUser` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `alibaba_cloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| ALB Load Balancer | `alibaba_cloud_alb_load_balancer` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Autoscaling Group | `alibaba_cloud_autoscaling_group` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| CDN Domain | `alibaba_cloud_cdn_domain` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| CLB Load Balancer | `alibaba_cloud_clb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ECS Instance | `alibaba_cloud_ecs_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| EIP Address | `alibaba_cloud_eip` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| Global Accelerator | `alibaba_cloud_global_accelerator` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| NAT Gateway | `alibaba_cloud_nat_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| NLB Load Balancer | `alibaba_cloud_nlb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| OSS Bucket | `alibaba_cloud_oss_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| RAM Group | `alibaba_cloud_ram_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| RAM Policy | `alibaba_cloud_ram_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| RAM Role | `alibaba_cloud_ram_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| RAM User | `alibaba_cloud_ram_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| VPC | `alibaba_cloud_vpc` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| VPN Gateway | `alibaba_cloud_vpn_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `alibaba_cloud_account` | **HAS** | `alibaba_cloud_cdn_domain` |
| `alibaba_cloud_account` | **HAS** | `alibaba_cloud_global_accelerator` |
| `alibaba_cloud_autoscaling_group` | **USES** | `alibaba_cloud_vpc` |
| `alibaba_cloud_eip` | **ASSIGNED** | `alibaba_cloud_ecs_instance` |
| `alibaba_cloud_eip` | **ASSIGNED** | `alibaba_cloud_clb` |
| `alibaba_cloud_ram_group` | **HAS** | `alibaba_cloud_ram_user` |
| `alibaba_cloud_ram_policy` | **ASSIGNED** | `alibaba_cloud_ram_user` |
| `alibaba_cloud_ram_policy` | **ASSIGNED** | `alibaba_cloud_ram_group` |
| `alibaba_cloud_ram_policy` | **ASSIGNED** | `alibaba_cloud_ram_role` |
| `alibaba_cloud_vpc` | **HAS** | `alibaba_cloud_ecs_instance` |
| `alibaba_cloud_vpc` | **HAS** | `alibaba_cloud_alb_load_balancer` |
| `alibaba_cloud_vpc` | **HAS** | `alibaba_cloud_nat_gateway` |
| `alibaba_cloud_vpc` | **HAS** | `alibaba_cloud_vpn_gateway` |
| `alibaba_cloud_vpc` | **HAS** | `alibaba_cloud_nlb` |
| `alibaba_cloud_vpc` | **HAS** | `alibaba_cloud_clb` |

## Release Notes

-   **2026-04-08** — Improved OS type and name accuracy for Alibaba Cloud ECS instance entities.

---

Source: /integrations/directory/anthropic

# Anthropic

Visualize Anthropic organization data in the JupiterOne graph. Map users to workspaces, track API key ownership and status, and monitor identity and access changes through custom queries and alerts.

## Installation

The Anthropic integration ingests organization details, users, workspaces, workspace memberships, and API keys using the Anthropic [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api). Before setting up the integration in JupiterOne, you will need to create an **Admin API key** in the Claude Console.

### Prerequisites

-   An Anthropic **organization** (the Admin API is unavailable for individual accounts). If you have not set one up, go to **Console > Settings > Organization** first.
-   An organization member with the **admin** role — only admins can create Admin API keys.
-   Access to JupiterOne with permission to configure integrations.

### Creating an Admin API key in Anthropic

1.  Log in to the [Claude Console](https://console.anthropic.com/) as an organization admin.
2.  Navigate to **Settings > Admin Keys** ([https://platform.claude.com/settings/admin-keys](https://platform.claude.com/settings/admin-keys)).
3.  Click **Create Admin Key** and give it a recognizable name (for example, `JupiterOne Integration`).
4.  Copy the generated key — it starts with `sk-ant-admin` and is shown only once.

> **NOTE**
> 
> Admin API keys are separate from standard API keys. Only organization admins can create them, and they provide access to the organization management endpoints (`/v1/organizations/me`, `/v1/organizations/users`, `/v1/organizations/workspaces`, workspace members, and `/v1/organizations/api_keys`). No additional scope configuration is required — the integration only reads from these endpoints.

### Configuration in JupiterOne

To install the Anthropic integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Anthropic. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Anthropic account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Anthropic **API Key** — the Admin API key created above (starts with `sk-ant-admin`). This field is required.
    
-   Optionally, a **Base URL** to override the Anthropic API endpoint. Leave blank to use the default `https://api.anthropic.com`.
    
-   Optionally, an **Anthropic Version** to override the `anthropic-version` request header. Leave blank to use the default `2023-06-01`.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `admin`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://platform.claude.com/docs/en/docs/administration/administration-api](https://platform.claude.com/docs/en/docs/administration/administration-api)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | Roles |
| --- | --- |
| Fetch Api Keys | `admin` |
| Fetch Users | `admin` |
| Fetch Workspace Members | `admin` |
| Fetch Workspaces | `admin` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `anthropic_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Api Key | `anthropic_api_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| User | `anthropic_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Workspace | `anthropic_workspace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `anthropic_account` | **HAS** | `anthropic_user` |
| `anthropic_account` | **HAS** | `anthropic_workspace` |
| `anthropic_user` | **ASSIGNED** | `anthropic_workspace` |
| `anthropic_user` | **CREATED** | `anthropic_api_key` |
| `anthropic_workspace` | **HAS** | `anthropic_api_key` |

### Anthropic Account

`anthropic_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Anthropic Api Key

`anthropic_api_key` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `partialKeyHint` | `string` | A partial hint of the API key value |  |
| `status` | `string` | The status of the API key (active, inactive, archived) |  |

---

### Anthropic User

`anthropic_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `email` | `array` of `string`s | The email address(es) of the user |  |
| `role` | `string` | The role of the user in the organization (user, developer, billing, admin, claude\_code\_user, managed) |  |

---

### Anthropic Workspace

`anthropic_workspace` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `archivedOn` | `number` | Timestamp when the workspace was archived |  |
| `displayColor` | `string` | The display color of the workspace |  |

---

---

Source: /integrations/directory/apple-business-manager

# Apple Business Manager

JupiterOne's integration with Apple Business Manager collects data about MDM servers and managed devices, providing visibility into your organization's Apple device management infrastructure.

## Installation

For this integration, you will need an [Apple Business Manager](https://business.apple.com/) account with administrative access and API access enabled. This integration uses JWT-based OAuth authentication with the Apple Business Manager API.

> **INFO**
> 
> You will need to generate a server token and obtain the required credentials from Apple Business Manager. See the [Apple Business Manager API documentation](https://developer.apple.com/documentation/applebusinessmanagerapi) for more information.

### Obtaining API Credentials

1.  Log in to [Apple Business Manager](https://business.apple.com/)
2.  Navigate to **Settings** > **Preferences**
3.  Under **Server Tokens**, create a new token with the required permissions
4.  Download the private key (.pem file)
5.  Note the following values:
    -   **Client ID**: Your organization's Apple Business Manager Client ID
    -   **Key ID**: The identifier for the private key
    -   **Private Key**: The content of the downloaded .pem file Once the API Token is created, you can find the Client ID and Key ID by clicking "Manage" next to the new token.

![Apple Business Manager server token settings](/assets/images/abm2-66e38746559bae2b8f5bc276e8ccfdd5.png) ![Apple Business Manager server token details](/assets/images/abm1-54704a98d7c20c24af3eb41b607aba85.png)

The server token you create must have sufficient permissions to access:

-   MDM server configurations
-   Device inventory

### Configuration in JupiterOne

To install the Apple Business Manager integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Apple Business Manager. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Apple Business Manager account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Client ID**: Your Apple Business Manager Client ID
    
-   **Key ID**: The Key ID associated with your private key
    
-   **Private Key**: Upload the .pem file you downloaded from Apple Business Manager
    

Click **Create** once all values are provided to finalize the integration.

> **NOTE**
> 
> If the integration runs successfully but no entities are collected, verify that your organization has MDM servers configured in Apple Business Manager and that devices are assigned to your organization.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| AppleCare Coverage | `apple_business_manager_apple_care_coverage` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| MDM Server | `apple_business_manager_mdm_server` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Org Device | `apple_business_manager_org_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Organization | `apple_business_manager_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `apple_business_manager_org_device` | **HAS** | `apple_business_manager_apple_care_coverage` |
| `apple_business_manager_organization` | **HAS** | `apple_business_manager_mdm_server` |

### Apple Business Manager Apple Care Coverage

`apple_business_manager_apple_care_coverage` inherits from [Subscription](/data-model/schemas/Subscription.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agreementNumber` | `string` **|** `null` | Apple-issued agreement number for the coverage contract. Null for base Limited Warranty. |  |
| `contractCancelOn` | `number` **|** `null` | Timestamp the contract was cancelled, if cancelled (ms since epoch). |  |
| `endedOn` | `number` **|** `null` | Coverage end timestamp (ms since epoch). |  |
| `isCanceled` | `boolean` **|** `null` | Whether the coverage contract has been cancelled. |  |
| `isRenewable` | `boolean` **|** `null` | Whether the coverage contract can be renewed at end of term. |  |
| `paymentType` | `string` **|** `null` | Payment type for the coverage contract. Known values: `ABE_SUBSCRIPTION`, `PAID_UP_FRONT`, `SUBSCRIPTION`, `NONE`. |  |
| `startedOn` | `number` **|** `null` | Coverage start timestamp (ms since epoch). |  |

---

### Apple Business Manager Mdm Server

`apple_business_manager_mdm_server` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `serverType` | `string` **|** `null` |  |  |

---

### Apple Business Manager Org Device

`apple_business_manager_org_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `addedToOrgOn` | `number` |  |  |
| `bluetoothMacAddress` | `string` **|** `null` |  |  |
| `color` | `string` **|** `null` |  |  |
| `deviceCapacity` | `string` **|** `null` |  |  |
| `deviceFamily` | `string` **|** `null` |  |  |
| `eid` | `string` **|** `null` |  |  |
| `imei` | `array` **|** `null` |  |  |
| `meid` | `array` **|** `null` |  |  |
| `orderedOn` | `number` |  |  |
| `orderNumber` | `string` |  |  |
| `partNumber` | `string` |  |  |
| `productType` | `string` **|** `null` |  |  |
| `purchaseSourceId` | `string` |  |  |
| `purchaseSourceType` | `string` |  |  |
| `releasedFromOrgOn` | `number` **|** `null` |  |  |
| `status` | `string` |  |  |
| `wifiMacAddress` | `string` **|** `null` |  |  |

---

### Apple Business Manager Organization

`apple_business_manager_organization` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `adminId` | `string` |  |  |
| `orgAddress` | `string` |  |  |
| `orgEmail` | `string` |  |  |
| `orgId` | `string` |  |  |
| `orgPhone` | `string` |  |  |
| `orgType` | `string` |  |  |

---

## Release Notes

-   **2026-01-20** — New Apple Business Manager integration: ingests organizations, MDM servers, and organization-owned devices.

---

Source: /integrations/directory/aquasec

# Aqua Security

Visualize Aqua Security accounts, groups, users, and API keys, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an API Key and Secret key on Aqua Security. See [their documentation](https://cloud.aquasec.com/cspm/#/apikeys) for more information.

### Configuration in Aqua Security

When creating the API Key and Secret for this integration, ensure the credentials have **read-only access** to the following resources:

-   **Accounts** (`/v2/accounts/{accountId}`)
-   **Groups** (`/v2/groups`)
-   **Users** (`/v2/users`)
-   **API Keys** (`/v2/apikeys`)

The integration uses HMAC-SHA256 signature authentication and requires no write permissions.

### Configuration in JupiterOne

To install the Aqua Security integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Aqua Security. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Aqua Security account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Aqua Security **Account ID**, **API Key**, and **API Secret**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `aquasec_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| API Key | `aquasec_api_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Group | `aquasec_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `aquasec_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `aquasec_account` | **HAS** | `aquasec_user` |
| `aquasec_account` | **HAS** | `aquasec_group` |
| `aquasec_account` | **HAS** | `aquasec_api_key` |
| `aquasec_group` | **HAS** | `aquasec_user` |

### Aquasec User

`aquasec_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `confirmed` | `boolean` |  |  |
| `multiaccount` | `boolean` |  |  |
| `passwordReset` | `boolean` |  |  |
| `sendAnnouncements` | `boolean` |  |  |
| `sendNewPlugins` | `boolean` |  |  |
| `sendNewRisks` | `boolean` |  |  |
| `sendScanResults` | `boolean` |  |  |

---

---

Source: /integrations/directory/armis

# Armis

The Armis integration adds comprehensive device visibility and threat detection capabilities. This integration enables JupiterOne users to better manage assets, assess risks, and respond to incidents more effectively by leveraging Armis's device insights.

## Installation

To install this integration, you will need to configure settings both within Armis and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your Armis's account.

### Configuration on Armis

> **NOTE**
> 
> You will have to configure an API secret key in Armis so that the integration can make REST API calls to fetch data from Armis.

1.  Using a web browser, go to your Armis tenant (e.g. `https://my-tenant.armis.com`) and log in with your credentials.
    
2.  Click on Settings -> API Management
    
    ![Settings](/assets/images/armis-settings-8af8fa5df13ab217a097715d8e55274d.png)
    
3.  Click on the `Create` button
    
    ![Create Button](/assets/images/armis-create-button-c9e6fcfb6b60f6ebce67779519957801.png)
    
4.  You will get a message box with the newly created API Secret Key. Save the key in a safe place, you will need this to configure the integration in JupiterOne.
    
    ![Armis API Secret Key](/assets/images/armis-api-key-26b61713983b8516ae6b8eaa056307bf.png)
    

## Data Volume Configuration

Control how much data is ingested from Armis to manage storage and processing.

### Ingestion Windows (Time Ranges)

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Historical Days** | Number of days for which data should be retrieved from Armis | 90 | Any number greater than 0 |
| **Vulnerabilities Ingestion Window** | Ingestion window for vulnerabilities last detected (days ago) | 90 | 90, 180, 275, 365 |

**How it affects data volume:** Higher number of days will result in more devices, alerts, and vulnerabilities being ingested from Armis.

### Data Filtering Options

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **Included Vulnerability Severities** | Multi-select | Select vulnerability severities to ingest | Critical, High, Medium |
| **Included Vulnerability Status** | Multi-select | Select vulnerability status to ingest | Open |

**How it affects data volume:** Filtering by severity and status reduces the number of vulnerability entities ingested. By default, only Critical, High, and Medium severity vulnerabilities with Open status are imported.

### Finalize in JupiterOne

To install the `Armis` integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select `Armis`. Click **New Instance** to begin configuring the integration.

Creating an integration instance requires the following:

-   Enter the Armis URL (e.g. `https://<tenant>.armis.com`)
    
-   Enter the Armis API Secret Key generated for use by JupiterOne.
    
-   Enter the account name by which you want to identify this Armis account in JupiterOne.
    
-   \[Optional\] Enter a description to help your team identify the integration.
    
-   \[Optional\] Select a polling interval that is sufficient for your monitoring requirements. You can leave this as `DISABLED` and manually execute the integration.
    
-   \[Optional\] Enter the Historical Days (any number greater than 0). The integration will ask Armis to return devices/alerts seen in the last few days. The Historical Days number will be used for this query. Higher number of days will result in more data ingested.
    
-   \[Optional\] Disable TLS Verification - Set this to true only if you have an on-prem Armis server that does not have a valid SSL certificate configured. For most cases this value should be false.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `armis_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `armis_finding_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Device | `armis_device` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Site | `armis_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| Vendor | `armis` | [Vendor](https://docs.jupiterone.io/data-model/schemas/Vendor) |
| Vulnerability | `armis_finding_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Vulnerability | `armis_finding_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `armis` | **HOSTS** | `armis_account` |
| `armis_account` | **MANAGES** | `armis_device` |
| `armis_account` | **HAS** | `armis_site` |
| `armis_device` | **HAS** | `armis_finding_vulnerability` |
| `armis_device` | **HAS** | `armis_finding_alert` |
| `armis_site` | **HAS** | `armis_device` |

### Armis Device

`armis_device` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_key` \*

 | `string` |  |  |
| `ipAddress` | `string` |  |  |
| `ipv6` | `string` |  |  |
| `macAddress` | `string` |  |  |

---

### Armis Finding Vulnerability

`armis_finding_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`blocking` \*

 | `boolean` **|** `null` |  |  |
| 

`production` \*

 | `boolean` **|** `null` |  |  |
| 

`public` \*

 | `boolean` **|** `null` |  |  |
| 

`remediationActions` \*

 | `string` **|** `null` |  |  |

---

### Armis Finding Vulnerability

`armis_finding_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`blocking` \*

 | `boolean` **|** `null` |  |  |
| 

`production` \*

 | `boolean` **|** `null` |  |  |
| 

`public` \*

 | `boolean` **|** `null` |  |  |
| 

`remediationActions` \*

 | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name accuracy for Armis device entities, using human-readable OS names.
-   **2025-08-19** — Added recommended actions normalization to Armis vulnerability and finding entities.
-   **2025-08-05** — Added advisory ID, confidence level, remediation information, first detected, and last detected timestamps to Armis vulnerability entities.
-   **2025-06-03** — Added Armis unified vulnerability ingestion, supporting both vulnerability and finding entity classes with configurable severity filtering.

---

Source: /integrations/directory/artifactory

# Artifactory

Visualize JFrog Artifactory repository groups, code repositories, builds, keys, permissions, user groups, and users, and monitor changes through queries and alerts.

## Installation

For this integration, JupiterOne requires the namespace of your Artifactory account. It also requires are a **Client Access Token**, **Client Pipeline Access Token**, and the **Client Administrator Name** that granted the access tokens.

### Configuration in Artifactory

Configure API access tokens in Artifactory using the instructions in the [Access Tokens guide](https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-tokens#AccessTokens-CreateToken).

#### Required permissions

The integration reads platform-wide security and administration APIs, so the **Client Access Token** must be created with the `applied-permissions/admin` scope, or by a user holding Admin privileges. A token limited to a user's own permissions cannot read most of the endpoints below and its steps will fail with `403 Forbidden`.

The token is used for these endpoints:

| Endpoint | Used for |
| --- | --- |
| `GET artifactory/api/system/ping` | Connection check when the instance is saved |
| `GET artifactory/api/security/users` and `GET artifactory/api/security/users/{name}` | Users |
| `GET artifactory/api/security/groups` and `GET artifactory/api/security/groups/{name}` | Groups |
| `GET artifactory/api/security/token` | Access tokens |
| `GET artifactory/api/repositories` | Repositories |
| `POST artifactory/api/search/aql` | Artifacts |
| `GET artifactory/api/v2/security/permissions` and `GET artifactory/api/v2/security/permissions/{name}` | Permissions |
| `GET artifactory/api/build`, `GET artifactory/api/build/{name}` and `POST artifactory/api/search/buildArtifacts` | Builds |
| `GET xray/api/v1/artifacts` and `POST xray/api/v1/summary/artifact` | Vulnerabilities (requires JFrog Xray) |

The optional **Client Pipeline Access Token** is used only for `GET pipelines/api/v1/pipelinesources`, and only when **Ingest Pipeline Information** is enabled.

#### Network access

JupiterOne reaches your JFrog host over the public internet from its own egress addresses. If a reverse proxy, WAF, CDN, IP allowlist or edge rate limiter sits in front of the host, it can reject JupiterOne's requests with `403 Forbidden` before they ever reach Artifactory — which looks like a permissions problem but is not one.

A rejection from the edge is recognisable in two ways: the failures are intermittent or vary between jobs rather than always affecting the same endpoints, and the error page is HTML from the proxy rather than Artifactory's own JSON error. When the integration sees an HTML error page where an API error belongs, the job error says so and points at a proxy as the likely cause. In that case, allowlist JupiterOne's egress addresses or exempt the JFrog API paths from the blocking rule; changing the token will not help.

## Data Volume Configuration

Control how much data is ingested from Artifactory to manage storage and processing.

### Ingestion Windows (Time Ranges)

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Artifacts Ingestion Window** | Ingest artifacts created within the last X days | 30 | 30, 60, 90, 365 |

**How it affects data volume:** A longer ingestion window retrieves more artifacts from Artifactory, increasing the number of artifact entities stored in JupiterOne.

### Data Filtering Options

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **Included Vulnerability Severities** | Multi-select | Select vulnerability severities to ingest | Medium, High, Critical |
| **Include Repository Artifacts** | Array | Comma-separated list of repositories from which artifacts will be ingested. Excludes all others. | None (all repositories) |

**How it affects data volume:**

-   Severity filtering reduces vulnerability entities by excluding low-severity findings. By default, only Medium, High, and Critical vulnerabilities are ingested.
-   Repository filtering limits artifact ingestion to specified repositories, significantly reducing data when only specific repositories are needed.

### Configuration in JupiterOne

To install the JFrog Artifactory integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Artifactory. Click **New Instance** to begin configuring your integration, providing the following:

-   **Account Name** used to identify the JFrog Artifactory account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` option is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Client Namespace** of your Artifactory account.
    
-   **Client Access Token** configured in your Artifactory account.
    
-   **Client Pipeline Access Token** configured in your Artifactory account.
    
-   **Client Administrator Name**, or username of the administrator who granted the Artifactory access tokens.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| AccessToken | `artifactory_access_token` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Account | `artifactory_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| ArtifactCodeModule | `artifactory_artifact_codemodule` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Build | `artifactory_build` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Finding | `artifactory_vulnerability_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Group | `artifactory_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Permission | `artifactory_permission` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| PipelineSource | `artifactory_pipeline_source` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Repository | `artifactory_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| RepositoryGroup | `artifactory_repository_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `artifactory_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `artifactory_access_token` | **ASSIGNED** | `artifactory_user` |
| `artifactory_account` | **HAS** | `artifactory_group` |
| `artifactory_account` | **HAS** | `artifactory_access_token` |
| `artifactory_account` | **HAS** | `artifactory_user` |
| `artifactory_account` | **HAS** | `artifactory_repository` |
| `artifactory_account` | **HAS** | `artifactory_repository_group` |
| `artifactory_account` | **HAS** | `artifactory_pipeline_source` |
| `artifactory_artifact_codemodule` | **HAS** | `artifactory_vulnerability_finding` |
| `artifactory_build` | **CREATED** | `artifactory_artifact_codemodule` |
| `artifactory_group` | **HAS** | `artifactory_user` |
| `artifactory_permission` | **ASSIGNED** | `artifactory_user` |
| `artifactory_permission` | **ASSIGNED** | `artifactory_group` |
| `artifactory_permission` | **ALLOWS** | `artifactory_repository` |
| `artifactory_permission` | **ALLOWS** | `artifactory_build` |
| `artifactory_permission` | **ALLOWS** | `artifactory_repository_group` |
| `artifactory_repository` | **HAS** | `artifactory_artifact_codemodule` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `artifactory_build` | **USES** | `github_repo` | FORWARD |

### Artifactory User

`artifactory_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `disableUIAccess` | `boolean` |  |  |
| `internalPasswordDisable` | `boolean` |  |  |
| `mfaStatus` | `boolean` |  |  |
| `policyManager` | `boolean` |  |  |
| `profileUpdatable` | `boolean` |  |  |
| `realm` | `string` |  |  |
| `reportsManager` | `boolean` |  |  |
| `watchManager` | `boolean` |  |  |

---

### Artifactory Vulnerability Finding

`artifactory_vulnerability_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

---

## Release Notes

-   **2026-10-18** — Added support for linking Artifactory builds to their GitHub source repositories, enabling cross-system traceability between build artifacts and source code.
    
-   **2026-05-05** — Artifactory access tokens are now classified as Non-Human Identity, improving visibility into non-human access and credential risk.
    
-   **2026-02-13** — Added TLS verification configuration options for Artifactory, supporting custom CA certificates and self-signed certificate environments.
    
-   **2025-06-03** — Artifactory vulnerability findings now support both the Vulnerability and Weakness entity classes for improved data model compatibility.
    
-   **2025-04-29** — Added configuration option to include artifacts from specific repositories in Artifactory ingestion.

---

Source: /integrations/directory/asana

# Asana

Visualize Asana workspaces, teams, users, projects, and project memberships, map Asana users to employees, and monitor changes to Asana users through queries and alerts.

## Installation

This integration uses OAuth 2.0 with a refresh token. You first register an OAuth application in Asana, then authorize JupiterOne against it so JupiterOne can refresh access tokens as needed.

Creating an instance requires the following:

-   An Asana user account with permission to create OAuth applications in the [Asana developer console](https://developers.asana.com/docs/oauth).
-   An OAuth application registered in Asana, granted the read scopes this integration needs: `users:read`, `workspaces:read`, `teams:read` and `projects:read`. Project memberships are read through an endpoint that Asana does not gate with a dedicated scope, so the application must be granted **Full permissions** to ingest them.

> **NOTE**
> 
> Granting **Full permissions** satisfies every scope above, including the project-memberships endpoint. You can instead select the individual read scopes, but project memberships will not be ingested without **Full permissions**.

### Register an Asana OAuth application

1.  Sign in to Asana and open the developer console (**My apps**). See Asana's [OAuth guide](https://developers.asana.com/docs/oauth#register-an-application) for registering an application, then select **Create new app**.
2.  Provide an **App name** and a **Redirect URL**. Non-native applications must use an `https` callback URL.
3.  In the sidebar, open **OAuth** and then **Permission scopes**. Toggle on **Full permissions**, or select the specific read scopes `users:read`, `workspaces:read`, `teams:read` and `projects:read`. See the [Asana OAuth scopes documentation](https://developers.asana.com/docs/oauth#oauth-scopes) for details.
4.  On the **OAuth** tab, note the **Client ID** and **Client Secret**. Obtain a **refresh token** by completing the OAuth authorization-code flow described in the [Asana OAuth documentation](https://developers.asana.com/docs/oauth).

### Configure the integration in JupiterOne

To install the Asana integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Asana. Click **New Instance** to begin configuring your integration.

-   The **Account Name** used to identify the Asana account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
-   **Description** to assist in identifying the integration instance, if desired.
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.

After clicking **Create**, you'll be prompted to authorize JupiterOne with Asana. Completing the authorization process will finalize the integration setup.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `asana_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Project | `asana_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Project Membership | `asana_project_membership` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Team | `asana_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `asana_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Workspace | `asana_workspace` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `asana_account` | **HAS** | `asana_workspace` |
| `asana_project` | **HAS** | `asana_project_membership` |
| `asana_project_membership` | **ALLOWS** | `asana_project` |
| `asana_team` | **HAS** | `asana_user` |
| `asana_team` | **ASSIGNED** | `asana_project` |
| `asana_user` | **OWNS** | `asana_project` |
| `asana_user` | **ASSIGNED** | `asana_project_membership` |
| `asana_workspace` | **HAS** | `asana_user` |
| `asana_workspace` | **HAS** | `asana_team` |
| `asana_workspace` | **HAS** | `asana_project` |

### Asana User

`asana_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |

---

---

Source: /integrations/directory/asset-panda

# Asset Panda

Visualize Asset Panda users and assets, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to acquire and provide the following within JupiterOne:

1.  An **Asset Panda Email and Password**: You need to enter the e-mail and password you would use to log into your account when going to the asset panda web application on the website. It is recommended to create a service account used for creating your token.
2.  The **Asset Mapping Configuration JSON File**: A JSON file that defines the mapping between Asset Panda assets and JupiterOne entities. It specifies the Group ID of the asset to be ingested and the Entity Class used to classify the corresponding JupiterOne entity. The entity classes can be found [here](https://docs.jupiterone.io/data-model/schemas/Host)

#### The Asset Mapping Configuration JSON file should adhere to the following structure:

```json
{
  "groups": [
    {
      "groupId": 123,
      "_class": "Host",
      "propertyToFieldMap": {
        "hostname": "field_12",
        "model": "field_24",
        "os": null,
        "retiredOn": {"field": "field_48", "type": "date"}
      }
    },
    {
      "groupId": 456,
      "_class": "Site",
      "propertyToFieldMap": {
        "displayName": "field_1",
        "officeCode": "field_2",
        "address": "field_3",
        "region": "field_4"
      }
    }
  ],
  "relationships": [
    {
      "_class": "HAS",
      "sourceGroupId": 123,
      "sourceField": "field_48",
      "targetGroupId": 456,
      "targetField": "id"
    }
  ]
}
```

#### Key descriptions:

##### `groups`: An array of objects that define the mapping between Asset Panda groups and JupiterOne entities.

1.  `groupId` (Required):

-   Type: `number`
-   Description: A unique identifier for the group. This ID must exist and be valid in Asset Panda.

2.  `_class` (Required):

-   Type: `string`
-   Description: The name of the class representing the schema. This must correspond to a valid class name in JupiterOne's data model schema repository.

3.  `propertyToFieldMap` (Required):

-   Type: `object`
-   Description: A mapping of property names to field names. Each property represents an entity property in the JupiterOne schema, and its value is the field to which it maps in the Asset Panda asset.
    -   Keys: Property names (`string`)
    -   Values: Field names (`string`) or `null` if no mapping is provided. An object with the following fields is also accepted:
        -   `field`: The field name in Asset Panda.
        -   `type`: The type of the field. Only valid value for now is `date`, used to parse date values to the correct JupiterOne format.
-   For the specified \_class, all required properties from the schema must be included in propertyToFieldMap. Missing properties will cause validation to fail. You can find the required properties in the [data model schema](https://docs.jupiterone.io/data-model/schemas/Host#required-properties).
-   Fields not found in the JupiterOne schema can be added as additional properties.

##### `relationships`: Relationships define how entities in Asset Panda relate to one another in JupiterOne. The \_class field must be a valid relationship type in the JupiterOne data model.

1.  `_class` (Required):

-   Type: `string`
-   Description: The name of the class representing the relationship. Examples of possible relationship classes can be found in the JupiterOne documentation [here](https://docs.jupiterone.io/data-model/jupiterone-data-model#relationship-examples).

2.  `sourceGroupId` (required):

-   Type: `number`
-   Description: A unique identifier for the source group. This ID must exist and be valid in Asset Panda.

3.  `sourceField` (required):

-   Type: `string`
-   Description: The field in the source group that contains the identifier for the target entity. This field must exist and hold valid values.

4.  `targetGroupId` (required):

-   Type: `number`
-   Description: A unique identifier for the target group. This ID must exist and be valid in Asset Panda.

5.  `targetField` (optional, default: `id`):

-   Type: `string`
-   Description: The field in the target group that corresponds to the source entity's reference field. This field must exist and hold valid values. When this field is `id`, the sourceField must be of type `EntityListField` in Asset Panda.

#### How to find the group ID in Asset Panda:

1.  Open Group Settings:

-   Log in to the Asset Panda web application.
-   Click on the Cog icon in the top-right corner.
-   Select Group Settings from the dropdown menu.

2.  Select the Desired Group:

-   In the Group Settings, locate and click on the group you want to ingest.

3.  Copy the Group ID:

-   Once the group is selected, look at the URL in your browser's address bar.
-   The Group ID will be part of the URL. Copy this ID for your use.

#### How to find the field keys in Asset Panda:

1.  Open Developer Tools:

-   Go to the Asset Panda web application in your browser.
-   Right-click anywhere on the page and select Inspect or Inspect Element to open the developer tools.

2.  Access the Network Tab:

-   In the developer tools, click on the Network tab.
-   Reload the page to capture all network requests.

3.  Filter Requests:

-   Use the search bar or filter options to search for requests containing the term "fields".

4.  View the Request Details:

-   Select the relevant network request.
-   Go to the Preview tab in the request details.

5.  Locate the Field Keys:

-   In the list of field objects displayed under the Preview tab, look for the property labeled "key". This is the field key you need.

### Configuration in JupiterOne

To install the Asset Panda integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Asset Panda. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Asset Panda account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Asset Panda **Email** and **Password**.
    
-   The **Asset Mapping Configuration JSON File** that defines the mapping between Asset Panda assets and JupiterOne entities.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `asset_panda_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| User | `asset_panda_account_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `asset_panda_account` | **HAS** | `asset_panda_account_user` |
| `asset_panda_account` | **HAS** | `ANY_RESOURCE` |

### Asset Panda Account

`asset_panda_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `subtype` | `string` |  |  |
| `type` | `string` |  |  |

---

### Asset Panda Account User

`asset_panda_account_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |

---

---

Source: /integrations/directory/atspoke

# atSpoke

Visualize atSpoke users, teams, requests and webhooks in the JupiterOne graph. Map atSpoke users to employees in your JupiterOne account. Monitor changes to atSpoke users using JupiterOne alerts. Correlate atSpoke request types and volume with other security events.

## Installation

To install this integration, you will need a Business or Enterprise level atSpoke account in order to create an API key for JupiterOne to access the system.

### Configuration on atSpoke

1.  Log into atSpoke on a Business-level or Enterprise-level account (Teams-level accounts do not provide API functionality).
2.  Go to My Profile.
3.  Select the API tab.
4.  Generate a token at the bottom of the page. Note that you can only have one token for the whole atSpoke account, and it allows access to all things.

### Configuration in JupiterOne

To install the atSpoke integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select atSpoke. Click **New Instance** to begin configuring the integration.

Creating an atSpoke instance requires the following:

-   The **Account Name** used to identify the atSpoke account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the **atSpoke API Key** generated on the atSpoke site.
    

Click **Create** once all values are provided to finalize the integration.

> **NOTE**
> 
> When the integration runs, the JupiterOne graph will request the most recent 100 atSpoke requests. If there are more than 100 requests available and the first 100 are not enough to establish at least 14 days of history, JupiterOne will keep collecting requests in batches of 100 until 14 days of history are established or all requests are gathered.
> 
> These requests will be Record entities in the JupiterOne graph, and the collection size will grow indefinitely (ie. old Records will not be deleted, unlike users, teams, and webhooks which only show current in the J1 graph).

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| atSpoke Account | `atspoke_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| atSpoke Request | `atspoke_request` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| atSpoke Request Type | `atspoke_requesttype` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| atSpoke Team | `atspoke_team` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| atSpoke User | `atspoke_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| atSpoke Webhook | `atspoke_webhook` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `atspoke_account` | **HAS** | `atspoke_user` |
| `atspoke_account` | **HAS** | `atspoke_team` |
| `atspoke_account` | **HAS** | `atspoke_webhook` |
| `atspoke_account` | **HAS** | `atspoke_request` |
| `atspoke_account` | **HAS** | `atspoke_requesttype` |
| `atspoke_request` | **HAS** | `atspoke_requesttype` |
| `atspoke_team` | **HAS** | `atspoke_user` |

---

Source: /integrations/directory/auth0

# Auth0

Visualize Auth0 clients and users, map Auth0 users to employees, and monitor changes through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within Auth0 and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your Auth0 dashboard.

### Configuration on Auth0

> **NOTE**
> 
> An Auth0 Machine-to-Machine app's `Domain`, `Client ID`, and `Client Secret` are required for the JupiterOne integration to interact with Auth0.

In order to obtain your app's credentials for the integration, an administrator of the Auth0 account will need to create a new App within your Auth0 dashboard.

To create a new Auth0 app for use with JupiterOne:

1.  Navigate to the Auth0 dashboard.
2.  Within the **Applications** section, select **Applications**.
3.  Create a new Machine-to-Machine application and enable the app to use the Auth0 Management API or select your desired API.
4.  In the API permissions, select `read:users` ,`read:roles`,`read:resource_servers` and `read:clients` and click **Authorize**.
5.  Navigate to the newly created app's **Settings** to retrieve the `Domain`, `Client ID`, and `Client Secret`.

> **INFO**
> 
> For more information, refer to Auth0's documentation for [creating a machine-to-machine app](https://auth0.com/docs/get-started/auth0-overview/create-applications) or for [accessing the app's settings](https://auth0.com/docs/get-started/applications/application-settings).

### Configuration in JupiterOne

To install the Auth0 integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Auth0. Click **New Instance** to begin configuring the integration.

Creating an Auth0 instance requires the following:

-   The **Account Name** used to identify the Auth0 account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the **Auth0 Client ID** for the Machine-to-Machine application designated for JupiterOne's use.
    
-   Enter the **Auth0 Client Secret** for the Machine-to-Machine application designated for JupiterOne's use.
    
-   Enter the **Auth0 Domain** for your Auth0 tenant. Format is typically `{YOURDOMAIN}.{REGION}.auth0.com`. Do not include `https://`. If you are using a custom domain (e.g. 'mycustomdomain.com'), you can use it here.
    
-   Enter the **Auth0 Audience** for your Auth0 tenant, which points to the specific API you will be using. Format must be an auth0.com subdomain, followed by `/api/{version}/`. Examples might be `https://{YOURDOMAIN}.{REGION}.auth0.com/api/v2/` or `https://{YOURDOMAIN}.auth0.com/api/v2/`.
    
    > **NOTE**
    > 
    > Even if you are using a custom domain with Auth0, you need to use your default Auth0 tenant domain here. Also, the trailing slash is necessary.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Auth0 Account | `auth0_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Auth0 Client | `auth0_client` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Auth0 Organization | `auth0_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Auth0 Role | `auth0_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Auth0 Server | `auth0_server` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Auth0 User | `auth0_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `auth0_account` | **HAS** | `auth0_user` |
| `auth0_account` | **HAS** | `auth0_client` |
| `auth0_account` | **HAS** | `auth0_organization` |
| `auth0_organization` | **HAS** | `auth0_user` |
| `auth0_role` | **PROTECTS** | `auth0_server` |
| `auth0_user` | **ASSIGNED** | `auth0_role` |

### Auth0 Organization

`auth0_organization` inherits from [Organization](/data-model/schemas/Organization.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `logoUrl` | `string` **|** `null` | URL of the logo shown on the organization login page |  |
| `metadataKeys` | `array` **|** `null` | Names of the metadata keys set on the organization (values are not ingested) |  |
| `pageBackgroundColor` | `string` **|** `null` | Background color of the organization login page, as a hex code |  |
| `primaryColor` | `string` **|** `null` | Primary branding color of the organization login page, as a hex code |  |

---

### Auth0 Server

`auth0_server` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `function` | `array` of `string`s |  |  |
| `offlineAccess` | `boolean` |  |  |
| `public` | `boolean` |  |  |
| `webLink` | `string` |  |  |

---

### Auth0 User

`auth0_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `blocked` | `boolean` |  |  |
| `createdAt` | `string` |  |  |
| `emailVerified` | `boolean` |  |  |
| `familyName` | `string` |  |  |
| `givenName` | `string` |  |  |
| `identities` | `string` |  |  |
| `lastIp` | `string` |  |  |
| `lastLogin` | `string` |  |  |
| `loginsCount` | `number` |  |  |
| `multifactor` | `array` of `string`s |  |  |
| `nickname` | `string` |  |  |
| `phoneNumber` | `string` |  |  |
| `phoneVerified` | `boolean` |  |  |
| `picture` | `string` |  |  |
| `updatedAt` | `string` |  |  |
| `userId` | `string` |  |  |
| `weblink` | `string` |  |  |

---

---

Source: /integrations/directory/automox

# Automox

Visualize Automox services, teams, and users, map users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an `API Key` in Automox, which requires . See [their documentation](https://help.automox.com/hc/en-us/articles/5385455262484-Managing-Keys) for more information.

### Configuration in JupiterOne

To install the Automox integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Automox. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Automox account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Automox **Account ID**, **Agent Access Key**, and the **API Key** generated for use by JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `automox_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `automox_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device Group | `automox_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `automox_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `automox_account` | **HAS** | `automox_user` |
| `automox_account` | **MANAGES** | `automox_device` |
| `automox_account` | **MANAGES** | `automox_device_group` |
| `automox_device_group` | **HAS** | `automox_device` |

### Automox Account

`automox_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Automox Device

`automox_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `compliant` | `boolean` |  |  |
| `connected` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `deleted` | `boolean` |  |  |
| `lastProcessedOn` | `number` |  |  |
| `lastRefreshedOn` | `number` |  |  |
| `lastScanFailedOn` | `number` |  |  |
| `macAddress` | `array` of `string`s |  |  |
| `organizationId` | `number` |  |  |
| `osFamily` | `string` |  |  |
| `osVersionId` | `number` |  |  |
| `serialNumber` | `string` |  |  |
| `serverGroupId` | `number` |  |  |
| `status.agentStatus` | `string` |  |  |
| `status.deviceStatus` | `string` |  |  |
| `status.policyStatus` | `string` |  |  |
| `status.policyStatuses` | `array` of `number`s |  |  |
| `updatedOn` | `number` |  |  |

---

### Automox User

`automox_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `samlEnabled` | `boolean` |  |  |
| `ssoEnabled` | `boolean` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name accuracy for Automox device entities, combining OS family and OS name into human-readable display values.

---

Source: /integrations/directory/aws

# AWS

Visualize AWS cloud resources, map AWS users to employees, and monitor visibility, governance, and compliance against the AWS CIS Framework and security benchmarks. Additionally, monitor AWS vulnerabilities and findings and changes in AWS cloud resources through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within AWS and on JupiterOne. The integration instance configuration requires the customer's **Role ARN** to assume in order to read infrastructure information through AWS APIs. The role is configured to require an **External ID**; this value is auto-generated by JupiterOne and must be used when creating the IAM role.

Information is ingested from all AWS regions that do not require additional contractual arrangements with AWS. Submit a JupiterOne support request if you need to monitor additional regions.

> **INFO**
> 
> This integration enables the creation of automated workflows within JupiterOne alerts using SNS and SQS to remediate configuration gaps in AWS.

### Configuration on AWS

Detailed setup instructions and a pre-built **CloudFormation Stack** are provided in the application and maintained in the public [JupiterOne AWS CloudFormation](https://github.com/JupiterOne/jupiterone-aws-cloudformation) project on GitHub. Follow the steps under **In JupiterOne** to capture the auto-generated **External ID** specific to the integration instance.

Once the steps on GitHub are completed, continue to finalizing the integration instance on JupiterOne.

### Configuration in JupiterOne

To install the AWS integration in JupiterOne, navigate to **Integrations** and select **AWS**. Click **New Instance** to begin configuring the integration.

Creating an integration instance requires the following:

-   The **Account Name** used to identify the AWS account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
-   A **Description** to assist in identifying the integration instance, if desired.
-   A **Polling Interval** that fits your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
-   The **Role ARN** of the IAM role to assume in order to authenticate with AWS.
-   The **External ID** associated with the IAM role. This value is auto-generated and should be used when creating the IAM role for this integration.

Click **Create** once all values are provided.

#### Use Role Chaining

Enable **Use Role Chaining** to cause the integration to assume an intermediate IAM role before assuming the primary **Role ARN**. This gives AWS administrators a dedicated role to monitor and audit the actions taken by this integration.

When **Use Role Chaining** is enabled, two additional required fields appear:

-   **Intermediate Role ARN** — The ARN of the IAM role to assume before assuming the primary Role ARN.
-   **Intermediate External ID** — The External ID associated with the intermediate role.

### Set Permissions

The AWS integration requires security auditor permissions into the target AWS account, as defined by a combination of the [SecurityAudit](https://console.aws.amazon.com/iam/home#policies/arn:aws:iam::aws:policy/SecurityAudit) IAM policy managed by AWS, and a few additional `List*`, `Get*`, and `Describe*` permissions missing from the AWS managed policy. The exact policy and permission statements can be found in the public [JupiterOne AWS CloudFormation](https://github.com/JupiterOne/jupiterone-aws-cloudformation) project on GitHub.

### Manage Organization Accounts

After configuring the AWS integration, enable **Configure Organization Accounts** to automatically create and manage JupiterOne integration instances for all accounts in your AWS Organization. This account must be the management (master) account, and all accounts must share the same IAM role name and External ID.

To exclude a specific sub-account from automatic integration configuration, tag the sub-account in AWS Organizations with: `j1-integration: SKIP`.

When **Configure Organization Accounts** is enabled, two additional options become available:

-   **Auto-delete Removed Accounts** — When enabled, JupiterOne automatically deletes integration instances for AWS accounts that have been deleted or removed from the Organization. Enabled by default.
-   **Auto-delete sub-accounts** — When enabled, JupiterOne automatically deletes sub-account integration instances when the parent organizational account integration is deleted.

> **NOTE**
> 
> JupiterOne automatically ingests all sub-accounts from the Organization the next time it polls your environment.

When adding or configuring sub-accounts separately, use the same IAM role name, policies, and External ID as the management account. Use your preferred infrastructure-as-code method to generate an identical IAM role in each sub-account.

### Service Control Policy Issues

Errors may occur if a Service Control Policy (SCP) is blocking specified services or regions. AWS services that JupiterOne cannot ingest are listed in the **Integration Jobs** logs (**Integrations > Configurations > Settings > Jobs**).

For each SCP that is blocking JupiterOne ingestion, add the following condition to your SCP JSON:

```json
"Condition": {
  "ArnNotLike": {
    "aws:PrincipalARN": [
        "arn:aws:iam::*:role/JupiterOne*"
    ]
  }
}
```

Ensure this ARN matches the IAM role ARN used to configure your JupiterOne AWS integration.

> **INFO**
> 
> See the [AWS Service control policies documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) for the latest information.

## Data Volume Configuration

Control how much data is ingested from AWS to manage storage and processing volume.

### Ingestion Windows

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **ECR Image Findings Ingestion Window** | Ingestion window for ECR image findings. Findings for images pulled or pushed within this timeframe are collected. | 7 days | 1 day, 3 days, 7 days, 30 days, 90 days |
| **Inspector V2 Findings Ingestion Window** | Ingestion window for Inspector V2 findings observed within the selected timeframe. | 30 days | 7 days, 30 days, 60 days, 90 days |
| **Security Hub Findings Ingestion Window** | Ingestion window for Security Hub findings. Only findings updated within this timeframe are collected. Leave empty to collect all active findings regardless of age. | 30 days | 7 days, 30 days, 60 days, 90 days |

Longer windows increase the number of security findings ingested from ECR, Inspector, and Security Hub.

### Data Filtering Options

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **ECR Findings Severities** | Select which severity levels of ECR image findings to ingest. | All severities | Informational, Low, Medium, High, Critical |
| **ECR Findings Maximum Scan Age** | Skip ECR image findings from scans completed more than the selected number of days ago. Findings without a scan completion date are always ingested. | All ages | 30 days, 90 days, 180 days, 365 days |
| **Inspector V2 resource types** | Limit Inspector V2 findings to specific AWS resource types. | All types | AWS EC2 Instance, AWS ECR Container Images, AWS ECR Repository, AWS Lambda Function, AWS Code Repository |
| **Security Hub compliance status to skip** | Compliance status values to exclude when ingesting Security Hub findings. | None (all ingested) | Passed, Warning, Failed, Not available |
| **Security Hub workflow status to skip** | Workflow status values to exclude when ingesting Security Hub findings. Skipping Resolved and Suppressed is a common way to reduce noise. | None (all ingested) | New, Notified, Resolved, Suppressed |

### Advanced Configuration

| Field | Description | Default |
| --- | --- | --- |
| **Consent to Collect Sensitive Data** | When enabled, JupiterOne collects sensitive data from `aws_lambda_function`, `aws_cloudformation_stack`, `aws_launch_template_version`, and `aws_ecs_task_definition` entities. JupiterOne redacts most sensitive fields, but not environment variable names. If you store secrets in environment variables, consider enabling redaction. | Enabled |
| **Lambda Environment Variables To Promote** | Lambda environment variable names to promote as properties on `aws_lambda_function` entities (comma-separated). Values are not redacted — do not include variables that hold sensitive data. | None |
| **Ingest Backup Recovery Point Tags** | When enabled, JupiterOne fetches and attaches tags for AWS Backup recovery points. May increase integration run time. | Disabled |
| **Ingest EC2 deprecated images** | When enabled, JupiterOne ingests EC2 images that are deprecated. Deprecated images may contain less information and may increase integration run time. | Disabled |
| **Ingest Bedrock Agent Instructions** | When enabled, JupiterOne ingests the system instruction (prompt) configured on Bedrock agents. This may contain sensitive business logic. | Disabled |

## Reference

### S3 Bucket `public` Property

The `aws_s3_bucket.public` property is calculated based on the **Access** field in the AWS S3 console:

| Access | `aws_s3_bucket.public` |
| --- | --- |
| Public | `true` |
| Objects can be public | `undefined` |
| Bucket and objects not public | `false` |

### AWS IAM Policies

Each `aws_iam_policy` entity includes a boolean `admin` property that indicates whether the policy grants administrative-level access. The flag is determined from the policy name: if the name contains the word "admin" (case-insensitive), the flag is set to `true`. Examples: `AdministratorAccess`, `AdminPolicy`, `MyCustomAdminRole`.

### Next Steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. See the [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (791)

-   `access-analyzer:ListAnalyzers`
-   `access-analyzer:ListFindings`
-   `account:GetAlternateContact`
-   `account:GetContactInformation`
-   `acm-pca:ListCertificateAuthorities`
-   `acm-pca:ListTags`
-   `acm:DescribeCertificate`
-   `acm:ListCertificates`
-   `acm:ListTagsForCertificate`
-   `aidevops:DescribePrivateConnection`
-   `aidevops:GetAgentSpace`
-   `aidevops:GetOperatorApp`
-   `aidevops:GetService`
-   `aidevops:ListAgentSpaces`
-   `aidevops:ListAssociations`
-   `aidevops:ListPrivateConnections`
-   `aidevops:ListServices`
-   `airflow:GetEnvironment`
-   `airflow:ListEnvironments`
-   `apigateway:GET arn:aws:apigateway:*::/apis`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/authorizers`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/integrations`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/routes`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/stages`
-   `apigateway:GET arn:aws:apigateway:*::/domainnames`
-   `apigateway:GET arn:aws:apigateway:*::/domainnames/*/apimappings`
-   `apigateway:GET arn:aws:apigateway:*::/restapis`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/authorizers`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/authorizers/*`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*/methods/*`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages/*`
-   `appconfig:GetAccountSettings`
-   `appconfig:GetConfigurationProfile`
-   `appconfig:GetDeployment`
-   `appconfig:ListApplications`
-   `appconfig:ListConfigurationProfiles`
-   `appconfig:ListDeploymentStrategies`
-   `appconfig:ListDeployments`
-   `appconfig:ListEnvironments`
-   `appconfig:ListHostedConfigurationVersions`
-   `appconfig:ListTagsForResource`
-   `application-autoscaling:DescribeScalableTargets`
-   `application-autoscaling:DescribeScalingPolicies`
-   `aps:DescribeLoggingConfiguration`
-   `aps:DescribeQueryLoggingConfiguration`
-   `aps:DescribeResourcePolicy`
-   `aps:DescribeScraper`
-   `aps:DescribeWorkspace`
-   `aps:DescribeWorkspaceConfiguration`
-   `aps:ListScrapers`
-   `aps:ListWorkspaces`
-   `athena:GetWorkGroup`
-   `athena:ListTagsForResource`
-   `athena:ListWorkGroups`
-   `auditmanager:GetAssessment`
-   `auditmanager:GetAssessmentFramework`
-   `auditmanager:GetControl`
-   `auditmanager:GetDelegations`
-   `auditmanager:GetEvidenceFoldersByAssessmentControl`
-   `auditmanager:GetSettings`
-   `auditmanager:ListAssessmentFrameworks`
-   `auditmanager:ListAssessments`
-   `auditmanager:ListControls`
-   `auditmanager:ListTagsForResource`
-   `autoscaling:DescribeAutoScalingGroups`
-   `autoscaling:DescribeLaunchConfigurations`
-   `autoscaling:DescribePolicies`
-   `aws-marketplace:GetEntitlements`
-   `aws-marketplace:ListEntities`
-   `backup:GetBackupVaultAccessPolicy`
-   `backup:ListBackupJobs`
-   `backup:ListBackupPlans`
-   `backup:ListBackupVaults`
-   `backup:ListCopyJobs`
-   `backup:ListRecoveryPointsByBackupVault`
-   `backup:ListRestoreJobs`
-   `backup:ListRestoreTestingPlans`
-   `backup:ListTags`
-   `backup:ListTagsForResource`
-   `batch:DescribeComputeEnvironments`
-   `batch:DescribeJobDefinitions`
-   `batch:DescribeJobQueues`
-   `batch:ListJobs`
-   `bedrock-agentcore:GetAgentRuntime`
-   `bedrock-agentcore:GetApiKeyCredentialProvider`
-   `bedrock-agentcore:GetBrowser`
-   `bedrock-agentcore:GetCodeInterpreter`
-   `bedrock-agentcore:GetEvaluator`
-   `bedrock-agentcore:GetGateway`
-   `bedrock-agentcore:GetGatewayTarget`
-   `bedrock-agentcore:GetMemory`
-   `bedrock-agentcore:ListAgentRuntimes`
-   `bedrock-agentcore:ListApiKeyCredentialProviders`
-   `bedrock-agentcore:ListBrowserProfiles`
-   `bedrock-agentcore:ListBrowsers`
-   `bedrock-agentcore:ListCodeInterpreters`
-   `bedrock-agentcore:ListEvaluators`
-   `bedrock-agentcore:ListGatewayTargets`
-   `bedrock-agentcore:ListGateways`
-   `bedrock-agentcore:ListMemories`
-   `bedrock-agentcore:ListPolicyEngines`
-   `bedrock-agentcore:ListTagsForResource`
-   `bedrock:GetAgent`
-   `bedrock:GetAgentActionGroup`
-   `bedrock:GetCustomModel`
-   `bedrock:GetDataSource`
-   `bedrock:GetEvaluationJob`
-   `bedrock:GetFlow`
-   `bedrock:GetFoundationModelAvailability`
-   `bedrock:GetGuardrail`
-   `bedrock:GetImportedModel`
-   `bedrock:GetInferenceProfile`
-   `bedrock:GetKnowledgeBase`
-   `bedrock:GetModelCustomizationJob`
-   `bedrock:GetModelInvocationLoggingConfiguration`
-   `bedrock:GetProvisionedModelThroughput`
-   `bedrock:ListAgentActionGroups`
-   `bedrock:ListAgents`
-   `bedrock:ListCustomModels`
-   `bedrock:ListDataSources`
-   `bedrock:ListEvaluationJobs`
-   `bedrock:ListFlows`
-   `bedrock:ListFoundationModels`
-   `bedrock:ListGuardrails`
-   `bedrock:ListImportedModels`
-   `bedrock:ListInferenceProfiles`
-   `bedrock:ListKnowledgeBases`
-   `bedrock:ListModelCustomizationJobs`
-   `bedrock:ListModelInvocationJobs`
-   `bedrock:ListProvisionedModelThroughputs`
-   `bedrock:ListTagsForResource`
-   `cassandra:Select`
-   `cloudformation:DescribeStacks`
-   `cloudformation:ListStacks`
-   `cloudfront:GetDistributionConfig`
-   `cloudfront:ListDistributions`
-   `cloudfront:ListKeyGroups`
-   `cloudfront:ListPublicKeys`
-   `cloudfront:ListTagsForResource`
-   `cloudhsm:DescribeBackups`
-   `cloudhsm:DescribeClusters`
-   `cloudhsm:ListTags`
-   `cloudtrail:DescribeTrails`
-   `cloudtrail:GetEventSelectors`
-   `cloudtrail:GetTrailStatus`
-   `cloudtrail:ListTags`
-   `cloudwatch:DescribeAlarms`
-   `cloudwatch:GetMetricData`
-   `cloudwatch:ListTagsForResource`
-   `codeartifact:DescribeDomain`
-   `codeartifact:DescribeRepository`
-   `codeartifact:GetDomainPermissionsPolicy`
-   `codeartifact:GetRepositoryEndpoint`
-   `codeartifact:GetRepositoryPermissionsPolicy`
-   `codeartifact:ListDomains`
-   `codeartifact:ListPackageGroups`
-   `codeartifact:ListPackages`
-   `codeartifact:ListRepositories`
-   `codeartifact:ListTagsForResource`
-   `codebuild:BatchGetProjects`
-   `codebuild:BatchGetReportGroups`
-   `codebuild:GetResourcePolicy`
-   `codebuild:ListProjects`
-   `codebuild:ListReportGroups`
-   `codecommit:GetRepository`
-   `codecommit:ListRepositories`
-   `codecommit:ListTagsForResource`
-   `codedeploy:BatchGetApplications`
-   `codedeploy:BatchGetDeploymentGroups`
-   `codedeploy:GetDeploymentConfig`
-   `codedeploy:ListApplications`
-   `codedeploy:ListDeploymentConfigs`
-   `codedeploy:ListDeploymentGroups`
-   `codedeploy:ListTagsForResource`
-   `codeguru-profiler:ListProfilingGroups`
-   `codeguru-reviewer:DescribeRepositoryAssociation`
-   `codeguru-reviewer:ListRepositoryAssociations`
-   `codeguru-reviewer:ListTagsForResource`
-   `codepipeline:GetPipeline`
-   `codepipeline:ListPipelines`
-   `cognito-identity:DescribeIdentityPool`
-   `cognito-identity:ListIdentityPools`
-   `cognito-idp:DescribeRiskConfiguration`
-   `cognito-idp:DescribeUserPool`
-   `cognito-idp:DescribeUserPoolClient`
-   `cognito-idp:DescribeUserPoolDomain`
-   `cognito-idp:ListUserPoolClients`
-   `cognito-idp:ListUserPools`
-   `cognito-idp:ListUsers`
-   `config:BatchGetResourceConfig`
-   `config:DescribeComplianceByConfigRule`
-   `config:DescribeConfigRules`
-   `config:GetComplianceDetailsByConfigRule`
-   `datasync:DescribeLocationEfs`
-   `datasync:DescribeLocationFsxLustre`
-   `datasync:DescribeLocationFsxOntap`
-   `datasync:DescribeLocationFsxOpenZfs`
-   `datasync:DescribeLocationFsxWindows`
-   `datasync:DescribeLocationHdfs`
-   `datasync:DescribeLocationNfs`
-   `datasync:DescribeLocationObjectStorage`
-   `datasync:DescribeLocationS3`
-   `datasync:DescribeLocationSmb`
-   `datasync:DescribeTask`
-   `datasync:ListLocations`
-   `datasync:ListTagsForResource`
-   `datasync:ListTasks`
-   `dax:DescribeClusters`
-   `detective:GetInvestigation`
-   `detective:ListGraphs`
-   `detective:ListInvestigations`
-   `detective:ListTagsForResource`
-   `devops-guru:DescribeAccountHealth`
-   `devops-guru:DescribeServiceIntegration`
-   `devops-guru:ListAnomaliesForInsight`
-   `devops-guru:ListInsights`
-   `devops-guru:ListNotificationChannels`
-   `directconnect:DescribeConnections`
-   `directconnect:DescribeDirectConnectGateways`
-   `directconnect:DescribeLags`
-   `directconnect:DescribeVirtualInterfaces`
-   `dms:DescribeEndpoints`
-   `dms:DescribeReplicationInstances`
-   `dms:ListTagsForResource`
-   `ds:DescribeDirectories`
-   `dynamodb:DescribeContinuousBackups`
-   `dynamodb:DescribeGlobalTable`
-   `dynamodb:DescribeTable`
-   `dynamodb:ListBackups`
-   `dynamodb:ListGlobalTables`
-   `dynamodb:ListTables`
-   `dynamodb:ListTagsOfResource`
-   `ec2:DescribeAddresses`
-   `ec2:DescribeCustomerGateways`
-   `ec2:DescribeFlowLogs`
-   `ec2:DescribeHosts`
-   `ec2:DescribeIamInstanceProfileAssociations`
-   `ec2:DescribeImageAttribute`
-   `ec2:DescribeImages`
-   `ec2:DescribeInstanceAttribute`
-   `ec2:DescribeInstances`
-   `ec2:DescribeInternetGateways`
-   `ec2:DescribeKeyPairs`
-   `ec2:DescribeLaunchTemplateVersions`
-   `ec2:DescribeLaunchTemplates`
-   `ec2:DescribeManagedPrefixLists`
-   `ec2:DescribeNatGateways`
-   `ec2:DescribeNetworkAcls`
-   `ec2:DescribeNetworkInterfaces`
-   `ec2:DescribeRegions`
-   `ec2:DescribeRouteTables`
-   `ec2:DescribeSecurityGroupRules`
-   `ec2:DescribeSecurityGroups`
-   `ec2:DescribeSnapshotAttribute`
-   `ec2:DescribeSnapshots`
-   `ec2:DescribeSubnets`
-   `ec2:DescribeTransitGatewayAttachments`
-   `ec2:DescribeTransitGatewayRouteTables`
-   `ec2:DescribeTransitGatewayVpcAttachments`
-   `ec2:DescribeTransitGateways`
-   `ec2:DescribeVolumes`
-   `ec2:DescribeVpcEndpointConnections`
-   `ec2:DescribeVpcEndpointServiceConfigurations`
-   `ec2:DescribeVpcEndpointServicePermissions`
-   `ec2:DescribeVpcEndpointServices`
-   `ec2:DescribeVpcEndpoints`
-   `ec2:DescribeVpcPeeringConnections`
-   `ec2:DescribeVpcs`
-   `ec2:DescribeVpnConnections`
-   `ec2:DescribeVpnGateways`
-   `ec2:GetEbsDefaultKmsKeyId`
-   `ec2:GetEbsEncryptionByDefault`
-   `ec2:GetManagedPrefixListEntries`
-   `ecr:DescribeImageScanFindings`
-   `ecr:DescribeImages`
-   `ecr:DescribeRepositories`
-   `ecr:GetLifecyclePolicy`
-   `ecr:GetRepositoryPolicy`
-   `ecr:ListTagsForResource`
-   `ecs:DescribeClusters`
-   `ecs:DescribeContainerInstances`
-   `ecs:DescribeServices`
-   `ecs:DescribeTaskDefinition`
-   `ecs:DescribeTasks`
-   `ecs:ListClusters`
-   `ecs:ListContainerInstances`
-   `ecs:ListServices`
-   `ecs:ListTaskDefinitionFamilies`
-   `ecs:ListTasks`
-   `eks:DescribeCluster`
-   `eks:DescribeClusterVersions`
-   `eks:DescribeNodegroup`
-   `eks:ListClusters`
-   `eks:ListNodegroups`
-   `elasticache:DescribeCacheClusters`
-   `elasticache:DescribeCacheSubnetGroups`
-   `elasticache:DescribeReplicationGroups`
-   `elasticache:DescribeSnapshots`
-   `elasticache:ListTagsForResource`
-   `elasticfilesystem:DescribeFileSystemPolicy`
-   `elasticfilesystem:DescribeFileSystems`
-   `elasticfilesystem:DescribeMountTargetSecurityGroups`
-   `elasticfilesystem:DescribeMountTargets`
-   `elasticloadbalancing:DescribeListeners`
-   `elasticloadbalancing:DescribeLoadBalancerAttributes`
-   `elasticloadbalancing:DescribeLoadBalancers`
-   `elasticloadbalancing:DescribeRules`
-   `elasticloadbalancing:DescribeTags`
-   `elasticloadbalancing:DescribeTargetGroups`
-   `elasticloadbalancing:DescribeTargetHealth`
-   `elasticmapreduce:DescribeCluster`
-   `elasticmapreduce:DescribeSecurityConfiguration`
-   `elasticmapreduce:ListClusters`
-   `elasticmapreduce:ListInstances`
-   `elasticmapreduce:ListSecurityConfigurations`
-   `emr-serverless:GetApplication`
-   `emr-serverless:ListApplications`
-   `es:DescribeDomains`
-   `es:DescribeElasticsearchDomains`
-   `es:ListDomainNames`
-   `es:ListTags`
-   `events:DescribeApiDestination`
-   `events:DescribeArchive`
-   `events:DescribeConnection`
-   `events:DescribeEventBus`
-   `events:ListApiDestinations`
-   `events:ListArchives`
-   `events:ListConnections`
-   `events:ListEndpoints`
-   `events:ListEventBuses`
-   `events:ListRules`
-   `events:ListTagsForResource`
-   `events:ListTargetsByRule`
-   `firehose:DescribeDeliveryStream`
-   `firehose:ListDeliveryStreams`
-   `firehose:ListTagsForDeliveryStream`
-   `fms:ListAppsLists`
-   `fms:ListPolicies`
-   `fms:ListProtocolsLists`
-   `fms:ListResourceSetResources`
-   `fms:ListResourceSets`
-   `fms:ListTagsForResource`
-   `fsx:DescribeFileSystems`
-   `glacier:GetVaultAccessPolicy`
-   `glacier:GetVaultLock`
-   `glacier:ListTagsForVault`
-   `glacier:ListVaults`
-   `globalaccelerator:ListAccelerators`
-   `globalaccelerator:ListCustomRoutingAccelerators`
-   `globalaccelerator:ListCustomRoutingEndpointGroups`
-   `globalaccelerator:ListCustomRoutingListeners`
-   `globalaccelerator:ListEndpointGroups`
-   `globalaccelerator:ListListeners`
-   `globalaccelerator:ListTagsForResource`
-   `glue:GetConnection`
-   `glue:GetConnections`
-   `glue:GetDataCatalogEncryptionSettings`
-   `glue:GetDatabase`
-   `glue:GetDatabases`
-   `glue:GetDevEndpoint`
-   `glue:GetDevEndpoints`
-   `glue:GetJob`
-   `glue:GetResourcePolicy`
-   `glue:GetSecurityConfigurations`
-   `glue:GetTags`
-   `glue:ListJobs`
-   `glue:ListSessions`
-   `grafana:DescribeWorkspace`
-   `grafana:ListWorkspaces`
-   `guardduty:DescribeOrganizationConfiguration`
-   `guardduty:DescribePublishingDestination`
-   `guardduty:GetDetector`
-   `guardduty:GetFindings`
-   `guardduty:ListDetectors`
-   `guardduty:ListFindings`
-   `guardduty:ListOrganizationAdminAccounts`
-   `guardduty:ListPublishingDestinations`
-   `health:DescribeAffectedEntities`
-   `health:DescribeEventDetails`
-   `health:DescribeEvents`
-   `iam:GenerateCredentialReport`
-   `iam:GetAccessKeyLastUsed`
-   `iam:GetAccountPasswordPolicy`
-   `iam:GetAccountSummary`
-   `iam:GetCredentialReport`
-   `iam:GetGroup`
-   `iam:GetGroupPolicy`
-   `iam:GetOpenIDConnectProvider`
-   `iam:GetPolicyVersion`
-   `iam:GetRole`
-   `iam:GetRolePolicy`
-   `iam:GetSAMLProvider`
-   `iam:GetServerCertificate`
-   `iam:GetUser`
-   `iam:GetUserPolicy`
-   `iam:ListAccessKeys`
-   `iam:ListAccountAliases`
-   `iam:ListEntitiesForPolicy`
-   `iam:ListGroupPolicies`
-   `iam:ListGroups`
-   `iam:ListInstanceProfiles`
-   `iam:ListMFADevices`
-   `iam:ListOpenIDConnectProviderTags`
-   `iam:ListOpenIDConnectProviders`
-   `iam:ListPolicies`
-   `iam:ListRolePolicies`
-   `iam:ListRoleTags`
-   `iam:ListRoles`
-   `iam:ListSAMLProviders`
-   `iam:ListServerCertificates`
-   `iam:ListServiceSpecificCredentials`
-   `iam:ListUserPolicies`
-   `iam:ListUserTags`
-   `iam:ListUsers`
-   `identitystore:ListGroupMemberships`
-   `identitystore:ListGroups`
-   `identitystore:ListUsers`
-   `imagebuilder:GetComponent`
-   `imagebuilder:GetContainerRecipe`
-   `imagebuilder:GetDistributionConfiguration`
-   `imagebuilder:GetImage`
-   `imagebuilder:GetImagePipeline`
-   `imagebuilder:GetInfrastructureConfiguration`
-   `imagebuilder:GetLifecyclePolicy`
-   `imagebuilder:GetWorkflow`
-   `imagebuilder:ListComponents`
-   `imagebuilder:ListContainerRecipes`
-   `imagebuilder:ListDistributionConfigurations`
-   `imagebuilder:ListImageBuildVersions`
-   `imagebuilder:ListImagePipelines`
-   `imagebuilder:ListImages`
-   `imagebuilder:ListInfrastructureConfigurations`
-   `imagebuilder:ListLifecyclePolicies`
-   `imagebuilder:ListWorkflows`
-   `inspector2:DescribeOrganizationConfiguration`
-   `inspector2:GetConfiguration`
-   `inspector2:GetDelegatedAdminAccount`
-   `inspector2:GetEncryptionKey`
-   `inspector2:ListCisScanResultsAggregatedByTargetResource`
-   `inspector2:ListCisScans`
-   `inspector2:ListCoverage`
-   `inspector2:ListFilters`
-   `inspector2:ListFindings`
-   `inspector2:ListTagsForResource`
-   `inspector:DescribeAssessmentRuns`
-   `inspector:DescribeFindings`
-   `inspector:DescribeRulesPackages`
-   `inspector:ListAssessmentRuns`
-   `inspector:ListFindings`
-   `kafka:GetBootstrapBrokers`
-   `kafka:ListClustersV2`
-   `kafka:ListTagsForResource`
-   `kinesis:DescribeStreamSummary`
-   `kinesis:ListStreamConsumers`
-   `kinesis:ListStreams`
-   `kinesis:ListTagsForStream`
-   `kms:DescribeKey`
-   `kms:GetKeyPolicy`
-   `kms:GetKeyRotationStatus`
-   `kms:ListAliases`
-   `kms:ListKeys`
-   `kms:ListResourceTags`
-   `lambda:GetFunction`
-   `lambda:GetFunctionUrlConfig`
-   `lambda:GetPolicy`
-   `lambda:ListCodeSigningConfigs`
-   `lambda:ListFunctions`
-   `lambda:ListFunctionsByCodeSigningConfig`
-   `lambda:ListTags`
-   `lex:DescribeResourcePolicy`
-   `lex:ListBotAliases`
-   `lex:ListBots`
-   `license-manager:ListLicenses`
-   `license-manager:ListReceivedLicenses`
-   `logs:DescribeDestinations`
-   `logs:DescribeLogGroups`
-   `logs:DescribeMetricFilters`
-   `logs:DescribeSubscriptionFilters`
-   `macie2:DescribeClassificationJob`
-   `macie2:DescribeOrganizationConfiguration`
-   `macie2:GetAutomatedDiscoveryConfiguration`
-   `macie2:GetClassificationExportConfiguration`
-   `macie2:GetFindings`
-   `macie2:GetFindingsPublicationConfiguration`
-   `macie2:ListAutomatedDiscoveryAccounts`
-   `macie2:ListClassificationJobs`
-   `macie2:ListFindings`
-   `macie2:ListOrganizationAdminAccounts`
-   `mq:DescribeBroker`
-   `mq:ListBrokers`
-   `neptune-graph:GetGraph`
-   `neptune-graph:GetImportTask`
-   `neptune-graph:ListExportTasks`
-   `neptune-graph:ListGraphSnapshots`
-   `neptune-graph:ListGraphs`
-   `neptune-graph:ListImportTasks`
-   `neptune-graph:ListPrivateGraphEndpoints`
-   `neptune-graph:ListTagsForResource`
-   `neptune:DescribeDBClusters`
-   `neptune:DescribeDBInstances`
-   `network-firewall:DescribeFirewall`
-   `network-firewall:DescribeFirewallPolicy`
-   `network-firewall:DescribeRuleGroup`
-   `network-firewall:ListFirewallPolicies`
-   `network-firewall:ListFirewalls`
-   `network-firewall:ListRuleGroups`
-   `networkmanager:GetConnectPeer`
-   `networkmanager:GetCoreNetwork`
-   `networkmanager:GetCoreNetworkPolicy`
-   `networkmanager:ListAttachmentRoutingPolicyAssociations`
-   `networkmanager:ListAttachments`
-   `networkmanager:ListConnectPeers`
-   `networkmanager:ListCoreNetworkPolicyVersions`
-   `networkmanager:ListCoreNetworkRoutingInformation`
-   `networkmanager:ListCoreNetworks`
-   `nova-act:GetWorkflowDefinition`
-   `nova-act:GetWorkflowRun`
-   `nova-act:ListModels`
-   `nova-act:ListWorkflowDefinitions`
-   `nova-act:ListWorkflowRuns`
-   `organizations:DescribeAccount`
-   `organizations:DescribeOrganization`
-   `organizations:DescribeOrganizationalUnit`
-   `organizations:DescribePolicy`
-   `organizations:ListAccounts`
-   `organizations:ListChildren`
-   `organizations:ListPolicies`
-   `organizations:ListRoots`
-   `organizations:ListTagsForResource`
-   `organizations:ListTargetsForPolicy`
-   `outposts:GetCatalogItem`
-   `outposts:GetOrder`
-   `outposts:GetOutpostInstanceTypes`
-   `outposts:GetOutpostSupportedInstanceTypes`
-   `outposts:GetPrivateConnectivityConfig`
-   `outposts:ListAssetInstances`
-   `outposts:ListAssets`
-   `outposts:ListOrders`
-   `outposts:ListOutposts`
-   `outposts:ListSites`
-   `quicksight:DescribeAccountSettings`
-   `quicksight:DescribeAccountSubscription`
-   `quicksight:DescribeDashboard`
-   `quicksight:DescribeDashboardPermissions`
-   `quicksight:DescribeDataSet`
-   `quicksight:DescribeDataSource`
-   `quicksight:DescribeIpRestriction`
-   `quicksight:DescribeKeyRegistration`
-   `quicksight:DescribeVpcConnection`
-   `quicksight:ListCustomPermissions`
-   `quicksight:ListDashboards`
-   `quicksight:ListDataSets`
-   `quicksight:ListDataSources`
-   `quicksight:ListGroupMemberships`
-   `quicksight:ListGroups`
-   `quicksight:ListNamespaces`
-   `quicksight:ListTagsForResource`
-   `quicksight:ListUsers`
-   `quicksight:ListVpcConnections`
-   `ram:GetResourceShareAssociations`
-   `ram:GetResourceShareInvitations`
-   `ram:GetResourceShares`
-   `ram:ListResources`
-   `rds:DescribeDBClusterParameterGroups`
-   `rds:DescribeDBClusterParameters`
-   `rds:DescribeDBClusterSnapshots`
-   `rds:DescribeDBClusters`
-   `rds:DescribeDBInstances`
-   `rds:DescribeDBParameterGroups`
-   `rds:DescribeDBParameters`
-   `rds:DescribeDBProxies`
-   `rds:DescribeDBProxyTargetGroups`
-   `rds:DescribeDBProxyTargets`
-   `rds:DescribeDBSnapshots`
-   `rds:DescribeDBSubnetGroups`
-   `rds:DescribeOptionGroups`
-   `redshift-serverless:ListEndpointAccess`
-   `redshift-serverless:ListNamespaces`
-   `redshift-serverless:ListRecoveryPoints`
-   `redshift-serverless:ListSnapshots`
-   `redshift-serverless:ListTagsForResource`
-   `redshift-serverless:ListUsageLimits`
-   `redshift-serverless:ListWorkgroups`
-   `redshift:DescribeClusterParameterGroups`
-   `redshift:DescribeClusterParameters`
-   `redshift:DescribeClusters`
-   `redshift:DescribeDataShares`
-   `redshift:DescribeLoggingStatus`
-   `resource-explorer-2:GetDefaultView`
-   `resource-explorer-2:GetIndex`
-   `resource-explorer-2:GetView`
-   `resource-explorer-2:ListIndexes`
-   `resource-explorer-2:ListTagsForResource`
-   `resource-explorer-2:ListViews`
-   `rolesanywhere:GetProfile`
-   `rolesanywhere:GetTrustAnchor`
-   `rolesanywhere:ListProfiles`
-   `rolesanywhere:ListTagsForResource`
-   `rolesanywhere:ListTrustAnchors`
-   `route53:GetHostedZone`
-   `route53:ListHostedZones`
-   `route53:ListResourceRecordSets`
-   `route53domains:GetDomainDetail`
-   `route53domains:ListDomains`
-   `route53domains:ListTagsForDomain`
-   `route53resolver:ListResolverRuleAssociations`
-   `route53resolver:ListResolverRules`
-   `route53resolver:ListTagsForResource`
-   `s3:GetAccountPublicAccessBlock`
-   `s3:GetBucketAcl`
-   `s3:GetBucketLocation`
-   `s3:GetBucketLogging`
-   `s3:GetBucketNotification`
-   `s3:GetBucketObjectLockConfiguration`
-   `s3:GetBucketOwnershipControls`
-   `s3:GetBucketPolicy`
-   `s3:GetBucketPolicyStatus`
-   `s3:GetBucketPublicAccessBlock`
-   `s3:GetBucketTagging`
-   `s3:GetBucketVersioning`
-   `s3:GetBucketWebsite`
-   `s3:GetEncryptionConfiguration`
-   `s3:GetInventoryConfiguration`
-   `s3:GetLifecycleConfiguration`
-   `s3:GetReplicationConfiguration`
-   `s3:ListAccessPoints`
-   `s3:ListAllMyBuckets`
-   `sagemaker:DescribeDomain`
-   `sagemaker:DescribeEndpoint`
-   `sagemaker:DescribeEndpointConfig`
-   `sagemaker:DescribeFeatureGroup`
-   `sagemaker:DescribeInferenceRecommendationsJob`
-   `sagemaker:DescribeModel`
-   `sagemaker:DescribeModelBiasJobDefinition`
-   `sagemaker:DescribeModelQualityJobDefinition`
-   `sagemaker:DescribeNotebookInstance`
-   `sagemaker:DescribePipelineExecution`
-   `sagemaker:DescribeProcessingJob`
-   `sagemaker:DescribeTrainingJob`
-   `sagemaker:DescribeTransformJob`
-   `sagemaker:ListDomains`
-   `sagemaker:ListEndpoints`
-   `sagemaker:ListFeatureGroups`
-   `sagemaker:ListInferenceRecommendationsJobs`
-   `sagemaker:ListModelBiasJobDefinitions`
-   `sagemaker:ListModelQualityJobDefinitions`
-   `sagemaker:ListModels`
-   `sagemaker:ListNotebookInstances`
-   `sagemaker:ListPipelineExecutions`
-   `sagemaker:ListPipelines`
-   `sagemaker:ListProcessingJobs`
-   `sagemaker:ListTags`
-   `sagemaker:ListTrainingJobs`
-   `sagemaker:ListTransformJobs`
-   `secretsmanager:DescribeSecret`
-   `secretsmanager:GetResourcePolicy`
-   `secretsmanager:ListSecretVersionIds`
-   `secretsmanager:ListSecrets`
-   `securityagent:BatchGetAgentSpaces`
-   `securityagent:BatchGetArtifactMetadata`
-   `securityagent:BatchGetTargetDomains`
-   `securityagent:BatchGetThreatModels`
-   `securityagent:ListAgentSpaces`
-   `securityagent:ListApplications`
-   `securityagent:ListArtifacts`
-   `securityagent:ListPrivateConnections`
-   `securityagent:ListTagsForResource`
-   `securityagent:ListTargetDomains`
-   `securityagent:ListThreatModels`
-   `securityhub:DescribeHub`
-   `securityhub:DescribeStandards`
-   `securityhub:DescribeStandardsControls`
-   `securityhub:GetEnabledStandards`
-   `securityhub:GetFindings`
-   `servicecatalog:DescribeConstraint`
-   `servicecatalog:DescribePortfolio`
-   `servicecatalog:DescribeProductAsAdmin`
-   `servicecatalog:ListConstraintsForPortfolio`
-   `servicecatalog:ListLaunchPaths`
-   `servicecatalog:ListPortfolios`
-   `servicecatalog:ListPortfoliosForProduct`
-   `servicecatalog:ListPrincipalsForPortfolio`
-   `servicecatalog:ListProvisioningArtifacts`
-   `servicecatalog:ListResourcesForTagOption`
-   `servicecatalog:ListTagOptions`
-   `servicecatalog:SearchProductsAsAdmin`
-   `servicediscovery:GetInstance`
-   `servicediscovery:ListInstances`
-   `servicediscovery:ListNamespaces`
-   `servicediscovery:ListServices`
-   `servicediscovery:ListTagsForResource`
-   `ses:GetConfigurationSet`
-   `ses:GetEmailIdentity`
-   `ses:ListConfigurationSets`
-   `ses:ListEmailIdentities`
-   `ses:ListReceiptFilters`
-   `shield:DescribeDRTAccess`
-   `shield:DescribeEmergencyContactSettings`
-   `shield:DescribeSubscription`
-   `shield:GetSubscriptionState`
-   `shield:ListProtectionGroups`
-   `shield:ListProtections`
-   `shield:ListResourcesInProtectionGroup`
-   `shield:ListTagsForResource`
-   `signer:GetSigningProfile`
-   `signer:ListProfilePermissions`
-   `signer:ListSigningJobs`
-   `signer:ListSigningProfiles`
-   `sns:GetSubscriptionAttributes`
-   `sns:GetTopicAttributes`
-   `sns:ListSubscriptions`
-   `sns:ListTagsForResource`
-   `sns:ListTopics`
-   `sqs:GetQueueAttributes`
-   `sqs:ListQueueTags`
-   `sqs:ListQueues`
-   `ssm:DescribeDocumentPermission`
-   `ssm:DescribeInstanceInformation`
-   `ssm:DescribeInstancePatchStates`
-   `ssm:DescribeParameters`
-   `ssm:DescribePatchBaselines`
-   `ssm:DescribePatchGroupState`
-   `ssm:DescribePatchGroups`
-   `ssm:GetDocument`
-   `ssm:GetServiceSetting`
-   `ssm:ListAssociations`
-   `ssm:ListComplianceItems`
-   `ssm:ListComplianceSummaries`
-   `ssm:ListDocuments`
-   `ssm:ListInventoryEntries`
-   `ssm:ListTagsForResource`
-   `sso:DescribePermissionSet`
-   `sso:GetInlinePolicyForPermissionSet`
-   `sso:ListAccountAssignments`
-   `sso:ListAccountAssignmentsForPrincipal`
-   `sso:ListAccountsForProvisionedPermissionSet`
-   `sso:ListApplications`
-   `sso:ListCustomerManagedPolicyReferencesInPermissionSet`
-   `sso:ListInstances`
-   `sso:ListManagedPoliciesInPermissionSet`
-   `sso:ListPermissionSets`
-   `sso:ListTagsForResource`
-   `states:DescribeStateMachine`
-   `states:ListStateMachines`
-   `states:ListTagsForResource`
-   `storagegateway:DescribeCachediSCSIVolumes`
-   `storagegateway:DescribeGatewayInformation`
-   `storagegateway:DescribeNFSFileShares`
-   `storagegateway:DescribeSMBFileShares`
-   `storagegateway:DescribeStorediSCSIVolumes`
-   `storagegateway:DescribeTapeArchives`
-   `storagegateway:ListFileShares`
-   `storagegateway:ListGateways`
-   `storagegateway:ListTagsForResource`
-   `storagegateway:ListTapePools`
-   `storagegateway:ListTapes`
-   `storagegateway:ListVolumes`
-   `tag:GetResources`
-   `transfer:DescribeServer`
-   `transfer:ListServers`
-   `transfer:ListTagsForResource`
-   `transfer:ListUsers`
-   `vpc-lattice:ListListeners`
-   `vpc-lattice:ListServiceNetworkServiceAssociations`
-   `vpc-lattice:ListServiceNetworkVpcAssociations`
-   `vpc-lattice:ListServiceNetworkVpcEndpointAssociations`
-   `vpc-lattice:ListServiceNetworks`
-   `vpc-lattice:ListServices`
-   `vpc-lattice:ListTargetGroups`
-   `waf:GetWebACL`
-   `waf:ListWebACLs`
-   `wafv2:GetIPSet`
-   `wafv2:GetLoggingConfiguration`
-   `wafv2:GetRuleGroup`
-   `wafv2:GetWebACL`
-   `wafv2:ListIPSets`
-   `wafv2:ListResourcesForWebACL`
-   `wafv2:ListRuleGroups`
-   `wafv2:ListTagsForResource`
-   `wafv2:ListWebACLs`
-   `workspaces:DescribeTags`
-   `workspaces:DescribeWorkspaceBundles`
-   `workspaces:DescribeWorkspaces`
-   `xray:GetEncryptionConfig`
-   `xray:GetGroups`
-   `xray:ListResourcePolicies`
-   `xray:ListTagsForResource`

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (206)

-   `access-analyzer:List*`
-   `account:Get*`
-   `acm-pca:List*`
-   `acm:Describe*`
-   `acm:List*`
-   `airflow:Get*`
-   `airflow:List*`
-   `apigateway:GET arn:aws:apigateway:*::/*`
-   `appconfig:Get*`
-   `appconfig:List*`
-   `aps:Describe*`
-   `aps:Get*`
-   `aps:List*`
-   `athena:Get*`
-   `athena:List*`
-   `auditmanager:Get*`
-   `auditmanager:List*`
-   `autoscaling:Describe*`
-   `aws-marketplace:Get*`
-   `aws-marketplace:List*`
-   `backup:Get*`
-   `backup:List*`
-   `batch:Describe*`
-   `batch:List*`
-   `bedrock-agentcore:Get*`
-   `bedrock-agentcore:List*`
-   `bedrock:Get*`
-   `bedrock:List*`
-   `cloudformation:Describe*`
-   `cloudformation:List*`
-   `cloudfront:Get*`
-   `cloudfront:List*`
-   `cloudhsm:Describe*`
-   `cloudhsm:List*`
-   `cloudtrail:Describe*`
-   `cloudtrail:Get*`
-   `cloudtrail:List*`
-   `cloudwatch:Describe*`
-   `cloudwatch:Get*`
-   `cloudwatch:List*`
-   `codeartifact:Describe*`
-   `codeartifact:Get*`
-   `codeartifact:List*`
-   `codebuild:BatchGet*`
-   `codebuild:Get*`
-   `codebuild:List*`
-   `codecommit:Get*`
-   `codecommit:List*`
-   `codedeploy:BatchGet*`
-   `codedeploy:Get*`
-   `codedeploy:List*`
-   `codeguru-profiler:List*`
-   `codeguru-reviewer:Describe*`
-   `codeguru-reviewer:List*`
-   `codepipeline:Get*`
-   `codepipeline:List*`
-   `cognito-identity:Describe*`
-   `cognito-identity:List*`
-   `cognito-idp:Describe*`
-   `cognito-idp:List*`
-   `config:BatchGet*`
-   `config:Describe*`
-   `config:Get*`
-   `datasync:Describe*`
-   `datasync:List*`
-   `dax:Describe*`
-   `detective:Get*`
-   `detective:List*`
-   `devops-guru:Describe*`
-   `devops-guru:List*`
-   `directconnect:Describe*`
-   `dms:Describe*`
-   `dms:List*`
-   `ds:Describe*`
-   `dynamodb:Describe*`
-   `dynamodb:List*`
-   `ec2:Describe*`
-   `ec2:Get*`
-   `ecr:Describe*`
-   `ecr:Get*`
-   `ecr:List*`
-   `ecs:Describe*`
-   `ecs:List*`
-   `eks:Describe*`
-   `eks:List*`
-   `elasticache:Describe*`
-   `elasticache:List*`
-   `elasticfilesystem:Describe*`
-   `elasticloadbalancing:Describe*`
-   `elasticmapreduce:Describe*`
-   `elasticmapreduce:List*`
-   `emr-serverless:Get*`
-   `emr-serverless:List*`
-   `es:Describe*`
-   `es:List*`
-   `events:List*`
-   `firehose:Describe*`
-   `firehose:List*`
-   `fms:List*`
-   `fsx:Describe*`
-   `glacier:Get*`
-   `glacier:List*`
-   `globalaccelerator:List*`
-   `glue:Get*`
-   `glue:List*`
-   `grafana:Describe*`
-   `grafana:List*`
-   `guardduty:Describe*`
-   `guardduty:Get*`
-   `guardduty:List*`
-   `health:Describe*`
-   `iam:Generate*`
-   `iam:Get*`
-   `iam:List*`
-   `identitystore:List*`
-   `imagebuilder:Get*`
-   `imagebuilder:List*`
-   `inspector2:Describe*`
-   `inspector2:Get*`
-   `inspector2:List*`
-   `inspector:Describe*`
-   `inspector:List*`
-   `kafka:Get*`
-   `kafka:List*`
-   `kinesis:Describe*`
-   `kinesis:List*`
-   `kms:Describe*`
-   `kms:Get*`
-   `kms:List*`
-   `lambda:Get*`
-   `lambda:List*`
-   `lex:Describe*`
-   `lex:List*`
-   `license-manager:List*`
-   `logs:Describe*`
-   `macie2:Describe*`
-   `macie2:Get*`
-   `macie2:List*`
-   `mq:Describe*`
-   `mq:List*`
-   `neptune-graph:Get*`
-   `neptune-graph:List*`
-   `neptune:Describe*`
-   `network-firewall:Describe*`
-   `network-firewall:List*`
-   `networkmanager:Get*`
-   `networkmanager:List*`
-   `organizations:Describe*`
-   `organizations:List*`
-   `quicksight:Describe*`
-   `quicksight:List*`
-   `ram:Get*`
-   `ram:List*`
-   `rds:Describe*`
-   `redshift-serverless:List*`
-   `redshift:Describe*`
-   `rolesanywhere:Get*`
-   `rolesanywhere:List*`
-   `route53:Get*`
-   `route53:List*`
-   `route53domains:Get*`
-   `route53domains:List*`
-   `route53resolver:List*`
-   `s3:Get*`
-   `s3:List*`
-   `sagemaker:Describe*`
-   `sagemaker:List*`
-   `secretsmanager:Describe*`
-   `secretsmanager:Get*`
-   `secretsmanager:List*`
-   `securityhub:Describe*`
-   `securityhub:Get*`
-   `servicediscovery:Get*`
-   `servicediscovery:List*`
-   `ses:Get*`
-   `ses:List*`
-   `shield:Describe*`
-   `shield:Get*`
-   `shield:List*`
-   `signer:Get*`
-   `signer:List*`
-   `sns:Get*`
-   `sns:List*`
-   `sqs:Get*`
-   `sqs:List*`
-   `ssm:Describe*`
-   `ssm:Get*`
-   `ssm:List*`
-   `sso:Describe*`
-   `sso:Get*`
-   `sso:List*`
-   `states:Describe*`
-   `states:List*`
-   `storagegateway:Describe*`
-   `storagegateway:List*`
-   `tag:Get*`
-   `transfer:Describe*`
-   `transfer:List*`
-   `vpc-lattice:List*`
-   `waf:Get*`
-   `waf:List*`
-   `wafv2:Get*`
-   `wafv2:List*`
-   `workspaces:Describe*`
-   `xray:Get*`
-   `xray:List*`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (8)

-   `GET https://aidevops.{region}.api.aws/v1/agentspaces/{agentSpaceId}`
-   `GET https://aidevops.{region}.api.aws/v1/private-connections`
-   `GET https://aidevops.{region}.api.aws/v1/private-connections/{name}`
-   `GET https://aidevops.{region}.api.aws/v1/services/{serviceId}`
-   `GET https://aidevops.{region}.api.aws/v2/agentspaces/{agentSpaceId}/operator`
-   `POST https://aidevops.{region}.api.aws/v1/agentspaces/list`
-   `POST https://aidevops.{region}.api.aws/v1/agentspaces/{agentSpaceId}/associations/list`
-   `POST https://aidevops.{region}.api.aws/v1/services/list`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (9)

-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_DescribePrivateConnection.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_DescribePrivateConnection.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_GetAgentSpace.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_GetAgentSpace.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_GetOperatorApp.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_GetOperatorApp.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_GetService.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_GetService.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_ListAgentSpaces.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_ListAgentSpaces.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_ListAssociations.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_ListAssociations.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_ListPrivateConnections.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_ListPrivateConnections.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_ListServices.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_ListServices.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/userguide/about-aws-devops-agent-supported-regions.html](https://docs.aws.amazon.com/devopsagent/latest/userguide/about-aws-devops-agent-supported-regions.html)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (270)

| Step | Permissions | Roles | Endpoints |
| --- | --- | --- | --- |
| Build AccessAnalyzer Finding Principal Relationships | \- | \- | \- |
| Build ACM Certificate to Cognito User Pool Relationships | `cognito-idp:DescribeUserPoolDomain` | `cognito-idp:Describe*` | \- |
| Build AWS ApiGateway API to Domain Name Relationships | `apigateway:GET arn:aws:apigateway:*::/domainnames/*/apimappings` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Build AWS EC2 VPC Endpoint Service to LB Relationships | \- | \- | \- |
| Build AWS EC2 VPC Endpoint Service to VPC Endpoint Relationships | \- | \- | \- |
| Build Bedrock Action Group to Lambda Function Relationships | \- | \- | \- |
| Build Bedrock Agent Runtime to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Agent Runtime to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Agent Runtime to VPC Relationships | \- | \- | \- |
| Build Bedrock Agent to Foundation Model Relationships | \- | \- | \- |
| Build Bedrock Agent to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Agent to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Agent to KMS Key Relationships | \- | \- | \- |
| Build Bedrock API Key to IAM User Relationships | \- | \- | \- |
| Build Bedrock Browser to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Browser to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Browser to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Browser to VPC Relationships | \- | \- | \- |
| Build Bedrock Code Interpreter to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Code Interpreter to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Code Interpreter to VPC Relationships | \- | \- | \- |
| Build Bedrock Custom Model to Foundation Model Relationships | \- | \- | \- |
| Build Bedrock Custom Model to KMS Key Relationships | \- | \- | \- |
| Build Bedrock Custom Model to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Data Source to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Evaluation Job to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Flow to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Flow to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Flow to KMS Key Relationships | \- | \- | \- |
| Build Bedrock Gateway Target to API Key Credential Provider Relationships | \- | \- | \- |
| Build Bedrock Gateway to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Gateway to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Gateway to KMS Key Relationships | \- | \- | \- |
| Build Bedrock Guardrail to Agent Relationships | \- | \- | \- |
| Build Bedrock Guardrail to KMS Key Relationships | \- | \- | \- |
| Build Bedrock Imported Model to KMS Key Relationships | \- | \- | \- |
| Build Bedrock Imported Model to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Knowledge Base to Foundation Model Relationships | \- | \- | \- |
| Build Bedrock Knowledge Base to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Knowledge Base to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Knowledge Base to OpenSearch Domain Relationships | \- | \- | \- |
| Build Bedrock Logging to CloudWatch Log Group Relationships | \- | \- | \- |
| Build Bedrock Logging to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Memory to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Memory to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Memory to KMS Key Relationships | \- | \- | \- |
| Build Bedrock Model Customization Job to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Model Invocation Job to Custom Model Relationships | \- | \- | \- |
| Build Bedrock Model Invocation Job to Foundation Model Relationships | \- | \- | \- |
| Build Bedrock Model Invocation Job to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Model Invocation Job to KMS Key Relationships | \- | \- | \- |
| Build Bedrock Model Invocation Job to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Provisioned Throughput to Model Relationships | \- | \- | \- |
| Build Bedrock Service to VPC Endpoint Relationships | \- | \- | \- |
| Build CodeArtifact Domain KMS Key Relationships | \- | \- | \- |
| Build CodeArtifact Package Group Parent Relationships | \- | \- | \- |
| Build CodeArtifact VPC Endpoint Relationships | \- | \- | \- |
| Build CodeBuild Project Has VPC Relationship | \- | \- | \- |
| Build CodeDeploy Deployment Group IAM Relationships | \- | \- | \- |
| Build CodeGuru Reviewer Repository Association KMS Key Relationships | \- | \- | \- |
| Build DevOps Agent Agent Space to IAM Role Relationships | \- | \- | \- |
| Build DevOps Agent Agent Space to KMS Key Relationships | \- | \- | \- |
| Build DevOps Agent Agent Space to VPC Endpoint Relationships | \- | \- | \- |
| Build DevOps Agent Association to IAM Role Relationships | \- | \- | \- |
| Build DevOps Agent Association to Service Relationships | \- | \- | \- |
| Build DevOps Agent Private Connection to VPC Relationships | \- | \- | \- |
| Build DevOps Agent Service to IAM Role Relationships | \- | \- | \- |
| Build DevOps Agent Service to KMS Key Relationships | \- | \- | \- |
| Build DevOps Agent Service to Private Connection Relationships | \- | \- | \- |
| Build EC2 Instance uses IAM Instance Profile Relationships | `ec2:DescribeIamInstanceProfileAssociations` | `ec2:Describe*` | \- |
| Build EMR Cluster to IAM Relationships | \- | \- | \- |
| Build EMR Cluster to Security Configuration Relationships | \- | \- | \- |
| Build EMR Cluster to VPC Endpoint Relationships | \- | \- | \- |
| Build GuardDuty Publishing Destination to KMS Key Relationships | \- | \- | \- |
| Build GuardDuty Publishing Destination to S3 Bucket Relationships | \- | \- | \- |
| Build IAM Identity Center Group has User relationships | `identitystore:ListGroupMemberships` | `identitystore:List*` | \- |
| Build IAM Identity Center Permission Set relationships | `sso:ListAccountAssignments`, `sso:ListAccountAssignmentsForPrincipal`, `sso:ListAccountsForProvisionedPermissionSet`, `sso:GetInlinePolicyForPermissionSet`, `sso:ListManagedPoliciesInPermissionSet`, `sso:ListCustomerManagedPolicyReferencesInPermissionSet` | `sso:Get*`, `sso:List*` | \- |
| Build IAM Roles Anywhere Profile to IAM Policy Relationships | \- | \- | \- |
| Build IAM Roles Anywhere Profile to IAM Role Relationships | \- | \- | \- |
| Build IAM Roles Anywhere Trust Anchor to ACM PCA Relationships | \- | \- | \- |
| Build Inspector v2 to KMS Key Relationships | \- | \- | \- |
| Build Inspector v2 to Resource Relationships | `inspector2:ListCoverage` | `inspector2:List*` | \- |
| Build Inspector v2 to VPC Endpoint Relationships | \- | \- | \- |
| Build Kinesis Stream to Consumer Relationships | `kinesis:ListStreamConsumers` | `kinesis:List*` | \- |
| Build Launch Template Version to Ami Relationships | \- | \- | \- |
| Build Nova Act Workflow Definition to S3 Bucket Relationships | \- | \- | \- |
| Build Nova Act Workflow Run to CloudWatch Log Group Relationships | \- | \- | \- |
| Build Nova Act Workflow Run to Model Relationships | \- | \- | \- |
| Build OpenSearch Domain to CloudWatch Log Group Relationships | \- | \- | \- |
| Build Outposts Asset to EC2 Instance Relationships | `outposts:ListAssetInstances` | \- | \- |
| Build Quicksight Group to User Relationships | `quicksight:ListGroupMemberships` | `quicksight:List*` | \- |
| Build Quicksight User to Custom Permissions Relationships | \- | \- | \- |
| Build RDS DB Proxy connects RDS Cluster relationships | \- | \- | \- |
| Build RDS DB Proxy connects RDS DB Instance relationships | \- | \- | \- |
| Build Resource Explorer CloudTrail Relationships | \- | \- | \- |
| Build Resource Explorer VPC Endpoint Relationships | \- | \- | \- |
| Build Route53 Resolver Rules uses VPC relationships | `route53resolver:ListResolverRuleAssociations` | `route53resolver:List*` | \- |
| Build S3 Bucket Lifecycle Rules | `s3:GetLifecycleConfiguration` | `s3:Get*` | \- |
| Build SageMaker Domain Relationships | \- | \- | \- |
| Build SageMaker Endpoint Relationships | \- | \- | \- |
| Build SageMaker Feature Group Relationships | \- | \- | \- |
| Build SageMaker Inference Recommendations Job Relationships | \- | \- | \- |
| Build SageMaker Model Bias Job Definition Relationships | \- | \- | \- |
| Build SageMaker Model Quality Job Definition Relationships | \- | \- | \- |
| Build SageMaker Processing Job Relationships | \- | \- | \- |
| Build SageMaker Training Job Relationships | \- | \- | \- |
| Build SageMaker Transform Job Relationships | \- | \- | \- |
| Build Service Catalog Portfolio Product Relationships | `servicecatalog:ListPortfoliosForProduct` | \- | \- |
| Build Service Catalog Principal Relationships | `servicecatalog:ListPrincipalsForPortfolio` | \- | \- |
| Build Shared DB Cluster Snapshot to Account Relationships | `rds:DescribeDBClusterSnapshots` | `rds:Describe*` | \- |
| Build Shared DB Snapshot to Account Relationships | `rds:DescribeDBSnapshots` | `rds:Describe*` | \- |
| Build States to CloudWatch Log Group Relationships | \- | \- | \- |
| Build States to IAM Relationships | \- | \- | \- |
| Build VPC Endpoint to Service Relationships | \- | \- | \- |
| Build VPC has OpenSearch Domain Relationships | \- | \- | \- |
| Build WAF v2 Web ACL to Resource Relationships | `wafv2:ListResourcesForWebACL` | `wafv2:List*` | \- |
| Build WAF Web ACL to Cognito User Pool Relationships | `wafv2:ListResourcesForWebACL` | `wafv2:List*` | \- |
| Fetch AccessAnalyzer Findings | `access-analyzer:ListFindings` | `access-analyzer:List*` | \- |
| Fetch ApiGateway Api to Integration Relationship | `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources`, `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Fetch ApiGateway Resources | `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources`, `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Fetch ApiGateway Stages | `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages`, `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages/*` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Fetch ApiGatewayV2 Authorizers | `apigateway:GET arn:aws:apigateway:*::/apis/*/authorizers` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Fetch ApiGatewayV2 Integrations | `apigateway:GET arn:aws:apigateway:*::/apis/*/integrations` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Fetch ApiGatewayV2 Routes | `apigateway:GET arn:aws:apigateway:*::/apis/*/routes` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Fetch ApiGatewayV2 Stages | `apigateway:GET arn:aws:apigateway:*::/apis/*/stages` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Fetch AppConfig Configuration Profiles | `appconfig:ListConfigurationProfiles`, `appconfig:GetConfigurationProfile` | `appconfig:List*`, `appconfig:Get*` | \- |
| Fetch AppConfig Deployments | `appconfig:ListDeployments`, `appconfig:GetDeployment`, `appconfig:ListTagsForResource` | `appconfig:List*`, `appconfig:Get*` | \- |
| Fetch AppConfig Environments | `appconfig:ListEnvironments` | `appconfig:List*` | \- |
| Fetch AppConfig Hosted Configuration Versions | `appconfig:ListHostedConfigurationVersions` | `appconfig:List*` | \- |
| Fetch Audit Manager Evidence Folders | `auditmanager:GetEvidenceFoldersByAssessmentControl` | `auditmanager:Get*` | \- |
| Fetch Autoscaling Launch Config to Image Relationships | `ec2:DescribeImages` | `ec2:Describe*` | \- |
| Fetch AWS EC2 Images | `ec2:DescribeImages`, `ec2:DescribeImageAttribute` | `ec2:Describe*` | \- |
| Fetch AWS EC2 Internet Gateways | `ec2:DescribeInternetGateways` | `ec2:Describe*` | \- |
| Fetch AWS EC2 Launch Template Versions | `ec2:DescribeLaunchTemplateVersions` | `ec2:Describe*` | \- |
| Fetch AWS EC2 NAT Gateways | `ec2:DescribeNatGateways` | `ec2:Describe*` | \- |
| Fetch AWS EC2 Security Group Rules | `ec2:DescribeSecurityGroupRules` | `ec2:Describe*` | \- |
| Fetch AWS EC2 Subnets | `ec2:DescribeSubnets` | `ec2:Describe*` | \- |
| Fetch AWS EC2 Volumes | `ec2:DescribeVolumes` | `ec2:Describe*` | \- |
| Fetch AWS EC2 VPC Endpoints | `ec2:DescribeVpcEndpoints` | `ec2:Describe*` | \- |
| Fetch AWS EC2 VPN Gateways | `ec2:DescribeVpnGateways`, `ec2:DescribeCustomerGateways` | `ec2:Describe*` | \- |
| Fetch AWS EMR Instances | `elasticmapreduce:ListInstances` | `elasticmapreduce:List*` | \- |
| Fetch AWS Organization | `organizations:DescribeOrganization`, `organizations:ListAccounts`, `organizations:ListTagsForResource` | `organizations:Describe*`, `organizations:List*` | \- |
| Fetch Backup Copy Jobs | `backup:ListCopyJobs` | `backup:List*` | \- |
| Fetch Backup Jobs | `backup:ListBackupJobs` | `backup:List*` | \- |
| Fetch Backup Recovery Points | `backup:ListRecoveryPointsByBackupVault`, `backup:ListTagsForResource` | `backup:List*` | \- |
| Fetch Backup Restore Jobs | `backup:ListRestoreJobs` | `backup:List*` | \- |
| Fetch Batch Jobs | `batch:ListJobs` | `batch:List*` | \- |
| Fetch Bedrock Agent Action Groups | `bedrock:ListAgentActionGroups`, `bedrock:GetAgentActionGroup` | `bedrock:Get*`, `bedrock:List*` | \- |
| Fetch Bedrock Gateway Targets | `bedrock-agentcore:ListGatewayTargets`, `bedrock-agentcore:GetGatewayTarget` | `bedrock-agentcore:Get*`, `bedrock-agentcore:List*` | \- |
| Fetch Bedrock Knowledge Base Data Sources | `bedrock:ListDataSources`, `bedrock:GetDataSource` | `bedrock:Get*`, `bedrock:List*` | \- |
| Fetch Cloudfront Key Groups | `cloudfront:ListKeyGroups` | `cloudfront:List*` | \- |
| Fetch Cloudhsm Backups | `cloudhsm:DescribeBackups` | `cloudhsm:Describe*` | \- |
| Fetch CloudMap Service Instances | `servicediscovery:ListInstances`, `servicediscovery:GetInstance` | `servicediscovery:Get*`, `servicediscovery:List*` | \- |
| Fetch CloudMap Services | `servicediscovery:ListServices`, `servicediscovery:ListTagsForResource` | `servicediscovery:Get*`, `servicediscovery:List*` | \- |
| Fetch Cloudtrail Event Selectors | `cloudtrail:DescribeTrails`, `cloudtrail:GetEventSelectors` | `cloudtrail:Describe*`, `cloudtrail:Get*` | \- |
| Fetch CloudWAN Attachments | `networkmanager:ListAttachments`, `networkmanager:ListAttachmentRoutingPolicyAssociations` | `networkmanager:List*` | \- |
| Fetch CloudWAN Connect Peers | `networkmanager:ListConnectPeers`, `networkmanager:GetConnectPeer` | `networkmanager:List*`, `networkmanager:Get*` | \- |
| Fetch CloudWAN Core Network Policies | `networkmanager:GetCoreNetworkPolicy` | `networkmanager:Get*` | \- |
| Fetch CloudWAN Core Network Policy Versions | `networkmanager:ListCoreNetworkPolicyVersions` | `networkmanager:List*` | \- |
| Fetch CloudWAN Core Network Routes | `networkmanager:ListCoreNetworkRoutingInformation` | `networkmanager:List*` | \- |
| Fetch CloudWatch Log Group Metrics | `cloudwatch:GetMetricData` | `cloudwatch:Get*` | \- |
| Fetch Cloudwatch Logs Metric Filters | `logs:DescribeMetricFilters` | `logs:Describe*` | \- |
| Fetch Cloudwatch Logs Subscription Filters | `logs:DescribeSubscriptionFilters` | `logs:Describe*` | \- |
| Fetch CodeArtifact Package Groups | `codeartifact:ListPackageGroups`, `codeartifact:ListTagsForResource` | `codeartifact:List*` | \- |
| Fetch CodeArtifact Packages | `codeartifact:ListPackages` | `codeartifact:List*` | \- |
| Fetch CodeArtifact Repositories | `codeartifact:ListRepositories`, `codeartifact:DescribeRepository`, `codeartifact:GetRepositoryPermissionsPolicy`, `codeartifact:GetRepositoryEndpoint`, `codeartifact:ListTagsForResource` | `codeartifact:List*`, `codeartifact:Describe*`, `codeartifact:Get*` | \- |
| Fetch CodeDeploy Deployment Groups | `codedeploy:ListDeploymentGroups`, `codedeploy:BatchGetDeploymentGroups`, `codedeploy:ListTagsForResource` | `codedeploy:BatchGet*`, `codedeploy:List*` | \- |
| Fetch Cognito IDP User Pool Clients | `cognito-idp:ListUserPoolClients`, `cognito-idp:DescribeUserPoolClient` | `cognito-idp:Describe*`, `cognito-idp:List*` | \- |
| Fetch Cognito IDP User Pool Users | `cognito-idp:ListUsers` | `cognito-idp:List*` | \- |
| Fetch DataSync Locations | `datasync:ListLocations`, `datasync:DescribeLocationS3`, `datasync:DescribeLocationEfs`, `datasync:DescribeLocationFsxWindows`, `datasync:DescribeLocationFsxLustre`, `datasync:DescribeLocationFsxOntap`, `datasync:DescribeLocationFsxOpenZfs`, `datasync:DescribeLocationNfs`, `datasync:DescribeLocationSmb`, `datasync:DescribeLocationObjectStorage`, `datasync:DescribeLocationHdfs`, `datasync:ListTagsForResource` | `datasync:Describe*`, `datasync:List*` | \- |
| Fetch DataSync Tasks | `datasync:ListTasks`, `datasync:DescribeTask`, `datasync:ListTagsForResource` | `datasync:Describe*`, `datasync:List*` | \- |
| Fetch Detective Investigations | `detective:ListInvestigations`, `detective:GetInvestigation` | `detective:Get*`, `detective:List*` | \- |
| Fetch DevOps Agent Associations | `aidevops:ListAssociations` | \- | `POST https://aidevops.{region}.api.aws/v1/agentspaces/{agentSpaceId}/associations/list` |
| Fetch DevOps Guru Anomalies | `devops-guru:ListAnomaliesForInsight` | `devops-guru:List*` | \- |
| Fetch DevOps Guru Notification Channels | `devops-guru:ListNotificationChannels` | `devops-guru:List*` | \- |
| Fetch EC2 Transit Gateway Attachments | `ec2:DescribeTransitGatewayAttachments` | `ec2:Describe*` | \- |
| Fetch EC2 Transit Gateway Route Tables | `ec2:DescribeTransitGatewayRouteTables` | `ec2:Describe*` | \- |
| Fetch EC2 Transit Gateway VPC Attachments | `ec2:DescribeTransitGatewayVpcAttachments` | `ec2:Describe*` | \- |
| Fetch ECR Image Findings | `ecr:DescribeImageScanFindings` | `ecr:Describe*` | \- |
| Fetch ECR Images | `ecr:DescribeImages` | `ecr:Describe*` | \- |
| Fetch ECS Cluster Services | `ecs:ListServices`, `ecs:DescribeServices` | `ecs:Describe*`, `ecs:List*` | \- |
| Fetch ECS Container Instances | `ecs:DescribeContainerInstances`, `ecs:ListContainerInstances` | `ecs:Describe*`, `ecs:List*` | \- |
| Fetch ECS Task Definitions | `ecs:DescribeTaskDefinition`, `ecs:ListTaskDefinitionFamilies` | `ecs:Describe*`, `ecs:List*` | \- |
| Fetch ECS Tasks | `ecs:DescribeTasks`, `ecs:ListTasks` | `ecs:Describe*`, `ecs:List*` | \- |
| Fetch EFS Mount Targets | `elasticfilesystem:DescribeMountTargetSecurityGroups`, `elasticfilesystem:DescribeMountTargets` | `elasticfilesystem:Describe*` | \- |
| Fetch EKS Node Groups | `eks:ListNodegroups`, `eks:DescribeNodegroup` | `eks:Describe*`, `eks:List*` | \- |
| Fetch Elasticache Clusters Subnet Groups | `elasticache:DescribeCacheSubnetGroups` | `elasticache:Describe*` | \- |
| Fetch Elasticache Snapshots | `elasticache:ListTagsForResource`, `elasticache:DescribeSnapshots` | `elasticache:Describe*`, `elasticache:List*` | \- |
| Fetch ELB Listener Rules | `elasticloadbalancing:DescribeTags`, `elasticloadbalancing:DescribeRules` | `elasticloadbalancing:Describe*` | \- |
| Fetch ELB Listeners | `elasticloadbalancing:DescribeTags`, `elasticloadbalancing:DescribeListeners` | `elasticloadbalancing:Describe*` | \- |
| Fetch ELB Target Groups | `elasticloadbalancing:DescribeTags`, `elasticloadbalancing:DescribeTargetGroups`, `elasticloadbalancing:DescribeTargetHealth` | `elasticloadbalancing:Describe*` | \- |
| Fetch Firewall Manager Resource Set Resources | `fms:ListResourceSetResources` | `fms:List*` | \- |
| Fetch Global Accelerator Custom Routing Endpoint Groups | `globalaccelerator:ListCustomRoutingEndpointGroups` | `globalaccelerator:List*` | \- |
| Fetch Global Accelerator Custom Routing Listeners | `globalaccelerator:ListCustomRoutingListeners` | `globalaccelerator:List*` | \- |
| Fetch Global Accelerator Endpoint Groups | `globalaccelerator:ListEndpointGroups` | `globalaccelerator:List*` | \- |
| Fetch Global Accelerator Listeners | `globalaccelerator:ListListeners` | `globalaccelerator:List*` | \- |
| Fetch Guardduty Findings | `guardduty:ListFindings`, `guardduty:GetFindings` | `guardduty:Get*`, `guardduty:List*` | \- |
| Fetch GuardDuty Publishing Destinations | `guardduty:ListPublishingDestinations`, `guardduty:DescribePublishingDestination` | `guardduty:List*`, `guardduty:Describe*` | \- |
| Fetch IAM Group Policies | `iam:ListGroupPolicies`, `iam:GetGroupPolicy` | `iam:Get*`, `iam:List*` | \- |
| Fetch IAM Group to User Relationships | `iam:GetGroup` | `iam:Get*` | \- |
| Fetch IAM Identity Center Applications | `sso:ListApplications` | `sso:List*` | \- |
| Fetch IAM Identity Center Groups | `identitystore:ListGroups` | `identitystore:List*` | \- |
| Fetch IAM Identity Center Permission Sets | `sso:ListPermissionSets`, `sso:DescribePermissionSet`, `sso:ListTagsForResource` | `sso:Describe*`, `sso:List*` | \- |
| Fetch IAM Identity Center Users | `identitystore:ListUsers` | `identitystore:List*` | \- |
| Fetch IAM Policies | `iam:ListPolicies`, `iam:GetPolicyVersion`, `iam:ListEntitiesForPolicy`, `tag:GetResources` | `iam:Get*`, `iam:List*`, `tag:Get*` | \- |
| Fetch IAM Role Policies | `iam:ListRolePolicies`, `iam:GetRolePolicy` | `iam:Get*`, `iam:List*` | \- |
| Fetch IAM Roles | `iam:ListInstanceProfiles`, `iam:GetRole`, `iam:ListRoles`, `iam:ListRoleTags` | `iam:Get*`, `iam:List*` | \- |
| Fetch IAM User Policies | `iam:ListUserPolicies`, `iam:GetUserPolicy` | `iam:Get*`, `iam:List*` | \- |
| Fetch IAM Users | `iam:GetUser`, `iam:ListUsers`, `iam:ListUserTags`, `iam:ListAccessKeys`, `iam:ListMFADevices`, `iam:GetAccessKeyLastUsed` | `iam:Get*`, `iam:List*` | \- |
| Fetch Inspector Findings | `inspector:DescribeFindings`, `inspector:DescribeRulesPackages`, `inspector:ListFindings` | `inspector:Describe*`, `inspector:List*` | \- |
| Fetch Inspector v2 CIS Findings | `inspector2:ListCisScanResultsAggregatedByTargetResource` | `inspector2:List*` | \- |
| Fetch Instance to Image Relationships | `ec2:DescribeImages` | `ec2:Describe*` | \- |
| Fetch Keyspaces Tables | `cassandra:Select`, `application-autoscaling:DescribeScalableTargets`, `application-autoscaling:DescribeScalingPolicies` | \- | \- |
| Fetch Lex V2 Bot Aliases | `lex:ListBotAliases`, `lex:DescribeResourcePolicy` | `lex:Describe*`, `lex:List*` | \- |
| Fetch Macie Automated Discovery Accounts | `macie2:ListAutomatedDiscoveryAccounts` | `macie2:List*` | \- |
| Fetch Marketplace Entitlements | `aws-marketplace:GetEntitlements` | `aws-marketplace:Get*` | \- |
| Fetch Neptune Analytics Graph Export Tasks | `neptune-graph:ListExportTasks` | `neptune-graph:List*` | \- |
| Fetch Neptune Analytics Graph Import Tasks | `neptune-graph:ListImportTasks`, `neptune-graph:GetImportTask` | `neptune-graph:Get*`, `neptune-graph:List*` | \- |
| Fetch Neptune Analytics Graph Snapshots | `neptune-graph:ListGraphSnapshots`, `neptune-graph:ListTagsForResource` | `neptune-graph:List*` | \- |
| Fetch Nova Act Models | `nova-act:ListModels` | \- | \- |
| Fetch Nova Act Workflow Definitions | `nova-act:ListWorkflowDefinitions`, `nova-act:GetWorkflowDefinition` | \- | \- |
| Fetch Nova Act Workflow Runs | `nova-act:ListWorkflowRuns`, `nova-act:GetWorkflowRun` | \- | \- |
| Fetch Organization Policy Targets | `organizations:ListTargetsForPolicy` | `organizations:List*` | \- |
| Fetch Organization Roots | `organizations:ListRoots` | `organizations:List*` | \- |
| Fetch Organizational Units | `organizations:DescribeOrganizationalUnit`, `organizations:ListChildren` | `organizations:Describe*`, `organizations:List*` | \- |
| Fetch Outposts Assets | `outposts:ListAssets`, `outposts:ListOrders`, `outposts:GetOrder`, `outposts:GetCatalogItem` | \- | \- |
| Fetch Outposts Outposts | `outposts:ListOutposts`, `outposts:GetOutpostInstanceTypes`, `outposts:GetOutpostSupportedInstanceTypes`, `outposts:GetPrivateConnectivityConfig` | \- | \- |
| Fetch Quicksight Dashboards | `quicksight:ListDashboards`, `quicksight:DescribeDashboard`, `quicksight:DescribeDashboardPermissions` | `quicksight:Describe*`, `quicksight:List*` | \- |
| Fetch Quicksight Data Sets | `quicksight:ListDataSets`, `quicksight:DescribeDataSet` | `quicksight:Describe*`, `quicksight:List*` | \- |
| Fetch Quicksight Data Sources | `quicksight:ListDataSources`, `quicksight:DescribeDataSource` | `quicksight:Describe*`, `quicksight:List*` | \- |
| Fetch RAM Resource Share Associations | `ram:GetResourceShareAssociations` | `ram:Get*` | \- |
| Fetch RAM Resource Share Invitations | `ram:GetResourceShareInvitations` | `ram:Get*` | \- |
| Fetch RAM Shared Resources | `ram:ListResources` | `ram:List*` | \- |
| Fetch RDS DB Proxy Target Groups | `rds:DescribeDBProxyTargetGroups` | `rds:Describe*` | \- |
| Fetch Restore Testing Plans | `backup:ListRestoreTestingPlans`, `backup:ListTags` | `backup:List*` | \- |
| Fetch Route53 Records | `route53:ListResourceRecordSets` | `route53:List*` | \- |
| Fetch S3 Access Points | `s3:ListAccessPoints` | `s3:List*` | \- |
| Fetch S3 Buckets | `cloudwatch:GetMetricData`, `s3:ListAllMyBuckets`, `s3:GetBucketLocation`, `s3:GetBucketPolicy`, `s3:GetBucketTagging`, `s3:GetBucketAcl`, `s3:GetBucketLogging`, `s3:GetBucketNotification`, `s3:GetBucketVersioning`, `s3:GetReplicationConfiguration`, `s3:GetBucketPublicAccessBlock`, `s3:GetBucketObjectLockConfiguration`, `s3:GetLifecycleConfiguration`, `s3:GetBucketOwnershipControls`, `s3:GetBucketPolicyStatus`, `s3:GetEncryptionConfiguration`, `s3:GetInventoryConfiguration` | `cloudwatch:Get*`, `s3:Get*`, `s3:List*` | \- |
| Fetch S3 Buckets Website Config | `s3:GetBucketWebsite` | `s3:Get*` | \- |
| Fetch Secret Versions | `secretsmanager:ListSecretVersionIds` | `secretsmanager:List*` | \- |
| Fetch Secrets | `secretsmanager:ListSecrets`, `secretsmanager:DescribeSecret`, `secretsmanager:GetResourcePolicy` | `secretsmanager:Describe*`, `secretsmanager:Get*`, `secretsmanager:List*` | \- |
| Fetch Security Agent Agent Spaces | `securityagent:ListAgentSpaces`, `securityagent:BatchGetAgentSpaces`, `securityagent:ListTagsForResource` | \- | \- |
| Fetch Security Agent Applications | `securityagent:ListApplications` | \- | \- |
| Fetch Security Agent Artifacts | `securityagent:ListArtifacts`, `securityagent:BatchGetArtifactMetadata` | \- | \- |
| Fetch Security Agent Private Connections | `securityagent:ListPrivateConnections` | \- | \- |
| Fetch Security Agent Target Domains | `securityagent:ListTargetDomains`, `securityagent:BatchGetTargetDomains` | \- | \- |
| Fetch Security Agent Threat Models | `securityagent:ListThreatModels`, `securityagent:BatchGetThreatModels` | \- | \- |
| Fetch Service Catalog Constraints | `servicecatalog:ListConstraintsForPortfolio`, `servicecatalog:DescribeConstraint` | \- | \- |
| Fetch Service Catalog Launch Paths | `servicecatalog:ListLaunchPaths` | \- | \- |
| Fetch Service Catalog Provisioning Artifacts | `servicecatalog:ListProvisioningArtifacts` | \- | \- |
| Fetch Service Catalog Tag Options | `servicecatalog:ListTagOptions`, `servicecatalog:ListResourcesForTagOption` | \- | \- |
| Fetch Signer Signing Jobs | `signer:ListSigningJobs` | `signer:List*` | \- |
| Fetch Signer Signing Profiles | `signer:ListSigningProfiles`, `signer:GetSigningProfile`, `signer:ListProfilePermissions` | `signer:List*`, `signer:Get*` | \- |
| Fetch SSM Instance Inventory Entries | `ssm:ListInventoryEntries` | `ssm:List*` | \- |
| Fetch SSM Instance Patch States | `ssm:DescribeInstancePatchStates` | `ssm:Describe*` | \- |
| Fetch SSM Service to EC2 Instance Relationships | `ssm:DescribeInstanceInformation` | `ssm:Describe*` | \- |
| Fetch Storage Gateway File Shares | `storagegateway:ListFileShares`, `storagegateway:DescribeNFSFileShares`, `storagegateway:DescribeSMBFileShares`, `storagegateway:ListTagsForResource` | `storagegateway:Describe*`, `storagegateway:List*` | \- |
| Fetch Storage Gateway Tapes | `storagegateway:ListTapes`, `storagegateway:DescribeTapeArchives`, `storagegateway:ListTagsForResource` | `storagegateway:Describe*`, `storagegateway:List*` | \- |
| Fetch Storage Gateway Volumes | `storagegateway:ListVolumes`, `storagegateway:DescribeCachediSCSIVolumes`, `storagegateway:DescribeStorediSCSIVolumes`, `storagegateway:ListTagsForResource` | `storagegateway:Describe*`, `storagegateway:List*` | \- |
| Fetch Transfer Servers details | \- | \- | \- |
| Fetch Transfer Users | `transfer:ListUsers`, `transfer:ListTagsForResource` | `transfer:List*` | \- |
| Fetch VPC Lattice Listeners | `vpc-lattice:ListListeners` | `vpc-lattice:List*` | \- |
| Fetch VPC Lattice Networks | `vpc-lattice:ListServiceNetworks` | `vpc-lattice:List*` | \- |
| Fetch VPC Lattice Service Network Service Associations | `vpc-lattice:ListServiceNetworkServiceAssociations` | `vpc-lattice:List*` | \- |
| Fetch VPC Lattice Service Network VPC Associations | `vpc-lattice:ListServiceNetworkVpcAssociations` | `vpc-lattice:List*` | \- |
| Fetch VPC Lattice Service Network VPC Endpoint Associations | `vpc-lattice:ListServiceNetworkVpcEndpointAssociations` | `vpc-lattice:List*` | \- |
| Fetch VPC Lattice Services | `vpc-lattice:ListServices` | `vpc-lattice:List*` | \- |
| Fetch VPC Lattice Target Groups | `vpc-lattice:ListTargetGroups` | `vpc-lattice:List*` | \- |
| Fetch VPC to VPC Relationships | `ec2:DescribeVpcPeeringConnections` | `ec2:Describe*` | \- |
| Fetch WAF v2 IP Sets | `wafv2:GetIPSet`, `wafv2:ListIPSets`, `wafv2:ListTagsForResource` | `wafv2:Get*`, `wafv2:List*` | \- |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| AccessAnalyzer Analyzer | `aws_accessanalyzer_analyzer` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment), [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| AccessAnalyzer Finding | `aws_accessanalyzer_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| ACM Certificate | `aws_acm_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Amazon Keyspaces Keyspace | `aws_keyspaces_keyspace` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Amazon Keyspaces Table | `aws_keyspaces_table` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Amazon Managed Grafana | `aws_grafana` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Amazon Managed Service for Prometheus | `aws_prometheus` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| ApiGateway Domain Name | `aws_api_gateway_domain_name` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| ApiGateway Resource | `aws_api_gateway_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| ApiGateway Resource Method | `aws_api_gateway_method` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| ApiGateway Rest Api | `aws_api_gateway_rest_api` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ApiGateway Stage | `aws_api_gateway_stage` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| ApiGateway Stage Method Setting | `aws_api_gateway_stage_method_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ApiGatewayV2 Api | `aws_api_gateway_v2_api` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ApiGatewayV2 Authorizer | `aws_api_gateway_v2_authorizer` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ApiGatewayV2 Integration | `aws_api_gateway_v2_integration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ApiGatewayV2 Route | `aws_api_gateway_v2_route` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| ApiGatewayV2 Stage | `aws_api_gateway_v2_stage` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Athena Work Group | `aws_athena_work_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Audit Manager Assessment | `aws_auditmanager_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Audit Manager Control | `aws_auditmanager_control` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Audit Manager Evidence Folder | `aws_auditmanager_evidence_folder` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| Audit Manager Framework | `aws_auditmanager_framework` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Autoscaling Group | `aws_autoscaling_group` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Autoscaling Launch Configuration | `aws_autoscaling_launch_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Autoscaling Policy | `aws_autoscaling_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AccessAnalyzer Service | `aws_accessanalyzer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Account | `aws_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AWS ACM Service | `aws_acm` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ApiGateway Service | `aws_apigateway` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS AppConfig | `aws_appconfig` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS AppConfig Account Settings | `aws_appconfig_account_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Application | `aws_appconfig_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS AppConfig Configuration Profile | `aws_appconfig_configuration_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Deployment | `aws_appconfig_deployment` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| AWS AppConfig Deployment Strategy | `aws_appconfig_deployment_strategy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Environment | `aws_appconfig_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Hosted Configuration Version | `aws_appconfig_hosted_configuration_version` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Athena Service | `aws_athena` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Audit Manager Delegation | `aws_auditmanager_delegation` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Audit Manager Service | `aws_auditmanager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Audit Manager Settings | `aws_auditmanager_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Auto Scaling Plans Service | `aws_autoscalingplans` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Autoscaling Service | `aws_autoscaling` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Backup Copy Job | `aws_backup_copy_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Backup Job | `aws_backup_job` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Backup Plan | `aws_backup_plan` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Backup Recovery Point | `aws_backup_recovery_point` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Backup Restore Job | `aws_backup_restore_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Backup Service | `aws_backup` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Backup Vault | `aws_backup_vault` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Batch Compute Environment | `aws_batch_compute_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Batch Job Definition | `aws_batch_job_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS Batch Job Queue | `aws_batch_job_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS Batch Service | `aws_batch` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Bedrock Agent | `aws_bedrock_agent` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS Bedrock Agent Action Group | `aws_bedrock_agent_action_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Agent Runtime | `aws_bedrock_agent_runtime` | [Workload](https://docs.jupiterone.io/data-model/schemas/Workload) |
| AWS Bedrock API Key | `aws_bedrock_api_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| AWS Bedrock API Key Credential Provider | `aws_bedrock_api_key_credential_provider` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Browser | `aws_bedrock_browser` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Bedrock Browser Profile | `aws_bedrock_browser_profile` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Bedrock Code Interpreter | `aws_bedrock_code_interpreter` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Bedrock Custom Model | `aws_bedrock_custom_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Bedrock Evaluation Job | `aws_bedrock_evaluation_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Bedrock Evaluator | `aws_bedrock_evaluator` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Flow | `aws_bedrock_flow` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Bedrock Foundation Model | `aws_bedrock_foundation_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Bedrock Gateway | `aws_bedrock_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Bedrock Gateway Target | `aws_bedrock_gateway_target` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Guardrail | `aws_bedrock_guardrail` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| AWS Bedrock Imported Model | `aws_bedrock_imported_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Bedrock Inference Profile | `aws_bedrock_inference_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Knowledge Base | `aws_bedrock_knowledge_base` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Bedrock Knowledge Base Data Source | `aws_bedrock_knowledge_base_data_source` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Memory | `aws_bedrock_memory` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Model Customization Job | `aws_bedrock_model_customization_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Bedrock Model Invocation Job | `aws_bedrock_model_invocation_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Bedrock Model Invocation Logging | `aws_bedrock_model_invocation_logging` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Policy Engine | `aws_bedrock_policy_engine` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| AWS Bedrock Provisioned Throughput | `aws_bedrock_provisioned_throughput` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Bedrock Service | `aws_bedrock` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloud WAN Attachment | `aws_networkmanager_attachment` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Cloud WAN Connect Peer | `aws_networkmanager_connect_peer` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloud WAN Core Network | `aws_networkmanager_core_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Cloud WAN Core Network Policy | `aws_networkmanager_core_network_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloud WAN Core Network Policy Version | `aws_networkmanager_core_network_policy_version` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloud WAN Core Network Route | `aws_networkmanager_core_network_route` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS Cloudformation Service | `aws_cloudformation` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloudformation Stacks | `aws_cloudformation_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloudfront Distribution | `aws_cloudfront_distribution` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Cloudfront Distribution Origin | `aws_cloudfront_distribution_origin` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloudfront Key Group | `aws_cloudfront_key_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Cloudfront Public Key | `aws_cloudfront_public_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| AWS Cloudfront Service | `aws_cloudfront` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloudhsm Service | `aws_cloudhsm` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudMap Namespace | `aws_cloudmap_namespace` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS CloudMap Service | `aws_cloudmap` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudMap Service | `aws_cloudmap_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudMap Service Instance | `aws_cloudmap_service_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Cloudtrail Service | `aws_cloudtrail` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudTrail Trail | `aws_cloudtrail_trail` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloudwatch Alarms | `aws_cloudwatch_metric_alarm` | Monitor |
| AWS Cloudwatch Event | `aws_cloudwatch_events` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudWatch Log Group Metrics | `aws_cloudwatch_log_group_metrics` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS Cloudwatch Logs Service | `aws_cloudwatch_logs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloudwatch Service | `aws_cloudwatch` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeArtifact Service | `aws_codeartifact` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeBuild Service | `aws_codebuild` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeCommit Service | `aws_codecommit` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeDeploy Service | `aws_codedeploy` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeGuru Service | `aws_codeguru` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodePipeline Service | `aws_codepipeline` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito Identity | `aws_cognito_identity` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito Identity Pool | `aws_cognito_identity_pool` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito IDP Service | `aws_cognito_idp` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito IDP User Pool Client | `aws_cognito_user_pool_client` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Cognito IDP User Pool User | `aws_cognito_user_pool_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS Config Rule Finding | `aws_config_rule_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| AWS Customer Gateway | `aws_customer_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Database Migration Service | `aws_dms` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Database Migration Service Endpoint | `aws_dms_endpoint` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| AWS Database Migration Service Instance | `aws_dms_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS DataSync Location | `aws_datasync_location` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS DataSync Service | `aws_datasync` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS DataSync Task | `aws_datasync_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Dedicated Host | `aws_dedicated_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Detective Service | `aws_detective` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS DevOps Agent Agent Space | `aws_devopsagent_agent_space` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS DevOps Agent Association | `aws_devopsagent_association` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS DevOps Agent Private Connection | `aws_devopsagent_private_connection` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS DevOps Agent Service | `aws_devopsagent_service` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS DevOps Guru Service | `aws_devops_guru` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Direct Connect BGP Peer | `aws_directconnect_bgp_peer` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Direct Connect Connection | `aws_directconnect_connection` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Direct Connect Gateway | `aws_directconnect_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Direct Connect LAG | `aws_directconnect_lag` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Direct Connect Service | `aws_directconnect` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Direct Connect Virtual Interface | `aws_directconnect_virtual_interface` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Directory Service | `aws_ds` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Directory Service Directory | `aws_ds_directory` | [Directory](https://docs.jupiterone.io/data-model/schemas/Directory) |
| AWS DynamoDB Service | `aws_dynamodb` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EC2 Image Builder | `aws_imagebuilder` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EC2 Security Group Rule | `aws_ec2_security_group_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS EC2 Service | `aws_ec2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EC2 Settings | `aws_ec2_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EC2 Transit Gateway | `aws_ec2_transit_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS EC2 Transit Gateway Attachment | `aws_ec2_transit_gateway_attachment` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS EC2 Transit Gateway Route Table | `aws_ec2_transit_gateway_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EC2 Transit Gateway VPC Attachment | `aws_ec2_transit_gateway_vpc_attachment` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS ECR Service | `aws_ecr` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ECS Service | `aws_ecs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EFS Service | `aws_efs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EIP Address | `aws_eip` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| AWS EKS Service | `aws_eks` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ElastiCache Service | `aws_elasticache` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Elasticsearch Service | `aws_es` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ELB Service | `aws_elasticloadbalancing` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EMR Cluster | `aws_elasticmapreduce_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS EMR Security Configuration | `aws_emr_security_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EMR Serverless | `aws_emr_serverless` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EMR Serverless Application | `aws_emr_serverless_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS EMR Service | `aws_elasticmapreduce` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Firehose Delivery Stream | `aws_firehose_delivery_stream` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection), [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS Firehose Service | `aws_firehose` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Firewall Manager | `aws_fms` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS FSx | `aws_fsx` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Glacier Service | `aws_glacier` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Global Accelerator Accelerator | `aws_global_accelerator_accelerator` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Global Accelerator Endpoint Group | `aws_global_accelerator_endpoint_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Global Accelerator Listener | `aws_global_accelerator_listener` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Global Accelerator Service | `aws_global_accelerator` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Glue Catalog Database | `aws_glue_catalog_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| AWS Glue Connection | `aws_glue_connection` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Glue Data Catalog Encryption Settings | `aws_glue_data_catalog_encryption_settings` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| AWS Glue Dev Endpoint | `aws_glue_dev_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS Glue Job | `aws_glue_job` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Glue Security Configurations | `aws_glue_security_configuration` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| AWS Glue Service | `aws_glue` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Glue Session | `aws_glue_session` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Grafana Workspace | `aws_grafana_workspace` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Guardduty Service | `aws_guardduty` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Health Event | `aws_health_event` | Event |
| AWS Health Service | `aws_health` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS IAM Identity Center | `aws_sso` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS IAM Identity Center Application | `aws_sso_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS IAM Identity Center Group | `aws_sso_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| AWS IAM Identity Center Instance | `aws_sso_instance` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS IAM Identity Center Permission Set | `aws_sso_permission_set` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS IAM Identity Center User | `aws_sso_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS IAM Roles Anywhere Profile | `aws_iam_roles_anywhere_profile` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS IAM Roles Anywhere Service | `aws_iam_roles_anywhere` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS IAM Roles Anywhere Trust Anchor | `aws_iam_roles_anywhere_trust_anchor` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| AWS IAM Service | `aws_iam` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Image | `aws_ami` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource), [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| AWS Image Builder Component | `aws_imagebuilder_component` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| AWS Image Builder Container Recipe | `aws_imagebuilder_container_recipe` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Distribution Configuration | `aws_imagebuilder_distribution_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Image | `aws_imagebuilder_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| AWS Image Builder Image Pipeline | `aws_imagebuilder_image_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Image Builder Infrastructure Configuration | `aws_imagebuilder_infrastructure_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Lifecycle Policy | `aws_imagebuilder_lifecycle_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Workflow | `aws_imagebuilder_workflow` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Inspector Assessment | `aws_inspector_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| AWS Inspector Service | `aws_inspector` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Inspector v2 Service | `aws_inspectorv2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Instance | `aws_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Instance Application | `aws_instance_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Internet Gateway | `aws_internet_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Key Pair | `aws_key_pair` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| AWS Keyspaces Service | `aws_keyspaces` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Kinesis Consumer | `aws_kinesis_consumer` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Kinesis Service | `aws_kinesis` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Kinesis Stream | `aws_kinesis_stream` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection), [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS KMS Key | `aws_kms_key` | [CryptoKey](https://docs.jupiterone.io/data-model/schemas/CryptoKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| AWS KMS Service | `aws_kms` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Lambda Service | `aws_lambda` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Launch Template | `aws_launch_template` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Launch Template Version | `aws_launch_template_version` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| AWS Lex V2 Bot | `aws_lexv2_bot` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Lex V2 Bot Alias | `aws_lexv2_bot_alias` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Lex V2 Service | `aws_lexv2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS License Manager License | `aws_license_manager_license` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS License Manager Received License | `aws_license_manager_received_license` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS License Manager Service | `aws_license_manager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Macie Admin Account | `aws_macie_admin_account` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Macie Automated Discovery Account | `aws_macie_automated_discovery_account` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Macie Automated Discovery Configuration | `aws_macie_automated_discovery_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Macie Classification Export Configuration | `aws_macie_classification_export_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Macie Classification Job | `aws_macie_classification_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Macie Finding | `aws_macie_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| AWS Macie Finding Publication Configuration | `aws_macie_finding_publication_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Macie Organization Configuration | `aws_macie_organization_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Macie Service | `aws_macie` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Marketplace Entitlement | `aws_marketplace_entitlement` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS Marketplace Entity | `aws_marketplace_entity` | [Product](https://docs.jupiterone.io/data-model/schemas/Product) |
| AWS Marketplace Service | `aws_marketplace` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS MQ | `aws_mq` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS MQ Broker | `aws_mq_broker` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS MSK | `aws_msk` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS MSK Cluster | `aws_msk_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS MWAA Environment | `aws_mwaa_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS NAT Gateway | `aws_nat_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Neptune Service | `aws_neptune` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Network ACL | `aws_network_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Network Firewall Service | `aws_networkfirewall` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Network Interface | `aws_eni` | [NetworkInterface](https://docs.jupiterone.io/data-model/schemas/NetworkInterface) |
| AWS Network Manager | `aws_networkmanager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Nova Act Model | `aws_nova_act_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Nova Act Service | `aws_nova_act` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Nova Act Workflow Definition | `aws_nova_act_workflow_definition` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Nova Act Workflow Run | `aws_nova_act_workflow_run` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS OpenSearch Domain | `aws_opensearch_domain` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS OpenSearch Service | `aws_opensearch` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Organization | `aws_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| AWS Organization Root | `aws_organization_root` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Organizational Unit | `aws_organizational_unit` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Outpost | `aws_outposts_outpost` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS Outposts Asset | `aws_outposts_asset` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Outposts Service | `aws_outposts` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Outposts Site | `aws_outposts_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| AWS Prefix List | `aws_prefix_list` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Private Certificate Authority Service | `aws_acm_pca` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Prometheus Scraper | `aws_prometheus_scraper` | [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| AWS Prometheus Workspace | `aws_prometheus_workspace` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Quicksight Service | `aws_quicksight` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS RAM Principal | `aws_ram_principal` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AWS RAM Resource Share | `aws_ram_resource_share` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS RAM Resource Share Invitation | `aws_ram_resource_share_invitation` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS RAM Shared Resource | `aws_ram_shared_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS RDS Service | `aws_rds` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Redshift Serverless Service | `aws_redshift_serverless` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Redshift Service | `aws_redshift` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Resource Access Manager Service | `aws_ram_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Resource Explorer Service | `aws_resource_explorer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Restore Testing Plan | `aws_backup_restore_testing_plan` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Route Table | `aws_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Route53 Domain | `aws_route53_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| AWS Route53 Hosted Zone | `aws_route53_zone` | [DomainZone](https://docs.jupiterone.io/data-model/schemas/DomainZone) |
| AWS Route53 record | `aws_route53_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| AWS Route53 Resolver Rule | `aws_route53_resolver_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS Route53 Service | `aws_route53` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS S3 Access Point | `aws_s3_access_point` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS S3 Bucket | `aws_s3_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS S3 Bucket Lifecycle Rule | `aws_s3_bucket_lifecycle_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS S3 Bucket Policy | `aws_s3_bucket_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS S3 Service | `aws_s3` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS S3 Website Configuration | `aws_s3_website_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SageMaker | `aws_sagemaker` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SageMaker Domain | `aws_sagemaker_domain` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS SageMaker Endpoint | `aws_sagemaker_endpoint` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS SageMaker Feature Group | `aws_sagemaker_feature_group` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS SageMaker Inference Recommendations Job | `aws_sagemaker_inference_recommendations_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS SageMaker Model | `aws_sagemaker_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS SageMaker Model Bias Job Definition | `aws_sagemaker_model_bias_job_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SageMaker Model Quality Job Definition | `aws_sagemaker_model_quality_job_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SageMaker Notebook Instance | `aws_sagemaker_notebook_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS SageMaker Pipeline Execution | `aws_sagemaker_pipeline_execution` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS SageMaker Processing Job | `aws_sagemaker_processing_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS SageMaker Training Job | `aws_sagemaker_training_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS SageMaker Transform Job | `aws_sagemaker_transform_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Secrets Manager Service | `aws_secretsmanager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Security Agent Agent Space | `aws_security_agent_agent_space` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Security Agent Application | `aws_security_agent_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Security Agent Artifact | `aws_security_agent_artifact` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| AWS Security Agent Private Connection | `aws_security_agent_private_connection` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Security Agent Service | `aws_securityagent` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Security Agent Target Domain | `aws_security_agent_target_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| AWS Security Agent Threat Model | `aws_security_agent_threat_model` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| AWS Security Group | `aws_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Security Hub | `aws_securityhub` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Security Hub Control | `aws_securityhub_control` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| AWS Security Hub Standard | `aws_securityhub_standard` | [Standard](https://docs.jupiterone.io/data-model/schemas/Standard) |
| AWS Service Catalog | `aws_servicecatalog` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Service Catalog Constraint | `aws_servicecatalog_constraint` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| AWS Service Catalog Launch Path | `aws_servicecatalog_launch_path` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Portfolio | `aws_servicecatalog_portfolio` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Product | `aws_servicecatalog_product` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Provisioning Artifact | `aws_servicecatalog_provisioning_artifact` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Tag Option | `aws_servicecatalog_tag_option` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SES Configuration Set | `aws_ses_configuration_set` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SES Identity | `aws_ses_identity` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS SES Receipt Filter | `aws_ses_receipt_filter` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS SES Service | `aws_ses` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Shield Protection | `aws_shield_protection` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Shield Protection Group | `aws_shield_protection_group` | ResourceGroup |
| AWS Shield Service | `aws_shield` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Shield Subscription | `aws_shield_subscription` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS Signer Service | `aws_signer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Signer Signing Job | `aws_signer_signing_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Signer Signing Profile | `aws_signer_signing_profile` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Snapshot | `aws_ebs_snapshot` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS SNS Service | `aws_sns` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SNS Subscription | `aws_sns_subscription` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS SNS Topic | `aws_sns_topic` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| AWS SQS Service | `aws_sqs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SSM Associations | `aws_ssm_associations` | [Document](https://docs.jupiterone.io/data-model/schemas/Document) |
| AWS SSM Compliance Summary | `aws_ssm_compliance_summary` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| AWS SSM Document | `aws_ssm_document` | [Document](https://docs.jupiterone.io/data-model/schemas/Document) |
| AWS SSM Instance Inventory | `aws_instance_inventory` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SSM Instance Patch State | `aws_instance_patch_state` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| AWS SSM Patch Baseline | `aws_patch_baseline` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SSM Patch Group | `aws_patch_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS SSM Secure String Parameter Metadata | `aws_secure_string_parameter` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| AWS SSM Service | `aws_ssm` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SSM Service Setting | `aws_ssm_service_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SSM Session Document | `aws_session_document` | [Document](https://docs.jupiterone.io/data-model/schemas/Document) |
| AWS States Service | `aws_states` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS States State Machine | `aws_states_state_machine` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS Storage Gateway | `aws_storage_gateway_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Storage Gateway File Share | `aws_storage_gateway_file_share` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Storage Gateway Service | `aws_storage_gateway` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Storage Gateway Tape | `aws_storage_gateway_tape` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Storage Gateway Tape Pool | `aws_storage_gateway_tape_pool` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Storage Gateway Volume | `aws_storage_gateway_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| AWS Subnet | `aws_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Transfer Server | `aws_transfer_server` | [Host](https://docs.jupiterone.io/data-model/schemas/Host), [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Transfer Service | `aws_transfer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Transfer User | `aws_transfer_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS Volume | `aws_ebs_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| AWS VPC | `aws_vpc` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC Endpoint | `aws_vpc_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS VPC Endpoint Service | `aws_vpc_endpoint_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS VPC Lattice | `aws_vpc_lattice` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS VPC Lattice Listener | `aws_vpc_lattice_listener` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS VPC Lattice Listener Rule | `aws_vpc_lattice_listener_rule` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS VPC Lattice Service | `aws_vpc_lattice_service` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| AWS VPC Lattice Service Network | `aws_vpc_lattice_service_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC Lattice Target Group | `aws_vpc_lattice_target_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS VPC Service | `aws_ec2_vpc` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS VPN Connection | `aws_vpn_connection` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS VPN Gateway | `aws_vpn_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS WAF Classic Service | `aws_waf` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS WAF v2 IP Set | `aws_waf_v2_ip_set` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS WAF v2 Rule Group | `aws_waf_v2_rule_group` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| AWS WAF v2 Service | `aws_wafv2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS WAF v2 Web ACL | `aws_waf_v2_web_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS WAF v2 Web ACL Firewall Manager Rule Group | `aws_waf_v2_web_acl_firewall_manager_rule_group` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS WAF v2 Web ACL Rule | `aws_waf_v2_web_acl_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS WAF Web ACL | `aws_waf_web_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS WorkSpaces Bundle | `aws_workspaces_bundle` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS WorkSpaces Service | `aws_workspaces` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS WorkSpaces Workspace | `aws_workspace` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS X-Ray Service | `aws_xray` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Batch Job | `aws_batch_job` | [Process](https://docs.jupiterone.io/data-model/schemas/Process), [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Cloudhsm Backup | `aws_cloudhsm_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup), [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| Cloudhsm Cluster | `aws_cloudhsm_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster), [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| Cloudhsm Instance | `aws_cloudhsm_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host), [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| Cloudwatch Events Rule | `aws_cloudwatch_event_rule` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Cloudwatch Logs Destination | `aws_cloudwatch_log_destination` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| Cloudwatch Logs Log Group | `aws_cloudwatch_log_group` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| CloudWatch Logs Metric Filter | `aws_cloudwatch_log_metric_filter` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Cloudwatch Logs Subscription Filter | `aws_cloudwatch_log_subscription_filter` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| CodeArtifact Domain | `aws_codeartifact_domain` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| CodeArtifact Package | `aws_codeartifact_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| CodeArtifact Package Group | `aws_codeartifact_package_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| CodeArtifact Repository | `aws_codeartifact_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| CodeBuild Project | `aws_codebuild_project` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeBuild Report Group | `aws_codebuild_report_group` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| CodeCommit Repository | `aws_codecommit_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| CodeDeploy Application | `aws_codedeploy_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| CodeDeploy Deployment Config | `aws_codedeploy_deployment_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeDeploy Deployment Group | `aws_codedeploy_deployment_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeGuru Profiling Group | `aws_codeguru_profiling_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeGuru Reviewer Repository Association | `aws_codeguru_reviewer_repository_association` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodePipeline Pipeline | `aws_codepipeline_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| Cognito User Pool | `aws_cognito_user_pool` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Configservice Rule | `aws_config_rule` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Configservice Service | `aws_config` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Detective Graph | `aws_detective_graph` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Detective Investigation | `aws_detective_investigation` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DevOps Guru Anomaly | `aws_devops_guru_anomaly` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DevOps Guru Insight | `aws_devops_guru_insight` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DevOps Guru Notification Channel | `aws_devops_guru_notification_channel` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| DynamoDB Accelerator (DAX) Cluster | `aws_dax_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| DynamoDB Accelerator (DAX) Service | `aws_dax` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| DynamoDB Global Table | `aws_dynamodb_global_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| DynamoDB Table | `aws_dynamodb_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| ECR Image | `aws_ecr_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| ECR Image Finding | `aws_ecr_image_scan_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| ECR Repository | `aws_ecr_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| ECS Cluster | `aws_ecs_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| ECS Cluster Service | `aws_ecs_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| ECS Container Instance | `aws_ecs_container_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host), [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| ECS Task | `aws_ecs_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task), [Process](https://docs.jupiterone.io/data-model/schemas/Process) |
| ECS Task Container Definition | `aws_ecs_task_container_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ECS Task Definition | `aws_ecs_task_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| EFS File System | `aws_efs_file_system` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| EFS Mount Target | `aws_efs_mount_target` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| EKS Clusters | `aws_eks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| EKS Node Group | `aws_eks_node_group` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Elasticache Cluster | `aws_elasticache_memcached_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Elasticache Node | `aws_elasticache_cluster_node` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Elasticache Redis Cluster | `aws_elasticache_redis_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Elasticache Snapshot | `aws_elasticache_snapshot` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Elasticsearch Domain | `aws_elasticsearch_domain` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| ELB Application Load Balancer | `aws_alb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ELB Gateway Load Balancer | `aws_elb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ELB Listener | `aws_lb_listener` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| ELB Listener Rule | `aws_lb_listener_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| ELB Network Load Balancer | `aws_nlb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ELB Target Group | `aws_lb_target_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| EventBridge API Destination | `aws_eventbridge_api_destination` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| EventBridge Archive | `aws_eventbridge_archive` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| EventBridge Connection | `aws_eventbridge_connection` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| EventBridge Event Bus | `aws_eventbridge_event_bus` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| EventBridge Global Endpoint | `aws_eventbridge_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Firewall | `aws_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Firewall Policy | `aws_firewall_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Firewall Rule Group | `aws_firewall_rule_group` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| FMS Application List | `aws_fms_application_list` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| FMS Policy | `aws_fms_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| FMS Protocols List | `aws_fms_protocols_list` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| FMS Resource Set | `aws_fms_resource_set` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| FSx File System | `aws_fsx_file_system` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Glacier Vault | `aws_glacier_vault` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Guardduty Detector | `aws_guardduty_detector` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment), [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| Guardduty Finding | `aws_guardduty_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| GuardDuty Publishing Destination | `aws_guardduty_publishing_destination` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| IAM Access Key | `aws_iam_access_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM Account Password Policy | `aws_iam_account_password_policy` | [PasswordPolicy](https://docs.jupiterone.io/data-model/schemas/PasswordPolicy) |
| IAM Group | `aws_iam_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| IAM Group Policy | `aws_iam_group_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| IAM Instance Profile | `aws_iam_instance_profile` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM MFA Device | `mfa_device` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| IAM OIDC Provider | `aws_iam_oidc_provider` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| IAM Policy | `aws_iam_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| IAM Role | `aws_iam_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM Role Policy | `aws_iam_role_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| IAM SAML Provider | `aws_iam_saml_provider` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| IAM Server Certificate | `aws_iam_server_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM User | `aws_iam_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| IAM User Policy | `aws_iam_user_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Inspector Finding | `aws_inspector_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Inspector Finding | `aws_inspector_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Inspector v2 CIS Finding | `aws_inspectorv2_cis_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Inspector v2 CIS Scan | `aws_inspectorv2_cis_scan` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Inspector v2 Configuration | `aws_inspectorv2_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Inspector v2 Filter | `aws_inspectorv2_filter` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Inspector v2 Finding | `aws_inspectorv2_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Inspector v2 Finding | `aws_inspectorv2_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Lambda Functions | `aws_lambda_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| Managed Workflows for Apache Airflow | `aws_mwaa` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Neptune Analytics Graph | `aws_neptune_analytics_graph` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Neptune Analytics Graph Export Task | `aws_neptune_analytics_graph_export_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Neptune Analytics Graph Import Task | `aws_neptune_analytics_graph_import_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Neptune Analytics Graph Snapshot | `aws_neptune_analytics_graph_snapshot` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Neptune Database Cluster | `aws_neptune_database_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Neptune Database Instance | `aws_neptune_database_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Organization Policy | `aws_organization_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Organization Tag Policy | `aws_organization_tag_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Private Certificate Authority | `aws_acm_pca_certificate_authority` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Quicksight Custom Permissions | `aws_quicksight_custom_permissions` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Quicksight Dashboard | `aws_quicksight_dashboard` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Quicksight Data Set | `aws_quicksight_data_set` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Quicksight Data Source | `aws_quicksight_data_source` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Quicksight Group | `aws_quicksight_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Quicksight User | `aws_quicksight_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Quicksight VPC Connection | `aws_quicksight_vpc_connection` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS Cluster | `aws_rds_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| RDS DB Cluster Parameter Group | `aws_rds_cluster_parameter_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Cluster Snapshots | `aws_db_cluster_snapshot` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| RDS DB Instance | `aws_db_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| RDS DB Option Group | `aws_db_option_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Parameter Group | `aws_db_parameter_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Proxy | `aws_db_proxy` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| RDS DB Proxy Target | `aws_db_proxy_target` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Proxy Target Group | `aws_db_proxy_target_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Snapshots | `aws_db_snapshot` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| RDS DB Subnet Group | `aws_db_subnet_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Redshift Cluster | `aws_redshift_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Redshift Cluster Parameter Group | `aws_redshift_cluster_parameter_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Redshift Datashare | `aws_redshift_datashare` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Redshift Datashare Authorization | `aws_redshift_datashare_authorization` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Redshift Serverless Endpoint Access | `aws_redshift_serverless_endpoint_access` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| Redshift Serverless Namespace | `aws_redshift_serverless_namespace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Redshift Serverless Recovery Point | `aws_redshift_serverless_recovery_point` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Redshift Serverless Snapshot | `aws_redshift_serverless_snapshot` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Redshift Serverless Usage Limit | `aws_redshift_serverless_usage_limit` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Redshift Serverless Workgroup | `aws_redshift_serverless_workgroup` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Resource Explorer Index | `aws_resource_explorer_index` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Resource Explorer View | `aws_resource_explorer_view` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Secret | `aws_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Secret Version | `aws_secret_version` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Security Hub Account | `aws_securityhub_account` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Security Hub Finding | `aws_securityhub_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Security Hub Finding | `aws_securityhub_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| SQS Queue | `aws_sqs_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| X-Ray Encryption Config | `aws_xray_encryption_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| X-Ray Group | `aws_xray_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| X-Ray Resource Policy | `aws_xray_resource_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `aws_accessanalyzer` | **HAS** | `aws_accessanalyzer_analyzer` |
| `aws_accessanalyzer_analyzer` | **IDENTIFIED** | `aws_accessanalyzer_finding` |
| `aws_accessanalyzer_finding` | **IDENTIFIED** | `aws_resource` |
| `aws_account` | **HAS** | `aws_accessanalyzer` |
| `aws_account` | **HAS** | `aws_acm` |
| `aws_account` | **HAS** | `aws_acm_pca` |
| `aws_account` | **HAS** | `aws_autoscalingplans` |
| `aws_account` | **HAS** | `aws_ec2_vpc` |
| `aws_account` | **HAS** | `aws_apigateway` |
| `aws_account` | **HAS** | `aws_appconfig` |
| `aws_account` | **HAS** | `aws_athena` |
| `aws_account` | **HAS** | `aws_auditmanager` |
| `aws_account` | **HAS** | `aws_autoscaling` |
| `aws_account` | **HAS** | `aws_backup` |
| `aws_account` | **HAS** | `aws_batch` |
| `aws_account` | **HAS** | `aws_bedrock` |
| `aws_account` | **HAS** | `aws_cloudformation` |
| `aws_account` | **HAS** | `aws_cloudfront` |
| `aws_account` | **HAS** | `aws_cloudhsm` |
| `aws_account` | **HAS** | `aws_cloudtrail` |
| `aws_account` | **HAS** | `aws_cloudmap` |
| `aws_account` | **HAS** | `aws_cloudwatch_events` |
| `aws_account` | **HAS** | `aws_cloudwatch_logs` |
| `aws_account` | **HAS** | `aws_cloudwatch` |
| `aws_account` | **HAS** | `aws_cognito_idp` |
| `aws_account` | **HAS** | `aws_cognito_identity` |
| `aws_account` | **HAS** | `aws_codeartifact` |
| `aws_account` | **HAS** | `aws_codebuild` |
| `aws_account` | **HAS** | `aws_codedeploy` |
| `aws_account` | **HAS** | `aws_codeguru` |
| `aws_account` | **HAS** | `aws_codecommit` |
| `aws_account` | **HAS** | `aws_codepipeline` |
| `aws_account` | **HAS** | `aws_config` |
| `aws_account` | **HAS** | `aws_datasync` |
| `aws_account` | **HAS** | `aws_detective` |
| `aws_account` | **HAS** | `aws_devops_guru` |
| `aws_account` | **HAS** | `aws_directconnect` |
| `aws_account` | **HAS** | `aws_dms` |
| `aws_account` | **HAS** | `aws_ds` |
| `aws_account` | **HAS** | `aws_dynamodb` |
| `aws_account` | **HAS** | `aws_dax` |
| `aws_account` | **HAS** | `aws_keyspaces` |
| `aws_account` | **HAS** | `aws_securityagent` |
| `aws_account` | **HAS** | `aws_ec2` |
| `aws_account` | **HAS** | `aws_ecr` |
| `aws_account` | **HAS** | `aws_ecs` |
| `aws_account` | **HAS** | `aws_efs` |
| `aws_account` | **HAS** | `aws_eks` |
| `aws_account` | **HAS** | `aws_elasticache` |
| `aws_account` | **HAS** | `aws_elasticloadbalancing` |
| `aws_account` | **HAS** | `aws_elasticmapreduce` |
| `aws_account` | **HAS** | `aws_emr_serverless` |
| `aws_account` | **HAS** | `aws_es` |
| `aws_account` | **HAS** | `aws_firehose` |
| `aws_account` | **HAS** | `aws_fms` |
| `aws_account` | **HAS** | `aws_glacier` |
| `aws_account` | **HAS** | `aws_global_accelerator` |
| `aws_account` | **HAS** | `aws_glue` |
| `aws_account` | **HAS** | `aws_grafana` |
| `aws_account` | **HAS** | `aws_guardduty` |
| `aws_account` | **HAS** | `aws_health` |
| `aws_account` | **HAS** | `aws_health_event` |
| `aws_account` | **HAS** | `aws_iam` |
| `aws_account` | **HAS** | `aws_iam_roles_anywhere` |
| `aws_account` | **HAS** | `aws_imagebuilder` |
| `aws_account` | **HAS** | `aws_inspector` |
| `aws_account` | **HAS** | `aws_inspectorv2` |
| `aws_account` | **HAS** | `aws_kinesis` |
| `aws_account` | **HAS** | `aws_kms` |
| `aws_account` | **HAS** | `aws_lambda` |
| `aws_account` | **HAS** | `aws_license_manager` |
| `aws_account` | **HAS** | `aws_lexv2` |
| `aws_account` | **HAS** | `aws_macie` |
| `aws_account` | **HAS** | `aws_marketplace` |
| `aws_account` | **OWNS** | `aws_marketplace_entity` |
| `aws_account` | **HAS** | `aws_mwaa` |
| `aws_account` | **HAS** | `aws_mq` |
| `aws_account` | **HAS** | `aws_msk` |
| `aws_account` | **HAS** | `aws_neptune` |
| `aws_account` | **HAS** | `aws_networkfirewall` |
| `aws_account` | **HAS** | `aws_networkmanager` |
| `aws_account` | **HAS** | `aws_nova_act` |
| `aws_account` | **HAS** | `aws_prometheus` |
| `aws_account` | **HAS** | `aws_quicksight` |
| `aws_account` | **HAS** | `aws_resource_explorer` |
| `aws_account` | **HAS** | `aws_ram_service` |
| `aws_account` | **HAS** | `aws_rds` |
| `aws_account` | **HAS** | `aws_db_instance` |
| `aws_account` | **HAS** | `aws_redshift_serverless` |
| `aws_account` | **HAS** | `aws_redshift` |
| `aws_account` | **HAS** | `aws_route53` |
| `aws_account` | **HAS** | `aws_s3` |
| `aws_account` | **HAS** | `aws_sagemaker` |
| `aws_account` | **HAS** | `aws_secretsmanager` |
| `aws_account` | **HAS** | `aws_securityhub` |
| `aws_account` | **HAS** | `aws_servicecatalog` |
| `aws_account` | **HAS** | `aws_ses` |
| `aws_account` | **HAS** | `aws_shield` |
| `aws_account` | **HAS** | `aws_signer` |
| `aws_account` | **HAS** | `aws_sns` |
| `aws_account` | **HAS** | `aws_sqs` |
| `aws_account` | **HAS** | `aws_states` |
| `aws_account` | **HAS** | `aws_ssm` |
| `aws_account` | **HAS** | `aws_sso` |
| `aws_account` | **OWNS** | `aws_sso_instance` |
| `aws_account` | **HAS** | `aws_transfer` |
| `aws_account` | **HAS** | `aws_waf` |
| `aws_account` | **HAS** | `aws_wafv2` |
| `aws_account` | **HAS** | `aws_workspaces` |
| `aws_account` | **HAS** | `aws_vpc_lattice` |
| `aws_account` | **HAS** | `aws_fsx` |
| `aws_account` | **HAS** | `aws_opensearch` |
| `aws_account` | **HAS** | `aws_outposts` |
| `aws_account` | **HAS** | `aws_storage_gateway` |
| `aws_account` | **HAS** | `aws_xray` |
| `aws_acm` | **HAS** | `aws_acm_certificate` |
| `aws_acm_certificate` | **PROTECTS** | `aws_cognito_user_pool` |
| `aws_acm_pca` | **HAS** | `aws_acm_pca_certificate_authority` |
| `aws_alb` | **USES** | `aws_eni` |
| `aws_alb` | **HAS** | `aws_security_group` |
| `aws_alb` | **HAS** | `aws_lb_listener` |
| `aws_alb` | **CONNECTS** | `aws_lb_target_group` |
| `aws_ami` | **CONTAINS** | `aws_ebs_snapshot` |
| `aws_api_gateway_domain_name` | **HAS** | `aws_acm_certificate` |
| `aws_api_gateway_resource` | **HAS** | `aws_api_gateway_method` |
| `aws_api_gateway_rest_api` | **TRIGGERS** | `aws_lambda_function` |
| `aws_api_gateway_rest_api` | **HAS** | `aws_api_gateway_resource` |
| `aws_api_gateway_rest_api` | **HAS** | `aws_api_gateway_stage` |
| `aws_api_gateway_rest_api` | **USES** | `aws_api_gateway_domain_name` |
| `aws_api_gateway_stage` | **DEFINES** | `aws_api_gateway_stage_method_setting` |
| `aws_api_gateway_stage` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_api_gateway_v2_api` | **HAS** | `aws_api_gateway_v2_route` |
| `aws_api_gateway_v2_api` | **HAS** | `aws_api_gateway_v2_stage` |
| `aws_api_gateway_v2_api` | **USES** | `aws_api_gateway_domain_name` |
| `aws_api_gateway_v2_authorizer` | **CONNECTS** | `aws_lambda_function` |
| `aws_api_gateway_v2_integration` | **CONNECTS** | `aws_lambda_function` |
| `aws_api_gateway_v2_route` | **HAS** | `aws_api_gateway_v2_authorizer` |
| `aws_api_gateway_v2_route` | **HAS** | `aws_api_gateway_v2_integration` |
| `aws_api_gateway_v2_stage` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_apigateway` | **HAS** | `aws_api_gateway_rest_api` |
| `aws_apigateway` | **HAS** | `aws_api_gateway_domain_name` |
| `aws_apigateway` | **HAS** | `aws_api_gateway_v2_api` |
| `aws_appconfig` | **HAS** | `aws_appconfig_account_settings` |
| `aws_appconfig` | **HAS** | `aws_appconfig_application` |
| `aws_appconfig` | **HAS** | `aws_appconfig_deployment_strategy` |
| `aws_appconfig` | **CONNECTS** | `aws_vpc_endpoint` |
| `aws_appconfig_application` | **HAS** | `aws_appconfig_environment` |
| `aws_appconfig_application` | **HAS** | `aws_appconfig_configuration_profile` |
| `aws_appconfig_application` | **HAS** | `aws_appconfig_deployment` |
| `aws_appconfig_configuration_profile` | **HAS** | `aws_appconfig_hosted_configuration_version` |
| `aws_appconfig_configuration_profile` | **USES** | `aws_kms_key` |
| `aws_appconfig_configuration_profile` | **USES** | `aws_iam_role` |
| `aws_appconfig_deployment` | **USES** | `aws_kms_key` |
| `aws_appconfig_environment` | **USES** | `aws_cloudwatch_metric_alarm` |
| `aws_appconfig_environment` | **USES** | `aws_iam_role` |
| `aws_appconfig_hosted_configuration_version` | **USES** | `aws_kms_key` |
| `aws_athena` | **HAS** | `aws_athena_work_group` |
| `aws_athena_work_group` | **USES** | `aws_iam_role` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_framework` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_assessment` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_control` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_setting` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_delegation` |
| `aws_auditmanager_assessment` | **USES** | `aws_auditmanager_framework` |
| `aws_auditmanager_assessment` | **HAS** | `aws_auditmanager_evidence_folder` |
| `aws_auditmanager_delegation` | **ASSIGNED** | `aws_iam_role` |
| `aws_auditmanager_delegation` | **HAS** | `aws_auditmanager_assessment` |
| `aws_auditmanager_framework` | **HAS** | `aws_auditmanager_control` |
| `aws_auditmanager_setting` | **USES** | `aws_kms_key` |
| `aws_auditmanager_setting` | **USES** | `aws_sns_topic` |
| `aws_auditmanager_setting` | **ASSIGNED** | `aws_iam_role` |
| `aws_auditmanager_setting` | **USES** | `aws_s3_bucket` |
| `aws_autoscaling` | **HAS** | `aws_autoscaling_group` |
| `aws_autoscaling` | **HAS** | `aws_autoscaling_launch_configuration` |
| `aws_autoscaling_group` | **USES** | `aws_autoscaling_launch_configuration` |
| `aws_autoscaling_group` | **USES** | `aws_launch_template` |
| `aws_autoscaling_group` | **HAS** | `aws_instance` |
| `aws_autoscaling_group` | **USES** | `aws_autoscaling_policy` |
| `aws_autoscaling_launch_configuration` | **USES** | `aws_ami` |
| `aws_backup` | **HAS** | `aws_backup_vault` |
| `aws_backup` | **HAS** | `aws_backup_plan` |
| `aws_backup` | **HAS** | `aws_backup_restore_testing_plan` |
| `aws_backup_copy_job` | **CREATED** | `aws_backup_recovery_point` |
| `aws_backup_copy_job` | **USES** | `aws_backup_recovery_point` |
| `aws_backup_plan` | **HAS** | `aws_backup_job` |
| `aws_backup_plan` | **HAS** | `aws_backup_copy_job` |
| `aws_backup_recovery_point` | **PROTECTS** | `aws_resource` |
| `aws_backup_restore_job` | **HAS** | `aws_instance` |
| `aws_backup_restore_job` | **HAS** | `aws_db_instance` |
| `aws_backup_restore_testing_plan` | **HAS** | `aws_backup_restore_job` |
| `aws_backup_vault` | **HAS** | `aws_backup_recovery_point` |
| `aws_batch` | **HAS** | `aws_batch_job_definition` |
| `aws_batch` | **HAS** | `aws_batch_job_queue` |
| `aws_batch_compute_environment` | **USES** | `aws_iam_role` |
| `aws_batch_compute_environment` | **USES** | `aws_ecs_cluster` |
| `aws_batch_compute_environment` | **HAS** | `aws_security_group` |
| `aws_batch_job_queue` | **HAS** | `aws_batch_job` |
| `aws_bedrock` | **HAS** | `aws_bedrock_evaluation_job` |
| `aws_bedrock` | **HAS** | `aws_bedrock_model_customization_job` |
| `aws_bedrock` | **HAS** | `aws_bedrock_code_interpreter` |
| `aws_bedrock` | **HAS** | `aws_bedrock_foundation_model` |
| `aws_bedrock` | **HAS** | `aws_bedrock_guardrail` |
| `aws_bedrock` | **HAS** | `aws_bedrock_model_invocation_logging` |
| `aws_bedrock` | **HAS** | `aws_bedrock_agent` |
| `aws_bedrock` | **HAS** | `aws_bedrock_knowledge_base` |
| `aws_bedrock` | **HAS** | `aws_bedrock_custom_model` |
| `aws_bedrock` | **HAS** | `aws_bedrock_imported_model` |
| `aws_bedrock` | **HAS** | `aws_bedrock_model_invocation_job` |
| `aws_bedrock` | **HAS** | `aws_bedrock_provisioned_throughput` |
| `aws_bedrock` | **HAS** | `aws_bedrock_flow` |
| `aws_bedrock` | **HAS** | `aws_bedrock_inference_profile` |
| `aws_bedrock` | **HAS** | `aws_bedrock_agent_runtime` |
| `aws_bedrock` | **HAS** | `aws_bedrock_api_key` |
| `aws_bedrock` | **USES** | `aws_vpc_endpoint` |
| `aws_bedrock` | **HAS** | `aws_bedrock_memory` |
| `aws_bedrock` | **HAS** | `aws_bedrock_gateway` |
| `aws_bedrock` | **HAS** | `aws_bedrock_api_key_credential_provider` |
| `aws_bedrock` | **HAS** | `aws_bedrock_browser` |
| `aws_bedrock` | **HAS** | `aws_bedrock_evaluator` |
| `aws_bedrock` | **HAS** | `aws_bedrock_policy_engine` |
| `aws_bedrock` | **HAS** | `aws_bedrock_browser_profile` |
| `aws_bedrock_agent` | **HAS** | `aws_bedrock_agent_action_group` |
| `aws_bedrock_agent` | **USES** | `aws_iam_role` |
| `aws_bedrock_agent` | **USES** | `aws_kms_key` |
| `aws_bedrock_agent` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_agent` | **USES** | `aws_iam_policy` |
| `aws_bedrock_agent_action_group` | **USES** | `aws_lambda_function` |
| `aws_bedrock_agent_runtime` | **USES** | `aws_iam_role` |
| `aws_bedrock_agent_runtime` | **USES** | `aws_security_group` |
| `aws_bedrock_agent_runtime` | **USES** | `aws_subnet` |
| `aws_bedrock_agent_runtime` | **USES** | `aws_iam_policy` |
| `aws_bedrock_browser` | **USES** | `aws_iam_policy` |
| `aws_bedrock_browser` | **USES** | `aws_iam_role` |
| `aws_bedrock_browser` | **USES** | `aws_security_group` |
| `aws_bedrock_browser` | **USES** | `aws_subnet` |
| `aws_bedrock_browser` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_code_interpreter` | **USES** | `aws_iam_role` |
| `aws_bedrock_code_interpreter` | **USES** | `aws_security_group` |
| `aws_bedrock_code_interpreter` | **USES** | `aws_subnet` |
| `aws_bedrock_code_interpreter` | **USES** | `aws_iam_policy` |
| `aws_bedrock_custom_model` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_custom_model` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_custom_model` | **USES** | `aws_kms_key` |
| `aws_bedrock_evaluation_job` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_flow` | **USES** | `aws_iam_role` |
| `aws_bedrock_flow` | **USES** | `aws_kms_key` |
| `aws_bedrock_flow` | **USES** | `aws_iam_policy` |
| `aws_bedrock_gateway` | **USES** | `aws_iam_policy` |
| `aws_bedrock_gateway` | **USES** | `aws_iam_role` |
| `aws_bedrock_gateway` | **USES** | `aws_kms_key` |
| `aws_bedrock_gateway` | **HAS** | `aws_bedrock_gateway_target` |
| `aws_bedrock_gateway_target` | **USES** | `aws_bedrock_api_key_credential_provider` |
| `aws_bedrock_guardrail` | **USES** | `aws_kms_key` |
| `aws_bedrock_guardrail` | **PROTECTS** | `aws_bedrock_agent` |
| `aws_bedrock_imported_model` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_imported_model` | **USES** | `aws_kms_key` |
| `aws_bedrock_knowledge_base` | **HAS** | `aws_bedrock_knowledge_base_data_source` |
| `aws_bedrock_knowledge_base` | **USES** | `aws_iam_role` |
| `aws_bedrock_knowledge_base` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_knowledge_base` | **USES** | `aws_opensearch_domain` |
| `aws_bedrock_knowledge_base` | **USES** | `aws_iam_policy` |
| `aws_bedrock_knowledge_base_data_source` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_memory` | **USES** | `aws_iam_policy` |
| `aws_bedrock_memory` | **USES** | `aws_iam_role` |
| `aws_bedrock_memory` | **USES** | `aws_kms_key` |
| `aws_bedrock_model_customization_job` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_model_customization_job` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_model_invocation_job` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_model_invocation_job` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_model_invocation_job` | **USES** | `aws_iam_role` |
| `aws_bedrock_model_invocation_job` | **USES** | `aws_kms_key` |
| `aws_bedrock_model_invocation_job` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_model_invocation_job` | **USES** | `aws_bedrock_custom_model` |
| `aws_bedrock_model_invocation_logging` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_model_invocation_logging` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_bedrock_provisioned_throughput` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_provisioned_throughput` | **USES** | `aws_bedrock_custom_model` |
| `aws_cloudformation` | **HAS** | `aws_cloudformation_stack` |
| `aws_cloudfront` | **HAS** | `aws_cloudfront_distribution` |
| `aws_cloudfront` | **HAS** | `aws_cloudfront_key_group` |
| `aws_cloudfront` | **HAS** | `aws_cloudfront_public_key` |
| `aws_cloudfront_distribution` | **HAS** | `aws_cloudfront_distribution_origin` |
| `aws_cloudfront_distribution` | **TRIGGERS** | `aws_lambda_function` |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_api_gateway_rest_api` |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_elb` |
| `aws_cloudfront_key_group` | **HAS** | `aws_cloudfront_public_key` |
| `aws_cloudhsm` | **HAS** | `aws_cloudhsm_cluster` |
| `aws_cloudhsm_cluster` | **HAS** | `aws_cloudhsm_instance` |
| `aws_cloudhsm_cluster` | **HAS** | `aws_security_group` |
| `aws_cloudhsm_cluster` | **HAS** | `aws_cloudhsm_backup` |
| `aws_cloudhsm_instance` | **HAS** | `aws_security_group` |
| `aws_cloudmap` | **HAS** | `aws_cloudmap_namespace` |
| `aws_cloudmap_namespace` | **HAS** | `aws_cloudmap_service` |
| `aws_cloudmap_service` | **HAS** | `aws_cloudmap_service_instance` |
| `aws_cloudtrail` | **HAS** | `aws_cloudtrail_trail` |
| `aws_cloudtrail` | **LOGS** | `aws_resource_explorer` |
| `aws_cloudwatch` | **HAS** | `aws_cloudwatch_metric_alarm` |
| `aws_cloudwatch_events` | **HAS** | `aws_cloudwatch_event_rule` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_event_bus` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_archive` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_connection` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_api_destination` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_endpoint` |
| `aws_cloudwatch_log_group` | **USES** | `aws_kms_key` |
| `aws_cloudwatch_log_group` | **HAS** | `aws_cloudwatch_log_metric_filter` |
| `aws_cloudwatch_log_group` | **HAS** | `aws_cloudwatch_log_group_metrics` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_group` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_destination` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_subscription_filter` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_metric_filter` |
| `aws_cloudwatch_metric_alarm` | **TRIGGERS** | `aws_resource` |
| `aws_codeartifact` | **HAS** | `aws_codeartifact_domain` |
| `aws_codeartifact` | **USES** | `aws_vpc_endpoint` |
| `aws_codeartifact_domain` | **HAS** | `aws_codeartifact_repository` |
| `aws_codeartifact_domain` | **HAS** | `aws_codeartifact_package_group` |
| `aws_codeartifact_domain` | **USES** | `aws_kms_key` |
| `aws_codeartifact_package_group` | **HAS** | `aws_codeartifact_package_group` |
| `aws_codeartifact_repository` | **CONTAINS** | `aws_codeartifact_package` |
| `aws_codebuild` | **HAS** | `aws_codebuild_project` |
| `aws_codebuild` | **HAS** | `aws_codebuild_report_group` |
| `aws_codecommit` | **HAS** | `aws_codecommit_repository` |
| `aws_codedeploy` | **HAS** | `aws_codedeploy_application` |
| `aws_codedeploy` | **HAS** | `aws_codedeploy_deployment_config` |
| `aws_codedeploy_application` | **HAS** | `aws_codedeploy_deployment_group` |
| `aws_codedeploy_deployment_group` | **USES** | `aws_codedeploy_deployment_config` |
| `aws_codedeploy_deployment_group` | **USES** | `aws_iam_role` |
| `aws_codeguru` | **HAS** | `aws_codeguru_profiling_group` |
| `aws_codeguru` | **HAS** | `aws_codeguru_reviewer_repository_association` |
| `aws_codeguru_reviewer_repository_association` | **USES** | `aws_kms_key` |
| `aws_codepipeline` | **HAS** | `aws_codepipeline_pipeline` |
| `aws_cognito_identity` | **HAS** | `aws_cognito_identity_pool` |
| `aws_cognito_idp` | **HAS** | `aws_cognito_user_pool` |
| `aws_cognito_user_pool` | **HAS** | `aws_cognito_user_pool_client` |
| `aws_cognito_user_pool` | **HAS** | `aws_cognito_user_pool_user` |
| `aws_config` | **HAS** | `aws_config_rule` |
| `aws_config_rule` | **EVALUATES** | `aws_resource` |
| `aws_config_rule` | **IDENTIFIED** | `aws_config_rule_finding` |
| `aws_datasync` | **HAS** | `aws_datasync_task` |
| `aws_datasync` | **HAS** | `aws_datasync_location` |
| `aws_datasync_location` | **CONNECTS** | `aws_s3_bucket` |
| `aws_datasync_location` | **CONNECTS** | `aws_efs_file_system` |
| `aws_datasync_location` | **CONNECTS** | `aws_fsx_file_system` |
| `aws_datasync_task` | **USES** | `aws_datasync_location` |
| `aws_datasync_task` | **USES** | `aws_cloudwatch_log_group` |
| `aws_dax` | **HAS** | `aws_dax_cluster` |
| `aws_db_cluster_snapshot` | **USES** | `aws_kms_key` |
| `aws_db_instance` | **USES** | `aws_db_parameter_group` |
| `aws_db_instance` | **HAS** | `aws_security_group` |
| `aws_db_instance` | **USES** | `aws_kms_key` |
| `aws_db_instance` | **USES** | `aws_secret` |
| `aws_db_instance` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_db_instance` | **HAS** | `aws_db_snapshot` |
| `aws_db_instance` | **USES** | `aws_db_option_group` |
| `aws_db_instance` | **USES** | `aws_db_subnet_group` |
| `aws_db_proxy` | **USES** | `aws_subnet` |
| `aws_db_proxy` | **USES** | `aws_secret` |
| `aws_db_proxy` | **USES** | `aws_iam_role` |
| `aws_db_proxy` | **USES** | `aws_security_group` |
| `aws_db_proxy` | **HAS** | `aws_db_proxy_target_group` |
| `aws_db_proxy_target` | **CONNECTS** | `aws_db_instance` |
| `aws_db_proxy_target` | **CONNECTS** | `aws_rds_cluster` |
| `aws_db_proxy_target_group` | **HAS** | `aws_db_proxy_target` |
| `aws_db_snapshot` | **USES** | `aws_kms_key` |
| `aws_db_subnet_group` | **USES** | `aws_subnet` |
| `aws_detective` | **HAS** | `aws_detective_graph` |
| `aws_detective_graph` | **IDENTIFIED** | `aws_detective_investigation` |
| `aws_devops_guru` | **HAS** | `aws_devops_guru_notification_channel` |
| `aws_devops_guru` | **IDENTIFIED** | `aws_devops_guru_insight` |
| `aws_devops_guru_insight` | **HAS** | `aws_devops_guru_anomaly` |
| `aws_devops_guru_notification_channel` | **USES** | `aws_sns_topic` |
| `aws_devopsagent_agent_space` | **HAS** | `aws_devopsagent_association` |
| `aws_devopsagent_agent_space` | **USES** | `aws_kms_key` |
| `aws_devopsagent_agent_space` | **USES** | `aws_iam_role` |
| `aws_devopsagent_agent_space` | **USES** | `aws_vpc_endpoint` |
| `aws_devopsagent_association` | **USES** | `aws_devopsagent_service` |
| `aws_devopsagent_association` | **USES** | `aws_iam_role` |
| `aws_devopsagent_private_connection` | **CONNECTS** | `aws_vpc` |
| `aws_devopsagent_service` | **CONNECTS** | `aws_devopsagent_private_connection` |
| `aws_devopsagent_service` | **USES** | `aws_kms_key` |
| `aws_devopsagent_service` | **USES** | `aws_iam_role` |
| `aws_directconnect` | **HAS** | `aws_directconnect_connection` |
| `aws_directconnect` | **HAS** | `aws_directconnect_virtual_interface` |
| `aws_directconnect` | **HAS** | `aws_directconnect_lag` |
| `aws_directconnect` | **HAS** | `aws_directconnect_gateway` |
| `aws_directconnect_lag` | **HAS** | `aws_direct_connect_virtual_interface` |
| `aws_directconnect_lag` | **USES** | `aws_direct_connect_connection` |
| `aws_directconnect_virtual_interface` | **HAS** | `aws_directconnect_bgp_peer` |
| `aws_directconnect_virtual_interface` | **USES** | `aws_directconnect_lag` |
| `aws_directconnect_virtual_interface` | **USES** | `aws_direct_connect_gateway` |
| `aws_dms` | **HAS** | `aws_dms_instance` |
| `aws_dms` | **HAS** | `aws_dms_endpoint` |
| `aws_ds` | **HAS** | `aws_ds_directory` |
| `aws_dynamodb` | **HAS** | `aws_dynamodb_table` |
| `aws_dynamodb` | **HAS** | `aws_dynamodb_global_table` |
| `aws_dynamodb_global_table` | **IS** | `aws_dynamodb_table` |
| `aws_dynamodb_table` | **USES** | `aws_kms_key` |
| `aws_ebs_snapshot` | **USES** | `aws_kms_key` |
| `aws_ebs_volume` | **USES** | `aws_ebs_snapshot` |
| `aws_ebs_volume` | **HAS** | `aws_ebs_snapshot` |
| `aws_ebs_volume` | **USES** | `aws_kms_key` |
| `aws_ec2` | **HAS** | `aws_ec2_settings` |
| `aws_ec2` | **USES** | `aws_kms_key` |
| `aws_ec2` | **HAS** | `aws_instance` |
| `aws_ec2` | **HAS** | `aws_internet_gateway` |
| `aws_ec2` | **HAS** | `aws_key_pair` |
| `aws_ec2` | **HAS** | `aws_launch_template` |
| `aws_ec2` | **HAS** | `aws_network_acl` |
| `aws_ec2` | **HAS** | `aws_prefix_list` |
| `aws_ec2` | **HAS** | `aws_security_group` |
| `aws_ec2` | **HAS** | `aws_subnet` |
| `aws_ec2` | **HAS** | `aws_ec2_transit_gateway` |
| `aws_ec2` | **HAS** | `aws_ebs_volume` |
| `aws_ec2` | **HAS** | `aws_vpc` |
| `aws_ec2` | **HAS** | `aws_vpc_endpoint_service` |
| `aws_ec2` | **HAS** | `aws_dedicated_host` |
| `aws_ec2_transit_gateway` | **HAS** | `aws_ec2_transit_gateway_vpc_attachment` |
| `aws_ec2_transit_gateway` | **HAS** | `aws_ec2_transit_gateway_route_table` |
| `aws_ec2_transit_gateway` | **HAS** | `aws_ec2_transit_gateway_attachment` |
| `aws_ec2_transit_gateway` | **CONNECTS** | `aws_vpn_connection` |
| `aws_ec2_transit_gateway_vpc_attachment` | **USES** | `aws_vpc` |
| `aws_ecr` | **HAS** | `aws_ecr_repository` |
| `aws_ecr_image` | **HAS** | `aws_ecr_image_scan_finding` |
| `aws_ecr_repository` | **HAS** | `aws_ecr_image` |
| `aws_ecs` | **HAS** | `aws_ecs_cluster` |
| `aws_ecs` | **HAS** | `aws_ecs_task_definition` |
| `aws_ecs_cluster` | **HAS** | `aws_ecs_service` |
| `aws_ecs_cluster` | **HAS** | `aws_ecs_container_instance` |
| `aws_ecs_cluster` | **RUNS** | `aws_ecs_task` |
| `aws_ecs_container_instance` | **RUNS** | `aws_ecs_task` |
| `aws_ecs_service` | **USES** | `aws_subnet` |
| `aws_ecs_service` | **HAS** | `aws_security_group` |
| `aws_ecs_task_container_definition` | **USES** | `aws_secret` |
| `aws_ecs_task_definition` | **DEFINES** | `aws_ecs_service` |
| `aws_ecs_task_definition` | **DEFINES** | `aws_ecs_task` |
| `aws_ecs_task_definition` | **USES** | `aws_iam_role` |
| `aws_ecs_task_definition` | **HAS** | `aws_ecs_task_container_definition` |
| `aws_efs` | **HAS** | `aws_efs_file_system` |
| `aws_efs_file_system` | **USES** | `aws_kms_key` |
| `aws_efs_file_system` | **HAS** | `aws_efs_mount_target` |
| `aws_efs_mount_target` | **USES** | `aws_eni` |
| `aws_efs_mount_target` | **HAS** | `aws_security_group` |
| `aws_eks` | **HAS** | `aws_eks_cluster` |
| `aws_eks_cluster` | **HAS** | `aws_instance` |
| `aws_eks_cluster` | **HAS** | `aws_eks_node_group` |
| `aws_eks_cluster` | **HAS** | `aws_security_group` |
| `aws_eks_cluster` | **USES** | `aws_kms_key` |
| `aws_eks_cluster` | **TRUSTS** | `aws_iam_oidc_provider` |
| `aws_eks_node_group` | **HAS** | `aws_instance` |
| `aws_eks_node_group` | **USES** | `aws_iam_role` |
| `aws_elasticache` | **HAS** | `aws_elasticache_memcached_cluster` |
| `aws_elasticache` | **HAS** | `aws_elasticache_redis_cluster` |
| `aws_elasticache_cluster_node` | **USES** | `aws_eni` |
| `aws_elasticache_cluster_node` | **HAS** | `aws_security_group` |
| `aws_elasticache_memcached_cluster` | **USES** | `aws_eni` |
| `aws_elasticache_memcached_cluster` | **HAS** | `aws_security_group` |
| `aws_elasticache_memcached_cluster` | **HAS** | `aws_elasticache_snapshot` |
| `aws_elasticache_redis_cluster` | **HAS** | `aws_elasticache_cluster_node` |
| `aws_elasticache_redis_cluster` | **USES** | `aws_kms_key` |
| `aws_elasticache_snapshot` | **USES** | `aws_kms_key` |
| `aws_elasticloadbalancing` | **HAS** | `aws_alb` |
| `aws_elasticloadbalancing` | **HAS** | `aws_elb` |
| `aws_elasticloadbalancing` | **HAS** | `aws_nlb` |
| `aws_elasticmapreduce` | **HAS** | `aws_elasticmapreduce_cluster` |
| `aws_elasticmapreduce` | **HAS** | `aws_emr_security_configuration` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_kms_key` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_iam_role` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_iam_instance_profile` |
| `aws_elasticmapreduce_cluster` | **HAS** | `aws_instance` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_emr_security_configuration` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_vpc_endpoint` |
| `aws_elasticsearch_domain` | **USES** | `aws_eni` |
| `aws_elasticsearch_domain` | **HAS** | `aws_security_group` |
| `aws_elb` | **USES** | `aws_eni` |
| `aws_elb` | **CONNECTS** | `aws_instance` |
| `aws_elb` | **HAS** | `aws_security_group` |
| `aws_elb` | **HAS** | `aws_lb_listener` |
| `aws_elb` | **CONNECTS** | `aws_lb_target_group` |
| `aws_emr_serverless` | **HAS** | `aws_emr_serverless_application` |
| `aws_emr_serverless_application` | **USES** | `aws_kms_key` |
| `aws_eni` | **USES** | `aws_eip` |
| `aws_eni` | **HAS** | `aws_security_group` |
| `aws_es` | **HAS** | `aws_elasticsearch_domain` |
| `aws_eventbridge_api_destination` | **USES** | `aws_eventbridge_connection` |
| `aws_eventbridge_endpoint` | **USES** | `aws_eventbridge_event_bus` |
| `aws_eventbridge_event_bus` | **USES** | `aws_kms_key` |
| `aws_eventbridge_event_bus` | **HAS** | `aws_eventbridge_archive` |
| `aws_firehose` | **HAS** | `aws_firehose_delivery_stream` |
| `aws_firehose_delivery_stream` | **USES** | `aws_kms_key` |
| `aws_firehose_delivery_stream` | **USES** | `aws_kinesis_stream` |
| `aws_firehose_delivery_stream` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_firehose_delivery_stream` | **USES** | `aws_vpc_endpoint` |
| `aws_firehose_delivery_stream` | **CONNECTS** | `aws_vpc_endpoint_service` |
| `aws_firehose_delivery_stream` | **USES** | `aws_vpc` |
| `aws_firehose_delivery_stream` | **USES** | `aws_subnet` |
| `aws_firehose_delivery_stream` | **USES** | `aws_security_group` |
| `aws_firewall` | **HAS** | `aws_firewall_policy` |
| `aws_firewall` | **PROTECTS** | `aws_vpc` |
| `aws_firewall_policy` | **HAS** | `aws_firewall_rule_group` |
| `aws_firewall_rule_group` | **USES** | `aws_prefix_list` |
| `aws_fms` | **HAS** | `aws_fms_policy` |
| `aws_fms` | **HAS** | `aws_fms_resource_set` |
| `aws_fms` | **HAS** | `aws_fms_application_list` |
| `aws_fms` | **HAS** | `aws_fms_protocols_list` |
| `aws_fms_resource_set` | **HAS** | `aws_resource` |
| `aws_fsx` | **HAS** | `aws_fsx_file_system` |
| `aws_glacier` | **HAS** | `aws_glacier_vault` |
| `aws_global_accelerator` | **HAS** | `aws_global_accelerator_accelerator` |
| `aws_global_accelerator_accelerator` | **HAS** | `aws_global_accelerator_listener` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_alb` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_elb` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_nlb` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_eip` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_instance` |
| `aws_global_accelerator_listener` | **HAS** | `aws_global_accelerator_endpoint_group` |
| `aws_glue` | **HAS** | `aws_glue_job` |
| `aws_glue` | **HAS** | `aws_glue_catalog_database` |
| `aws_glue` | **HAS** | `aws_glue_data_catalog_encryption_settings` |
| `aws_glue` | **HAS** | `aws_glue_security_configuration` |
| `aws_glue` | **HAS** | `aws_glue_connection` |
| `aws_glue` | **HAS** | `aws_glue_session` |
| `aws_glue_connection` | **USES** | `aws_subnet` |
| `aws_glue_data_catalog_encryption_settings` | **USES** | `aws_kms_key` |
| `aws_glue_job` | **USES** | `aws_glue_connection` |
| `aws_glue_security_configuration` | **USES** | `aws_kms_key` |
| `aws_grafana` | **HAS** | `aws_grafana_workspace` |
| `aws_grafana_workspace` | **USES** | `aws_iam_role` |
| `aws_guardduty` | **HAS** | `aws_guardduty_detector` |
| `aws_guardduty_detector` | **IDENTIFIED** | `aws_guardduty_finding` |
| `aws_guardduty_detector` | **HAS** | `aws_guardduty_publishing_destination` |
| `aws_guardduty_publishing_destination` | **USES** | `aws_s3_bucket` |
| `aws_guardduty_publishing_destination` | **USES** | `aws_kms_key` |
| `aws_health` | **HAS** | `aws_health_event` |
| `aws_iam` | **HAS** | `aws_organization_policy` |
| `aws_iam` | **HAS** | `aws_organization_tag_policy` |
| `aws_iam` | **HAS** | `aws_iam_account_password_policy` |
| `aws_iam` | **HAS** | `aws_iam_group` |
| `aws_iam` | **HAS** | `aws_iam_group_policy` |
| `aws_iam` | **HAS** | `aws_iam_policy` |
| `aws_iam` | **HAS** | `aws_iam_role` |
| `aws_iam` | **HAS** | `aws_iam_role_policy` |
| `aws_iam` | **HAS** | `aws_iam_oidc_provider` |
| `aws_iam` | **HAS** | `aws_iam_saml_provider` |
| `aws_iam` | **HAS** | `aws_iam_user` |
| `aws_iam` | **HAS** | `aws_iam_access_key` |
| `aws_iam` | **HAS** | `aws_iam_user_policy` |
| `aws_iam` | **HAS** | `aws_iam_server_certificate` |
| `aws_iam` | **HAS** | `aws_iam_instance_profile` |
| `aws_iam_group` | **ASSIGNED** | `aws_iam_group_policy` |
| `aws_iam_group` | **HAS** | `aws_iam_user` |
| `aws_iam_group` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_group_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_group_policy` | **DENIES** | `aws_resource` |
| `aws_iam_instance_profile` | **USES** | `aws_role` |
| `aws_iam_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_policy` | **DENIES** | `aws_resource` |
| `aws_iam_policy` | **RESTRICTS** | `aws_iam_role` |
| `aws_iam_policy` | **RESTRICTS** | `aws_iam_user` |
| `aws_iam_role` | **ASSIGNED** | `aws_batch_compute_environment` |
| `aws_iam_role` | **ASSIGNED** | `aws_datasync_location` |
| `aws_iam_role` | **ASSIGNED** | `aws_ecs_task_definition` |
| `aws_iam_role` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_role` | **ASSIGNED** | `aws_iam_role_policy` |
| `aws_iam_role` | **ASSIGNED** | `aws_transfer_server` |
| `aws_iam_role` | **ASSIGNED** | `aws_transfer_user` |
| `aws_iam_role_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_role_policy` | **DENIES** | `aws_resource` |
| `aws_iam_roles_anywhere` | **HAS** | `aws_iam_roles_anywhere_trust_anchor` |
| `aws_iam_roles_anywhere` | **HAS** | `aws_iam_roles_anywhere_profile` |
| `aws_iam_roles_anywhere_profile` | **ALLOWS** | `aws_iam_role` |
| `aws_iam_roles_anywhere_profile` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_roles_anywhere_trust_anchor` | **USES** | `aws_acm_pca_certificate_authority` |
| `aws_iam_user` | **HAS** | `aws_bedrock_api_key` |
| `aws_iam_user` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_user` | **HAS** | `aws_iam_access_key` |
| `aws_iam_user` | **ASSIGNED** | `mfa_device` |
| `aws_iam_user` | **ASSIGNED** | `aws_iam_user_policy` |
| `aws_iam_user_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_user_policy` | **DENIES** | `aws_resource` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_component` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_image_pipeline` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_infrastructure_configuration` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_lifecycle_policy` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_container_recipe` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_distribution_configuration` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_workflow` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_imagebuilder_infrastructure_configuration` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_imagebuilder_distribution_configuration` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_imagebuilder_container_recipe` |
| `aws_imagebuilder_image_pipeline` | **CREATED** | `aws_imagebuilder_image` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_iam_role` |
| `aws_imagebuilder_lifecycle_policy` | **USES** | `aws_iam_role` |
| `aws_inspector` | **HAS** | `aws_inspector_assessment` |
| `aws_inspector_assessment` | **IDENTIFIED** | `aws_inspector_finding` |
| `aws_inspectorv2` | **SCANS** | `aws_instance` |
| `aws_inspectorv2` | **SCANS** | `aws_ecr_repository` |
| `aws_inspectorv2` | **SCANS** | `aws_ecr_image` |
| `aws_inspectorv2` | **IDENTIFIED** | `aws_inspectorv2_finding` |
| `aws_inspectorv2` | **HAS** | `aws_inspectorv2_filter` |
| `aws_inspectorv2` | **HAS** | `aws_inspectorv2_configuration` |
| `aws_inspectorv2` | **USES** | `aws_vpc_endpoint` |
| `aws_inspectorv2` | **HAS** | `aws_inspectorv2_cis_scan` |
| `aws_inspectorv2_cis_scan` | **HAS** | `aws_inspectorv2_cis_finding` |
| `aws_inspectorv2_configuration` | **USES** | `aws_kms_key` |
| `aws_instance` | **USES** | `aws_eip` |
| `aws_instance` | **USES** | `aws_key_pair` |
| `aws_instance` | **USES** | `aws_ami` |
| `aws_instance` | **HAS** | `aws_security_group` |
| `aws_instance` | **USES** | `aws_iam_instance_profile` |
| `aws_instance` | **USES** | `aws_eni` |
| `aws_instance` | **USES** | `aws_ebs_volume` |
| `aws_instance` | **USES** | `aws_dedicated_host` |
| `aws_instance` | **HAS** | `aws_inspectorv2_cis_finding` |
| `aws_instance` | **HAS** | `aws_instance_inventory` |
| `aws_instance` | **INSTALLED** | `aws_instance_application` |
| `aws_instance` | **LOGS** | `aws_instance_patch_state` |
| `aws_instance` | **HAS** | `aws_ssm_compliance_summary` |
| `aws_instance` | **HAS** | `aws_ssm_associations` |
| `aws_keyspaces` | **HAS** | `aws_keyspaces_keyspace` |
| `aws_keyspaces_keyspace` | **HAS** | `aws_keyspaces_table` |
| `aws_keyspaces_table` | **USES** | `aws_kms_key` |
| `aws_keyspaces_table` | **USES** | `aws_vpc_endpoint` |
| `aws_kinesis` | **HAS** | `aws_kinesis_stream` |
| `aws_kinesis_consumer` | **USES** | `aws_kinesis_stream` |
| `aws_kinesis_stream` | **USES** | `aws_kms_key` |
| `aws_kms` | **HAS** | `aws_kms_key` |
| `aws_lambda` | **HAS** | `aws_lambda_function` |
| `aws_lambda_function` | **HAS** | `aws_security_group` |
| `aws_lambda_function` | **ASSIGNED** | `aws_iam_role` |
| `aws_lambda_function` | **USES** | `aws_signer_signing_profile` |
| `aws_lambda_function` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_launch_template` | **HAS** | `aws_launch_template_version` |
| `aws_launch_template_version` | **USES** | `aws_ami` |
| `aws_lb_listener` | **HAS** | `aws_lb_listener_rule` |
| `aws_lb_listener` | **USES** | `aws_acm_certificate` |
| `aws_lb_listener` | **USES** | `aws_iam_server_certificate` |
| `aws_lb_target_group` | **HAS** | `aws_instance` |
| `aws_lb_target_group` | **HAS** | `aws_lambda_function` |
| `aws_lb_target_group` | **HAS** | `aws_eni` |
| `aws_lexv2` | **HAS** | `aws_lexv2_bot` |
| `aws_lexv2_bot` | **HAS** | `aws_lexv2_bot_alias` |
| `aws_license_manager` | **HAS** | `aws_license_manager_license` |
| `aws_license_manager` | **HAS** | `aws_license_manager_received_license` |
| `aws_macie` | **HAS** | `aws_macie_automated_discovery_configuration` |
| `aws_macie` | **HAS** | `aws_macie_admin_account` |
| `aws_macie` | **HAS** | `aws_macie_organization_configuration` |
| `aws_macie` | **HAS** | `aws_macie_finding_publication_configuration` |
| `aws_macie` | **HAS** | `aws_macie_classification_export_configuration` |
| `aws_macie` | **HAS** | `aws_macie_classification_job` |
| `aws_macie_automated_discovery_configuration` | **HAS** | `aws_macie_automated_discovery_account` |
| `aws_marketplace` | **HAS** | `aws_marketplace_entity` |
| `aws_marketplace` | **HAS** | `aws_marketplace_entitlement` |
| `aws_marketplace_entitlement` | **ASSIGNED** | `aws_account` |
| `aws_marketplace_entitlement` | **USES** | `aws_license_manager_received_license` |
| `aws_mq` | **HAS** | `aws_mq_broker` |
| `aws_mq_broker` | **USES** | `aws_kms_key` |
| `aws_mq_broker` | **USES** | `aws_subnet` |
| `aws_mq_broker` | **USES** | `aws_security_group` |
| `aws_msk` | **HAS** | `aws_msk_cluster` |
| `aws_mwaa` | **HAS** | `aws_mwaa_environment` |
| `aws_nat_gateway` | **USES** | `aws_eni` |
| `aws_neptune` | **HAS** | `aws_neptune_database_cluster` |
| `aws_neptune` | **HAS** | `aws_neptune_database_instance` |
| `aws_neptune` | **HAS** | `aws_neptune_analytics_graph` |
| `aws_neptune_analytics_graph` | **USES** | `aws_kms_key` |
| `aws_neptune_analytics_graph` | **CONNECTS** | `aws_vpc_endpoint` |
| `aws_neptune_analytics_graph` | **HAS** | `aws_neptune_analytics_graph_snapshot` |
| `aws_neptune_analytics_graph` | **HAS** | `aws_neptune_analytics_graph_export_task` |
| `aws_neptune_analytics_graph` | **HAS** | `aws_neptune_analytics_graph_import_task` |
| `aws_neptune_analytics_graph_export_task` | **USES** | `aws_kms_key` |
| `aws_neptune_analytics_graph_export_task` | **USES** | `aws_iam_role` |
| `aws_neptune_analytics_graph_import_task` | **USES** | `aws_kms_key` |
| `aws_neptune_analytics_graph_import_task` | **USES** | `aws_iam_role` |
| `aws_neptune_analytics_graph_snapshot` | **USES** | `aws_kms_key` |
| `aws_neptune_database_cluster` | **HAS** | `aws_security_group` |
| `aws_neptune_database_cluster` | **USES** | `aws_kms_key` |
| `aws_neptune_database_cluster` | **USES** | `aws_iam_role` |
| `aws_neptune_database_cluster` | **CONTAINS** | `aws_neptune_database_instance` |
| `aws_neptune_database_instance` | **HAS** | `aws_security_group` |
| `aws_neptune_database_instance` | **USES** | `aws_kms_key` |
| `aws_network_acl` | **PROTECTS** | `aws_subnet` |
| `aws_network_acl` | **ALLOWS** | `aws_resource` |
| `aws_network_acl` | **DENIES** | `aws_resource` |
| `aws_networkfirewall` | **HAS** | `aws_firewall` |
| `aws_networkfirewall` | **HAS** | `aws_firewall_policy` |
| `aws_networkfirewall` | **HAS** | `aws_firewall_rule_group` |
| `aws_networkmanager` | **HAS** | `aws_networkmanager_core_network` |
| `aws_networkmanager_attachment` | **HAS** | `aws_networkmanager_connect_peer` |
| `aws_networkmanager_attachment` | **USES** | `aws_vpc` |
| `aws_networkmanager_attachment` | **USES** | `aws_vpn_connection` |
| `aws_networkmanager_attachment` | **USES** | `aws_directconnect_gateway` |
| `aws_networkmanager_attachment` | **USES** | `aws_ec2_transit_gateway_route_table` |
| `aws_networkmanager_connect_peer` | **USES** | `aws_subnet` |
| `aws_networkmanager_core_network` | **HAS** | `aws_networkmanager_core_network_policy` |
| `aws_networkmanager_core_network` | **HAS** | `aws_networkmanager_core_network_route` |
| `aws_networkmanager_core_network` | **HAS** | `aws_networkmanager_core_network_policy_version` |
| `aws_networkmanager_core_network` | **HAS** | `aws_networkmanager_attachment` |
| `aws_nlb` | **USES** | `aws_eni` |
| `aws_nlb` | **HAS** | `aws_security_group` |
| `aws_nlb` | **HAS** | `aws_lb_listener` |
| `aws_nlb` | **CONNECTS** | `aws_lb_target_group` |
| `aws_nova_act` | **HAS** | `aws_nova_act_model` |
| `aws_nova_act` | **HAS** | `aws_nova_act_workflow_definition` |
| `aws_nova_act_workflow_definition` | **HAS** | `aws_nova_act_workflow_run` |
| `aws_nova_act_workflow_definition` | **USES** | `aws_s3_bucket` |
| `aws_nova_act_workflow_run` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_nova_act_workflow_run` | **USES** | `aws_nova_act_model` |
| `aws_opensearch` | **HAS** | `aws_opensearch_domain` |
| `aws_opensearch_domain` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_organization` | **HAS** | `aws_organization_root` |
| `aws_organization_root` | **HAS** | `aws_organizational_unit` |
| `aws_organizational_unit` | **HAS** | `aws_organizational_unit` |
| `aws_outposts` | **HAS** | `aws_outposts_site` |
| `aws_outposts_asset` | **HAS** | `aws_instance` |
| `aws_outposts_outpost` | **HAS** | `aws_outposts_asset` |
| `aws_outposts_outpost` | **USES** | `aws_vpc` |
| `aws_outposts_outpost` | **USES** | `aws_subnet` |
| `aws_outposts_outpost` | **USES** | `aws_vpc_endpoint` |
| `aws_outposts_outpost` | **USES** | `aws_iam_role` |
| `aws_outposts_site` | **HAS** | `aws_outposts_outpost` |
| `aws_patch_baseline` | **GENERATED** | `aws_instance_patch_state` |
| `aws_patch_group` | **USES** | `aws_patch_baseline` |
| `aws_patch_group` | **HAS** | `aws_instance` |
| `aws_prometheus` | **HAS** | `aws_prometheus_workspace` |
| `aws_prometheus` | **HAS** | `aws_prometheus_scraper` |
| `aws_prometheus_scraper` | **SCANS** | `aws_eks_cluster` |
| `aws_prometheus_scraper` | **USES** | `aws_subnet` |
| `aws_prometheus_scraper` | **USES** | `aws_security_group` |
| `aws_prometheus_scraper` | **USES** | `aws_iam_role` |
| `aws_prometheus_scraper` | **SENDS** | `aws_prometheus_workspace` |
| `aws_prometheus_workspace` | **USES** | `aws_kms_key` |
| `aws_prometheus_workspace` | **HAS** | `aws_cloudwatch_log_group` |
| `aws_quicksight` | **HAS** | `aws_quicksight_data_set` |
| `aws_quicksight` | **HAS** | `aws_quicksight_vpc_connection` |
| `aws_quicksight` | **HAS** | `aws_quicksight_user` |
| `aws_quicksight` | **HAS** | `aws_quicksight_group` |
| `aws_quicksight` | **HAS** | `aws_quicksight_custom_permissions` |
| `aws_quicksight_dashboard` | **USES** | `aws_quicksight_data_set` |
| `aws_quicksight_data_set` | **USES** | `aws_quicksight_data_source` |
| `aws_quicksight_data_source` | **CONNECTS** | `aws_quicksight_vpc_connection` |
| `aws_quicksight_group` | **HAS** | `aws_quicksight_user` |
| `aws_quicksight_user` | **ASSIGNED** | `aws_quicksight_custom_permissions` |
| `aws_ram_principal` | **USES** | `aws_ram_shared_resource` |
| `aws_ram_resource_share` | **GENERATED** | `aws_ram_resource_share_invitation` |
| `aws_ram_resource_share` | **CONTAINS** | `aws_ram_shared_resource` |
| `aws_ram_resource_share` | **ALLOWS** | `aws_ram_principal` |
| `aws_ram_service` | **HAS** | `aws_ram_resource_share` |
| `aws_rds` | **HAS** | `aws_rds_cluster` |
| `aws_rds` | **HAS** | `aws_db_instance` |
| `aws_rds` | **HAS** | `aws_db_subnet_group` |
| `aws_rds` | **HAS** | `aws_db_proxy` |
| `aws_rds_cluster` | **HAS** | `aws_security_group` |
| `aws_rds_cluster` | **USES** | `aws_kms_key` |
| `aws_rds_cluster` | **USES** | `aws_secret` |
| `aws_rds_cluster` | **CONTAINS** | `aws_db_instance` |
| `aws_rds_cluster` | **USES** | `aws_rds_cluster_parameter_group` |
| `aws_rds_cluster` | **HAS** | `aws_db_cluster_snapshot` |
| `aws_redshift` | **HAS** | `aws_redshift_cluster` |
| `aws_redshift_cluster` | **USES** | `aws_kms_key` |
| `aws_redshift_cluster` | **HAS** | `aws_security_group` |
| `aws_redshift_cluster` | **USES** | `aws_redshift_cluster_parameter_group` |
| `aws_redshift_cluster` | **HAS** | `aws_redshift_datashare` |
| `aws_redshift_cluster` | **ASSIGNED** | `aws_iam_role` |
| `aws_redshift_datashare_authorization` | **ALLOWS** | `aws_redshift_datashare` |
| `aws_redshift_serverless` | **HAS** | `aws_redshift_serverless_workgroup` |
| `aws_redshift_serverless` | **HAS** | `aws_redshift_serverless_namespace` |
| `aws_redshift_serverless` | **HAS** | `aws_redshift_serverless_usage_limit` |
| `aws_redshift_serverless_namespace` | **HAS** | `aws_redshift_datashare` |
| `aws_resource` | **USES** | `aws_acm_certificate` |
| `aws_resource` | **VIOLATES** | `aws_config_rule_finding` |
| `aws_resource` | **ALLOWS** | `aws_security_group` |
| `aws_resource` | **HAS** | `aws_health_event` |
| `aws_resource` | **HAS** | `aws_inspectorv2_finding` |
| `aws_resource` | **HAS** | `aws_securityhub_finding` |
| `aws_resource_explorer` | **HAS** | `aws_resource_explorer_index` |
| `aws_resource_explorer` | **HAS** | `aws_resource_explorer_view` |
| `aws_resource_explorer` | **USES** | `aws_vpc_endpoint` |
| `aws_route_table` | **USES** | `aws_prefix_list` |
| `aws_route53` | **HAS** | `aws_route53_domain` |
| `aws_route53` | **HAS** | `aws_route53_resolver_rule` |
| `aws_route53` | **HAS** | `aws_route53_zone` |
| `aws_route53_resolver_rule` | **USES** | `aws_vpc` |
| `aws_route53_zone` | **HAS** | `aws_route53_record` |
| `aws_s3` | **HAS** | `aws_s3_bucket` |
| `aws_s3_bucket` | **HAS** | `aws_macie_finding` |
| `aws_s3_bucket` | **HAS** | `aws_s3_access_point` |
| `aws_s3_bucket` | **USES** | `aws_kms_key` |
| `aws_s3_bucket` | **HAS** | `aws_s3_bucket_policy` |
| `aws_s3_bucket` | **NOTIFIES** | `aws_lambda_function` |
| `aws_s3_bucket` | **NOTIFIES** | `aws_sqs_queue` |
| `aws_s3_bucket` | **NOTIFIES** | `aws_sns_topic` |
| `aws_s3_bucket` | **ALLOWS** | `aws_account` |
| `aws_s3_bucket` | **ALLOWS** | `aws_s3` |
| `aws_s3_bucket` | **ALLOWS** | `aws_resource` |
| `aws_s3_bucket` | **DENIES** | `aws_resource` |
| `aws_s3_bucket` | **HAS** | `aws_s3_website_config` |
| `aws_s3_bucket` | **HAS** | `aws_s3_bucket_lifecycle_rule` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_notebook_instance` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_model` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_endpoint` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_domain` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_training_job` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_processing_job` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_transform_job` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_feature_group` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_model_quality_job_definition` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_model_bias_job_definition` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_inference_recommendations_job` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_pipeline_execution` |
| `aws_sagemaker_domain` | **USES** | `aws_iam_role` |
| `aws_sagemaker_domain` | **USES** | `aws_kms_key` |
| `aws_sagemaker_domain` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_domain` | **CONNECTS** | `aws_vpc` |
| `aws_sagemaker_domain` | **USES** | `aws_efs_file_system` |
| `aws_sagemaker_endpoint` | **USES** | `aws_iam_role` |
| `aws_sagemaker_endpoint` | **USES** | `aws_kms_key` |
| `aws_sagemaker_endpoint` | **USES** | `aws_sagemaker_model` |
| `aws_sagemaker_endpoint` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_endpoint` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_feature_group` | **USES** | `aws_iam_role` |
| `aws_sagemaker_feature_group` | **USES** | `aws_kms_key` |
| `aws_sagemaker_feature_group` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_inference_recommendations_job` | **USES** | `aws_iam_role` |
| `aws_sagemaker_model_bias_job_definition` | **USES** | `aws_iam_role` |
| `aws_sagemaker_model_bias_job_definition` | **USES** | `aws_kms_key` |
| `aws_sagemaker_model_quality_job_definition` | **USES** | `aws_iam_role` |
| `aws_sagemaker_model_quality_job_definition` | **USES** | `aws_kms_key` |
| `aws_sagemaker_processing_job` | **USES** | `aws_iam_role` |
| `aws_sagemaker_processing_job` | **USES** | `aws_kms_key` |
| `aws_sagemaker_processing_job` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_processing_job` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_training_job` | **USES** | `aws_iam_role` |
| `aws_sagemaker_training_job` | **USES** | `aws_kms_key` |
| `aws_sagemaker_training_job` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_training_job` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_transform_job` | **USES** | `aws_sagemaker_model` |
| `aws_sagemaker_transform_job` | **USES** | `aws_kms_key` |
| `aws_sagemaker_transform_job` | **USES** | `aws_s3_bucket` |
| `aws_secret` | **HAS** | `aws_secret_version` |
| `aws_secret` | **USES** | `aws_kms_key` |
| `aws_secretsmanager` | **HAS** | `aws_secret` |
| `aws_security_agent_agent_space` | **CONTAINS** | `aws_security_agent_target_domain` |
| `aws_security_agent_agent_space` | **HAS** | `aws_security_agent_threat_model` |
| `aws_security_agent_agent_space` | **HAS** | `aws_security_agent_artifact` |
| `aws_security_agent_agent_space` | **USES** | `aws_iam_role` |
| `aws_security_agent_agent_space` | **USES** | `aws_kms_key` |
| `aws_security_agent_agent_space` | **USES** | `aws_s3_bucket` |
| `aws_security_agent_agent_space` | **USES** | `aws_secret` |
| `aws_security_agent_agent_space` | **USES** | `aws_vpc` |
| `aws_security_agent_agent_space` | **HAS** | `aws_cloudwatch_log_group` |
| `aws_security_agent_agent_space` | **USES** | `aws_lambda_function` |
| `aws_security_agent_agent_space` | **USES** | `aws_subnet` |
| `aws_security_agent_agent_space` | **USES** | `aws_security_group` |
| `aws_security_agent_application` | **USES** | `aws_kms_key` |
| `aws_security_agent_private_connection` | **USES** | `aws_vpc` |
| `aws_security_agent_threat_model` | **USES** | `aws_iam_role` |
| `aws_security_agent_threat_model` | **HAS** | `aws_cloudwatch_log_group` |
| `aws_security_group` | **PROTECTS** | `aws_batch_compute_environment` |
| `aws_security_group` | **PROTECTS** | `aws_cloudhsm_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_cloudhsm_instance` |
| `aws_security_group` | **PROTECTS** | `aws_instance` |
| `aws_security_group` | **ALLOWS** | `aws_resource` |
| `aws_security_group` | **PROTECTS** | `aws_eni` |
| `aws_security_group` | **HAS** | `aws_ec2_security_group_rule` |
| `aws_security_group` | **USES** | `aws_prefix_list` |
| `aws_security_group` | **ALLOWS** | `aws_prefix_list` |
| `aws_security_group` | **PROTECTS** | `aws_vpc_endpoint` |
| `aws_security_group` | **PROTECTS** | `aws_ecs_service` |
| `aws_security_group` | **PROTECTS** | `aws_efs_mount_target` |
| `aws_security_group` | **PROTECTS** | `aws_eks_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_elasticache_memcached_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_elasticache_cluster_node` |
| `aws_security_group` | **PROTECTS** | `aws_elb` |
| `aws_security_group` | **PROTECTS** | `aws_alb` |
| `aws_security_group` | **PROTECTS** | `aws_nlb` |
| `aws_security_group` | **PROTECTS** | `aws_elasticsearch_domain` |
| `aws_security_group` | **PROTECTS** | `aws_lambda_function` |
| `aws_security_group` | **PROTECTS** | `aws_neptune_database_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_neptune_database_instance` |
| `aws_security_group` | **PROTECTS** | `aws_rds_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_db_instance` |
| `aws_security_group` | **PROTECTS** | `aws_redshift_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_endpoint` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_domain` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_training_job` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_processing_job` |
| `aws_securityagent` | **HAS** | `aws_security_agent_application` |
| `aws_securityagent` | **HAS** | `aws_security_agent_agent_space` |
| `aws_securityagent` | **HAS** | `aws_security_agent_target_domain` |
| `aws_securityagent` | **HAS** | `aws_security_agent_private_connection` |
| `aws_securityhub` | **HAS** | `aws_securityhub_account` |
| `aws_securityhub` | **HAS** | `aws_securityhub_standard` |
| `aws_securityhub_control` | **IDENTIFIED** | `aws_securityhub_finding` |
| `aws_securityhub_finding` | **CONNECTS** | `aws_securityhub_finding` |
| `aws_securityhub_standard` | **HAS** | `aws_securityhub_control` |
| `aws_securityhub_standard` | **IDENTIFIED** | `aws_securityhub_finding` |
| `aws_servicecatalog` | **HAS** | `aws_servicecatalog_portfolio` |
| `aws_servicecatalog` | **HAS** | `aws_servicecatalog_product` |
| `aws_servicecatalog` | **HAS** | `aws_servicecatalog_tag_option` |
| `aws_servicecatalog_portfolio` | **HAS** | `aws_servicecatalog_product` |
| `aws_servicecatalog_portfolio` | **HAS** | `aws_servicecatalog_constraint` |
| `aws_servicecatalog_portfolio` | **HAS** | `aws_servicecatalog_tag_option` |
| `aws_servicecatalog_product` | **HAS** | `aws_servicecatalog_provisioning_artifact` |
| `aws_servicecatalog_product` | **HAS** | `aws_servicecatalog_launch_path` |
| `aws_servicecatalog_product` | **HAS** | `aws_servicecatalog_tag_option` |
| `aws_ses` | **HAS** | `aws_ses_identity` |
| `aws_ses` | **HAS** | `aws_ses_configuration_set` |
| `aws_ses` | **HAS** | `aws_ses_receipt_filter` |
| `aws_ses_identity` | **USES** | `aws_ses_configuration_set` |
| `aws_session_document` | **USES** | `aws_s3_bucket` |
| `aws_session_document` | **USES** | `aws_cloudwatch_log_group` |
| `aws_session_document` | **USES** | `aws_kms_key` |
| `aws_shield` | **HAS** | `aws_shield_subscription` |
| `aws_shield` | **HAS** | `aws_shield_protection_group` |
| `aws_shield` | **HAS** | `aws_shield_protection` |
| `aws_shield_protection` | **PROTECTS** | `aws_resource` |
| `aws_shield_protection_group` | **PROTECTS** | `aws_resource` |
| `aws_shield_protection_group` | **HAS** | `aws_resource` |
| `aws_signer` | **HAS** | `aws_signer_signing_profile` |
| `aws_signer_signing_profile` | **HAS** | `aws_signer_signing_job` |
| `aws_sns` | **HAS** | `aws_sns_topic` |
| `aws_sns_topic` | **HAS** | `aws_sns_subscription` |
| `aws_sns_topic` | **USES** | `aws_kms_key` |
| `aws_sqs` | **HAS** | `aws_sqs_queue` |
| `aws_sqs_queue` | **SENDS** | `aws_sqs_queue` |
| `aws_sqs_queue` | **USES** | `aws_kms_key` |
| `aws_ssm` | **MANAGES** | `aws_instance` |
| `aws_ssm` | **HAS** | `aws_patch_baseline` |
| `aws_ssm` | **HAS** | `aws_patch_group` |
| `aws_ssm` | **MANAGES** | `aws_secure_string_parameter` |
| `aws_ssm` | **HAS** | `aws_session_document` |
| `aws_ssm` | **HAS** | `aws_ssm_document` |
| `aws_ssm` | **HAS** | `aws_ssm_compliance_summary` |
| `aws_ssm` | **HAS** | `aws_ssm_associations` |
| `aws_ssm_service_setting` | **MANAGES** | `aws_ssm` |
| `aws_sso` | **HAS** | `aws_sso_instance` |
| `aws_sso_group` | **ASSIGNED** | `aws_sso_permission_set` |
| `aws_sso_group` | **HAS** | `aws_sso_user` |
| `aws_sso_instance` | **HAS** | `aws_sso_application` |
| `aws_sso_instance` | **HAS** | `aws_sso_permission_set` |
| `aws_sso_instance` | **HAS** | `aws_sso_user` |
| `aws_sso_instance` | **HAS** | `aws_sso_group` |
| `aws_sso_user` | **ASSIGNED** | `aws_sso_permission_set` |
| `aws_states` | **HAS** | `aws_states_state_machine` |
| `aws_states_state_machine` | **USES** | `aws_iam_role` |
| `aws_states_state_machine` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_storage_gateway` | **HAS** | `aws_storage_gateway_gateway` |
| `aws_storage_gateway_file_share` | **USES** | `aws_iam_role` |
| `aws_storage_gateway_file_share` | **USES** | `aws_s3_bucket` |
| `aws_storage_gateway_file_share` | **USES** | `aws_kms_key` |
| `aws_storage_gateway_gateway` | **USES** | `aws_vpc_endpoint` |
| `aws_storage_gateway_gateway` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_storage_gateway_gateway` | **HAS** | `aws_storage_gateway_file_share` |
| `aws_storage_gateway_gateway` | **HAS** | `aws_storage_gateway_volume` |
| `aws_storage_gateway_gateway` | **HAS** | `aws_storage_gateway_tape` |
| `aws_storage_gateway_tape` | **USES** | `aws_kms_key` |
| `aws_storage_gateway_tape_pool` | **CONTAINS** | `aws_storage_gateway_tape` |
| `aws_storage_gateway_volume` | **USES** | `aws_kms_key` |
| `aws_subnet` | **HAS** | `aws_cloudhsm_instance` |
| `aws_subnet` | **HAS** | `aws_instance` |
| `aws_subnet` | **HAS** | `aws_nat_gateway` |
| `aws_subnet` | **USES** | `aws_route_table` |
| `aws_subnet` | **CONNECTS** | `aws_eni` |
| `aws_subnet` | **HAS** | `aws_efs_mount_target` |
| `aws_subnet` | **HAS** | `aws_elasticsearch_domain` |
| `aws_subnet` | **HAS** | `aws_lambda_function` |
| `aws_subnet` | **USES** | `aws_msk_cluster` |
| `aws_subnet` | **HAS** | `aws_workspace` |
| `aws_transfer` | **HAS** | `aws_transfer_server` |
| `aws_transfer_server` | **USES** | `aws_eip` |
| `aws_transfer_server` | **USES** | `aws_api_gateway_rest_api` |
| `aws_transfer_server` | **HAS** | `aws_transfer_user` |
| `aws_transfer_user` | **ALLOWS** | `aws_s3_bucket` |
| `aws_vpc` | **HAS** | `aws_cloudhsm_cluster` |
| `aws_vpc` | **HAS** | `aws_codebuild_project` |
| `aws_vpc` | **HAS** | `aws_vpn_gateway` |
| `aws_vpc` | **HAS** | `aws_internet_gateway` |
| `aws_vpc` | **HAS** | `aws_nat_gateway` |
| `aws_vpc` | **HAS** | `aws_network_acl` |
| `aws_vpc` | **HAS** | `aws_route_table` |
| `aws_vpc` | **HAS** | `aws_security_group` |
| `aws_vpc` | **CONTAINS** | `aws_subnet` |
| `aws_vpc` | **HAS** | `aws_vpc_endpoint` |
| `aws_vpc` | **HAS** | `aws_eks_cluster` |
| `aws_vpc` | **HAS** | `aws_elasticache_memcached_cluster` |
| `aws_vpc` | **HAS** | `aws_elasticache_cluster_node` |
| `aws_vpc` | **HAS** | `aws_elb` |
| `aws_vpc` | **HAS** | `aws_alb` |
| `aws_vpc` | **HAS** | `aws_nlb` |
| `aws_vpc` | **HAS** | `aws_glue_dev_endpoint` |
| `aws_vpc` | **HAS** | `aws_grafana_workspace` |
| `aws_vpc` | **HAS** | `aws_neptune_database_instance` |
| `aws_vpc` | **HAS** | `aws_db_instance` |
| `aws_vpc` | **HAS** | `aws_db_subnet_group` |
| `aws_vpc` | **HAS** | `aws_redshift_serverless_workgroup` |
| `aws_vpc` | **HAS** | `aws_redshift_cluster` |
| `aws_vpc` | **HAS** | `aws_s3_access_point` |
| `aws_vpc` | **HAS** | `aws_transfer_server` |
| `aws_vpc` | **CONNECTS** | `aws_vpc_lattice_service_network` |
| `aws_vpc` | **HAS** | `aws_opensearch_domain` |
| `aws_vpc_endpoint` | **CONNECTS** | `aws_security_agent_private_connection` |
| `aws_vpc_endpoint` | **HAS** | `aws_security_group` |
| `aws_vpc_endpoint` | **USES** | `aws_subnet` |
| `aws_vpc_endpoint` | **USES** | `aws_eni` |
| `aws_vpc_endpoint` | **CONNECTS** | `aws_auditmanager` |
| `aws_vpc_endpoint` | **CONNECTS** | `aws_vpc_lattice_service_network` |
| `aws_vpc_endpoint_service` | **ALLOWS** | `aws_resource` |
| `aws_vpc_endpoint_service` | **CONNECTS** | `aws_nlb` |
| `aws_vpc_endpoint_service` | **CONNECTS** | `aws_elb` |
| `aws_vpc_endpoint_service` | **CONNECTS** | `aws_vpc_endpoint` |
| `aws_vpc_lattice` | **HAS** | `aws_vpc_lattice_service` |
| `aws_vpc_lattice` | **HAS** | `aws_vpc_lattice_service_network` |
| `aws_vpc_lattice` | **HAS** | `aws_vpc_lattice_target_group` |
| `aws_vpc_lattice_listener_rule` | **DEFINES** | `aws_vpc_lattice_listener` |
| `aws_vpc_lattice_listener_rule` | **TRIGGERS** | `aws_vpc_lattice_target_group` |
| `aws_vpc_lattice_service` | **CONNECTS** | `aws_vpc_lattice_listener` |
| `aws_vpc_lattice_service_network` | **CONNECTS** | `aws_vpc_lattice_service` |
| `aws_vpc_lattice_target_group` | **HAS** | `aws_lambda_function` |
| `aws_vpc_lattice_target_group` | **HAS** | `aws_alb` |
| `aws_vpn_connection` | **CONNECTS** | `aws_customer_gateway` |
| `aws_vpn_gateway` | **CONNECTS** | `aws_vpn_connection` |
| `aws_waf` | **HAS** | `aws_waf_web_acl` |
| `aws_waf_v2_rule_group` | **HAS** | `aws_waf_v2_web_acl_rule` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_api_gateway_stage` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_cognito_user_pool` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_cloudfront_distribution` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_alb` |
| `aws_waf_v2_web_acl` | **HAS** | `aws_waf_v2_web_acl_rule` |
| `aws_waf_v2_web_acl` | **HAS** | `aws_waf_v2_web_acl_firewall_manager_rule_group` |
| `aws_waf_v2_web_acl` | **LOGS** | `aws_s3_bucket` |
| `aws_waf_v2_web_acl` | **LOGS** | `aws_firehose_delivery_stream` |
| `aws_waf_v2_web_acl` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_waf_v2_web_acl_rule` | **USES** | `aws_waf_v2_ip_set` |
| `aws_waf_v2_web_acl_rule` | **USES** | `aws_waf_v2_rule_group` |
| `aws_waf_web_acl` | **PROTECTS** | `aws_api_gateway_stage` |
| `aws_waf_web_acl` | **PROTECTS** | `aws_cloudfront_distribution` |
| `aws_wafv2` | **HAS** | `aws_waf_v2_web_acl` |
| `aws_wafv2` | **HAS** | `aws_waf_v2_ip_set` |
| `aws_wafv2` | **HAS** | `aws_waf_v2_rule_group` |
| `aws_workspace` | **USES** | `aws_workspaces_bundle` |
| `aws_workspaces` | **HAS** | `aws_workspace` |
| `aws_xray` | **HAS** | `aws_xray_group` |
| `aws_xray` | **HAS** | `aws_xray_encryption_config` |
| `aws_xray` | **HAS** | `aws_xray_resource_policy` |
| `aws_xray_encryption_config` | **USES** | `aws_kms_key` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `aws_accessanalyzer_finding` | **IDENTIFIED** | `aws_resource` | FORWARD |
| `aws_account` | **HAS** | `aws_account` | FORWARD |
| `aws_account` | **ALLOWS** | `aws_ami` | FORWARD |
| `aws_account` | **DENIES** | `aws_ami` | FORWARD |
| `aws_account` | **SHARED** | `aws_db_snapshot` | REVERSE |
| `aws_account` | **SHARED** | `aws_db_cluster_snapshot` | REVERSE |
| `aws_account` | **OWNS** | `aws_sso_instance` | REVERSE |
| `aws_acm_certificate` | **CONNECTS** | `aws_route53_record` | FORWARD |
| `aws_api_gateway_domain_name` | **HAS** | `aws_acm_certificate` | FORWARD |
| `aws_api_gateway_rest_api` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_api_gateway_rest_api` | **DENIES** | `aws_resource` | FORWARD |
| `aws_autoscaling_launch_configuration` | **USES** | `aws_ami` | FORWARD |
| `aws_backup_vault` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_backup_vault` | **DENIES** | `aws_resource` | FORWARD |
| `aws_batch_compute_environment` | **USES** | `aws_ami` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_s3_bucket` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_api_gateway_rest_api` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_api_gateway_domain_name` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_resource` | FORWARD |
| `aws_cloudtrail` | **LOGS** | `aws_s3_bucket` | FORWARD |
| `aws_cloudtrail` | **LOGS** | `aws_cloudwatch_log_group` | FORWARD |
| `aws_cloudtrail` | **SENDS** | `aws_s3` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_lambda` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_dynamodb` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_s3_bucket` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_lambda_function` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_dynamodb_table` | REVERSE |
| `aws_cloudwatch_event_rule` | **TRIGGERS** | `aws_resource` | FORWARD |
| `aws_codeartifact_domain` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_codeartifact_domain` | **DENIES** | `aws_resource` | FORWARD |
| `aws_codeartifact_repository` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_codeartifact_repository` | **DENIES** | `aws_resource` | FORWARD |
| `aws_datasync_location` | **CONNECTS** | `aws_s3_bucket` | FORWARD |
| `aws_datasync_location` | **CONNECTS** | `aws_efs_file_system` | FORWARD |
| `aws_datasync_location` | **CONNECTS** | `aws_fsx_file_system` | FORWARD |
| `aws_datasync_task` | **USES** | `aws_cloudwatch_log_group` | FORWARD |
| `aws_dynamodb_table` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_dynamodb_table` | **DENIES** | `aws_resource` | FORWARD |
| `aws_ec2` | **HAS** | `aws_ec2_transit_gateway` | FORWARD |
| `aws_ec2_transit_gateway_vpc_attachment` | **USES** | `aws_vpc` | FORWARD |
| `aws_ecr_repository` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_ecr_repository` | **DENIES** | `aws_resource` | REVERSE |
| `aws_ecs_task` | **USES** | `aws_eni` | FORWARD |
| `aws_efs_file_system` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_efs_file_system` | **DENIES** | `aws_resource` | FORWARD |
| `aws_eks_cluster` | **ALLOWS** | `internet` | REVERSE |
| `aws_elasticsearch_domain` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_elasticsearch_domain` | **DENIES** | `aws_resource` | REVERSE |
| `aws_firewall_rule_group` | **USES** | `aws_prefix_list` | FORWARD |
| `aws_fms_resource_set` | **HAS** | `aws_resource` | FORWARD |
| `aws_glacier_vault` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_glacier_vault` | **DENIES** | `aws_resource` | FORWARD |
| `aws_glue_catalog_database` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_glue_catalog_database` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_group_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_group_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_role` | **ASSIGNED** | `aws_auditmanager_setting` | REVERSE |
| `aws_iam_role` | **ASSIGNED** | `aws_auditmanager_delegation` | REVERSE |
| `aws_iam_role` | **ASSIGNED** | `aws_datasync_location` | FORWARD |
| `aws_iam_role` | **TRUSTS** | `aws_resource` | FORWARD |
| `aws_iam_role` | **TRUSTS** | `external_resource` | FORWARD |
| `aws_iam_role` | **USES** | `aws_neptune_analytics_graph_export_task` | REVERSE |
| `aws_iam_role` | **USES** | `aws_neptune_analytics_graph_import_task` | REVERSE |
| `aws_iam_role_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_role_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_saml_provider` | **IS** | `external_resource` | FORWARD |
| `aws_iam_user_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_user_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_inspectorv2_finding` | **IS** | `cve` | FORWARD |
| `aws_instance` | **USES** | `aws_ami` | FORWARD |
| `aws_instance_patch_state` | **GENERATED** | `aws_patch_baseline` | REVERSE |
| `aws_kinesis_stream` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_kinesis_stream` | **DENIES** | `aws_resource` | FORWARD |
| `aws_kms_key` | **USES** | `aws_auditmanager_setting` | REVERSE |
| `aws_kms_key` | **USES** | `aws_eventbridge_event_bus` | REVERSE |
| `aws_kms_key` | **USES** | `aws_cloudwatch_log_group` | REVERSE |
| `aws_kms_key` | **USES** | `aws_dynamodb_table` | REVERSE |
| `aws_kms_key` | **USES** | `aws_keyspaces_table` | REVERSE |
| `aws_kms_key` | **USES** | `aws_ebs_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_ebs_volume` | REVERSE |
| `aws_kms_key` | **USES** | `aws_efs_file_system` | REVERSE |
| `aws_kms_key` | **USES** | `aws_elasticache_redis_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_elasticache_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_glue_security_configuration` | REVERSE |
| `aws_kms_key` | **USES** | `aws_guardduty_publishing_destination` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_database_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_database_instance` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph_export_task` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph_import_task` | REVERSE |
| `aws_kms_key` | **USES** | `aws_rds_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_db_instance` | REVERSE |
| `aws_kms_key` | **USES** | `aws_db_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_db_cluster_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_redshift_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_s3_bucket` | REVERSE |
| `aws_kms_key` | **USES** | `aws_sns_topic` | REVERSE |
| `aws_kms_key` | **USES** | `aws_xray_encryption_config` | REVERSE |
| `aws_kms_key` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_kms_key` | **DENIES** | `aws_resource` | FORWARD |
| `aws_lambda_function` | **USES** | `aws_lambda_layer` | FORWARD |
| `aws_lambda_function` | **USES** | `aws_signer_signing_profile` | FORWARD |
| `aws_lambda_function` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_lambda_function` | **DENIES** | `aws_resource` | FORWARD |
| `aws_launch_template_version` | **USES** | `aws_ami` | FORWARD |
| `aws_lb_target_group` | **HAS** | `aws_eip` | FORWARD |
| `aws_lexv2_bot` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_lexv2_bot` | **DENIES** | `aws_resource` | FORWARD |
| `aws_lexv2_bot_alias` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_lexv2_bot_alias` | **DENIES** | `aws_resource` | FORWARD |
| `aws_macie_classification_export_configuration` | **USES** | `aws_s3_bucket` | FORWARD |
| `aws_macie_classification_export_configuration` | **USES** | `aws_kms_key` | FORWARD |
| `aws_macie_classification_job` | **SCANS** | `aws_s3_bucket` | FORWARD |
| `aws_nat_gateway` | **USES** | `aws_eip` | FORWARD |
| `aws_network_acl` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_network_acl` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_network_acl` | **DENIES** | `aws_resource` | FORWARD |
| `aws_network_acl` | **DENIES** | `aws_resource` | REVERSE |
| `aws_opensearch_domain` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_opensearch_domain` | **DENIES** | `aws_resource` | REVERSE |
| `aws_organization_policy` | **ENFORCES** | `aws_organization_root` | FORWARD |
| `aws_organization_policy` | **ENFORCES** | `aws_account` | FORWARD |
| `aws_organization_policy` | **ENFORCES** | `aws_organizational_unit` | FORWARD |
| `aws_organization_root` | **HAS** | `aws_account` | FORWARD |
| `aws_organizational_unit` | **HAS** | `aws_account` | FORWARD |
| `aws_patch_group` | **USES** | `aws_patch_baseline` | FORWARD |
| `aws_prometheus_scraper` | **SCANS** | `aws_eks_cluster` | FORWARD |
| `aws_prometheus_scraper` | **USES** | `aws_subnet` | FORWARD |
| `aws_prometheus_scraper` | **USES** | `aws_security_group` | FORWARD |
| `aws_prometheus_scraper` | **USES** | `aws_iam_role` | FORWARD |
| `aws_prometheus_scraper` | **SENDS** | `aws_prometheus_workspace` | FORWARD |
| `aws_prometheus_workspace` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_prometheus_workspace` | **DENIES** | `aws_resource` | FORWARD |
| `aws_ram_shared_resource` | **IS** | `aws_resource` | FORWARD |
| `aws_resource` | **USES** | `aws_acm_certificate` | REVERSE |
| `aws_route_table` | **USES** | `aws_prefix_list` | FORWARD |
| `aws_route53_record` | **CONNECTS** | `aws_acm_certificate` | REVERSE |
| `aws_route53_record` | **CONNECTS** | `aws_ses` | FORWARD |
| `aws_route53_record` | **CONNECTS** | `aws_resource` | FORWARD |
| `aws_s3_bucket` | **USES** | `aws_auditmanager_setting` | REVERSE |
| `aws_s3_bucket` | **HAS** | `aws_s3_access_point` | REVERSE |
| `aws_s3_bucket` | **PUBLISHES** | `aws_s3_bucket` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_account` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_account` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `everyone` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `everyone` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `aws_authenticated_users` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_authenticated_users` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `aws_s3` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_s3` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_s3_bucket` | **DENIES** | `aws_resource` | REVERSE |
| `aws_secret` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_secret` | **DENIES** | `aws_resource` | FORWARD |
| `aws_security_group` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_security_group` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_security_group` | **USES** | `aws_prefix_list` | FORWARD |
| `aws_security_group` | **ALLOWS** | `aws_prefix_list` | FORWARD |
| `aws_servicecatalog_portfolio` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_ses_identity` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_ses_identity` | **DENIES** | `aws_resource` | FORWARD |
| `aws_sns_subscription` | **HAS** | `aws_resource` | FORWARD |
| `aws_sns_topic` | **USES** | `aws_auditmanager_setting` | REVERSE |
| `aws_sns_topic` | **NOTIFIES** | `aws_resource` | FORWARD |
| `aws_sns_topic` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_sns_topic` | **DENIES** | `aws_resource` | REVERSE |
| `aws_sqs_queue` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_sqs_queue` | **DENIES** | `aws_resource` | REVERSE |
| `aws_sso_group` | **ASSIGNED** | `aws_account` | FORWARD |
| `aws_sso_permission_set` | **ASSIGNED** | `aws_iam_policy` | FORWARD |
| `aws_sso_permission_set` | **ASSIGNED** | `aws_account` | FORWARD |
| `aws_sso_user` | **ASSIGNED** | `aws_account` | FORWARD |
| `aws_vpc` | **LOGS** | `aws_cloudwatch_log_group` | FORWARD |
| `aws_vpc` | **LOGS** | `aws_s3_bucket` | FORWARD |
| `aws_vpc` | **CONNECTS** | `aws_vpc` | FORWARD |
| `aws_vpc` | **CONNECTS** | `aws_vpc` | REVERSE |
| `aws_vpc_endpoint` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_vpc_endpoint` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_vpc_endpoint` | **DENIES** | `aws_resource` | FORWARD |
| `aws_vpc_endpoint` | **DENIES** | `aws_resource` | REVERSE |

### Aws Api Gateway Stage Method Setting

`aws_api_gateway_stage_method_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cacheTtlInSeconds` | `number` |  |  |
| `isAuthorizationForCacheControlRequired` | `boolean` |  |  |
| `isCacheDataEncrypted` | `boolean` |  |  |
| `isCachingEnabled` | `boolean` |  |  |
| `isDataTraceEnabled` | `boolean` |  |  |
| `isMetricsEnabled` | `boolean` |  |  |
| `loggingLevel` | `string` |  |  |
| `methodPath` | `string` |  |  |
| `throttlingBurstLimit` | `number` |  |  |
| `throttlingRateLimit` | `number` |  |  |
| `unauthorizedCacheControlHeaderStrategy` | `string` |  |  |

---

### Aws Appconfig Account Settings

`aws_appconfig_account_settings` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns these settings. |  |
| 

`deletionProtectionPeriodInMinutes` \*

 | `number` **|** `null` | The interval, in minutes, during which AppConfig monitors for configuration retrieval before allowing deletion of a configuration profile or environment. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | Whether deletion protection is enabled for the account in this region, preventing deletion of actively-used environments and configuration profiles. |  |
| 

`isVendedMetricsEnabled` \*

 | `boolean` **|** `null` | Whether AppConfig publishes vended CloudWatch metrics for the account in this region. |  |
| 

`region` \*

 | `string` | AWS region these account settings apply to. |  |

---

### Aws Appconfig Application

`aws_appconfig_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig application. |  |
| 

`region` \*

 | `string` | AWS region where the application is deployed. |  |

---

### Aws Appconfig Configuration Profile

`aws_appconfig_configuration_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig configuration profile. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt configuration data at rest. |  |
| 

`kmsKeyIdentifier` \*

 | `string` **|** `null` | KMS key identifier (alias or key ID) used for encryption. |  |
| 

`locationUri` \*

 | `string` **|** `null` | URI pointing to the source of configuration data (S3 URI, SSM parameter, or hosted). |  |
| 

`region` \*

 | `string` | AWS region where the profile is deployed. |  |
| 

`retrievalRoleArn` \*

 | `string` **|** `null` | IAM role ARN that AppConfig uses to retrieve configuration from the location URI. |  |
| 

`type` \*

 | `string` **|** `null` | The type of the configuration profile (AWS.AppConfig.FeatureFlags or AWS.Freeform). |  |
| 

`validatorTypes` \*

 | `array` **|** `null` | List of validator types attached to this profile (JSON\_SCHEMA, LAMBDA). |  |

---

### Aws Appconfig Deployment

`aws_appconfig_deployment` inherits from [Deployment](/data-model/schemas/Deployment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig deployment. |  |
| 

`configurationLocationUri` \*

 | `string` **|** `null` | URI of the configuration source used in this deployment. |  |
| 

`configurationName` \*

 | `string` **|** `null` | Name of the configuration profile used in this deployment. |  |
| 

`deploymentNumber` \*

 | `number` | The sequence number of this deployment within the environment. |  |
| 

`deploymentStrategyId` \*

 | `string` **|** `null` | ID of the deployment strategy used for this deployment. |  |
| 

`environmentId` \*

 | `string` | The ID of the environment to which the configuration was deployed. |  |
| 

`extensionId` \*

 | `string` **|** `null` | ID of the AppConfig extension associated with this deployment. |  |
| 

`finalBakeTimeInMinutes` \*

 | `number` **|** `null` | Bake time in minutes applied during this deployment. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt configuration data for this deployment. |  |
| 

`kmsKeyIdentifier` \*

 | `string` **|** `null` | KMS key identifier used during this deployment. |  |
| 

`region` \*

 | `string` | AWS region where the deployment was executed. |  |
| 

`versionLabel` \*

 | `string` **|** `null` | Customer-defined version label for the configuration version deployed. |  |

---

### Aws Appconfig Deployment Strategy

`aws_appconfig_deployment_strategy` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the AppConfig deployment strategy. |  |
| 

`finalBakeTimeInMinutes` \*

 | `number` **|** `null` | Additional time in minutes to monitor after a deployment completes before it is considered successful. |  |
| 

`region` \*

 | `string` | AWS region where the deployment strategy is defined. |  |
| 

`replicateTo` \*

 | `string` **|** `null` | Whether to replicate the deployment strategy to AWS Systems Manager (SSM\_DOCUMENT) or not (NONE). |  |

---

### Aws Appconfig Environment

`aws_appconfig_environment` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alarmArn` \*

 | `string` **|** `null` | ARN of the CloudWatch alarm monitoring this environment. |  |
| 

`alarmRoleArn` \*

 | `string` **|** `null` | IAM role ARN used by AppConfig to evaluate CloudWatch alarms for this environment. |  |
| 

`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig environment. |  |
| 

`region` \*

 | `string` | AWS region where the environment is deployed. |  |
| 

`state` \*

 | `string` **|** `null` | The current state of the environment (e.g. READY\_FOR\_DEPLOYMENT, DEPLOYING, ROLLED\_BACK). |  |

---

### Aws Appconfig Hosted Configuration Version

`aws_appconfig_hosted_configuration_version` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the hosted configuration version. |  |
| 

`configurationProfileId` \*

 | `string` | The ID of the configuration profile this version belongs to. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt this hosted configuration version. |  |
| 

`region` \*

 | `string` | AWS region where the hosted configuration version is stored. |  |
| 

`versionNumber` \*

 | `number` | The version number of this hosted configuration version. |  |

---

### Aws Athena Work Group

`aws_athena_work_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`additionalConfiguration` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`bytesScannedCutoffPerQuery` \*

 | `number` **|** `null` |  |  |
| 

`customerContentEncryptionKmsKey` \*

 | `string` **|** `null` |  |  |
| 

`encrypted` \*

 | `boolean` |  |  |
| 

`encryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`engineVersionEffective` \*

 | `string` **|** `null` |  |  |
| 

`engineVersionSelected` \*

 | `string` **|** `null` |  |  |
| 

`executionRole` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterApplicationArn` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isEnforceWorkGroupConfiguration` \*

 | `boolean` **|** `null` |  |  |
| 

`isIdentityCenterEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isMinimumEncryptionEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublishCloudWatchMetricsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isRequesterPaysEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resultAclConfiguration` \*

 | `string` **|** `null` |  |  |
| 

`resultEncryptionKmsKey` \*

 | `string` **|** `null` |  |  |
| 

`resultEncryptionOption` \*

 | `string` **|** `null` |  |  |
| 

`resultExpectedBucketOwner` \*

 | `string` **|** `null` |  |  |
| 

`resultOutputLocation` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Auditmanager Assessment

`aws_auditmanager_assessment` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`assessmentReportDestination` \*

 | `string` **|** `null` |  |  |
| 

`awsAccountEmailAddress` \*

 | `string` **|** `null` |  |  |
| 

`awsAccountId` \*

 | `string` **|** `null` |  |  |
| 

`awsAccountName` \*

 | `string` **|** `null` |  |  |
| 

`complianceType` \*

 | `string` **|** `null` |  |  |
| 

`delegationsCount` \*

 | `number` |  |  |
| 

`frameworkArn` \*

 | `string` **|** `null` |  |  |
| 

`frameworkDescription` \*

 | `string` **|** `null` |  |  |
| 

`frameworkId` \*

 | `string` **|** `null` |  |  |
| 

`frameworkName` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`rolesCount` \*

 | `number` |  |  |
| 

`scopeAwsAccounts` \*

 | `array` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |

---

### Aws Auditmanager Control

`aws_auditmanager_control` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`actionPlanInstructions` \*

 | `string` **|** `null` |  |  |
| 

`actionPlanTitle` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`controlMappingSourcesCount` \*

 | `number` |  |  |
| 

`controlSources` \*

 | `string` **|** `null` |  |  |
| 

`createdBy` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastUpdatedBy` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`testingInformation` \*

 | `string` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Aws Auditmanager Delegation

`aws_auditmanager_delegation` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`assessmentId` \*

 | `string` **|** `null` |  |  |
| 

`assessmentName` \*

 | `string` **|** `null` |  |  |
| 

`controlSetName` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Auditmanager Evidence Folder

`aws_auditmanager_evidence_folder` inherits from [DataObject](/data-model/schemas/DataObject.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assessmentId` \*

 | `string` |  |  |
| 

`assessmentReportSelectionCount` \*

 | `number` |  |  |
| 

`author` \*

 | `string` **|** `null` |  |  |
| 

`controlId` \*

 | `string` |  |  |
| 

`controlName` \*

 | `string` **|** `null` |  |  |
| 

`controlSetId` \*

 | `string` |  |  |
| 

`dataSource` \*

 | `string` **|** `null` |  |  |
| 

`evidenceAwsServiceSourceCount` \*

 | `number` |  |  |
| 

`evidenceByTypeComplianceCheckCount` \*

 | `number` |  |  |
| 

`evidenceByTypeComplianceCheckIssuesCount` \*

 | `number` |  |  |
| 

`evidenceByTypeConfigurationDataCount` \*

 | `number` |  |  |
| 

`evidenceByTypeManualCount` \*

 | `number` |  |  |
| 

`evidenceByTypeUserActivityCount` \*

 | `number` |  |  |
| 

`evidenceResourcesIncludedCount` \*

 | `number` |  |  |
| 

`firstEvidenceAddedOn` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`totalEvidence` \*

 | `number` |  |  |

---

### Aws Auditmanager Framework

`aws_auditmanager_framework` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`complianceType` \*

 | `string` **|** `null` |  |  |
| 

`controlsCount` \*

 | `number` |  |  |
| 

`controlSetIds` \*

 | `array` **|** `null` |  |  |
| 

`controlSetsCount` \*

 | `number` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`logo` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Auditmanager Setting

`aws_auditmanager_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`defaultAssessmentReportsDestination` \*

 | `string` **|** `null` |  |  |
| 

`defaultAssessmentReportsDestinationBucketName` \*

 | `string` **|** `null` |  |  |
| 

`defaultAssessmentReportsDestinationType` \*

 | `string` **|** `null` |  |  |
| 

`defaultExportDestination` \*

 | `string` **|** `null` |  |  |
| 

`defaultExportDestinationBucketName` \*

 | `string` **|** `null` |  |  |
| 

`defaultExportDestinationType` \*

 | `string` **|** `null` |  |  |
| 

`defaultProcessOwnerRoleArns` \*

 | `array` **|** `null` |  |  |
| 

`deregistrationDeleteResources` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderBackfillStatus` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderEnablementStatus` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderError` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderEventDataStoreArn` \*

 | `string` **|** `null` |  |  |
| 

`isAwsOrgEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isDefaultKmsKey` \*

 | `boolean` **|** `null` |  |  |
| 

`isEvidenceFinderEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`snsTopicArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Bedrock Agent

`aws_bedrock_agent` inherits from [Function](/data-model/schemas/Function.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentCollaboration` \*

 | `string` **|** `null` | Multi-agent collaboration mode (e.g., DISABLED, SUPERVISOR) |  |
| `agentId` | `string` | Unique identifier for the Bedrock agent |  |
| `arn` | `string` | ARN of the Bedrock agent |  |
| 

`customerEncryptionKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt agent resources |  |
| 

`displayName` \*

 | `string` | Display name of the Bedrock agent |  |
| 

`foundationModel` \*

 | `string` **|** `null` | Foundation model identifier used by the agent |  |
| 

`guardrailId` \*

 | `string` **|** `null` | ID of the Bedrock guardrail associated with this agent |  |
| 

`hasInstruction` \*

 | `boolean` **|** `null` | Whether the agent has a system instruction configured; true if instruction text is present |  |
| 

`idleSessionTTLInSeconds` \*

 | `number` **|** `null` | Time in seconds before an idle session expires |  |
| 

`instruction` \*

 | `string` **|** `null` | System instruction prompt given to the agent |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the agent is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`isGuardrailAssociated` \*

 | `boolean` **|** `null` | Whether a guardrail is associated with this agent; true means content filtering is active |  |
| 

`isMemoryEnabled` \*

 | `boolean` **|** `null` | Whether the agent retains memory across sessions |  |
| 

`name` \*

 | `string` | Name of the Bedrock agent |  |
| 

`orchestrationType` \*

 | `string` **|** `null` | Orchestration strategy used by the agent (e.g., DEFAULT, CUSTOM\_ORCHESTRATION) |  |
| `preparedOn` | `number` | Timestamp (epoch ms) when the agent was last prepared |  |
| 

`region` \*

 | `string` | AWS region where the agent is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM role assumed by the agent for API calls |  |

---

### Aws Bedrock Agent Action Group

`aws_bedrock_agent_action_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`actionGroupExecutor` \*

 | `string` **|** `null` | Type of executor for the action group (e.g., LAMBDA, RETURN\_CONTROL) |  |
| `actionGroupId` | `string` | Unique identifier for the action group |  |
| `agentId` | `string` | ID of the parent Bedrock agent that owns this action group |  |
| 

`apiSchemaS3Uri` \*

 | `string` **|** `null` | S3 URI of the OpenAPI schema defining the action group API |  |
| 

`apiSchemaType` \*

 | `string` **|** `null` | Type of API schema used (e.g., S3, INLINE) |  |
| 

`displayName` \*

 | `string` | Display name of the action group |  |
| 

`functionCount` \*

 | `number` **|** `null` | Number of functions defined in the action group |  |
| 

`functionNames` \*

 | `array` **|** `null` | Names of functions defined in the action group function schema |  |
| 

`isLambdaBacked` \*

 | `boolean` **|** `null` | Whether this action group executes via a Lambda function; true means external code execution |  |
| 

`isReturnControl` \*

 | `boolean` **|** `null` | Whether the action group returns control to the caller instead of executing directly |  |
| 

`lambdaFunctionArn` \*

 | `string` **|** `null` | ARN of the Lambda function invoked by this action group |  |
| 

`name` \*

 | `string` | Name of the action group |  |
| 

`parentActionGroupSignature` \*

 | `string` **|** `null` | Signature of a built-in parent action group (e.g., AMAZON.UserInput, AMAZON.CodeInterpreter) |  |
| 

`region` \*

 | `string` | AWS region where the action group is defined |  |

---

### Aws Bedrock Agent Runtime

`aws_bedrock_agent_runtime` inherits from [Workload](/data-model/schemas/Workload.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentRuntimeId` \*

 | `string` **|** `null` |  |  |
| 

`agentRuntimeVersion` \*

 | `string` **|** `null` |  |  |
| `arn` | `string` |  |  |
| 

`failureReason` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublicNetwork` \*

 | `boolean` **|** `null` |  |  |
| 

`isVpcConfigured` \*

 | `boolean` **|** `null` |  |  |
| 

`networkMode` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`serverProtocol` \*

 | `string` **|** `null` |  |  |
| 

`subnetIds` \*

 | `array` **|** `null` |  |  |

---

### Aws Bedrock Api Key

`aws_bedrock_api_key` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiKeyId` \*

 | `string` | IAM ServiceSpecificCredentialId — unique identifier for the API key |  |
| 

`isAutoCreatedUser` \*

 | `boolean` **|** `null` | True when the owning IAM user was auto-created by AWS for this key (UserName starts with "BedrockAPIKey-") |  |
| 

`isExpired` \*

 | `boolean` **|** `null` | True when the API key has reached its expiration date |  |
| 

`isNeverExpiring` \*

 | `boolean` **|** `null` | True when the API key was created without an expiration date — long-lived credential risk |  |
| 

`region` \*

 | `string` | Region label - API keys are global; set to "global" for the entity |  |
| 

`serviceCredentialAlias` \*

 | `string` **|** `null` | Public, non-secret prefix of the bearer token; safe to display |  |
| 

`serviceName` \*

 | `string` | AWS service the credential is scoped to (always bedrock.amazonaws.com) |  |
| 

`serviceUserName` \*

 | `string` **|** `null` | Service-side username generated by IAM for the key |  |
| `status` | `string` | Lifecycle status — Active, Inactive, or Expired |  |
| 

`userName` \*

 | `string` | IAM user that owns the API key |  |

---

### Aws Bedrock Api Key Credential Provider

`aws_bedrock_api_key_credential_provider` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiKeySecretArn` \*

 | `string` **|** `null` | ARN of the Secrets Manager secret holding the API key (ARN only, never the value) |  |
| `arn` | `string` |  |  |
| 

`credentialProviderArn` \*

 | `string` **|** `null` | ARN of the API key credential provider |  |
| 

`region` \*

 | `string` | AWS region where the credential provider is deployed |  |

---

### Aws Bedrock Browser

`aws_bedrock_browser` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`failureReason` \*

 | `string` **|** `null` | Reason the browser entered a failed state, if any |  |
| 

`isPublicNetwork` \*

 | `boolean` **|** `null` | Whether the browser egresses over the public network |  |
| 

`isRecordingEnabled` \*

 | `boolean` **|** `null` | Whether browser session recording to S3 is enabled for the browser |  |
| 

`isVpcConfigured` \*

 | `boolean` **|** `null` | Whether the browser is configured with a VPC |  |
| 

`networkMode` \*

 | `string` **|** `null` | Network mode of the browser (PUBLIC or VPC) |  |
| 

`recordingS3Bucket` \*

 | `string` **|** `null` | Name of the S3 bucket browser session recordings are written to |  |
| 

`recordingS3Prefix` \*

 | `string` **|** `null` | S3 key prefix under which browser session recordings are written |  |
| 

`region` \*

 | `string` | AWS region where the browser is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM execution role the browser assumes |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Security group IDs attached to the browser VPC config |  |
| 

`subnetIds` \*

 | `array` **|** `null` | Subnet IDs attached to the browser VPC config |  |

---

### Aws Bedrock Browser Profile

`aws_bedrock_browser_profile` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`lastSavedBrowserId` \*

 | `string` **|** `null` | Identifier of the browser whose session data was last saved to the profile |  |
| 

`lastSavedBrowserSessionId` \*

 | `string` **|** `null` | Identifier of the browser session whose data was last saved to the profile |  |
| 

`lastSavedOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) browser session data was last saved to the profile |  |
| 

`region` \*

 | `string` | AWS region where the browser profile is deployed |  |

---

### Aws Bedrock Code Interpreter

`aws_bedrock_code_interpreter` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`codeInterpreterId` \*

 | `string` **|** `null` |  |  |
| 

`failureReason` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublicNetwork` \*

 | `boolean` **|** `null` |  |  |
| 

`isSandboxed` \*

 | `boolean` **|** `null` |  |  |
| 

`isVpcConfigured` \*

 | `boolean` **|** `null` |  |  |
| 

`networkMode` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`subnetIds` \*

 | `array` **|** `null` |  |  |

---

### Aws Bedrock Custom Model

`aws_bedrock_custom_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the custom model |  |
| 
`baseModelArn` \*

 | `string` **|** `null` | ARN of the foundation model used as the base for customization |  |
| 

`customizationType` \*

 | `string` **|** `null` | Type of customization applied (e.g., FINE\_TUNING, CONTINUED\_PRE\_TRAINING) |  |
| 

`displayName` \*

 | `string` | Display name of the custom model |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the custom model is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`jobArn` \*

 | `string` **|** `null` | ARN of the model customization job that produced this model |  |
| `modelId` | `string` | Unique identifier for the custom model |  |
| 

`modelKmsKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt the custom model |  |
| 

`name` \*

 | `string` | Name of the custom model |  |
| 

`outputDataConfigS3Uri` \*

 | `string` **|** `null` | S3 URI where training output artifacts are stored |  |
| 

`region` \*

 | `string` | AWS region where the custom model is stored |  |
| 

`trainingDataConfigS3Uri` \*

 | `string` **|** `null` | S3 URI of the training dataset used to create the custom model |  |

---

### Aws Bedrock Evaluation Job

`aws_bedrock_evaluation_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationType` \*

 | `string` **|** `null` |  |  |
| `arn` | `string` |  |  |
| 

`customerEncryptionKeyId` \*

 | `string` **|** `null` |  |  |
| 

`evaluationDatasets` \*

 | `array` **|** `null` |  |  |
| 

`evaluationMetrics` \*

 | `array` **|** `null` |  |  |
| 

`failureMessages` \*

 | `array` **|** `null` |  |  |
| 

`isAutomatedEvaluation` \*

 | `boolean` **|** `null` |  |  |
| 

`isHumanEvaluation` \*

 | `boolean` **|** `null` |  |  |
| 

`isModelInference` \*

 | `boolean` **|** `null` |  |  |
| 

`isRagInference` \*

 | `boolean` **|** `null` |  |  |
| 

`jobDescription` \*

 | `string` **|** `null` |  |  |
| 

`jobName` \*

 | `string` **|** `null` |  |  |
| 

`jobType` \*

 | `string` **|** `null` |  |  |
| `lastModifiedOn` | `number` | Timestamp (epoch ms) when the evaluation job was last modified |  |
| 

`modelIdentifiers` \*

 | `array` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`outputDataConfigS3Uri` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`taskType` \*

 | `string` **|** `null` |  |  |

---

### Aws Bedrock Evaluator

`aws_bedrock_evaluator` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`isLockedForModification` \*

 | `boolean` **|** `null` | Whether the evaluator is locked because an active config references it |  |
| 

`level` \*

 | `string` **|** `null` | Evaluation scope level (TOOL\_CALL, TRACE, or SESSION) |  |
| 

`region` \*

 | `string` | AWS region where the evaluator is deployed |  |

---

### Aws Bedrock Flow

`aws_bedrock_flow` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the Bedrock flow |  |
| 
`connectionCount` \*

 | `number` **|** `null` | Number of connections between nodes in the flow |  |
| 

`customerEncryptionKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt flow resources |  |
| 

`displayName` \*

 | `string` | Display name of the flow |  |
| `flowId` | `string` | Unique identifier for the flow |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the flow is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`name` \*

 | `string` | Name of the flow |  |
| 

`nodeCount` \*

 | `number` **|** `null` | Number of nodes in the flow definition |  |
| 

`region` \*

 | `string` | AWS region where the flow is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM role assumed by the flow during execution |  |
| 

`version` \*

 | `string` **|** `null` | Version identifier of the flow |  |

---

### Aws Bedrock Foundation Model

`aws_bedrock_foundation_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agreementStatus` \*

 | `string` **|** `null` | Whether the end user license agreement for the model has been accepted in this account (e.g., AVAILABLE, NOT\_AVAILABLE, ERROR) |  |
| `arn` | `string` | ARN of the foundation model |  |
| 

`authorizationStatus` \*

 | `string` **|** `null` | Whether the account is authorized to invoke the model (e.g., AUTHORIZED, NOT\_AUTHORIZED) |  |
| 

`customizationsSupported` \*

 | `array` **|** `null` | Customization types supported (e.g., FINE\_TUNING, CONTINUED\_PRE\_TRAINING) |  |
| 

`displayName` \*

 | `string` | Display name of the foundation model |  |
| 

`entitlementAvailability` \*

 | `string` **|** `null` | Whether the account is entitled to the model (e.g., AVAILABLE, NOT\_AVAILABLE) |  |
| 

`inferenceTypesSupported` \*

 | `array` **|** `null` | Inference types the model supports (e.g., ON\_DEMAND, PROVISIONED) |  |
| 

`inputModalities` \*

 | `array` **|** `null` | Input modalities supported by the model (e.g., TEXT, IMAGE, EMBEDDING) |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the model lifecycle status is ACTIVE and available for use |  |
| 

`isAuthorized` \*

 | `boolean` **|** `null` | Whether the account is currently authorized to invoke this model; derived from authorizationStatus |  |
| 

`isFineTuneable` \*

 | `boolean` **|** `null` | Whether the model can be fine-tuned with custom training data |  |
| 

`isStreamingSupported` \*

 | `boolean` **|** `null` | Whether the model supports streaming inference responses |  |
| `modelId` | `string` | Unique model identifier (e.g., anthropic.claude-3-sonnet-20240229-v1:0) |  |
| 

`modelLifecycleStatus` \*

 | `string` **|** `null` | Lifecycle status of the model (e.g., ACTIVE, LEGACY) |  |
| 

`modelName` \*

 | `string` **|** `null` | Human-readable name of the model (e.g., Claude 3 Sonnet) |  |
| 

`name` \*

 | `string` | Name of the foundation model |  |
| 

`outputModalities` \*

 | `array` **|** `null` | Output modalities supported by the model (e.g., TEXT, IMAGE, EMBEDDING) |  |
| 

`providerName` \*

 | `string` **|** `null` | Name of the model provider (e.g., Anthropic, Amazon, Meta) |  |
| 

`region` \*

 | `string` | AWS region where the model is available |  |
| 

`regionAvailability` \*

 | `string` **|** `null` | Whether the model is available in the region (e.g., AVAILABLE, NOT\_AVAILABLE) |  |

---

### Aws Bedrock Gateway

`aws_bedrock_gateway` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`authorizerType` \*

 | `string` **|** `null` | Authorizer type that controls access to the gateway |  |
| 

`category` \*

 | `array` of `string`s | OSI-layer category of the gateway |  |
| 

`exceptionLevel` \*

 | `string` **|** `null` | Verbosity of errors returned to callers (DEBUG leaks internals) |  |
| 

`function` \*

 | `array` of `string`s | Function the gateway performs |  |
| 

`gatewayUrl` \*

 | `string` **|** `null` | Public invocation endpoint URL of the gateway |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt the gateway |  |
| 

`protocolType` \*

 | `string` **|** `null` | Protocol the gateway exposes (e.g., MCP) |  |
| 

`public` \*

 | `boolean` | Whether the gateway exposes a public invocation endpoint |  |
| 

`region` \*

 | `string` | AWS region where the gateway is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM role the gateway assumes |  |

---

### Aws Bedrock Gateway Target

`aws_bedrock_gateway_target` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiKeyCredentialProviderArns` \*

 | `array` **|** `null` | ARNs of API key credential providers used by this target (ARNs only, never the secret) |  |
| `arn` | `string` |  |  |
| 

`lastSynchronizedOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) the target was last synchronized |  |
| 

`region` \*

 | `string` | AWS region where the gateway target is deployed |  |
| 

`targetId` \*

 | `string` **|** `null` | Identifier of the target within its gateway |  |

---

### Aws Bedrock Guardrail

`aws_bedrock_guardrail` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the Bedrock guardrail |  |
| 
`blockedInputMessaging` \*

 | `string` **|** `null` | Message returned to users when their input is blocked by the guardrail |  |
| 

`blockedOutputsMessaging` \*

 | `string` **|** `null` | Message returned to users when model output is blocked by the guardrail |  |
| 

`blockedTopicCount` \*

 | `number` **|** `null` | Number of topics configured as blocked in the topic policy |  |
| 

`contentFilterTypes` \*

 | `array` **|** `null` | Types of content filters enabled (e.g., SEXUAL, VIOLENCE, HATE, INSULTS) |  |
| 

`displayName` \*

 | `string` | Display name of the guardrail |  |
| 

`failureRecommendations` \*

 | `array` **|** `null` | Recommendations for resolving guardrail creation or update failures |  |
| 

`groundingThreshold` \*

 | `number` **|** `null` | Minimum grounding score (0-1) required for responses to pass the grounding filter |  |
| `guardrailId` | `string` | Unique identifier for the guardrail |  |
| 

`guardrailProfileArn` \*

 | `string` **|** `null` | ARN of the cross-region guardrail profile for multi-region deployments |  |
| 

`isContentFilterEnabled` \*

 | `boolean` **|** `null` | Whether content filtering is enabled to block harmful content categories |  |
| 

`isContextualGroundingEnabled` \*

 | `boolean` **|** `null` | Whether contextual grounding checks are enabled to reduce hallucination |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the guardrail is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`isPiiDetectionEnabled` \*

 | `boolean` **|** `null` | Whether PII detection is enabled to identify or block personally identifiable information |  |
| 

`isPromptAttackDetectionEnabled` \*

 | `boolean` **|** `null` | Whether prompt attack (injection) detection is enabled to protect against adversarial inputs |  |
| 

`isSensitiveInfoFilterEnabled` \*

 | `boolean` **|** `null` | Whether sensitive information filtering (PII/regex) is enabled |  |
| 

`isTopicPolicyEnabled` \*

 | `boolean` **|** `null` | Whether topic-based blocking policies are configured |  |
| 

`isWordFilterEnabled` \*

 | `boolean` **|** `null` | Whether word-based filtering is enabled to block specific terms |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt guardrail data |  |
| 

`managedWordListTypes` \*

 | `array` **|** `null` | Types of managed word lists applied (e.g., PROFANITY) |  |
| 

`name` \*

 | `string` | Name of the guardrail |  |
| 

`piiEntityTypes` \*

 | `array` **|** `null` | PII entity types detected or blocked (e.g., EMAIL, PHONE, SSN) |  |
| 

`regexPatternCount` \*

 | `number` **|** `null` | Number of custom regex patterns configured for sensitive data detection |  |
| 

`region` \*

 | `string` | AWS region where the guardrail is deployed |  |
| 

`relevanceThreshold` \*

 | `number` **|** `null` | Minimum relevance score (0-1) required for responses to pass the relevance filter |  |
| 

`statusReasons` \*

 | `array` **|** `null` | Reasons explaining the current guardrail status |  |
| `version` | `string` | Version of the guardrail (e.g., DRAFT or a numeric version) |  |

---

### Aws Bedrock Imported Model

`aws_bedrock_imported_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the imported model |  |
| 
`customModelUnitsPerModelCopy` \*

 | `number` **|** `null` | Number of custom model units consumed by each copy of the model |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the imported model is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`isInstructSupported` \*

 | `boolean` **|** `null` | Whether the imported model supports the Converse API |  |
| 

`jobArn` \*

 | `string` **|** `null` | ARN of the model import job that created this model |  |
| 

`jobName` \*

 | `string` **|** `null` | Name of the model import job that created this model |  |
| 

`modelArchitecture` \*

 | `string` **|** `null` | Architecture of the imported model (e.g., llama2, mistral) |  |
| 

`modelDataSourceS3Uri` \*

 | `string` **|** `null` | S3 URI of the model weights that were imported into Bedrock |  |
| `modelId` | `string` | Unique identifier for the imported model |  |
| 

`modelKmsKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt the imported model |  |
| 

`region` \*

 | `string` | AWS region where the imported model is stored |  |

---

### Aws Bedrock Inference Profile

`aws_bedrock_inference_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the inference profile |  |
| 
`displayName` \*

 | `string` | Display name of the inference profile |  |
| `inferenceProfileId` | `string` | Unique identifier for the inference profile |  |
| 

`modelArns` \*

 | `array` **|** `null` | ARNs of the models routed to by this inference profile |  |
| 

`name` \*

 | `string` | Name of the inference profile |  |
| 

`region` \*

 | `string` | AWS region where the inference profile is configured |  |
| 

`type` \*

 | `string` **|** `null` | Type of inference profile (e.g., SYSTEM\_DEFINED, APPLICATION) |  |

---

### Aws Bedrock Knowledge Base

`aws_bedrock_knowledge_base` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the Bedrock knowledge base |  |
| 
`displayName` \*

 | `string` | Display name of the knowledge base |  |
| 

`embeddingModelArn` \*

 | `string` **|** `null` | ARN of the embedding model used to vectorize documents |  |
| 

`failureReasons` \*

 | `array` **|** `null` | Reasons why the knowledge base failed to create or update |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the knowledge base is in an active and usable state |  |
| 

`isOpenSearchBacked` \*

 | `boolean` **|** `null` | Whether the knowledge base uses OpenSearch Serverless as its vector store |  |
| `knowledgeBaseId` | `string` | Unique identifier for the knowledge base |  |
| 

`knowledgeBaseType` \*

 | `string` **|** `null` | Type of the knowledge base (e.g., VECTOR, KENDRA) |  |
| 

`name` \*

 | `string` | Name of the knowledge base |  |
| 

`region` \*

 | `string` | AWS region where the knowledge base is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM role used by the knowledge base to access data sources |  |
| 

`storageConfigurationArn` \*

 | `string` **|** `null` | ARN of the vector store resource used for storage |  |
| 

`storageType` \*

 | `string` **|** `null` | Type of vector store backing the knowledge base (e.g., OPENSEARCH\_SERVERLESS, PINECONE, RDS) |  |

---

### Aws Bedrock Knowledge Base Data Source

`aws_bedrock_knowledge_base_data_source` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`chunkingStrategy` \*

 | `string` **|** `null` | Strategy used to chunk documents (e.g., FIXED\_SIZE, NONE, HIERARCHICAL) |  |
| `dataSourceId` | `string` | Unique identifier for the data source |  |
| 

`dataSourceType` \*

 | `string` **|** `null` | Type of data source (e.g., S3, WEB, CONFLUENCE) |  |
| 

`displayName` \*

 | `string` | Display name of the data source |  |
| 

`failureReason` \*

 | `string` **|** `null` | Reason why the data source failed to sync or create |  |
| 

`isS3Backed` \*

 | `boolean` **|** `null` | Whether the data source reads from an S3 bucket |  |
| 

`isWebCrawler` \*

 | `boolean` **|** `null` | Whether the data source crawls web content |  |
| `knowledgeBaseId` | `string` | ID of the parent knowledge base this data source belongs to |  |
| 

`name` \*

 | `string` | Name of the data source |  |
| 

`region` \*

 | `string` | AWS region where the data source is configured |  |
| 

`s3BucketArn` \*

 | `string` **|** `null` | ARN of the S3 bucket used as the data source |  |
| 

`s3InclusionPrefixes` \*

 | `array` **|** `null` | S3 key prefixes that scope which objects are included in the data source |  |

---

### Aws Bedrock Memory

`aws_bedrock_memory` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`encryptionKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt the memory |  |
| 

`eventExpiryDuration` \*

 | `number` **|** `null` | Number of days memory events are retained before expiry |  |
| 

`failureReason` \*

 | `string` **|** `null` | Reason the memory entered a failed state, if any |  |
| 

`memoryExecutionRoleArn` \*

 | `string` **|** `null` | ARN of the IAM role the memory assumes to execute operations |  |
| 

`region` \*

 | `string` | AWS region where the memory is deployed |  |

---

### Aws Bedrock Model Customization Job

`aws_bedrock_model_customization_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`baseModelArn` \*

 | `string` **|** `null` |  |  |
| 

`customizationType` \*

 | `string` **|** `null` |  |  |
| `endTime` | `number` |  |  |
| 

`failureMessage` \*

 | `string` **|** `null` |  |  |
| 

`jobName` \*

 | `string` **|** `null` |  |  |
| `lastModifiedOn` | `number` | Timestamp (epoch ms) when the customization job was last modified |  |
| 

`name` \*

 | `string` |  |  |
| 

`outputDataConfigS3Uri` \*

 | `string` **|** `null` |  |  |
| 

`outputModelArn` \*

 | `string` **|** `null` |  |  |
| 

`outputModelName` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`trainingDataConfigS3Uri` \*

 | `string` **|** `null` |  |  |
| 

`validationDataConfigS3Uris` \*

 | `array` **|** `null` |  |  |

---

### Aws Bedrock Model Invocation Job

`aws_bedrock_model_invocation_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the model invocation job |  |
| 
`endedOn` \*

 | `number` **|** `null` | Timestamp of when the job ended |  |
| 

`inputDataConfigS3BucketOwner` \*

 | `string` **|** `null` | Account id that owns the input bucket, when specified |  |
| 

`inputDataConfigS3Uri` \*

 | `string` **|** `null` | S3 URI the job reads its input records from |  |
| 

`inputS3Format` \*

 | `string` **|** `null` | Format of the input records (e.g., JSONL) |  |
| 

`isVpcConfigured` \*

 | `boolean` **|** `null` | Whether the job runs inside a customer VPC rather than over the public Bedrock endpoint |  |
| 

`jobModelId` \*

 | `string` **|** `null` | Identifier of the model the job invokes; may be a foundation model id or a custom model ARN |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` | Timestamp of when the job was last modified |  |
| 

`outputDataConfigS3BucketOwner` \*

 | `string` **|** `null` | Account id that owns the output bucket, when specified |  |
| 

`outputDataConfigS3Uri` \*

 | `string` **|** `null` | S3 URI the job writes its output records to |  |
| 

`outputS3EncryptionKeyId` \*

 | `string` **|** `null` | Id or ARN of the KMS key used to encrypt the job output in S3 |  |
| 

`region` \*

 | `string` | AWS region where the job runs |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM service role Bedrock assumes to run the job |  |
| 

`statusMessage` \*

 | `string` **|** `null` | Message describing why the job is in its current status |  |
| 

`submittedOn` \*

 | `number` **|** `null` | Timestamp of when the job was submitted |  |
| 

`timeoutDurationInHours` \*

 | `number` **|** `null` | Number of hours after which the job times out |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` | Security group ids the job is attached to, when VPC configured |  |
| 

`vpcSubnetIds` \*

 | `array` **|** `null` | Subnet ids the job is attached to, when VPC configured |  |

---

### Aws Bedrock Model Invocation Logging

`aws_bedrock_model_invocation_logging` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cloudWatchLogGroupName` \*

 | `string` **|** `null` | Name of the CloudWatch log group receiving invocation logs |  |
| 

`isCloudWatchLoggingEnabled` \*

 | `boolean` **|** `null` | Whether model invocation logs are delivered to CloudWatch Logs |  |
| 

`isEmbeddingDataLogged` \*

 | `boolean` **|** `null` | Whether embedding data is included in invocation logs |  |
| 

`isImageDataLogged` \*

 | `boolean` **|** `null` | Whether image input and output data is included in invocation logs |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` | Whether any model invocation logging is enabled; false means no invocation data is captured |  |
| 

`isS3LoggingEnabled` \*

 | `boolean` **|** `null` | Whether model invocation logs are delivered to an S3 bucket |  |
| 

`isTextDataLogged` \*

 | `boolean` **|** `null` | Whether text input and output data is included in invocation logs |  |
| 

`region` \*

 | `string` | AWS region where logging is configured |  |
| 

`s3BucketName` \*

 | `string` **|** `null` | Name of the S3 bucket where invocation logs are stored |  |
| 

`s3KeyPrefix` \*

 | `string` **|** `null` | S3 key prefix for organizing invocation log files |  |

---

### Aws Bedrock Policy Engine

`aws_bedrock_policy_engine` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`region` \*

 | `string` | AWS region where the policy engine is deployed |  |
| 

`statusReasons` \*

 | `array` **|** `null` | Reasons explaining the current status of the policy engine |  |

---

### Aws Bedrock Provisioned Throughput

`aws_bedrock_provisioned_throughput` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the provisioned throughput |  |
| 
`commitmentDuration` \*

 | `string` **|** `null` | Commitment duration for the provisioned throughput (e.g., OneMonth, SixMonths) |  |
| `commitmentExpirationTime` | `number` | Timestamp (epoch ms) when the commitment period expires |  |
| 

`desiredModelUnits` \*

 | `number` **|** `null` | Desired number of model units for the provisioned throughput |  |
| 

`displayName` \*

 | `string` | Display name of the provisioned throughput |  |
| 

`failureMessage` \*

 | `string` **|** `null` | Error message if the provisioned throughput failed to create or update |  |
| 

`foundationModelArn` \*

 | `string` **|** `null` | ARN of the underlying foundation model |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the provisioned throughput is currently in service and accepting requests |  |
| `lastModifiedOn` | `number` | Timestamp (epoch ms) when the provisioned throughput was last modified |  |
| 

`modelArn` \*

 | `string` **|** `null` | ARN of the model associated with this provisioned throughput |  |
| 

`modelUnits` \*

 | `number` **|** `null` | Number of model units currently provisioned |  |
| 

`name` \*

 | `string` | Name of the provisioned throughput |  |
| `provisionedModelId` | `string` | Unique identifier for the provisioned model throughput |  |
| 

`region` \*

 | `string` | AWS region where the provisioned throughput is deployed |  |

---

### Aws Cloudmap Namespace

`aws_cloudmap_namespace` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`creatorRequestId` \*

 | `string` **|** `null` |  |  |
| 

`hostedZoneId` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isHttpNamespace` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceCount` \*

 | `number` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Aws Cloudmap Service

`aws_cloudmap_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`creatorRequestId` \*

 | `string` **|** `null` |  |  |
| 

`dnsRecordTtl` \*

 | `number` **|** `null` |  |  |
| 

`dnsRecordType` \*

 | `string` **|** `null` |  |  |
| 

`healthCheckFailureThreshold` \*

 | `number` **|** `null` |  |  |
| 

`healthCheckResourcePath` \*

 | `string` **|** `null` |  |  |
| 

`healthCheckType` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`instanceCount` \*

 | `number` **|** `null` |  |  |
| 

`isHealthCheckEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`namespaceId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`routingPolicy` \*

 | `string` **|** `null` |  |  |

---

### Aws Cloudmap Service Instance

`aws_cloudmap_service_instance` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`creatorRequestId` \*

 | `string` **|** `null` |  |  |
| 

`customAttributesCount` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`instanceId` \*

 | `string` **|** `null` |  |  |
| 

`port` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceId` \*

 | `string` |  |  |

---

### Aws Cloudwatch Log Group Metrics

`aws_cloudwatch_log_group_metrics` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`collectedOn` \*

 | `number` |  |  |
| 

`dailyDeliveryErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyDeliveryThrottling` \*

 | `number` **|** `null` |  |  |
| 

`dailyEMFParsingErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyEMFValidationErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyForwardedBytes` \*

 | `number` **|** `null` |  |  |
| 

`dailyForwardedLogEvents` \*

 | `number` **|** `null` |  |  |
| 

`dailyIncomingBytes` \*

 | `number` **|** `null` |  |  |
| 

`dailyIncomingLogEvents` \*

 | `number` **|** `null` |  |  |
| 

`dailyLogEventsWithFindings` \*

 | `number` **|** `null` |  |  |
| 

`dailyTransformationErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyTransformedBytes` \*

 | `number` **|** `null` |  |  |
| 

`dailyTransformedLogEvents` \*

 | `number` **|** `null` |  |  |
| 

`endedOn` \*

 | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`logGroupName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`period` \*

 | `number` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`startedOn` \*

 | `number` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Cloudwatch Log Metric Filter

`aws_cloudwatch_log_metric_filter` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`defaultValue` \*

 | `number` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`filterName` \*

 | `string` |  |  |
| 

`filterPattern` \*

 | `string` **|** `null` |  |  |
| 

`isApplyOnTransformedLogs` \*

 | `boolean` **|** `null` |  |  |
| 

`logGroupName` \*

 | `string` |  |  |
| 

`metricName` \*

 | `string` **|** `null` |  |  |
| 

`metricNamespace` \*

 | `string` **|** `null` |  |  |
| 

`metricTransformationCount` \*

 | `number` **|** `null` |  |  |
| 

`metricValue` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`pattern` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`unit` \*

 | `string` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Codeartifact Domain

`aws_codeartifact_domain` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the domain. |  |
| 

`arn` \*

 | `string` | The ARN of the domain. |  |
| 

`assetSizeBytes` \*

 | `number` **|** `null` | The total size, in bytes, of all assets in the domain. |  |
| 

`domainOwner` \*

 | `string` **|** `null` | The 12-digit account number of the AWS account that owns the domain. |  |
| 

`encryptionKeyArn` \*

 | `string` **|** `null` | The ARN of the KMS key used to encrypt assets in the domain. |  |
| 

`hasResourcePolicy` \*

 | `boolean` **|** `null` | True when a domain permissions policy is attached, false when none is attached, and null when the policy could not be read. |  |
| 

`isCrossAccountAccessAllowed` \*

 | `boolean` **|** `null` | True when the domain permissions policy grants access to a principal outside the ingesting account; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | True when the domain permissions policy grants access to any principal; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`region` \*

 | `string` | The AWS region the domain resides in. |  |
| 

`repositoryCount` \*

 | `number` **|** `null` | The number of repositories in the domain. |  |
| 

`resourcePolicyPrincipalAccountIds` \*

 | `array` **|** `null` | Distinct external account ids referenced as principals in the domain permissions policy. |  |
| 

`resourcePolicyRevision` \*

 | `string` **|** `null` | The current revision of the domain permissions policy. |  |
| 

`s3BucketArn` \*

 | `string` **|** `null` | The ARN of the S3 bucket that stores the package assets in the domain. |  |

---

### Aws Codeartifact Package

`aws_codeartifact_package` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the package. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the domain that contains the package. |  |
| 

`format` \*

 | `string` | The package format (e.g. npm, pypi, maven, nuget, generic). |  |
| 

`isUpstreamAllowed` \*

 | `boolean` **|** `null` | True when package versions may be pulled from an upstream source. |  |
| 

`namespace` \*

 | `string` **|** `null` | The namespace of the package (e.g. Maven groupId or npm scope). |  |
| 

`packageName` \*

 | `string` | The name of the package. |  |
| 

`publishRestriction` \*

 | `string` **|** `null` | Whether publishing new package versions is ALLOW or BLOCK. |  |
| 

`region` \*

 | `string` | The AWS region the package resides in. |  |
| 

`repositoryName` \*

 | `string` **|** `null` | The name of the repository that contains the package. |  |
| 

`upstreamRestriction` \*

 | `string` **|** `null` | Whether pulling package versions from upstream is ALLOW or BLOCK. |  |

---

### Aws Codeartifact Package Group

`aws_codeartifact_package_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the package group. |  |
| 

`arn` \*

 | `string` | The ARN of the package group. |  |
| 

`contactInfo` \*

 | `string` **|** `null` | The contact information of the package group. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the domain that contains the package group. |  |
| 

`domainOwner` \*

 | `string` **|** `null` | The 12-digit account number that owns the domain. |  |
| 

`externalUpstreamRestrictionMode` \*

 | `string` **|** `null` | The origin restriction mode (ALLOW, BLOCK, or INHERIT) for retaining package versions from external, public repositories. |  |
| 

`internalUpstreamRestrictionMode` \*

 | `string` **|** `null` | The origin restriction mode (ALLOW, BLOCK, or INHERIT) for retaining package versions from internal upstream repositories. |  |
| 

`parentPattern` \*

 | `string` **|** `null` | The pattern of the parent package group. |  |
| 

`pattern` \*

 | `string` | The pattern the package group matches. |  |
| 

`publishRestrictionMode` \*

 | `string` **|** `null` | The origin restriction mode (ALLOW, BLOCK, or INHERIT) for publishing package versions to the group. |  |
| 

`region` \*

 | `string` | The AWS region the package group resides in. |  |

---

### Aws Codeartifact Repository

`aws_codeartifact_repository` inherits from [Repository](/data-model/schemas/Repository.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the repository. |  |
| 

`administratorAccount` \*

 | `string` **|** `null` | The account that manages the repository. |  |
| 

`arn` \*

 | `string` | The ARN of the repository. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the domain that contains the repository. |  |
| 

`domainOwner` \*

 | `string` **|** `null` | The 12-digit account number that owns the domain. |  |
| 

`endpointGeneric` \*

 | `string` **|** `null` | The generic endpoint URL of the repository. |  |
| 

`endpointMaven` \*

 | `string` **|** `null` | The Maven endpoint URL of the repository. |  |
| 

`endpointNpm` \*

 | `string` **|** `null` | The npm endpoint URL of the repository. |  |
| 

`endpointNuget` \*

 | `string` **|** `null` | The NuGet endpoint URL of the repository. |  |
| 

`endpointPypi` \*

 | `string` **|** `null` | The PyPI endpoint URL of the repository. |  |
| 

`externalConnectionNames` \*

 | `array` **|** `null` | The names of the external connections (e.g. public:npmjs) the repository proxies. |  |
| 

`externalConnectionStatus` \*

 | `string` **|** `null` | The status of the external connection when a single connection is configured. |  |
| 

`hasExternalConnections` \*

 | `boolean` **|** `null` | True when the repository has at least one external connection. |  |
| 

`hasResourcePolicy` \*

 | `boolean` **|** `null` | True when a repository permissions policy is attached, false when none is attached, and null when the policy could not be read. |  |
| 

`isCrossAccountAccessAllowed` \*

 | `boolean` **|** `null` | True when the repository permissions policy grants access to a principal outside the ingesting account; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | True when the repository permissions policy grants access to any principal; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`region` \*

 | `string` | The AWS region the repository resides in. |  |
| 

`resourcePolicyPrincipalAccountIds` \*

 | `array` **|** `null` | Distinct external account ids referenced as principals in the repository permissions policy. |  |
| 

`resourcePolicyRevision` \*

 | `string` **|** `null` | The current revision of the repository permissions policy. |  |
| 

`upstreamRepositoryNames` \*

 | `array` **|** `null` | The names of the upstream repositories. |  |

---

### Aws Codedeploy Application

`aws_codedeploy_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`applicationId` \*

 | `string` **|** `null` |  |  |
| 

`applicationName` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`gitHubAccountName` \*

 | `string` **|** `null` |  |  |
| 

`isLinkedToGitHub` \*

 | `boolean` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Codedeploy Deployment Config

`aws_codedeploy_deployment_config` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`canaryInterval` \*

 | `number` **|** `null` |  |  |
| 

`canaryPercentage` \*

 | `number` **|** `null` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`deploymentConfigId` \*

 | `string` **|** `null` |  |  |
| 

`deploymentConfigName` \*

 | `string` |  |  |
| 

`firstZoneMonitorDurationInSeconds` \*

 | `number` **|** `null` |  |  |
| 

`isBuiltIn` \*

 | `boolean` |  |  |
| 

`linearInterval` \*

 | `number` **|** `null` |  |  |
| 

`linearPercentage` \*

 | `number` **|** `null` |  |  |
| 

`minimumHealthyHostsPerZoneType` \*

 | `string` **|** `null` |  |  |
| 

`minimumHealthyHostsPerZoneValue` \*

 | `number` **|** `null` |  |  |
| 

`minimumHealthyHostsType` \*

 | `string` **|** `null` |  |  |
| 

`minimumHealthyHostsValue` \*

 | `number` **|** `null` |  |  |
| 

`monitorDurationInSeconds` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`trafficRoutingType` \*

 | `string` **|** `null` |  |  |

---

### Aws Codedeploy Deployment Group

`aws_codedeploy_deployment_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`alarmNames` \*

 | `array` **|** `null` |  |  |
| 

`applicationKey` \*

 | `string` |  |  |
| 

`applicationName` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`autoRollbackEvents` \*

 | `array` **|** `null` |  |  |
| 

`autoScalingGroups` \*

 | `array` **|** `null` |  |  |
| 

`blueGreenTerminateAction` \*

 | `string` **|** `null` |  |  |
| 

`blueGreenTerminationWaitTime` \*

 | `number` **|** `null` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`deploymentConfigName` \*

 | `string` **|** `null` |  |  |
| 

`deploymentGroupId` \*

 | `string` **|** `null` |  |  |
| 

`deploymentGroupName` \*

 | `string` |  |  |
| 

`deploymentOption` \*

 | `string` **|** `null` |  |  |
| 

`deploymentType` \*

 | `string` **|** `null` |  |  |
| 

`ecsClusterName` \*

 | `string` **|** `null` |  |  |
| 

`ecsServiceName` \*

 | `string` **|** `null` |  |  |
| 

`elbNames` \*

 | `array` **|** `null` |  |  |
| 

`greenFleetProvisioningAction` \*

 | `string` **|** `null` |  |  |
| 

`isAlarmsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoRollbackEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isIgnorePollAlarmFailure` \*

 | `boolean` **|** `null` |  |  |
| 

`isTerminationHookEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`lastAttemptedDeploymentId` \*

 | `string` **|** `null` |  |  |
| 

`lastAttemptedDeploymentStatus` \*

 | `string` **|** `null` |  |  |
| 

`lastSuccessfulDeploymentId` \*

 | `string` **|** `null` |  |  |
| 

`lastSuccessfulDeploymentStatus` \*

 | `string` **|** `null` |  |  |
| 

`outdatedInstancesStrategy` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`targetGroupNames` \*

 | `array` **|** `null` |  |  |
| 

`triggerNames` \*

 | `array` **|** `null` |  |  |
| 

`triggerTargetArns` \*

 | `array` **|** `null` |  |  |

---

### Aws Codeguru Profiling Group

`aws_codeguru_profiling_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`isProfilingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`latestAgentPingOn` \*

 | `number` **|** `null` |  |  |
| 

`latestProfileReceivedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Codeguru Reviewer Repository Association

`aws_codeguru_reviewer_repository_association` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`associationId` \*

 | `string` **|** `null` |  |  |
| 

`connectionArn` \*

 | `string` **|** `null` |  |  |
| 

`encryptedKeyRef` \*

 | `string` **|** `null` |  |  |
| 

`encryptionOption` \*

 | `string` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`providerType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`s3BucketName` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`stateReason` \*

 | `string` **|** `null` |  |  |

---

### Aws Cognito Identity Pool

`aws_cognito_identity_pool` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`developerProviderName` \*

 | `null` **|** `string` |  |  |
| 

`identityPoolId` \*

 | `null` **|** `string` |  |  |
| 

`isClassicFlowAllowed` \*

 | `null` **|** `boolean` |  |  |
| 

`isUnauthenticatedIdentitiesAllowed` \*

 | `null` **|** `boolean` |  |  |
| 

`openIdConnectProviderArns` \*

 | `null` **|** `array` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`samlProviderArns` \*

 | `null` **|** `array` |  |  |

---

### Aws Cognito User Pool

`aws_cognito_user_pool` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountTakeoverHighActionEvent` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverHighActionNotify` \*

 | `null` **|** `boolean` |  |  |
| 

`accountTakeoverLowActionEvent` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverLowActionNotify` \*

 | `null` **|** `boolean` |  |  |
| 

`accountTakeoverMediumActionEvent` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverMediumActionNotify` \*

 | `null` **|** `boolean` |  |  |
| 

`accountTakeoverNotifyFrom` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverNotifyReplyTo` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverNotifySourceArn` \*

 | `null` **|** `string` |  |  |
| 

`adminCreateUserConfigAllowAdminCreateUserOnly` \*

 | `null` **|** `boolean` |  |  |
| 

`adminCreateUserConfigUnusedAccountValidityDays` \*

 | `null` **|** `number` |  |  |
| 

`arn` \*

 | `null` **|** `string` |  |  |
| 

`compromisedCredentialsEventAction` \*

 | `null` **|** `string` |  |  |
| 

`compromisedCredentialsEventFilter` \*

 | `null` **|** `array` |  |  |
| 

`customDomain` \*

 | `null` **|** `string` |  |  |
| 

`deletionProtection` \*

 | `null` **|** `string` |  |  |
| 

`deviceConfigurationChallengeRequiredOnNewDevice` \*

 | `null` **|** `boolean` |  |  |
| 

`deviceConfigurationDeviceOnlyRememberedOnUserPrompt` \*

 | `null` **|** `boolean` |  |  |
| 

`domain` \*

 | `null` **|** `string` |  |  |
| 

`emailConfigurationEmailSendingAccount` \*

 | `null` **|** `string` |  |  |
| 

`estimatedNumberOfUsers` \*

 | `null` **|** `number` |  |  |
| 

`mfaConfiguration` \*

 | `null` **|** `string` |  |  |
| 

`policiesPasswordPolicyMinimumLength` \*

 | `null` **|** `number` |  |  |
| 

`policiesPasswordPolicyRequireLowercase` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyRequireNumbers` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyRequireSymbols` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyRequireUppercase` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyTemporaryPasswordValidityDays` \*

 | `null` **|** `number` |  |  |
| 

`policiesSignInPolicyAllowedFirstAuthFactors` \*

 | `null` **|** `array` |  |  |
| 

`region` \*

 | `null` **|** `string` |  |  |
| 

`riskConfigurationLastModifiedOn` \*

 | `null` **|** `number` |  |  |
| 

`riskExceptionBlockedIPRangeList` \*

 | `null` **|** `array` |  |  |
| 

`riskExceptionSkippedIPRangeList` \*

 | `null` **|** `array` |  |  |
| 

`smsConfigurationExternalId` \*

 | `null` **|** `string` |  |  |
| 

`smsConfigurationFailure` \*

 | `null` **|** `string` |  |  |
| 

`smsConfigurationSnsCallerArn` \*

 | `null` **|** `string` |  |  |
| 

`smsConfigurationSnsRegion` \*

 | `null` **|** `string` |  |  |
| 

`userAttributeUpdateSettingsAttributesRequireVerificationBeforeUpdate` \*

 | `null` **|** `array` |  |  |
| 

`usernameConfigurationCaseSensitive` \*

 | `null` **|** `boolean` |  |  |
| 

`userPoolAddOnsAdvancedSecurityAdditionalFlowsTypeCustomAuthMode` \*

 | `null` **|** `string` |  |  |
| 

`userPoolAddOnsAdvancedSecurityMode` \*

 | `null` **|** `string` |  |  |
| 

`verificationMessageTemplateDefaultEmailOption` \*

 | `null` **|** `string` |  |  |

---

### Aws Cognito User Pool Client

`aws_cognito_user_pool_client` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessTokenValidity` | `number` |  |  |
| `accountId` | `string` |  |  |
| `allowedOAuthFlows` | `array` of `string`s |  |  |
| `allowedOAuthScopes` | `array` of `string`s |  |  |
| `analyticsConfigurationApplicationId` | `string` |  |  |
| `analyticsConfigurationExternalId` | `string` |  |  |
| `analyticsConfigurationRoleArn` | `string` |  |  |
| `authSessionValidity` | `number` |  |  |
| `callbackURLs` | `array` of `string`s |  |  |
| `createdOn` | `number` |  |  |
| `defaultRedirectURI` | `string` |  |  |
| `explicitAuthFlows` | `array` of `string`s |  |  |
| 
`id` \*

 | `string` |  |  |
| `idTokenValidity` | `number` |  |  |
| `isAnalyticsConfigurationUserDataShared` | `boolean` |  |  |
| `isOAuthFlowsUserPoolClientAllowed` | `boolean` |  |  |
| `isPropagateAdditionalUserContextDataEnabled` | `boolean` |  |  |
| `isTokenRevocationEnabled` | `boolean` |  |  |
| `lastModifiedOn` | `number` |  |  |
| `logoutURLs` | `array` of `string`s |  |  |
| `preventUserExistenceErrors` | `string` |  |  |
| `readAttributes` | `array` of `string`s |  |  |
| `refreshTokenValidity` | `number` |  |  |
| 

`region` \*

 | `string` |  |  |
| `supportedIdentityProviders` | `array` of `string`s |  |  |
| `tokenValidityUnitsAccessToken` | `string` |  |  |
| `tokenValidityUnitsIdToken` | `string` |  |  |
| `tokenValidityUnitsRefreshToken` | `string` |  |  |
| `userPoolId` | `string` |  |  |
| `writeAttributes` | `array` of `string`s |  |  |

---

### Aws Cognito User Pool User

`aws_cognito_user_pool_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `isEnabled` | `boolean` |  |  |
| `lastModifiedOn` | `number` |  |  |
| `mfaDeilveryMediums` | `array` of `string`s |  |  |
| `mfaDeliveryAttributes` | `array` of `string`s |  |  |
| 
`region` \*

 | `string` |  |  |
| `userStatus` | `string` |  |  |

---

### Aws Config Rule Finding

`aws_config_rule_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`annotation` \*

 | `string` **|** `null` |  |  |
| 

`configRuleArn` \*

 | `string` **|** `null` |  |  |
| 

`configRuleInvokedOn` \*

 | `number` **|** `null` |  |  |
| 

`configRuleName` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceArn` \*

 | `string` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceType` \*

 | `string` |  |  |
| 

`resultRecordedOn` \*

 | `number` **|** `null` |  |  |

---

### Aws Datasync Location

`aws_datasync_location` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`efsFileSystemArn` \*

 | `null` **|** `string` |  |  |
| 

`fsxFileSystemArn` \*

 | `null` **|** `string` |  |  |
| 

`isEfsLocation` \*

 | `null` **|** `boolean` |  |  |
| 

`isFsxLocation` \*

 | `null` **|** `boolean` |  |  |
| 

`isOnPremisesLocation` \*

 | `null` **|** `boolean` |  |  |
| 

`isS3Location` \*

 | `null` **|** `boolean` |  |  |
| 

`locationType` \*

 | `string` |  |  |
| 

`locationUri` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`s3BucketAccessRoleArn` \*

 | `null` **|** `string` |  |  |

---

### Aws Datasync Task

`aws_datasync_task` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`cloudWatchLogGroupArn` \*

 | `null` **|** `string` |  |  |
| 

`createdOn` \*

 | `number` |  |  |
| 

`currentTaskExecutionArn` \*

 | `null` **|** `string` |  |  |
| 

`destinationLocationArn` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isCloudWatchLoggingEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`isScheduled` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`overwriteMode` \*

 | `null` **|** `string` |  |  |
| 

`posixPermissions` \*

 | `null` **|** `string` |  |  |
| 

`preserveDeletedFiles` \*

 | `null` **|** `string` |  |  |
| 

`preserveDevices` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`securityDescriptorCopyFlags` \*

 | `null` **|** `array` |  |  |
| 

`sourceLocationArn` \*

 | `string` |  |  |
| 

`transferMode` \*

 | `null` **|** `string` |  |  |
| 

`verifyMode` \*

 | `null` **|** `string` |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Dedicated Host

`aws_dedicated_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allocatedOn` | `number` |  |  |
| `allowsMultipleInstanceTypes` | `string` |  | **Any of**:
-   `off`

-   `on`

 |
| `assetId` | `string` |  |  |
| `autoPlacement` | `string` |  | **Any of**:

-   `off`

-   `on`

 |
| `availabilityZone` | `string` |  |  |
| `cores` | `number` |  |  |
| `hostId` | `string` |  |  |
| `hostMaintenance` | `string` |  | **Any of**:

-   `off`

-   `on`

 |
| `hostRecovery` | `string` |  | **Any of**:

-   `off`

-   `on`

 |
| `hostReservationId` | `string` |  |  |
| `instanceFamily` | `string` |  |  |
| `instanceType` | `string` |  |  |
| `memberOfServiceLinkedResourceGroup` | `boolean` |  |  |
| `outpostArn` | `string` |  |  |
| `ownerId` | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| `releasedOn` | `number` |  |  |
| `sockets` | `number` |  |  |
| `state` | `string` |  | **Any of**:

-   `available`

-   `pending`

-   `permanent-failure`

-   `released`

-   `released-permanent-failure`

-   `under-assessment`

 |
| `totalVCpus` | `number` |  |  |

---

### Aws Devops Guru Anomaly

`aws_devops_guru_anomaly` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`anomalyEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyId` \*

 | `string` |  |  |
| 

`anomalyReportedEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyReportedStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyType` \*

 | `string` **|** `null` |  |  |
| 

`associatedInsightId` \*

 | `string` **|** `null` |  |  |
| 

`limitValue` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`sourceResourceName` \*

 | `string` **|** `null` |  |  |
| 

`sourceResourceType` \*

 | `string` **|** `null` |  |  |
| 

`sourceService` \*

 | `string` **|** `null` |  |  |
| 

`stackNames` \*

 | `array` **|** `null` |  |  |

---

### Aws Devops Guru Insight

`aws_devops_guru_insight` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`associatedResourceArns` \*

 | `array` **|** `null` |  |  |
| 

`insightEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`insightId` \*

 | `string` |  |  |
| 

`insightStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`insightType` \*

 | `string` **|** `null` |  |  |
| 

`predictionEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`predictionStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceNames` \*

 | `array` **|** `null` |  |  |
| 

`stackNames` \*

 | `array` **|** `null` |  |  |

---

### Aws Devops Guru Notification Channel

`aws_devops_guru_notification_channel` inherits from [Channel](/data-model/schemas/Channel.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`channelId` \*

 | `string` |  |  |
| 

`messageTypes` \*

 | `array` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`severities` \*

 | `array` **|** `null` |  |  |
| 

`snsTopicArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Devopsagent Agent Space

`aws_devopsagent_agent_space` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentSpaceId` \*

 | `string` | The unique identifier of the agent space. |  |
| 

`isElevatedActionsEnabled` \*

 | `boolean` **|** `null` | Whether elevated actions are enabled on the agent space (flattened from the `elevatedActionsEnabled` preference), or null when the preference is not set. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | The ARN of the customer managed KMS key used to encrypt agent space resources, or null when an AWS owned key is used. |  |
| 

`locale` \*

 | `string` **|** `null` | The locale configured for the agent space, which determines the language used in agent responses, or null when not set. |  |
| 

`operatorAppRoleArns` \*

 | `array` **|** `null` | The IAM role ARNs the operator app assumes (collected from the IAM, IdC and IdP auth configurations), or null when no operator app is configured. |  |
| 

`region` \*

 | `string` | The AWS region the agent space resides in, for example `us-east-1`. |  |

---

### Aws Devopsagent Association

`aws_devopsagent_association` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentSpaceId` \*

 | `string` **|** `null` | The id of the agent space the association belongs to, or null when not reported. |  |
| 

`associationId` \*

 | `string` | The unique identifier of the association. |  |
| 

`capabilities` \*

 | `array` **|** `null` | The capabilities enabled on the association (capabilities configured but switched off are excluded), or null when none are enabled. |  |
| 

`region` \*

 | `string` | The AWS region the association resides in, for example `us-east-1`. |  |
| 

`serviceId` \*

 | `string` **|** `null` | The id of the registered service the association targets, or null when not reported. |  |

---

### Aws Devopsagent Private Connection

`aws_devopsagent_private_connection` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`certificateExpiresOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when the private connection certificate expires, or null when no certificate expiry is reported. |  |
| 

`dnsResolution` \*

 | `string` **|** `null` | How DNS is resolved for resources behind the connection, for example `IN_VPC` or `PUBLIC`, or null when not reported. |  |
| 

`failureMessage` \*

 | `string` **|** `null` | The failure message reported for the private connection, or null when it is not in a failed state. |  |
| 

`hostAddress` \*

 | `string` **|** `null` | The host address the private connection targets, or null when not reported. |  |
| 

`region` \*

 | `string` | The AWS region the private connection resides in, for example `us-east-1`. |  |
| 

`resourceConfigurationId` \*

 | `string` **|** `null` | The id of the resource configuration backing the private connection, or null when not reported. |  |
| 

`resourceGatewayId` \*

 | `string` **|** `null` | The id of the resource gateway backing the private connection, or null when not reported. |  |
| 

`type` \*

 | `string` **|** `null` | The type of the private connection, for example `SELF_MANAGED` or `SERVICE_MANAGED`, or null when not reported. |  |
| 

`vpcId` \*

 | `string` **|** `null` | The id of the VPC the private connection reaches into, or null when not reported. |  |

---

### Aws Devopsagent Service

`aws_devopsagent_service` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessibleResources` \*

 | `array` **|** `null` | The resources the service is scoped to (the plain-string entries of the opaque JSON values the API returns), or null when none are reported. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | The ARN of the customer managed KMS key used to encrypt the service configuration, or null when an AWS owned key is used. |  |
| 

`privateConnectionName` \*

 | `string` **|** `null` | The name of the private connection the service reaches its endpoint through, or null when the service is not behind a private connection. |  |
| 

`region` \*

 | `string` | The AWS region the service is registered in, for example `us-east-1`. |  |
| 

`serviceId` \*

 | `string` | The unique identifier of the registered service. |  |
| 

`serviceType` \*

 | `string` **|** `null` | The type of the registered service, for example `github` or `slack`, or null when not reported. |  |

---

### Aws Ec2 Security Group Rule

`aws_ec2_security_group_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` **|** `null` | The ARN of the security group rule. |  |
| 

`cidrIpv4` \*

 | `string` **|** `null` | The IPv4 CIDR range this rule applies to. |  |
| 

`cidrIpv6` \*

 | `string` **|** `null` | The IPv6 CIDR range this rule applies to. |  |
| 

`fromPort` \*

 | `number` **|** `null` | The start of the port range, or the ICMP type. Null when all ports are allowed. |  |
| 

`groupOwnerId` \*

 | `string` **|** `null` | The ID of the AWS account that owns the security group. |  |
| 

`ipProtocol` \*

 | `string` **|** `null` | The IP protocol (e.g. tcp, udp, icmp). Normalized to "all" when the API returns -1 (all protocols). |  |
| 

`isEgress` \*

 | `boolean` **|** `null` | Indicates whether the rule is an outbound (egress) rule. False for inbound (ingress) rules. |  |
| 

`prefixListId` \*

 | `string` **|** `null` | The ID of the prefix list this rule applies to. |  |
| 

`referencedGroupId` \*

 | `string` **|** `null` | The ID of the security group referenced by this rule, if any. |  |
| 

`referencedGroupOwnerId` \*

 | `string` **|** `null` | The AWS account ID that owns the referenced security group. |  |
| 

`referencedVpcId` \*

 | `string` **|** `null` | The ID of the VPC of the referenced security group, if any. |  |
| 

`region` \*

 | `string` | The AWS region the security group rule resides in. |  |
| 

`securityGroupRuleId` \*

 | `string` | The ID of the security group rule. |  |
| 

`toPort` \*

 | `number` **|** `null` | The end of the port range, or the ICMP code. Null when all ports are allowed. |  |

---

### Aws Elasticsearch Domain

`aws_elasticsearch_domain` inherits from [Database](/data-model/schemas/Database.md), [DataStore](/data-model/schemas/DataStore.md), [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessPolicies` \*

 | `string` **|** `null` | Raw JSON string of the IAM resource-based access policy attached to the Elasticsearch domain. |  |
| 

`atRestEncryptionEnabled` \*

 | `boolean` **|** `null` | Deprecated. Whether encryption at rest is enabled. Use encryptedAtRest instead. | **deprecated**: true |
| 

`encryptionAtRestKmsKeyId` \*

 | `string` **|** `null` | Identifier of the AWS KMS key used to encrypt data at rest in the Elasticsearch domain. May be a key ID, alias, or ARN depending on how the domain was configured. |  |
| 

`isAppLoggingEnabled` \*

 | `boolean` **|** `null` | Whether application log (ES\_APPLICATION\_LOGS) publishing to CloudWatch Logs is enabled. |  |
| 

`isAuditLoggingEnabled` \*

 | `boolean` **|** `null` | Whether audit log (AUDIT\_LOGS) publishing to CloudWatch Logs is enabled for this domain. |  |
| 

`isSlowIndexLoggingEnabled` \*

 | `boolean` **|** `null` | Whether slow index log (INDEX\_SLOW\_LOGS) publishing to CloudWatch Logs is enabled. |  |
| 

`region` \*

 | `string` | The AWS region the Elasticsearch domain resides in. |  |
| 

`transitEncryptionEnabled` \*

 | `boolean` **|** `null` | Deprecated. Whether node-to-node (in-transit) encryption is enabled. Use encryptedInTransit instead. | **deprecated**: true |

---

### Aws Emr Security Configuration

`aws_emr_security_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | Synthesized ARN of the EMR security configuration (also the entity \_key). |  |
| 

`isAtRestEncryptionEnabled` \*

 | `boolean` | Whether at-rest encryption is enabled. |  |
| 

`isEncryptionConfigured` \*

 | `boolean` | Whether an encryption configuration block is present. |  |
| 

`isInTransitEncryptionEnabled` \*

 | `boolean` | Whether in-transit encryption is enabled. |  |
| 

`isKerberosConfigured` \*

 | `boolean` | Whether Kerberos authentication is configured. |  |
| 

`isKerberosCrossRealmTrustConfigured` \*

 | `boolean` | Whether a cross-realm trust is configured (presence only). |  |
| 

`isLocalDiskEbsEncryptionEnabled` \*

 | `boolean` | Whether EBS encryption is enabled for local disks. |  |
| 

`isLocalDiskEncryptionConfigured` \*

 | `boolean` | Whether a local-disk encryption block is present. |  |
| 

`isSecureNamespaceConfigured` \*

 | `boolean` | Whether Lake Formation secure-namespace info is present. |  |
| 

`isTlsCertificateConfigured` \*

 | `boolean` | Whether an in-transit TLS certificate configuration is present. |  |
| 

`kerberosADDomainJoinUser` \*

 | `string` **|** `null` | Active Directory domain-join user for Kerberos. |  |
| 

`kerberosProvider` \*

 | `string` **|** `null` | Kerberos provider (ClusterDedicatedKdc, ExternalKdc). |  |
| 

`kerberosRealm` \*

 | `string` **|** `null` | Kerberos realm. |  |
| 

`lakeFormationQueryEngineRoleArn` \*

 | `string` **|** `null` | IAM role ARN used by the Lake Formation query engine. |  |
| 

`localDiskEncryptionAwsKmsKeyArn` \*

 | `string` **|** `null` | KMS key ARN used for local-disk encryption, if any. |  |
| 

`localDiskEncryptionKeyProviderType` \*

 | `string` **|** `null` | Local-disk encryption key provider type. |  |
| 

`region` \*

 | `string` | AWS region the security configuration was ingested from. |  |
| 

`s3EncryptionAwsKmsKeyArn` \*

 | `string` **|** `null` | KMS key ARN used for S3 encryption, if any. |  |
| 

`s3EncryptionKeyProviderType` \*

 | `string` **|** `null` | S3 encryption key provider type (AWS\_KMS, SERVICE\_DEFAULT). |  |
| 

`s3EncryptionMode` \*

 | `string` **|** `null` | S3 encryption mode (SSE-S3, SSE-KMS, CSE-KMS, CSE-Custom). |  |
| 

`secureNamespaceClusterId` \*

 | `string` **|** `null` | ID of the EKS cluster backing the Lake Formation secure namespace (EMR on EKS). |  |
| 

`secureNamespaceName` \*

 | `string` **|** `null` | Lake Formation secure namespace name. |  |
| 

`tlsCertificateProviderType` \*

 | `string` **|** `null` | TLS certificate provider type (PEM, Custom). |  |
| 

`tlsPrivateCertificateSecretArn` \*

 | `string` **|** `null` | Secrets Manager ARN of the private TLS certificate. |  |
| 

`tlsPublicCertificateSecretArn` \*

 | `string` **|** `null` | Secrets Manager ARN of the public TLS certificate. |  |

---

### Aws Emr Serverless Application

`aws_emr_serverless_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` |  |  |
| 

`applicationType` \*

 | `string` |  |  |
| 

`architecture` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`autoStopIdleTimeoutMinutes` \*

 | `number` **|** `null` |  |  |
| 

`cloudWatchLoggingEncryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`cloudWatchLogGroupName` \*

 | `string` **|** `null` |  |  |
| 

`encryptedKeyRef` \*

 | `string` **|** `null` |  |  |
| 

`isAutoStartEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoStopEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCloudWatchLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`isLivyEndpointEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isManagedPersistenceEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isStudioEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`managedPersistenceEncryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`maximumCapacityCpu` \*

 | `string` **|** `null` |  |  |
| 

`maximumCapacityDisk` \*

 | `string` **|** `null` |  |  |
| 

`maximumCapacityMemory` \*

 | `string` **|** `null` |  |  |
| 

`networkSecurityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`networkSubnetIds` \*

 | `array` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`releaseLabel` \*

 | `string` |  |  |
| 

`s3MonitoringEncryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`s3MonitoringLogUri` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` |  |  |
| 

`stateDetails` \*

 | `string` **|** `null` |  |  |

---

### Aws Fsx File System

`aws_fsx_file_system` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `null` **|** `string` |  |  |
| 

`createdOn` \*

 | `null` **|** `number` |  |  |
| 

`dnsName` \*

 | `null` **|** `string` |  |  |
| 

`fileSystemType` \*

 | `null` **|** `string` |  |  |
| 

`fileSystemTypeVersion` \*

 | `null` **|** `string` |  |  |
| 

`id` \*

 | `null` **|** `string` |  |  |
| 

`kmsKeyId` \*

 | `null` **|** `string` |  |  |
| 

`lifecycle` \*

 | `null` **|** `string` |  |  |
| 

`lustreAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`lustreDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`lustreDataCompressionType` \*

 | `null` **|** `string` |  |  |
| 

`lustreDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`lustreDriveCacheType` \*

 | `null` **|** `string` |  |  |
| 

`lustreIsCopyingTagsToBackups` \*

 | `null` **|** `boolean` |  |  |
| 

`lustreIsEfaEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`lustreMountName` \*

 | `null` **|** `string` |  |  |
| 

`lustrePerUnitStorageThroughput` \*

 | `null` **|** `number` |  |  |
| 

`lustreWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |
| 

`networkInterfaceIds` \*

 | `null` **|** `array` |  |  |
| 

`ontapAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`ontapDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`ontapDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`ontapEndpointIpAddressRange` \*

 | `null` **|** `string` |  |  |
| 

`ontapHAPairs` \*

 | `null` **|** `number` |  |  |
| 

`ontapPreferredSubnetId` \*

 | `null` **|** `string` |  |  |
| 

`ontapRouteTableIds` \*

 | `null` **|** `array` |  |  |
| 

`ontapThroughputCapacity` \*

 | `null` **|** `number` |  |  |
| 

`ontapThroughputCapacityPerHAPair` \*

 | `null` **|** `number` |  |  |
| 

`ontapWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |
| 

`openzfsAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`openzfsDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`openzfsDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`openzfsEndpointIpAddress` \*

 | `null` **|** `string` |  |  |
| 

`openzfsEndpointIpAddressRange` \*

 | `null` **|** `string` |  |  |
| 

`openzfsIsCopyingTagsToBackups` \*

 | `null` **|** `boolean` |  |  |
| 

`openzfsIsCopyingTagsToVolumes` \*

 | `null` **|** `boolean` |  |  |
| 

`openzfsPreferredSubnetId` \*

 | `null` **|** `string` |  |  |
| 

`openzfsRootVolumeId` \*

 | `null` **|** `string` |  |  |
| 

`openzfsRouteTableIds` \*

 | `null` **|** `array` |  |  |
| 

`openzfsThroughputCapacity` \*

 | `null` **|** `number` |  |  |
| 

`openzfsWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |
| 

`ownerId` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `null` **|** `string` |  |  |
| 

`storageCapacity` \*

 | `null` **|** `number` |  |  |
| 

`storageType` \*

 | `null` **|** `string` |  |  |
| 

`subnetIds` \*

 | `null` **|** `array` |  |  |
| 

`vpcId` \*

 | `null` **|** `string` |  |  |
| 

`windowsActiveDirectoryId` \*

 | `null` **|** `string` |  |  |
| 

`windowsAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`windowsDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`windowsDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`windowsIsCopyingTagsToBackups` \*

 | `null` **|** `boolean` |  |  |
| 

`windowsPreferredFileServerIp` \*

 | `null` **|** `string` |  |  |
| 

`windowsPreferredSubnetId` \*

 | `null` **|** `string` |  |  |
| 

`windowsRemoteAdministrationEndpoint` \*

 | `null` **|** `string` |  |  |
| 

`windowsThroughputCapacity` \*

 | `null` **|** `number` |  |  |
| 

`windowsWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |

---

### Aws Grafana Workspace

`aws_grafana_workspace` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountAccessType` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`authenticationProviders` \*

 | `array` **|** `null` |  |  |
| 

`dataSources` \*

 | `array` **|** `null` |  |  |
| 

`endpoint` \*

 | `string` **|** `null` |  |  |
| 

`freeTrialExpirationOn` \*

 | `number` **|** `null` |  |  |
| 

`grafanaToken` \*

 | `string` **|** `null` |  |  |
| 

`grafanaVersion` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` |  |  |
| 

`isFreeTrialConsumed` \*

 | `boolean` **|** `null` |  |  |
| 

`isNetworkAccessRestricted` \*

 | `boolean` **|** `null` |  |  |
| 

`licenseExpirationOn` \*

 | `number` **|** `null` |  |  |
| 

`licenseType` \*

 | `string` **|** `null` |  |  |
| 

`modifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`networkAccessPrefixListIds` \*

 | `array` **|** `null` |  |  |
| 

`networkAccessVpceIds` \*

 | `array` **|** `null` |  |  |
| 

`notificationDestinations` \*

 | `array` **|** `null` |  |  |
| 

`organizationalUnits` \*

 | `array` **|** `null` |  |  |
| 

`organizationRoleName` \*

 | `string` **|** `null` |  |  |
| 

`permissionType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`samlConfigurationStatus` \*

 | `string` **|** `null` |  |  |
| 

`stackSetName` \*

 | `string` **|** `null` |  |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`vpcSubnetIds` \*

 | `array` **|** `null` |  |  |
| 

`webLink` \*

 | `string` |  |  |
| 

`workspaceId` \*

 | `string` **|** `null` |  |  |
| 

`workspaceRoleArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Guardduty Publishing Destination

`aws_guardduty_publishing_destination` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`destinationArn` \*

 | `string` **|** `null` | ARN of the S3 bucket/folder receiving exported findings. |  |
| 

`destinationId` \*

 | `string` | Identifier of the export destination. |  |
| 

`destinationType` \*

 | `string` **|** `null` | Export target type (currently only S3). |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether exported findings are encrypted with a KMS key (KmsKeyArn present). |  |
| 

`isPublishing` \*

 | `boolean` **|** `null` | Whether the export is actively publishing (Status === PUBLISHING). |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key encrypting exported findings (kept as a flat property in addition to the USES relationship, an intentional ADR-005 exception mirroring inspectorv2 kmsKeyId). |  |
| 

`publishingFailureStartedOn` \*

 | `number` **|** `null` | Epoch ms at which GuardDuty first failed to publish to this destination; non-null indicates an active export failure. |  |
| 

`region` \*

 | `string` | AWS region of the publishing destination. |  |

---

### Aws Iam Roles Anywhere Profile

`aws_iam_roles_anywhere_profile` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`durationSeconds` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isInstancePropertiesRequired` \*

 | `boolean` **|** `null` |  |  |
| 

`isRoleSessionNameAccepted` \*

 | `boolean` **|** `null` |  |  |
| 

`managedPolicyArns` \*

 | `array` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArns` \*

 | `array` **|** `null` |  |  |
| 

`sessionPolicy` \*

 | `string` **|** `null` |  |  |
| 

`updatedOn` \*

 | `number` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Iam Roles Anywhere Trust Anchor

`aws_iam_roles_anywhere_trust_anchor` inherits from [Certificate](/data-model/schemas/Certificate.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`areNotificationsEnabled` \*

 | `boolean` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`notificationChannels` \*

 | `array` **|** `null` |  |  |
| 

`notificationEvents` \*

 | `array` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`sourceAcmPcaArn` \*

 | `string` **|** `null` |  |  |
| 

`sourceType` \*

 | `string` **|** `null` |  |  |
| 

`updatedOn` \*

 | `number` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Imagebuilder Component

`aws_imagebuilder_component` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the component. |  |
| 

`arn` \*

 | `string` | The ARN of the Image Builder component. |  |
| 

`changeDescription` \*

 | `string` **|** `null` | The change description of the component for this version. |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the component document is encrypted at rest using a customer-managed KMS key. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | The KMS key ID used to encrypt the component. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform the component supports (Windows or Linux). |  |
| 

`region` \*

 | `string` | AWS region where the component is defined. |  |
| 

`supportedOsVersions` \*

 | `array` **|** `null` | The operating system versions the component supports. |  |
| 

`type` \*

 | `string` **|** `null` | The type of the component (BUILD or TEST). |  |
| 

`version` \*

 | `string` **|** `null` | The version of the component. |  |

---

### Aws Imagebuilder Container Recipe

`aws_imagebuilder_container_recipe` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the recipe. |  |
| 

`arn` \*

 | `string` | The ARN of the container recipe. |  |
| 

`componentArns` \*

 | `array` **|** `null` | ARNs of the components included in the recipe. |  |
| 

`componentCount` \*

 | `number` **|** `null` | The number of components in the recipe. |  |
| 

`containerType` \*

 | `string` **|** `null` | The type of container produced by the recipe (DOCKER). |  |
| 

`isDockerfileTemplatePresent` \*

 | `boolean` **|** `null` | Whether a Dockerfile template is present in the recipe. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | KMS key ID used to encrypt the container recipe. |  |
| 

`parentImage` \*

 | `string` **|** `null` | The base image used for the container recipe. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform for the container recipe (Linux or Windows). |  |
| 

`region` \*

 | `string` | AWS region where the recipe is defined. |  |
| 

`targetRepositoryName` \*

 | `string` **|** `null` | The name of the target repository for the container image. |  |
| 

`targetRepositoryService` \*

 | `string` **|** `null` | The service for the target repository (ECR or other). |  |
| 

`version` \*

 | `string` **|** `null` | The version of the container recipe. |  |
| 

`workingDirectory` \*

 | `string` **|** `null` | The working directory used during container image builds. |  |

---

### Aws Imagebuilder Distribution Configuration

`aws_imagebuilder_distribution_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the configuration. |  |
| 

`amiDistributionKmsKeyIds` \*

 | `array` **|** `null` | KMS key IDs used to encrypt distributed AMIs, aggregated across all distributions. |  |
| 

`amiDistributionLaunchPermissionGroupNames` \*

 | `array` **|** `null` | Group names granted launch permission on distributed AMIs. |  |
| 

`amiDistributionLaunchPermissionOrganizationArns` \*

 | `array` **|** `null` | Organization ARNs granted launch permission on distributed AMIs. |  |
| 

`amiDistributionLaunchPermissionUserIds` \*

 | `array` **|** `null` | User IDs granted launch permission on distributed AMIs. |  |
| 

`amiDistributionTargetAccountIds` \*

 | `array` **|** `null` | Target AWS account IDs for AMI distribution. |  |
| 

`arn` \*

 | `string` | The ARN of the distribution configuration. |  |
| 

`containerDistributionTargetAccountIds` \*

 | `array` **|** `null` | Target account IDs for container image distribution. Always null — the SDK does not expose container cross-account sharing (governed by ECR repository policy). |  |
| 

`containerDistributionTargetRepositoryNames` \*

 | `array` **|** `null` | Target repository names for container image distribution, aggregated across all distributions. |  |
| 

`distributionRegions` \*

 | `array` **|** `null` | The AWS regions where images are distributed. |  |
| 

`isSharedCrossAccount` \*

 | `boolean` | Whether any distributed AMI is shared with specific AWS accounts, users, or organizations (distinct from public exposure). |  |
| 

`public` \*

 | `boolean` | Whether any distributed AMI is shared publicly (launchPermission grants the reserved `all` group). |  |
| 

`region` \*

 | `string` | AWS region where the configuration is defined. |  |

---

### Aws Imagebuilder Image

`aws_imagebuilder_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the image. |  |
| 

`arn` \*

 | `string` | The ARN of the Image Builder image build version. |  |
| 

`containerRecipeArn` \*

 | `string` **|** `null` | ARN of the container recipe used to build this image. |  |
| 

`distributionConfigurationArn` \*

 | `string` **|** `null` | ARN of the distribution configuration used for this image. |  |
| 

`ebsKmsKeyIds` \*

 | `array` **|** `null` | KMS key IDs used for EBS block device encryption, collected across every mapped device in the image recipe or container recipe instance configuration. Values may be a key ARN or an alias. Null when no mapped device names a key. |  |
| 

`imageRecipeArn` \*

 | `string` **|** `null` | ARN of the image recipe used to build this image. |  |
| 

`infrastructureConfigurationArn` \*

 | `string` **|** `null` | ARN of the infrastructure configuration used to build this image. |  |
| 

`isEbsEncrypted` \*

 | `boolean` **|** `null` | True when every EBS block device mapped by the build instance declares encryption. Collected from the image recipe (AMI images) or the container recipe instance configuration (container images). Null when the image maps no EBS devices. |  |
| 

`isImageScanningEnabled` \*

 | `boolean` **|** `null` | Whether image scanning was enabled for this build. |  |
| 

`isImageTestsEnabled` \*

 | `boolean` **|** `null` | Whether image tests were enabled for this build. |  |
| 

`osVersion` \*

 | `string` **|** `null` | The OS version of the image. |  |
| 

`outputResourcesAmiIds` \*

 | `array` **|** `null` | AMI IDs produced as output resources. |  |
| 

`outputResourcesContainerImages` \*

 | `array` **|** `null` | Container image URIs produced as output resources. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform of the image (Windows or Linux). |  |
| 

`region` \*

 | `string` | AWS region where the image was built. |  |
| 

`sourcePipelineArn` \*

 | `string` **|** `null` | ARN of the pipeline that created this image, if pipeline-created. |  |
| 

`state` \*

 | `string` **|** `null` | The current build state of the image (from state.status). |  |
| 

`stateReason` \*

 | `string` **|** `null` | The reason for the current state. |  |
| 

`type` \*

 | `string` **|** `null` | The type of image output (AMI or DOCKER). |  |
| 

`version` \*

 | `string` **|** `null` | The semantic version of the image. |  |

---

### Aws Imagebuilder Image Pipeline

`aws_imagebuilder_image_pipeline` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the pipeline. |  |
| 

`arn` \*

 | `string` | The ARN of the image pipeline. |  |
| 

`containerRecipeArn` \*

 | `string` **|** `null` | ARN of the container recipe used by this pipeline (container pipelines). |  |
| 

`distributionConfigurationArn` \*

 | `string` **|** `null` | ARN of the distribution configuration used by this pipeline. |  |
| 

`executionRoleArn` \*

 | `string` **|** `null` | ARN of the IAM role used to execute the pipeline. |  |
| 

`imageRecipeArn` \*

 | `string` **|** `null` | ARN of the image recipe used by this pipeline (AMI pipelines). |  |
| 

`imageTestsConfigurationTimeoutMinutes` \*

 | `number` **|** `null` | The timeout in minutes for image tests. |  |
| 

`infrastructureConfigurationArn` \*

 | `string` **|** `null` | ARN of the infrastructure configuration used by this pipeline. |  |
| 

`isEnhancedImageMetadataEnabled` \*

 | `boolean` **|** `null` | Whether enhanced image metadata is enabled for the pipeline. |  |
| 

`isImageScanningConfigurationEnabled` \*

 | `boolean` **|** `null` | Whether image scanning is enabled for this pipeline. |  |
| 

`isImageTestsConfigurationEnabled` \*

 | `boolean` **|** `null` | Whether image tests are enabled for this pipeline. |  |
| 

`lastRunOn` \*

 | `number` **|** `null` | Timestamp of the last pipeline execution. |  |
| 

`nextRunOn` \*

 | `number` **|** `null` | Timestamp of the next scheduled pipeline execution. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform of the pipeline (Windows or Linux). |  |
| 

`region` \*

 | `string` | AWS region where the pipeline is defined. |  |
| 

`scheduleExpression` \*

 | `string` **|** `null` | The cron expression for the pipeline schedule. |  |
| 

`schedulePipelineExecutionStartCondition` \*

 | `string` **|** `null` | The condition under which the scheduled pipeline runs. |  |
| 

`scheduleTimezone` \*

 | `string` **|** `null` | The timezone for the schedule. |  |

---

### Aws Imagebuilder Infrastructure Configuration

`aws_imagebuilder_infrastructure_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the configuration. |  |
| 

`arn` \*

 | `string` | The ARN of the infrastructure configuration. |  |
| 

`iamInstanceProfileName` \*

 | `string` **|** `null` | The IAM instance profile name attached to the build instance. |  |
| 

`instanceMetadataHttpPutResponseHopLimit` \*

 | `number` **|** `null` | The HTTP PUT response hop limit for IMDSv2. |  |
| 

`instanceMetadataHttpTokens` \*

 | `string` **|** `null` | IMDSv2 token requirement setting (required or optional). |  |
| 

`instanceTypes` \*

 | `array` **|** `null` | The instance types used for the build EC2 instance. |  |
| 

`isTerminateInstanceOnFailure` \*

 | `boolean` **|** `null` | Whether to terminate the build instance on failure. |  |
| 

`keyPair` \*

 | `string` **|** `null` | The EC2 key pair name used for the build instance. |  |
| 

`region` \*

 | `string` | AWS region where the configuration is defined. |  |
| 

`s3LogsBucketName` \*

 | `string` **|** `null` | S3 bucket name for storing build logs. |  |
| 

`s3LogsKeyPrefix` \*

 | `string` **|** `null` | S3 key prefix for build log files. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Security group IDs attached to the build EC2 instance. |  |
| 

`snsTopicArn` \*

 | `string` **|** `null` | ARN of the SNS topic for build notifications. |  |
| 

`subnetId` \*

 | `string` **|** `null` | The subnet ID where the build instance runs. |  |

---

### Aws Imagebuilder Lifecycle Policy

`aws_imagebuilder_lifecycle_policy` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the policy. |  |
| 

`arn` \*

 | `string` | The ARN of the lifecycle policy. |  |
| 

`executionRoleArn` \*

 | `string` **|** `null` | ARN of the IAM role used to execute lifecycle actions. |  |
| 

`lastRunOn` \*

 | `number` **|** `null` | Timestamp of the last policy execution. |  |
| 

`policyDetailActionType` \*

 | `string` **|** `null` | The action type from the first policy detail (DELETE, DEPRECATE, or DISABLE). |  |
| 

`policyDetailFilterType` \*

 | `string` **|** `null` | The filter type from the first policy detail (AGE or COUNT). |  |
| 

`policyDetailFilterUnit` \*

 | `string` **|** `null` | The filter unit from the first policy detail (DAYS, WEEKS, MONTHS, or YEARS). |  |
| 

`policyDetailFilterValue` \*

 | `number` **|** `null` | The filter threshold value from the first policy detail. |  |
| 

`policyDetailRetentionAtLeastCount` \*

 | `number` **|** `null` | The minimum number of images to retain per the first policy detail. |  |
| 

`region` \*

 | `string` | AWS region where the policy is defined. |  |
| 

`resourceType` \*

 | `string` **|** `null` | The type of resource the policy applies to (AMI\_IMAGE or CONTAINER\_IMAGE). |  |

---

### Aws Imagebuilder Workflow

`aws_imagebuilder_workflow` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the workflow. |  |
| 

`arn` \*

 | `string` | The ARN of the Image Builder workflow. |  |
| 

`changeDescription` \*

 | `string` **|** `null` | The change description for this workflow version. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | KMS key ID used to encrypt the workflow. |  |
| 

`region` \*

 | `string` | AWS region where the workflow is defined. |  |
| 

`type` \*

 | `string` **|** `null` | The type of the workflow (BUILD, TEST, or DISTRIBUTION). |  |
| 

`version` \*

 | `string` **|** `null` | The version of the workflow. |  |
| 

`workflowState` \*

 | `string` **|** `null` | The current state status of the workflow (from state.status). |  |

---

### Aws Inspector Finding

`aws_inspector_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws Inspector Finding

`aws_inspector_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws Inspectorv2 Cis Finding

`aws_inspectorv2_cis_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | AWS account ID owning the assessed instance. Differs from the integration account when CIS scans are read through an Inspector delegated administrator. |  |
| 

`failedChecks` \*

 | `number` **|** `null` | Number of CIS checks that failed on this instance. |  |
| 

`passedChecks` \*

 | `number` **|** `null` | Number of CIS checks that passed on this instance. |  |
| 

`platform` \*

 | `string` **|** `null` | OS platform assessed (e.g. AMAZON\_LINUX\_2, WINDOWS\_SERVER\_2019). |  |
| 

`region` \*

 | `string` | AWS region where the CIS scan was executed. |  |
| 

`scanArn` \*

 | `string` | ARN of the parent CIS scan. |  |
| 

`skippedChecks` \*

 | `number` **|** `null` | Number of CIS checks skipped on this instance. |  |
| 

`targetResourceId` \*

 | `string` **|** `null` | EC2 instance ID that was assessed (e.g. i-0abc123). |  |
| 

`targetStatus` \*

 | `string` **|** `null` | Status of the CIS scan target: TIMED\_OUT | CANCELLED | COMPLETED. |  |
| 

`targetStatusReason` \*

 | `string` **|** `null` | Reason for target status (e.g. UNSUPPORTED\_OS, SSM\_UNMANAGED). |  |

---

### Aws Inspectorv2 Cis Scan

`aws_inspectorv2_cis_scan` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the CIS scan run. |  |
| 

`failedChecks` \*

 | `number` **|** `null` | Number of CIS checks that failed. |  |
| 

`region` \*

 | `string` | AWS region the scan was executed in. |  |
| 

`scanConfigurationArn` \*

 | `string` **|** `null` | ARN of the CIS scan configuration that triggered this scan. |  |
| 

`scheduledBy` \*

 | `string` **|** `null` | Account or entity that scheduled the scan. |  |
| 

`securityLevel` \*

 | `string` **|** `null` | CIS security level: LEVEL\_1 or LEVEL\_2. |  |
| 

`totalChecks` \*

 | `number` **|** `null` | Total number of CIS checks evaluated. |  |

---

### Aws Inspectorv2 Configuration

`aws_inspectorv2_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`ec2ScanMode` \*

 | `string` **|** `null` | EC2 automated scan mode (EC2\_HYBRID or EC2\_SSM\_AGENT\_BASED). |  |
| 

`ec2ScanModeStatus` \*

 | `string` **|** `null` | Status of the EC2 scan mode setting (PENDING/SUCCESS). |  |
| 

`ecrPullDateRescanDuration` \*

 | `string` **|** `null` | ECR re-scan duration measured from image pull date (e.g. DAYS\_30). |  |
| 

`ecrPullDateRescanMode` \*

 | `string` **|** `null` | ECR pull-date re-scan mode. |  |
| 

`ecrRescanDuration` \*

 | `string` **|** `null` | ECR automated re-scan duration (e.g. DAYS\_30, LIFETIME). |  |
| 

`ecrRescanDurationStatus` \*

 | `string` **|** `null` | Status of changes to the ECR re-scan duration (FAILED/PENDING/SUCCESS). |  |
| 

`ecrRescanDurationUpdatedOn` \*

 | `number` **|** `null` | When the ECR re-scan duration setting was last changed (epoch ms). |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt Inspector Lambda code scan data in this region (the only scan type that supports a customer-managed key; absent when using an AWS-owned key). |  |
| 

`region` \*

 | `string` | The AWS region this configuration applies to. |  |

---

### Aws Inspectorv2 Filter

`aws_inspectorv2_filter` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `string` **|** `null` | The action applied to findings that match the filter (NONE or SUPPRESS). |  |
| 

`arn` \*

 | `string` | The Amazon Resource Number (ARN) associated with this filter. |  |
| 

`criteriaFields` \*

 | `array` **|** `null` | The names of the FilterCriteria fields that are populated on this filter (e.g. "severity", "resourceType"). Only the field names are captured, not their matched values, so this indicates which dimensions the filter constrains but not the specific values it matches or suppresses. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The AWS account ID of the account that created the filter. |  |
| 

`reason` \*

 | `string` **|** `null` | The reason for the filter. |  |
| 

`region` \*

 | `string` **|** `null` | The AWS region the filter was read from. |  |

---

### Aws Inspectorv2 Finding

`aws_inspectorv2_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws Inspectorv2 Finding

`aws_inspectorv2_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws License Manager License

`aws_license_manager_license` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`beneficiary` \*

 | `string` **|** `null` |  |  |
| 

`expiresOn` \*

 | `number` **|** `null` |  |  |
| 

`homeRegion` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`issuerKeyFingerprint` \*

 | `string` **|** `null` |  |  |
| 

`issuerName` \*

 | `string` **|** `null` |  |  |
| 

`productName` \*

 | `string` **|** `null` |  |  |
| 

`productSku` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`validityStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`version` \*

 | `string` **|** `null` |  |  |

---

### Aws License Manager Received License

`aws_license_manager_received_license` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allowedOperations` \*

 | `array` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`beneficiary` \*

 | `string` **|** `null` |  |  |
| 

`borrowMaxTimeToLiveInMinutes` \*

 | `number` **|** `null` |  |  |
| 

`consumptionRenewType` \*

 | `string` **|** `null` |  |  |
| 

`expiresOn` \*

 | `number` **|** `null` |  |  |
| 

`homeRegion` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isBorrowAllowEarlyCheckIn` \*

 | `boolean` **|** `null` |  |  |
| 

`issuerKeyFingerprint` \*

 | `string` **|** `null` |  |  |
| 

`issuerName` \*

 | `string` **|** `null` |  |  |
| 

`issuerSignKey` \*

 | `string` **|** `null` |  |  |
| 

`productName` \*

 | `string` **|** `null` |  |  |
| 

`productSku` \*

 | `string` **|** `null` |  |  |
| 

`provisionalMaxTimeToLiveInMinutes` \*

 | `number` **|** `null` |  |  |
| 

`receivedStatus` \*

 | `string` **|** `null` |  |  |
| 

`receivedStatusReason` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`validityStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`version` \*

 | `string` **|** `null` |  |  |

---

### Aws Macie Admin Account

`aws_macie_admin_account` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`adminAccountId` \*

 | `string` | Identifier of the AWS account delegated as the Amazon Macie administrator for the organization. |  |

---

### Aws Macie Automated Discovery Account

`aws_macie_automated_discovery_account` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | Identifier of the AWS organization member account whose automated sensitive data discovery status this records. The status itself is on the inherited `status` property. |  |

---

### Aws Macie Automated Discovery Configuration

`aws_macie_automated_discovery_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | Identifier of the AWS account this automated discovery configuration belongs to. |  |
| 

`autoEnableOrganizationMembers` \*

 | `string` **|** `null` | Which organization member accounts automated sensitive data discovery is enabled for as they join: `ALL`, `NEW` or `NONE`. Null when the account is not a Macie administrator. |  |
| 

`classificationScopeId` \*

 | `string` **|** `null` | Identifier of the classification scope that defines which S3 buckets automated discovery excludes, or null when no scope applies. |  |
| 

`disabledOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when automated sensitive data discovery was most recently disabled, or null if it has never been disabled. |  |
| 

`firstEnabledOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when automated sensitive data discovery was first enabled for the account, or null if it has never been enabled. |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when the automated sensitive data discovery status was last changed, or null when it has never changed. |  |
| 

`sensitivityInspectionTemplateId` \*

 | `string` **|** `null` | Identifier of the sensitivity inspection template that defines which managed and custom data identifiers automated discovery uses, or null when no template applies. |  |

---

### Aws Macie Classification Export Configuration

`aws_macie_classification_export_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | Identifier of the AWS account this classification export configuration belongs to. |  |
| 

`region` \*

 | `string` | The AWS region this classification export configuration applies to, for example `us-east-1`. The configuration is per-region. |  |
| 

`s3DestinationBucketName` \*

 | `string` **|** `null` | Name of the S3 bucket sensitive data discovery results are exported to, or null when no export destination is configured. |  |
| 

`s3DestinationKeyPrefix` \*

 | `string` **|** `null` | Key prefix within the destination S3 bucket that exported results are written under, or null when results are written to the bucket root or no export destination is configured. |  |
| 

`s3DestinationKmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt exported sensitive data discovery results, or null when no export destination is configured. |  |

---

### Aws Macie Classification Job

`aws_macie_classification_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`approximateObjectsToProcess` \*

 | `number` **|** `null` | Approximate number of objects the job is expected to analyse, across all of its runs. |  |
| 

`arn` \*

 | `string` | The Amazon Resource Name (ARN) of the classification job. |  |
| 

`isInitialRun` \*

 | `boolean` **|** `null` | Whether the job is configured to analyse all eligible existing objects immediately on its first run. |  |
| 

`isScheduleDailyEnabled` \*

 | `boolean` **|** `null` | Whether the job runs on a daily schedule. Null when the job has no schedule at all (a one-time job). |  |
| 

`jobExpiresOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when a job paused by a user expires and is cancelled automatically, or null when the job is not user-paused. |  |
| 

`jobId` \*

 | `string` | Identifier of the classification job. |  |
| 

`jobPausedOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when a user most recently paused the job, or null when the job has not been user-paused. |  |
| 

`jobStatus` \*

 | `string` **|** `null` | Current status of the job, for example `RUNNING`, `PAUSED`, `CANCELLED`, `COMPLETE`, `IDLE` or `USER_PAUSED`. |  |
| 

`jobType` \*

 | `string` **|** `null` | Whether the job runs once or on a schedule: `ONE_TIME` or `SCHEDULED`. |  |
| 

`lastRunErrorCode` \*

 | `string` **|** `null` | Error code from the job run that most recently failed, or null when the last run did not error. |  |
| 

`lastRunOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when the job last started running, or null when it has never run. |  |
| 

`managedDataIdentifierSelector` \*

 | `string` **|** `null` | How the job selects AWS managed data identifiers: `ALL`, `EXCLUDE`, `INCLUDE`, `NONE` or `RECOMMENDED`. |  |
| 

`numberOfRuns` \*

 | `number` **|** `null` | Total number of times the job has run. |  |
| 

`region` \*

 | `string` | The AWS region the classification job is defined in, for example `us-east-1`. |  |
| 

`samplingPercentage` \*

 | `number` **|** `null` | Percentage of eligible objects the job analyses, from 1 to 100. Below 100 the job samples rather than analysing everything. |  |
| 

`scheduleDayOfMonth` \*

 | `number` **|** `null` | Day of the month the job runs on, from 1 to 31, or null when the job is not on a monthly schedule. |  |
| 

`scheduleDayOfWeek` \*

 | `string` **|** `null` | Day of the week the job runs on, for example `MONDAY`, or null when the job is not on a weekly schedule. |  |

---

### Aws Macie Finding Publication Configuration

`aws_macie_finding_publication_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | Identifier of the AWS account this finding publication configuration belongs to. |  |
| 

`isPublishClassificationFindings` \*

 | `boolean` **|** `null` | Whether Amazon Macie publishes sensitive data findings to AWS Security Hub. |  |
| 

`isPublishPolicyFindings` \*

 | `boolean` **|** `null` | Whether Amazon Macie publishes policy findings to AWS Security Hub. |  |
| 

`region` \*

 | `string` | The AWS region this finding publication configuration applies to, for example `us-east-1`. The configuration is per-region. |  |

---

### Aws Macie Organization Configuration

`aws_macie_organization_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | Identifier of the delegated Macie administrator account this organization configuration was read from. |  |
| 

`isAutoEnabled` \*

 | `boolean` **|** `null` | Whether Amazon Macie is automatically enabled for new accounts as they join the organization. |  |
| 

`isMaxAccountLimitReached` \*

 | `boolean` **|** `null` | Whether the organization has reached the quota for the number of accounts Amazon Macie can be enabled for. When true, new accounts are not enabled automatically. |  |

---

### Aws Marketplace Entitlement

`aws_marketplace_entitlement` inherits from [Subscription](/data-model/schemas/Subscription.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`customerIdentifier` \*

 | `string` **|** `null` | Entitlement.CustomerIdentifier — opaque buyer handle from ResolveCustomer. |  |
| 

`dimension` \*

 | `string` **|** `null` | Entitlement.Dimension — the capacity dimension this entitlement covers (e.g. Users, DataGB). |  |
| 

`productCode` \*

 | `string` | Marketplace ProductCode used to query GetEntitlements. Equals AWS License Manager GrantedLicense.ProductSKU. |  |
| 

`region` \*

 | `string` | AWS region (always us-east-1 for the AWS Marketplace Entitlement Service). |  |
| 

`valueBoolean` \*

 | `boolean` **|** `null` | Entitlement.Value.BooleanValue when present. |  |
| 

`valueDouble` \*

 | `number` **|** `null` | Entitlement.Value.DoubleValue when present. |  |
| 

`valueInteger` \*

 | `number` **|** `null` | Entitlement.Value.IntegerValue when present. |  |
| 

`valueString` \*

 | `string` **|** `null` | Entitlement.Value.StringValue when present. |  |

---

### Aws Marketplace Entity

`aws_marketplace_entity` inherits from [Product](/data-model/schemas/Product.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | EntityArn from ListEntities, e.g. arn:aws:aws-marketplace:::AmiProduct/prod-xxxx. |  |
| 

`entityId` \*

 | `string` | Opaque catalog entity ID, e.g. prod-xxxx. |  |
| 

`entityType` \*

 | `string` | Marketplace entity discriminator: AmiProduct, ContainerProduct, SaaSProduct, DataProduct, Offer, or ResaleAuthorization. |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` | EntitySummary.LastModifiedDate parsed via parseTimePropertyValue (milliseconds since epoch). |  |
| 

`offerAvailableUntilOn` \*

 | `number` **|** `null` | OfferSummary.AvailabilityEndDate parsed via parseTimePropertyValue. |  |
| 

`offerBuyerAccountIds` \*

 | `array` **|** `null` | OfferSummary.BuyerAccounts — AWS account IDs targeted by a private offer. |  |
| 

`offerOfferSetId` \*

 | `string` **|** `null` | OfferSummary.OfferSetId. |  |
| 

`offerProductId` \*

 | `string` **|** `null` | OfferSummary.ProductId — references another aws\_marketplace\_entity EntityId. |  |
| 

`offerReleasedOn` \*

 | `number` **|** `null` | OfferSummary.ReleaseDate parsed via parseTimePropertyValue. |  |
| 

`offerResaleAuthorizationId` \*

 | `string` **|** `null` | OfferSummary.ResaleAuthorizationId — references a ResaleAuthorization entity EntityId. |  |
| 

`offerState` \*

 | `string` **|** `null` | OfferSummary.State. |  |
| 

`offerTargeting` \*

 | `array` **|** `null` | OfferSummary.Targeting — string targeting tokens (e.g. None, BuyerAccounts, CountryCodes). |  |
| 

`ownershipType` \*

 | `string` | Ownership filter under which the entity was discovered: SELF (owned by calling account) or SHARED (visible via private offer/RAM share). |  |
| 

`productTitle` \*

 | `string` **|** `null` | Product title from {AmiProduct|ContainerProduct|SaaSProduct|DataProduct}Summary.ProductTitle. |  |
| 

`productVisibility` \*

 | `string` **|** `null` | Per-product visibility from the type-specific product sub-summary. |  |
| 

`region` \*

 | `string` | AWS region (always us-east-1 for the AWS Marketplace Catalog Service). |  |
| 

`resaleAvailableUntilOn` \*

 | `number` **|** `null` | ResaleAuthorizationSummary.AvailabilityEndDate parsed via parseTimePropertyValue. |  |
| 

`resaleManufacturerAccountId` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ManufacturerAccountId — counterparty AWS account. |  |
| 

`resaleManufacturerLegalName` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ManufacturerLegalName. |  |
| 

`resaleOfferExtendedStatus` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.OfferExtendedStatus. |  |
| 

`resaleProductId` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ProductId. |  |
| 

`resaleProductName` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ProductName. |  |
| 

`resaleResellerAccountId` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ResellerAccountID — counterparty AWS account. |  |
| 

`resaleResellerLegalName` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ResellerLegalName. |  |
| 

`resaleStatus` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.Status. |  |
| 

`visibility` \*

 | `string` **|** `null` | Top-level entity visibility from ListEntities (e.g. Public, Limited, Restricted). |  |

---

### Aws Networkmanager Attachment

`aws_networkmanager_attachment` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The synthesized attachment ARN (arn:aws:networkmanager::{ownerAccountId}:attachment/{attachmentId}); entity \_key. |  |
| 

`associatedRoutingPolicies` \*

 | `array` **|** `null` | Routing policies currently associated with this attachment (flattened across all ListAttachmentRoutingPolicyAssociations records). |  |
| 

`attachmentId` \*

 | `string` | The CloudWAN attachment ID (attachment-…). |  |
| 

`attachmentPolicyRuleNumber` \*

 | `number` **|** `null` | Rule number from the attachment-policies\[\] that bound this attachment to its segment. |  |
| 

`attachmentType` \*

 | `string` **|** `null` | One of VPC | SITE\_TO\_SITE\_VPN | CONNECT | DIRECT\_CONNECT\_GATEWAY | TRANSIT\_GATEWAY\_ROUTE\_TABLE. |  |
| 

`coreNetworkArn` \*

 | `string` **|** `null` | ARN of the owning core network. |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`edgeLocation` \*

 | `string` **|** `null` | Edge location the attachment is bound to. |  |
| 

`edgeLocations` \*

 | `array` **|** `null` | Edge locations associated with the attachment — set on Direct Connect Gateway attachments that span multiple edges. |  |
| 

`hasLastModificationErrors` \*

 | `boolean` | True when LastModificationErrors\[\] has one or more entries. |  |
| 

`id` \*

 | `string` | The CloudWAN attachment ID (attachment-…). |  |
| 

`isPendingAcceptance` \*

 | `boolean` | True when the attachment is awaiting acceptance (PENDING\_ATTACHMENT\_ACCEPTANCE or PENDING\_TAG\_ACCEPTANCE). |  |
| 

`lastModificationErrorCodes` \*

 | `array` **|** `null` | Error codes from LastModificationErrors\[\].Code if any. |  |
| 

`networkFunctionGroupName` \*

 | `string` **|** `null` | Network function group binding for service-insertion attachments. |  |
| 

`ownerAccountId` \*

 | `string` **|** `null` | AWS account that owns this attachment — present even when the underlying resource is in a different account. |  |
| 

`pendingRoutingPolicies` \*

 | `array` **|** `null` | Routing policies pending association with this attachment (flattened across all ListAttachmentRoutingPolicyAssociations records). |  |
| 

`proposedNetworkFunctionGroupName` \*

 | `string` **|** `null` | Proposed network-function-group binding from a pending change (drift detection). |  |
| 

`proposedSegmentName` \*

 | `string` **|** `null` | Proposed segment binding from a pending change (drift detection). |  |
| 

`region` \*

 | `string` **|** `null` | Edge location (AWS region) the attachment terminates in — alias of edgeLocation. |  |
| 

`resourceArn` \*

 | `string` **|** `null` | The underlying VPC/VPN/Direct-Connect-Gateway/Transit-Gateway-Route-Table ARN. Kept on the entity to support compliance queries against cross-account targets that may not be ingested. |  |
| 

`routingPolicyLabels` \*

 | `array` **|** `null` | Routing-policy labels associated with this attachment, sourced from ListAttachmentRoutingPolicyAssociations. |  |
| 

`segmentName` \*

 | `string` **|** `null` | Segment the attachment is bound to (compliance pivot). |  |
| 

`state` \*

 | `string` **|** `null` | Lifecycle state. |  |

---

### Aws Networkmanager Connect Peer

`aws_networkmanager_connect_peer` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | The owning AWS account ID. |  |
| 

`arn` \*

 | `string` | The synthesized connect-peer ARN (arn:aws:networkmanager::{ownerAccountId}:connect-peer/{connectPeerId}); entity \_key. |  |
| 

`bgpPeerAsns` \*

 | `array` **|** `null` | BGP peer ASNs (one per Configuration.BgpConfigurations entry). |  |
| 

`connectAttachmentId` \*

 | `string` | The Connect attachment ID this peer is bound to (relationship pivot). |  |
| 

`connectPeerId` \*

 | `string` | The Connect Peer ID. |  |
| 

`coreNetworkAddress` \*

 | `string` **|** `null` | BGP local address on the core network side. |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`edgeLocation` \*

 | `string` **|** `null` | Edge location. |  |
| 

`hasLastModificationErrors` \*

 | `boolean` | True when LastModificationErrors\[\] has one or more entries. |  |
| 

`id` \*

 | `string` | The Connect Peer ID. |  |
| 

`insideCidrBlocks` \*

 | `array` **|** `null` | Inside CIDR blocks (GRE only). |  |
| 

`peerAddress` \*

 | `string` **|** `null` | BGP peer address (customer/appliance side). |  |
| 

`protocol` \*

 | `string` **|** `null` | Encapsulation protocol. | **Any of**:

-   `GRE`

-   `NO_ENCAP`

-   `undefined`

 |
| 

`region` \*

 | `string` **|** `null` | Edge location of this peer (alias of edgeLocation). |  |
| 

`state` \*

 | `string` **|** `null` | Lifecycle state. |  |
| 

`subnetArn` \*

 | `string` **|** `null` | Subnet ARN for NO\_ENCAP peers. Kept on the entity to support cross-account compliance queries. |  |

---

### Aws Networkmanager Core Network

`aws_networkmanager_core_network` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | The owning AWS account ID derived from the ARN. |  |
| 

`arn` \*

 | `string` | The CloudWAN core network ARN; entity \_key. |  |
| 

`coreNetworkId` \*

 | `string` | The CloudWAN core network ID (e.g. core-network-…). |  |
| 

`edgeAsns` \*

 | `array` **|** `null` | Per-edge BGP ASNs assigned by the core network at each edge location. |  |
| 

`edgeLocations` \*

 | `array` **|** `null` | All edge locations (AWS regions) the core network is deployed to. |  |
| 

`globalNetworkId` \*

 | `string` | The parent NetworkManager global network ID. |  |
| 

`id` \*

 | `string` | The CloudWAN core network ID (e.g. core-network-…). |  |
| 

`latestPolicyVersionId` \*

 | `number` **|** `null` | Policy version ID currently aliased LATEST — used to detect drift versus LIVE. |  |
| 

`livePolicyVersionId` \*

 | `number` **|** `null` | Policy version ID currently aliased LIVE on the core network — the enforced policy. |  |
| 

`networkFunctionGroupNames` \*

 | `array` **|** `null` | Names of network function groups defined for service insertion on the core network. |  |
| 

`region` \*

 | `string` | The control-plane region for the core network (us-west-2 for commercial, us-gov-west-1 for GovCloud). |  |
| 

`segmentNames` \*

 | `array` **|** `null` | Names of segments (logical isolation domains) defined on the core network. |  |
| 

`state` \*

 | `string` **|** `null` | Lifecycle state (AVAILABLE, UPDATING, CREATING, DELETING, …). |  |

---

### Aws Networkmanager Core Network Policy

`aws_networkmanager_core_network_policy` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | The owning AWS account ID derived from the ARN. |  |
| 

`alias` \*

 | `string` **|** `null` | Alias of this version (LIVE = enforced, LATEST = latest published). | **Any of**:

-   `LIVE`

-   `LATEST`

-   `undefined`

 |
| 

`asnRanges` \*

 | `array` **|** `null` | BGP ASN ranges available to the core network (from core-network-configuration.asn-ranges). |  |
| 

`attachmentPolicyRuleCount` \*

 | `number` **|** `null` | Number of attachment-policy rules — a quick gauge of policy complexity. |  |
| 

`changeSetState` \*

 | `string` **|** `null` | Change-set state (READY\_TO\_EXECUTE, EXECUTING, OUT\_OF\_DATE, FAILED, …). |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`hasPolicyErrors` \*

 | `boolean` | True when the policy has one or more PolicyErrors entries (compliance signal). |  |
| 

`id` \*

 | `string` | The policy version ID (string-coerced) — natural AWS resource identifier scoped to the parent core network. |  |
| 

`insideCidrBlocks` \*

 | `array` **|** `null` | Inside CIDR blocks reserved for Connect attachments (from core-network-configuration.inside-cidr-blocks). |  |
| 

`isLive` \*

 | `boolean` | True when this policy version is aliased LIVE. |  |
| 

`isVpnEcmpSupportEnabled` \*

 | `boolean` **|** `null` | Whether VPN ECMP support is enabled on the core network (from core-network-configuration.vpn-ecmp-support). |  |
| 

`networkFunctionGroupNames` \*

 | `array` **|** `null` | All network-function-group names declared in the policy. |  |
| 

`policyErrorCodes` \*

 | `array` **|** `null` | Error codes from PolicyErrors\[\].ErrorCode if any. |  |
| 

`policyVersionId` \*

 | `number` | The policy version (monotonically increasing). |  |
| 

`region` \*

 | `string` | Control-plane region the policy was retrieved from. |  |
| 

`segmentNames` \*

 | `array` **|** `null` | All segment names declared in the policy. |  |

---

### Aws Networkmanager Core Network Policy Version

`aws_networkmanager_core_network_policy_version` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alias` \*

 | `string` **|** `null` | Alias (LIVE = enforced, LATEST = latest published, null = historical). | **Any of**:

-   `LIVE`

-   `LATEST`

-   `undefined`

 |
| 

`changeSetState` \*

 | `string` **|** `null` | Change-set state (READY\_TO\_EXECUTE, EXECUTING, OUT\_OF\_DATE, EXECUTION\_SUCCEEDED, FAILED). |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`isLive` \*

 | `boolean` | True when this version is currently aliased LIVE. |  |
| 

`policyVersionId` \*

 | `number` | The monotonically-increasing policy version number. |  |
| 

`region` \*

 | `string` | Control-plane region the version was retrieved from. |  |

---

### Aws Networkmanager Core Network Route

`aws_networkmanager_core_network_route` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`asPaths` \*

 | `array` **|** `null` | BGP AS\_PATH segments. |  |
| 

`communities` \*

 | `array` **|** `null` | BGP community values. |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`edgeLocation` \*

 | `string` **|** `null` | Edge location (AWS region) this route was learned from. |  |
| 

`localPreference` \*

 | `string` **|** `null` | BGP LOCAL\_PREF value. |  |
| 

`med` \*

 | `string` **|** `null` | BGP MED (Multi-Exit Discriminator) value. |  |
| 

`nextHopAttachmentId` \*

 | `string` **|** `null` | Core Network attachment ID of the next hop. |  |
| 

`nextHopEdgeLocation` \*

 | `string` **|** `null` | Edge location of the next hop. |  |
| 

`nextHopIpAddress` \*

 | `string` **|** `null` | BGP next-hop IP address. |  |
| 

`nextHopResourceId` \*

 | `string` **|** `null` | Resource ID of the next hop. |  |
| 

`nextHopResourceType` \*

 | `string` **|** `null` | Resource type of the next hop (e.g. "vpc", "vpn-connection"). |  |
| 

`nextHopSegmentName` \*

 | `string` **|** `null` | Segment of the next hop (inter-segment routing). |  |
| 

`prefix` \*

 | `string` **|** `null` | IP prefix for this route entry (e.g. "10.0.0.0/24"). |  |
| 

`region` \*

 | `string` | Control-plane region; same as edgeLocation. |  |
| 

`segmentName` \*

 | `string` | The segment this route entry belongs to. |  |

---

### Aws Nova Act Model

`aws_nova_act_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isActive` \*

 | `boolean` | Whether the model lifecycle status is `ACTIVE` and the model can be used by new workflow runs. |  |
| 

`lifecycleStatus` \*

 | `string` | Lifecycle status reported by Nova Act for the model, for example `ACTIVE` or `DEPRECATED`. |  |
| 

`minimumCompatibilityVersion` \*

 | `number` | Lowest Nova Act client compatibility version that can invoke this model. |  |
| 

`modelId` \*

 | `string` | Identifier of the Nova Act model, for example `nova-act-1.0`. |  |
| 

`region` \*

 | `string` | An AWS region the model is offered in, for example `us-east-1`. Models are offered in more than one region; this reports one of them. |  |

---

### Aws Nova Act Workflow Definition

`aws_nova_act_workflow_definition` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The Amazon Resource Name (ARN) of the workflow definition. |  |
| 

`region` \*

 | `string` | The AWS region the workflow definition is defined in, for example `us-east-1`. |  |
| 

`s3ExportBucketName` \*

 | `string` **|** `null` | Name of the S3 bucket workflow run artifacts are exported to, or null when no export destination is configured. |  |
| 

`s3ExportKeyPrefix` \*

 | `string` **|** `null` | Key prefix within the export S3 bucket that workflow run artifacts are written under, or null when no prefix is configured. |  |

---

### Aws Nova Act Workflow Run

`aws_nova_act_workflow_run` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The Amazon Resource Name (ARN) of the workflow run. |  |
| `endedOn` | `number` | Timestamp (epoch ms) when the workflow run ended |  |
| 

`logGroupName` \*

 | `string` **|** `null` | Name of the CloudWatch Logs log group the run writes logs to, or null when logging is not configured. |  |
| 

`modelId` \*

 | `string` | Identifier of the Nova Act model the run executed with. |  |
| 

`region` \*

 | `string` | The AWS region the workflow run executed in, for example `us-east-1`. |  |
| `startedOn` | `number` | Timestamp (epoch ms) when the workflow run started |  |
| 

`workflowRunId` \*

 | `string` | Identifier of the workflow run, unique within its workflow definition. |  |

---

### Aws Opensearch Domain

`aws_opensearch_domain` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessPolicies` \*

 | `string` **|** `null` | Raw JSON string of the IAM resource-based access policy attached to the OpenSearch domain. |  |
| 

`anonymousAuthDisabledOn` \*

 | `number` **|** `null` |  |  |
| 

`appLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`auditLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`autoTuneErrorMessage` \*

 | `string` **|** `null` |  |  |
| 

`autoTuneStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`autoTuneState` \*

 | `string` **|** `null` |  |  |
| 

`autoTuneUseOffPeakWindow` \*

 | `boolean` **|** `null` |  |  |
| 

`availabilityZoneCount` \*

 | `number` **|** `null` |  |  |
| 

`availabilityZones` \*

 | `array` **|** `null` |  |  |
| 

`changeProgressDetails` \*

 | `string` **|** `null` |  |  |
| 

`cognitoIdentityPoolId` \*

 | `string` **|** `null` |  |  |
| 

`cognitoRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`cognitoUserPoolId` \*

 | `string` **|** `null` |  |  |
| 

`customEndpoint` \*

 | `string` **|** `null` |  |  |
| 

`customEndpointCertificateArn` \*

 | `string` **|** `null` |  |  |
| 

`domainEndpointV2HostedZoneId` \*

 | `string` **|** `null` |  |  |
| 

`domainId` \*

 | `string` **|** `null` |  |  |
| 

`domainName` \*

 | `string` **|** `null` |  |  |
| 

`domainProcessingStatus` \*

 | `string` **|** `null` |  |  |
| 

`encryptionAtRestKmsKeyId` \*

 | `string` **|** `null` |  |  |
| 

`endpoint` \*

 | `string` **|** `null` |  |  |
| 

`endpoints` \*

 | `string` **|** `null` |  |  |
| 

`endpointV2` \*

 | `string` **|** `null` |  |  |
| 

`engineVersion` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterApplicationArn` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterInstanceArn` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterRolesKey` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterSubjectKey` \*

 | `string` **|** `null` |  |  |
| 

`instanceCount` \*

 | `number` **|** `null` |  |  |
| 

`instanceType` \*

 | `string` **|** `null` |  |  |
| 

`iops` \*

 | `number` **|** `null` |  |  |
| 

`ipAddressType` \*

 | `string` **|** `null` |  |  |
| 

`isAdvancedSecurityEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAnonymousAuthEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAppLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAuditLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoSoftwareUpdateEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoTuneEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCognitoEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isColdStorageEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCreated` \*

 | `boolean` **|** `null` |  |  |
| 

`isCustomEndpointEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isDedicatedMasterEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isDeleted` \*

 | `boolean` **|** `null` |  |  |
| 

`isEbsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncryptionAtRestEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isHttpsEnforced` \*

 | `boolean` **|** `null` |  |  |
| 

`isInternalUserDatabaseEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isInVpc` \*

 | `boolean` **|** `null` |  |  |
| 

`isJwtEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isMultiAzWithStandbyEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isNodeToNodeEncryptionEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isOffPeakWindowEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isProcessing` \*

 | `boolean` **|** `null` |  |  |
| 

`isSamlEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isSlowIndexLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isSlowSearchLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isUpgradeProcessing` \*

 | `boolean` **|** `null` |  |  |
| 

`isWarmEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isZoneAwarenessEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`jwtRolesKey` \*

 | `string` **|** `null` |  |  |
| 

`jwtSubjectKey` \*

 | `string` **|** `null` |  |  |
| 

`masterInstanceCount` \*

 | `number` **|** `null` |  |  |
| 

`masterInstanceType` \*

 | `string` **|** `null` |  |  |
| 

`modifyingProperties` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`naturalLanguageQueryGenerationCurrentState` \*

 | `string` **|** `null` |  |  |
| 

`naturalLanguageQueryGenerationDesiredState` \*

 | `string` **|** `null` |  |  |
| 

`offPeakWindowStartHours` \*

 | `number` **|** `null` |  |  |
| 

`offPeakWindowStartMinutes` \*

 | `number` **|** `null` |  |  |
| 

`opensearchVersion` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`samlRolesKey` \*

 | `string` **|** `null` |  |  |
| 

`samlSessionTimeoutMinutes` \*

 | `number` **|** `null` |  |  |
| 

`samlSubjectKey` \*

 | `string` **|** `null` |  |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`serviceSoftwareOptions` \*

 | `string` **|** `null` |  |  |
| 

`slowIndexLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`slowSearchLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`snapshotOptions` \*

 | `string` **|** `null` |  |  |
| 

`subnetIds` \*

 | `array` **|** `null` |  |  |
| 

`throughput` \*

 | `number` **|** `null` |  |  |
| 

`tlsSecurityPolicy` \*

 | `string` **|** `null` |  |  |
| 

`volumeSize` \*

 | `number` **|** `null` |  |  |
| 

`volumeType` \*

 | `string` **|** `null` |  |  |
| 

`vpcId` \*

 | `string` **|** `null` |  |  |
| 

`warmCount` \*

 | `number` **|** `null` |  |  |
| 

`warmType` \*

 | `string` **|** `null` |  |  |

---

### Aws Organization Root

`aws_organization_root` inherits from [Organization](/data-model/schemas/Organization.md), [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the organization root. |  |
| 

`enabledPolicyTypes` \*

 | `array` of `string`s | AWS Organizations policy types currently enabled for this organization root, as reported by ListRoots (for example SERVICE\_CONTROL\_POLICY, RESOURCE\_CONTROL\_POLICY, S3\_POLICY). Policy types absent from this list are not enabled for the root. |  |
| 

`isAiServicesOptOutPolicyEnabled` \*

 | `boolean` | Whether AI services opt-out policies are enabled for this organization root. These policies control whether AWS may store and use customer content submitted to AI services to improve those services. False when the policy type is disabled or is still being enabled. |  |
| 

`isBackupPolicyEnabled` \*

 | `boolean` | Whether backup policies are enabled for this organization root. Backup policies centrally define AWS Backup plans for the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isBedrockPolicyEnabled` \*

 | `boolean` | Whether Amazon Bedrock policies are enabled for this organization root. Bedrock policies centrally enforce Bedrock Guardrails on model inference calls made from the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isChatbotPolicyEnabled` \*

 | `boolean` | Whether chat applications policies are enabled for this organization root. These policies control which chat workspaces (Slack, Microsoft Teams) member accounts may connect to AWS. False when the policy type is disabled or is still being enabled. |  |
| 

`isDeclarativePolicyEc2Enabled` \*

 | `boolean` | Whether declarative policies for EC2 are enabled for this organization root. Declarative EC2 policies centrally enforce EC2 account attributes such as instance metadata defaults, serial console access, image block public access, and allowed AMI providers. False when the policy type is disabled or is still being enabled. |  |
| 

`isInspectorPolicyEnabled` \*

 | `boolean` | Whether Amazon Inspector policies are enabled for this organization root. Inspector policies centrally enable and configure Amazon Inspector scanning across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isNetworkSecurityDirectorPolicyEnabled` \*

 | `boolean` | Whether AWS Shield network security director policies are enabled for this organization root. These policies centrally enable AWS Shield network security director, which discovers compute, networking, and network security resources and evaluates their configuration against network topology, AWS best practices, and threat intelligence, across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isResourceControlPolicyEnabled` \*

 | `boolean` | Whether resource control policies (RCPs) are enabled for this organization root. RCPs set the maximum available permissions on resources in the member accounts, regardless of the calling principal's account. False when the policy type is disabled or is still being enabled. |  |
| 

`isS3PolicyEnabled` \*

 | `boolean` | Whether Amazon S3 policies are enabled for this organization root. S3 policies centrally enforce the four S3 Block Public Access settings across the member accounts, overriding account-level configuration. False when the policy type is disabled or is still being enabled. |  |
| 

`isSecurityHubPolicyEnabled` \*

 | `boolean` | Whether Security Hub policies are enabled for this organization root. Security Hub policies centrally configure Security Hub enablement, standards, and controls across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isServiceControlPolicyEnabled` \*

 | `boolean` | Whether service control policies (SCPs) are enabled for this organization root. SCPs set the maximum available permissions for principals in the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isTagPolicyEnabled` \*

 | `boolean` | Whether tag policies are enabled for this organization root. Tag policies standardise tag keys and values on resources across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isUpgradeRolloutPolicyEnabled` \*

 | `boolean` | Whether upgrade rollout policies are enabled for this organization root. Upgrade rollout policies centrally control how AWS service upgrades are staged across the member accounts. False when the policy type is disabled or is still being enabled. |  |

---

### Aws Organization Tag Policy

`aws_organization_tag_policy` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `awsManaged` | `boolean` |  |  |
| `content` | `string` |  |  |
| `type` | `string` |  |  |

---

### Aws Outposts Asset

`aws_outposts_asset` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetId` \*

 | `string` | The ID of the asset, unique within its Outpost. |  |
| 

`assetType` \*

 | `string` **|** `null` | The type of the asset (`COMPUTE`, `STORAGE`, `POWERSHELF`, `SWITCH`, `NETWORKING`), or null when AWS does not return it. |  |
| 

`catalogItemEc2Capacities` \*

 | `array` **|** `null` | The EC2 capacity the catalog item provides, one entry per capacity formatted as `<family>.<maxSize> x<quantity>` (for example `m5.24xlarge x1`). Null when the catalog item could not be read. |  |
| 

`catalogItemId` \*

 | `string` **|** `null` | The ID of the Outposts catalog item (hardware configuration) the asset was ordered as, for example `OR-0123456`. Null when no order line item references the asset. |  |
| 

`catalogItemPowerKva` \*

 | `number` **|** `null` | The power draw of the catalog item, in kVA, or null when the catalog item could not be read. |  |
| 

`catalogItemStatus` \*

 | `string` **|** `null` | The status of the catalog item (`AVAILABLE`, `DISCONTINUED`), or null when the catalog item could not be read. |  |
| 

`catalogItemSupportedStorage` \*

 | `array` **|** `null` | The storage options the catalog item supports (`EBS`, `S3`), or null when the catalog item could not be read. |  |
| 

`catalogItemSupportedUplinkGbps` \*

 | `array` **|** `null` | The uplink speeds, in Gbps, the catalog item supports, or null when the catalog item could not be read. |  |
| 

`catalogItemWeightLbs` \*

 | `number` **|** `null` | The weight of the catalog item, in pounds, or null when the catalog item could not be read. |  |
| 

`configuredInstanceCount` \*

 | `number` **|** `null` | The total number of instance slots configured across the asset capacity, or null for non-compute assets. |  |
| 

`configuredInstanceTypes` \*

 | `array` **|** `null` | The EC2 instance types configured on the asset capacity, or null for non-compute assets. |  |
| 

`hostId` \*

 | `string` **|** `null` | The EC2 dedicated host ID running on the asset, or null for non-compute assets. |  |
| 

`instanceFamilies` \*

 | `array` **|** `null` | The EC2 instance families supported by the asset, or null for non-compute assets. |  |
| 

`isActive` \*

 | `boolean` | Whether the compute asset state is `ACTIVE`. |  |
| 

`lineItemStatus` \*

 | `string` **|** `null` | The status of the order line item the asset shipped on, for example `INSTALLED`. Null when no order line item references the asset. |  |
| 

`maxVcpus` \*

 | `number` **|** `null` | The maximum number of vCPUs the asset provides, or null for non-compute assets. |  |
| 

`orderId` \*

 | `string` **|** `null` | The ID of the Outposts order the asset shipped on, for example `oo-0123456789abcdef0`. Null when no order line item references the asset or the order calls were denied. |  |
| 

`rackElevation` \*

 | `number` **|** `null` | The position of the asset in the rack, or null when AWS does not return it. |  |
| 

`rackId` \*

 | `string` **|** `null` | The rack ID the asset is installed in, or null when AWS does not return it. |  |
| 

`region` \*

 | `string` | The AWS Region whose Outposts control plane returned the asset, for example `us-east-1`. |  |
| 

`state` \*

 | `string` **|** `null` | The state of the compute asset (`ACTIVE`, `ISOLATED`, `RETIRING`, `INSTALLING`), or null for non-compute assets. |  |

---

### Aws Outposts Outpost

`aws_outposts_outpost` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The Amazon Resource Name (ARN) of the Outpost. |  |
| 

`availabilityZone` \*

 | `string` **|** `null` | The Availability Zone the Outpost is homed to, for example `us-east-1a`. Null when AWS does not return it. |  |
| 

`availabilityZoneId` \*

 | `string` **|** `null` | The ID of the Availability Zone the Outpost is homed to, for example `use1-az1`. Null when AWS does not return it. |  |
| 

`configuredInstanceTypes` \*

 | `array` **|** `null` | The EC2 instance types currently configured on the Outpost, or null when the call was denied or returned nothing. |  |
| 

`generation` \*

 | `string` **|** `null` | The hardware generation of the Outpost (`GENERATION_1`, `GENERATION_2`), or null when AWS does not return it. |  |
| 

`isActive` \*

 | `boolean` | Whether the Outpost lifecycle status is `ACTIVE`. |  |
| 

`lifeCycleStatus` \*

 | `string` **|** `null` | The lifecycle status of the Outpost, for example `ACTIVE`. Null when AWS does not return it. |  |
| 

`outpostId` \*

 | `string` | The ID of the Outpost, for example `op-0ab23c4567890def1`. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The AWS account ID of the Outpost owner, or null when AWS does not return it. |  |
| 

`privateConnectivityProvisioningRoleArn` \*

 | `string` **|** `null` | ARN of the IAM role used to provision private connectivity, or null when private connectivity is not configured. |  |
| 

`privateConnectivityRoleArn` \*

 | `string` **|** `null` | ARN of the IAM role used by the private connectivity configuration, or null when private connectivity is not configured. |  |
| 

`privateConnectivityStatus` \*

 | `string` **|** `null` | The status of private connectivity for the Outpost (`AVAILABLE`, `NOT_AVAILABLE`). Null when private connectivity is not configured or the call was denied. |  |
| 

`rackScalingType` \*

 | `string` **|** `null` | Whether the Outpost is a single rack or multiple racks (`SINGLE_RACK`, `MULTI_RACK`), or null when AWS does not return it. |  |
| 

`region` \*

 | `string` | The AWS Region whose Outposts control plane returned the Outpost, for example `us-east-1`. |  |
| 

`supportedHardwareType` \*

 | `string` **|** `null` | The type of hardware the Outpost supports (`RACK`, `SERVER`), or null when AWS does not return it. |  |
| 

`supportedInstanceTypes` \*

 | `array` **|** `null` | The EC2 instance types the Outpost supports, or null when the call was denied or returned nothing. |  |

---

### Aws Outposts Site

`aws_outposts_site` inherits from [Site](/data-model/schemas/Site.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | The ID of the AWS account that owns the site, or null when AWS does not return it. |  |
| 

`arn` \*

 | `string` | The Amazon Resource Name (ARN) of the site. |  |
| 

`fiberOpticCableType` \*

 | `string` **|** `null` | The type of fiber optic cable used for the rack uplink (`SINGLE_MODE`, `MULTI_MODE`), or null when the rack physical properties are not set. |  |
| 

`maximumSupportedWeightLbs` \*

 | `string` **|** `null` | The maximum rack weight the site can support, in pounds, reported by AWS as a range string such as `MAX_1400_LBS`. Null when not set. |  |
| 

`operatingAddressCity` \*

 | `string` **|** `null` | City of the site operating address, or null when the address is not shared with this account. |  |
| 

`operatingAddressCountryCode` \*

 | `string` **|** `null` | Country code of the site operating address, or null when the address is not shared with this account. |  |
| 

`operatingAddressStateOrRegion` \*

 | `string` **|** `null` | State or region of the site operating address, or null when the address is not shared with this account. |  |
| 

`opticalStandard` \*

 | `string` **|** `null` | The type of optical standard used to attach the rack to the network, for example `OPTIC_10GBASE_LR`. Null when not set. |  |
| 

`powerConnector` \*

 | `string` **|** `null` | The power connector AWS should plug the rack into, for example `L6_30P`. Null when not set. |  |
| 

`powerDrawKva` \*

 | `string` **|** `null` | The power draw available at the hardware, in kVA, reported by AWS as a string such as `POWER_10_KVA`. Null when not set. |  |
| 

`powerFeedDrop` \*

 | `string` **|** `null` | Whether the power feed comes above or below the rack (`ABOVE_RACK`, `BELOW_RACK`), or null when not set. |  |
| 

`powerPhase` \*

 | `string` **|** `null` | The power option provided for the hardware (`SINGLE_PHASE`, `THREE_PHASE`), or null when not set. |  |
| 

`region` \*

 | `string` | The AWS Region whose Outposts control plane returned the site, for example `us-east-1`. |  |
| 

`siteId` \*

 | `string` **|** `null` | The ID of the site, or null when AWS does not return it. |  |
| 

`uplinkCount` \*

 | `string` **|** `null` | The number of uplinks each Outpost network device is connected with, reported by AWS as a string such as `UPLINK_COUNT_2`. Null when not set. |  |
| 

`uplinkGbps` \*

 | `string` **|** `null` | The uplink speed the rack supports, reported by AWS as a string such as `UPLINK_1G`. Null when not set. |  |

---

### Aws Prometheus Scraper

`aws_prometheus_scraper` inherits from [Scanner](/data-model/schemas/Scanner.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alias` \*

 | `string` **|** `null` | Customer-assigned alias for the scraper (not unique). |  |
| 

`arn` \*

 | `string` | The full ARN of the scraper. |  |
| 

`destinationWorkspaceArn` \*

 | `string` **|** `null` | destination.ampConfiguration.workspaceArn — the AMP workspace the scraper writes metrics to. Used to build the SENDS relationship. |  |
| 

`eksClusterArn` \*

 | `string` **|** `null` | EKS cluster ARN the scraper collects from. Populated only when sourceType is EKS. |  |
| 

`isCrossAccountScrape` \*

 | `boolean` | True when DescribeScraper.roleConfiguration is present, indicating a cross-account scraping setup (source-account role + target-account role). |  |
| 

`region` \*

 | `string` | AWS region where the scraper runs. |  |
| 

`roleArn` \*

 | `string` | IAM role ARN the managed collector assumes to discover targets and write to the destination workspace. Required by the API. |  |
| 

`scraperId` \*

 | `string` | The AMP scraper identifier (e.g. s-abcd1234-...). |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Security group IDs applied to the scraper ENIs. Pulled from source.eksConfiguration.securityGroupIds or source.vpcConfiguration.securityGroupIds. May be null/empty for EKS (the field is optional on EksConfiguration). |  |
| 

`sourceAccountId` \*

 | `string` **|** `null` | AWS account ID parsed from `sourceRoleArn`. Used by the relationship-builder to construct subnet/security-group ARNs in the source account for cross-account scrapers, so mapped relationships resolve to the correct entities. Null when single-account. |  |
| 

`sourceRoleArn` \*

 | `string` **|** `null` | roleConfiguration.sourceRoleArn — IAM role in the source account used for cross-account scraping. Null when single-account. |  |
| 

`sourceType` \*

 | `string` **|** `null` | Discriminator for the source UNION. EKS when source.eksConfiguration is set, VPC when source.vpcConfiguration is set (MSK), null when neither (forward-compat). |  |
| 

`statusCode` \*

 | `string` **|** `null` | Scraper lifecycle status from DescribeScraper.status.statusCode (CREATING|ACTIVE|DELETING|CREATION\_FAILED|DELETION\_FAILED). |  |
| 

`statusReason` \*

 | `string` **|** `null` | Free-text reason for the current scraper status, populated when statusCode is a \*\_FAILED state. |  |
| 

`subnetIds` \*

 | `array` **|** `null` | Subnet IDs the scraper attaches its ENIs to. Pulled from source.eksConfiguration.subnetIds or source.vpcConfiguration.subnetIds. |  |
| 

`targetRoleArn` \*

 | `string` **|** `null` | roleConfiguration.targetRoleArn — IAM role in the target (workspace) account used for cross-account scraping. Null when single-account. |  |
| 

`webLink` \*

 | `string` **|** `null` | Link to the scraper in the AWS console. |  |

---

### Aws Prometheus Workspace

`aws_prometheus_workspace` inherits from [Logs](/data-model/schemas/Logs.md), [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alias` \*

 | `string` **|** `null` | Customer-assigned alias for the workspace (not unique). |  |
| 

`arn` \*

 | `string` | The full ARN of the workspace. |  |
| 

`configurationStatusCode` \*

 | `string` **|** `null` | Status code from DescribeWorkspaceConfiguration.status.statusCode (e.g. ACTIVE, UPDATING). |  |
| 

`displayName` \*

 | `string` | Human-readable name (alias when set, workspace ID otherwise). |  |
| 

`endpointStatusCode` \*

 | `string` **|** `null` | Workspace lifecycle status from DescribeWorkspace.status.statusCode (CREATING|ACTIVE|UPDATING|DELETING|CREATION\_FAILED). |  |
| 

`hasResourcePolicy` \*

 | `boolean` **|** `null` | True when DescribeResourcePolicy returned an attached policy (workspace is shared cross-account or cross-principal). False when no policy is attached. Null when the Describe call failed. |  |
| 

`isCustomerManagedEncryption` \*

 | `boolean` | True when the workspace is encrypted with a customer-managed KMS key; false when using an AWS-owned key. |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` | True when DescribeLoggingConfiguration returned a configuration with a logGroupArn. False when no configuration is attached. Null when the Describe call failed (e.g. AccessDenied or throttling) — distinguishes "feature off" from "could not determine". |  |
| 

`isQueryLoggingEnabled` \*

 | `boolean` **|** `null` | True when at least one CloudWatch Logs destination is configured for query logging. False when no configuration is attached. Null when the Describe call failed. |  |
| 

`loggingStatusCode` \*

 | `string` **|** `null` | Status code from DescribeLoggingConfiguration.status.statusCode. |  |
| 

`logGroupArn` \*

 | `string` **|** `null` | CloudWatch Logs log group ARN receiving rules/alerting logs; null when logging not configured. |  |
| 

`name` \*

 | `string` | The AMP workspace identifier (used as the entity name). |  |
| 

`policyDocument` \*

 | `string` **|** `null` | The raw JSON IAM policy document attached to the workspace via DescribeResourcePolicy. Used downstream to build IAM principal relationships. Null when no policy. |  |
| 

`prometheusEndpoint` \*

 | `string` **|** `null` | The Prometheus query API endpoint URL exposed by the workspace. |  |
| 

`queryLoggingQspThreshold` \*

 | `number` **|** `null` | Query samples processed (QSP) threshold filter for query logging — only queries above this threshold are logged. |  |
| 

`queryLoggingStatusCode` \*

 | `string` **|** `null` | Status code from DescribeQueryLoggingConfiguration.status.statusCode. |  |
| 

`queryLogGroupArn` \*

 | `string` **|** `null` | CloudWatch Logs log group ARN receiving query logs (first destination). Null when query logging not configured. |  |
| 

`queryLogGroupArns` \*

 | `array` **|** `null` | All CloudWatch Logs log group ARNs configured as query logging destinations (the API allows multiple even though current AWS console only supports one). |  |
| 

`region` \*

 | `string` | AWS region where the workspace lives. |  |
| 

`resourcePolicyStatusCode` \*

 | `string` **|** `null` | Lifecycle of the resource-based policy from DescribeResourcePolicy.policyStatus (CREATING|ACTIVE|UPDATING|DELETING). Null when no policy. |  |
| 

`retentionPeriodInDays` \*

 | `number` **|** `null` | Metric retention period in days from DescribeWorkspaceConfiguration. Null when DescribeWorkspaceConfiguration fails or is unavailable. |  |
| 

`webLink` \*

 | `string` **|** `null` | Link to the workspace in the AWS console. |  |
| 

`workspaceId` \*

 | `string` | The AMP workspace identifier (e.g. ws-abcd1234-...). |  |

---

### Aws Ram Principal

`aws_ram_principal` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`associatedResourceShares` \*

 | `array` **|** `null` |  |  |
| 

`associationStatus` \*

 | `string` **|** `null` |  |  |
| 

`associationStatusMessage` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isExternal` \*

 | `boolean` **|** `null` |  |  |
| 

`isOwnedBySelf` \*

 | `boolean` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`principalArn` \*

 | `string` |  |  |
| 

`principalType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`sourceOwner` \*

 | `string` |  |  |
| 

`vendor` \*

 | `string` |  |  |

---

### Aws Ram Resource Share

`aws_ram_resource_share` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isAllowExternalPrincipals` \*

 | `boolean` **|** `null` |  |  |
| 

`isFeatureSet` \*

 | `string` **|** `null` |  |  |
| 

`isOwnedBySelf` \*

 | `boolean` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`owningAccountId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceShareArn` \*

 | `string` **|** `null` |  |  |
| 

`sourceOwner` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`statusMessage` \*

 | `string` **|** `null` |  |  |

---

### Aws Ram Resource Share Invitation

`aws_ram_resource_share_invitation` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`invitationTimestamp` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`receiverAccountId` \*

 | `string` **|** `null` |  |  |
| 

`receiverArn` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceShareArn` \*

 | `string` **|** `null` |  |  |
| 

`resourceShareName` \*

 | `string` **|** `null` |  |  |
| 

`senderAccountId` \*

 | `string` **|** `null` |  |  |
| 

`status` \*

 | `string` |  |  |

---

### Aws Ram Shared Resource

`aws_ram_shared_resource` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isOwnedBySelf` \*

 | `boolean` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`resourceRegionScope` \*

 | `string` **|** `null` |  |  |
| 

`sourceOwner` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Aws Redshift Datashare

`aws_redshift_datashare` inherits from [DataCollection](/data-model/schemas/DataCollection.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` **|** `null` |  |  |
| 

`authorizationCount` \*

 | `number` **|** `null` |  |  |
| 

`datashareArn` \*

 | `string` **|** `null` |  |  |
| 

`datashareId` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`isProducerFromOtherAccount` \*

 | `boolean` **|** `null` |  |  |
| 

`isProducerFromOtherRegion` \*

 | `boolean` **|** `null` |  |  |
| 

`isPubliclyAccessibleByConsumers` \*

 | `boolean` **|** `null` |  |  |
| 

`managedBy` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`producerArn` \*

 | `string` **|** `null` |  |  |
| 

`producerType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Redshift Datashare Authorization

`aws_redshift_datashare_authorization` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`consumerIdentifier` \*

 | `string` **|** `null` |  |  |
| 

`consumerRegion` \*

 | `string` **|** `null` |  |  |
| 

`datashareArn` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`producerAllowedWrites` \*

 | `boolean` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`statusChangedOn` \*

 | `number` **|** `null` |  |  |

---

### Aws Resource Explorer Index

`aws_resource_explorer_index` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the index. |  |
| 

`isAggregator` \*

 | `boolean` **|** `null` | True if this is the aggregator index. |  |
| 

`region` \*

 | `string` | AWS region. |  |
| 

`replicatingFrom` \*

 | `array` **|** `null` | For an AGGREGATOR index: the Regions that replicate their content into this index. |  |
| 

`replicatingTo` \*

 | `array` **|** `null` | For a LOCAL index: the Regions whose content this index replicates to (i.e. the aggregator region). |  |
| 

`state` \*

 | `string` **|** `null` | Index state. |  |
| 

`type` \*

 | `string` **|** `null` | Index type: LOCAL or AGGREGATOR. |  |

---

### Aws Resource Explorer View

`aws_resource_explorer_view` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the view. |  |
| 

`filtersString` \*

 | `string` **|** `null` | Filter expression string. |  |
| 

`includedProperties` \*

 | `array` **|** `null` | Additional resource property names included in results. |  |
| 

`isDefaultView` \*

 | `boolean` **|** `null` | True if this is the account default view. |  |
| 

`ownerAccountId` \*

 | `string` **|** `null` | AWS account ID that owns this view. |  |
| 

`region` \*

 | `string` | AWS region. |  |
| 

`scope` \*

 | `string` **|** `null` | Scope ARN of the view. |  |
| 

`viewName` \*

 | `string` **|** `null` | View name. |  |

---

### Aws S3 Bucket Lifecycle Rule

`aws_s3_bucket_lifecycle_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`abortIncompleteMultipartUploadDays` \*

 | `number` **|** `null` | Days after multipart-upload initiation before the upload is aborted and parts deleted (rule.AbortIncompleteMultipartUpload.DaysAfterInitiation). Storage-cost and security hygiene signal. |  |
| 

`appliesToAllObjects` \*

 | `boolean` | True iff the rule has no filter (no prefix, no tag, no size bounds, no And operator). Wide-scope rules are a key compliance review signal. |  |
| 

`expirationDate` \*

 | `number` **|** `null` | Absolute date (epoch ms) at which current versions expire (rule.Expiration.Date). Most rules use Days OR Date, not both. |  |
| 

`expirationDays` \*

 | `number` **|** `null` | Days after object creation when current versions are expired (rule.Expiration.Days). Maps directly to retention policy in NIST SI-12 / SOC 2 CC6.5 / HIPAA 164.310(d)(2)(i) / PCI DSS 3.1. |  |
| 

`filterAndTagKeys` \*

 | `array` **|** `null` | Tag keys used in the multi-tag conjunction filter (rule.Filter.And.Tags). Parallel-array to filterAndTagValues — same index = same tag. |  |
| 

`filterAndTagValues` \*

 | `array` **|** `null` | Tag values used in the multi-tag conjunction filter. Index-aligned with filterAndTagKeys. |  |
| 

`filterObjectSizeGreaterThan` \*

 | `number` **|** `null` | Minimum object size in bytes for the rule to apply (rule.Filter.ObjectSizeGreaterThan or rule.Filter.And.ObjectSizeGreaterThan). |  |
| 

`filterObjectSizeLessThan` \*

 | `number` **|** `null` | Maximum object size in bytes for the rule to apply (rule.Filter.ObjectSizeLessThan or rule.Filter.And.ObjectSizeLessThan). |  |
| 

`filterPrefix` \*

 | `string` **|** `null` | Object key prefix the rule applies to. Pulled from rule.Prefix (deprecated), rule.Filter.Prefix, or rule.Filter.And.Prefix in that order. Null when no prefix is configured — see appliesToAllObjects for the "applies to every object" signal. |  |
| 

`filterTagKey` \*

 | `string` **|** `null` | Key of the single object tag that scopes this rule (when rule.Filter.Tag is set). |  |
| 

`filterTagValue` \*

 | `string` **|** `null` | Value of the single object tag that scopes this rule (when rule.Filter.Tag is set). |  |
| 

`hasAnyAction` \*

 | `boolean` | True iff the rule has at least one action defined (expiration, transition, noncurrent-version action, or abort-incomplete-multipart-upload). False indicates a misconfiguration — a rule with no action does nothing. |  |
| 

`isAppliedToNoncurrentVersions` \*

 | `boolean` | True iff the rule has any NoncurrentVersion\* action defined. Combined with bucket-level versioningEnabled in J1QL to spot misconfigurations. |  |
| 

`isEnabled` \*

 | `boolean` | Whether the lifecycle rule is currently being enforced (true iff Status === "Enabled"). Disabled rules look like coverage but are not applied — a key compliance signal. |  |
| 

`isExpiredObjectDeleteMarkerEnabled` \*

 | `boolean` **|** `null` | Whether the rule cleans up expired-object delete markers (rule.Expiration.ExpiredObjectDeleteMarker). Used to keep versioned bucket listings tidy. |  |
| 

`noncurrentExpirationDays` \*

 | `number` **|** `null` | Days a version is retained after becoming noncurrent before expiration (rule.NoncurrentVersionExpiration.NoncurrentDays). Critical for compliance on versioned buckets. |  |
| 

`noncurrentExpirationNewerVersions` \*

 | `number` **|** `null` | Number of newer noncurrent versions to retain before expiring older ones (rule.NoncurrentVersionExpiration.NewerNoncurrentVersions). |  |
| 

`noncurrentTransitionCount` \*

 | `number` | Number of noncurrent-version transitions defined on this rule. |  |
| 

`noncurrentTransitionDays` \*

 | `array` **|** `null` | Days after object version becomes noncurrent for each transition (rule.NoncurrentVersionTransitions\[\].NoncurrentDays). Index-aligned with noncurrentTransitionStorageClasses and noncurrentTransitionNewerVersions. A value of -1 indicates NoncurrentDays was missing in the source response. |  |
| 

`noncurrentTransitionNewerVersions` \*

 | `array` **|** `null` | Number of newer noncurrent versions to retain before transitioning, for each noncurrent transition (rule.NoncurrentVersionTransitions\[\].NewerNoncurrentVersions, max 100). Index-aligned. A value of -1 means NewerNoncurrentVersions was not configured for that transition. |  |
| 

`noncurrentTransitionStorageClasses` \*

 | `array` **|** `null` | Destination storage class for each noncurrent-version transition (rule.NoncurrentVersionTransitions\[\].StorageClass). Index-aligned. Empty string indicates the source response omitted StorageClass. |  |
| 

`region` \*

 | `string` **|** `null` | AWS region of the parent S3 bucket. Null for legacy buckets without a recorded region. |  |
| 

`ruleId` \*

 | `string` **|** `null` | AWS-side rule identifier (rule.ID). May be absent on rules created without an explicit ID — in that case the entity key falls back to an index-based synthesis. |  |
| 

`transitionCount` \*

 | `number` | Number of current-version transitions defined on this rule (rule.Transitions?.length ?? 0). Convenience for J1QL. |  |
| 

`transitionDates` \*

 | `array` **|** `null` | Absolute transition dates (epoch ms) for each transition (rule.Transitions\[\].Date). Index-aligned with transitionDays / transitionStorageClasses. A value of 0 at index i indicates that transition i is Days-based rather than Date-based; consult transitionDays\[i\] in that case. Null when there are no transitions. |  |
| 

`transitionDays` \*

 | `array` **|** `null` | Days after object creation for each transition (rule.Transitions\[\].Days). Parallel-array, index-aligned with transitionDates and transitionStorageClasses. A value of -1 at index i indicates that transition i is Date-based rather than Days-based; consult transitionDates\[i\] in that case. Null when there are no transitions. |  |
| 

`transitionStorageClasses` \*

 | `array` **|** `null` | Destination storage class for each transition (rule.Transitions\[\].StorageClass): one of STANDARD\_IA, ONEZONE\_IA, INTELLIGENT\_TIERING, GLACIER, GLACIER\_IR, DEEP\_ARCHIVE. Index-aligned with transitionDays / transitionDates. Empty string indicates the source response omitted StorageClass. |  |

---

### Aws Sagemaker Domain

`aws_sagemaker_domain` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`appNetworkAccessType` \*

 | `string` **|** `null` | Network egress mode for Studio apps: 'PublicInternetOnly' (SageMaker-managed VPC with direct internet access) or 'VpcOnly' (all traffic through the customer VPC). |  |
| 

`appSecurityGroupManagement` \*

 | `string` **|** `null` | Who creates and manages inter-app security groups in VpcOnly mode: 'Service' or 'Customer'. |  |
| 

`arn` \*

 | `string` | The ARN of the SageMaker domain. |  |
| 

`authMode` \*

 | `string` **|** `null` | How users authenticate into Studio: 'SSO' (IAM Identity Center) or 'IAM'. |  |
| 

`defaultSpaceExecutionRoleArn` \*

 | `string` **|** `null` | The default IAM execution role assumed by shared spaces in the domain. |  |
| 

`defaultSpaceSecurityGroupIds` \*

 | `array` **|** `null` | Default security groups applied to shared spaces in the domain. |  |
| 

`defaultUserExecutionRoleArn` \*

 | `string` **|** `null` | The default IAM execution role assumed by user profiles that do not override it. |  |
| 

`defaultUserSecurityGroupIds` \*

 | `array` **|** `null` | Default security groups applied to user-profile apps. |  |
| 

`dockerTrustedAccountIds` \*

 | `array` **|** `null` | AWS account IDs trusted to serve Docker images to this domain in VpcOnly mode — a cross-account trust list. |  |
| 

`domainId` \*

 | `string` | The SageMaker-assigned domain identifier (e.g. d-abc123defghi). |  |
| 

`domainSecurityGroupIds` \*

 | `array` **|** `null` | Domain-level security groups governing traffic between domain-level apps and user apps. |  |
| 

`executionRoleIdentityConfig` \*

 | `string` **|** `null` | Whether the user profile name is stamped onto assumed-role sessions as sts:SourceIdentity ('USER\_PROFILE\_NAME') or not ('DISABLED'). When DISABLED, CloudTrail cannot attribute Studio actions to an individual user. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the domain failed to provision, when applicable. |  |
| 

`homeEfsFileSystemId` \*

 | `string` **|** `null` | The ID of the EFS file system managed by the domain, which stores all user notebooks and code. |  |
| 

`homeEfsFileSystemKmsKeyId` \*

 | `string` **|** `null` | Deprecated by AWS in favour of kmsKeyId; usually absent on modern domains. Absence does not mean unencrypted. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isDockerAccessEnabled` \*

 | `boolean` **|** `null` | Whether local Docker interaction is enabled for Studio apps in this domain, which expands the container-escape surface. |  |
| 

`isPublicInternetAccessEnabled` \*

 | `boolean` | Whether Studio apps in this domain reach the internet directly through the SageMaker-managed VPC rather than being confined to the customer VPC. Describes egress, not inbound reachability. Defaults to true when AppNetworkAccessType is absent, matching the AWS default of PublicInternetOnly. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key used to encrypt the EFS volume attached to the domain. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |
| 

`region` \*

 | `string` | The AWS region hosting the domain. |  |
| 

`securityGroupIdForDomainBoundary` \*

 | `string` **|** `null` | The security group authorizing traffic between RSessionGateway apps and the RStudioServerPro app. |  |
| 

`subnetIds` \*

 | `array` **|** `null` | The VPC subnet IDs the domain uses for communication. |  |
| 

`url` \*

 | `string` **|** `null` | The Studio entry-point URL for the domain. |  |
| 

`vpcId` \*

 | `string` **|** `null` | The ID of the VPC the domain uses for communication. |  |

---

### Aws Sagemaker Endpoint

`aws_sagemaker_endpoint` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` |  |  |
| `createdOn` | `number` |  |  |
| `dataCaptureDestinationS3Uri` | `string` | The S3 URI where captured inference payloads are written. |  |
| `dataCaptureKmsKeyId` | `string` | The customer-managed KMS key used to encrypt captured inference data. May be a key ID, key ARN, alias, or alias ARN. Absence means an AWS-managed key is used, not that the data is unencrypted. |  |
| `dataCaptureModes` | `array` of `string`s | Which payloads are captured: 'Input', 'Output', or both. |  |
| `dataCaptureSamplingPercentage` | `number` | Percentage of live inference traffic persisted to S3, which may include sensitive payloads. |  |
| 

`displayName` \*

 | `string` |  |  |
| `endpointConfigName` | `string` |  |  |
| 

`endpointName` \*

 | `string` |  |  |
| `executionRoleArn` | `string` |  |  |
| `failureReason` | `string` |  |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| `isDataCaptureEnabled` | `boolean` | Whether inference request/response payloads are captured to S3. False when no DataCaptureConfig is configured on the endpoint config. |  |
| `kmsKeyId` | `string` |  |  |
| `modelNames` | `array` of `string`s |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `vpcSecurityGroupIds` | `array` of `string`s |  |  |
| `vpcSubnets` | `array` of `string`s |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Sagemaker Feature Group

`aws_sagemaker_feature_group` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the feature group. |  |
| 

`eventTimeFeatureName` \*

 | `string` **|** `null` | The name of the feature holding the event time of each record. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the feature group failed to be created, when applicable. |  |
| 

`featureCount` \*

 | `number` | The number of feature definitions declared on the feature group. |  |
| 

`featureGroupName` \*

 | `string` | The name of the feature group. |  |
| 

`glueCatalog` \*

 | `string` **|** `null` | The Glue data catalog the offline store is registered in, which governs who can query the data through Athena. |  |
| 

`glueDatabase` \*

 | `string` **|** `null` | The Glue database containing the offline store table. |  |
| 

`glueTableName` \*

 | `string` **|** `null` | The Glue table exposing the offline store. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isCustomerManagedKeyEncrypted` \*

 | `boolean` | Whether at least one store is encrypted with a customer-managed KMS key. Both stores are always encrypted at rest with an AWS-managed key when this is false. |  |
| 

`isGlueTableCreationDisabled` \*

 | `boolean` | Whether automatic Glue table creation for the offline store is disabled. |  |
| 

`isOnlineStoreEnabled` \*

 | `boolean` | Whether a low-latency online serving store exists for this feature group. |  |
| 

`offlineStoreBlockedReason` \*

 | `string` **|** `null` | Why replication into the offline store is blocked, when applicable. |  |
| 

`offlineStoreKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the offline S3 store. Absence means an AWS-managed key is used, not that the store is unencrypted. |  |
| 

`offlineStoreResolvedS3Uri` \*

 | `string` **|** `null` | The resolved S3 prefix feature records physically land in. |  |
| 

`offlineStoreS3Uri` \*

 | `string` **|** `null` | The S3 URI the offline store writes feature records to. |  |
| 

`offlineStoreStatus` \*

 | `string` **|** `null` | Whether replication into the offline store is 'Active', 'Blocked' or 'Disabled'. A blocked store silently loses data. |  |
| 

`onlineStoreKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the online store. Absence means an AWS-managed key is used, not that the store is unencrypted. |  |
| 

`onlineStoreStorageType` \*

 | `string` **|** `null` | The storage backing the online store: 'Standard' or 'InMemory'. |  |
| 

`onlineStoreTotalSizeBytes` \*

 | `number` **|** `null` | The total size of the online store in bytes, i.e. the volume of data at risk. |  |
| 

`recordIdentifierFeatureName` \*

 | `string` **|** `null` | The name of the feature that uniquely identifies a record in the feature group. |  |
| 

`region` \*

 | `string` | The AWS region hosting the feature group. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM role Feature Store assumes to persist records into the offline S3 store. |  |
| 

`tableFormat` \*

 | `string` **|** `null` | The table format of the offline store: 'Default' (Glue) or 'Iceberg'. |  |
| 

`ttlDurationUnit` \*

 | `string` **|** `null` | The unit of the default online store record time-to-live: 'Seconds', 'Minutes', 'Hours', 'Days' or 'Weeks'. |  |
| 

`ttlDurationValue` \*

 | `number` **|** `null` | The value of the default online store record time-to-live, expressed in ttlDurationUnit. |  |

---

### Aws Sagemaker Inference Recommendations Job

`aws_sagemaker_inference_recommendations_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the inference recommendations job. |  |
| 

`completedOn` \*

 | `number` **|** `null` | The time the job completed, in milliseconds since the epoch. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the inference recommendations job failed, when applicable. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`jobType` \*

 | `string` **|** `null` | The type of inference recommendations job: 'Default' or 'Advanced'. |  |
| 

`modelName` \*

 | `string` **|** `null` | The name of the SageMaker model used for inference benchmarking. |  |
| 

`modelPackageVersionArn` \*

 | `string` **|** `null` | The ARN of the model package version used for inference benchmarking. |  |
| 

`region` \*

 | `string` | The AWS region the inference recommendations job ran in. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM execution role assumed by the inference recommendations job. |  |

---

### Aws Sagemaker Model

`aws_sagemaker_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` |  |  |
| 

`containerCount` \*

 | `number` |  |  |
| 

`createdOn` \*

 | `number` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`executionRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`inferenceExecutionMode` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` |  |  |
| 

`modelName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`primaryContainerHostname` \*

 | `string` **|** `null` |  |  |
| 

`primaryContainerImage` \*

 | `string` **|** `null` |  |  |
| 

`primaryContainerMode` \*

 | `string` **|** `null` |  |  |
| 

`primaryContainerModelDataUrl` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Sagemaker Model Bias Job Definition

`aws_sagemaker_model_bias_job_definition` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the model bias monitoring job definition. |  |
| 

`baselineConstraintsS3Uri` \*

 | `string` **|** `null` | The S3 URI of the baseline constraints file used by the monitoring job. |  |
| 

`biasConfigS3Uri` \*

 | `string` **|** `null` | The S3 URI of the SHAP/bias analysis configuration file. |  |
| 

`imageUri` \*

 | `string` **|** `null` | The container image registry path used to run the model bias monitoring job. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for monitoring. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for monitoring. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isInterContainerTrafficEncryptionEnabled` \*

 | `boolean` | Whether traffic between the nodes of a distributed monitoring job is encrypted in transit. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` | Whether the monitoring container is isolated from the network. |  |
| 

`maxRuntimeInSeconds` \*

 | `number` **|** `null` | The maximum runtime allowed for the monitoring job in seconds. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting monitoring outputs written to S3. |  |
| 

`region` \*

 | `string` | The AWS region hosting this job definition. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM execution role the monitoring job assumes to access data and write results. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume. |  |
| 

`volumeSizeInGB` \*

 | `number` **|** `null` | The size of the ML storage volume attached to the monitoring instances. |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` | The security group IDs applied to the monitoring containers. |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` | The VPC subnet IDs the monitoring containers were attached to. |  |

---

### Aws Sagemaker Model Quality Job Definition

`aws_sagemaker_model_quality_job_definition` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the model quality monitoring job definition. |  |
| 

`baselineConstraintsS3Uri` \*

 | `string` **|** `null` | The S3 URI of the baseline constraints file used by the monitoring job. |  |
| 

`imageUri` \*

 | `string` **|** `null` | The container image registry path used to run the model quality monitoring job. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for monitoring. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for monitoring. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isInterContainerTrafficEncryptionEnabled` \*

 | `boolean` | Whether traffic between the nodes of a distributed monitoring job is encrypted in transit. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` | Whether the monitoring container is isolated from the network. |  |
| 

`maxRuntimeInSeconds` \*

 | `number` **|** `null` | The maximum runtime allowed for the monitoring job in seconds. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting monitoring outputs written to S3. |  |
| 

`problemType` \*

 | `string` **|** `null` | The ML problem type for model quality monitoring: 'BinaryClassification', 'MulticlassClassification', or 'Regression'. |  |
| 

`region` \*

 | `string` | The AWS region hosting this job definition. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM execution role the monitoring job assumes to access data and write results. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume. |  |
| 

`volumeSizeInGB` \*

 | `number` **|** `null` | The size of the ML storage volume attached to the monitoring instances. |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` | The security group IDs applied to the monitoring containers inside the customer VPC. |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` | The VPC subnet IDs the monitoring containers were attached to. |  |

---

### Aws Sagemaker Pipeline Execution

`aws_sagemaker_pipeline_execution` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the pipeline execution. |  |
| 

`experimentName` \*

 | `string` **|** `null` | The SageMaker Experiments experiment name this execution is associated with. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the pipeline execution failed, when applicable. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`maxParallelExecutionSteps` \*

 | `number` **|** `null` | The maximum number of pipeline steps that can run in parallel within this execution. |  |
| 

`pipelineArn` \*

 | `string` **|** `null` | The ARN of the pipeline this execution belongs to. |  |
| 

`region` \*

 | `string` | The AWS region the pipeline execution ran in. |  |
| 

`sourceExecutionArn` \*

 | `string` **|** `null` | The ARN of the source pipeline execution for selective re-runs. |  |
| 

`trialName` \*

 | `string` **|** `null` | The SageMaker Experiments trial name this execution is associated with. |  |

---

### Aws Sagemaker Processing Job

`aws_sagemaker_processing_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the SageMaker processing job. |  |
| 

`endedOn` \*

 | `number` **|** `null` | The time processing ended, in milliseconds since the epoch. |  |
| 

`exitMessage` \*

 | `string` **|** `null` | An optional string the processing container wrote on exit, describing the outcome. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the processing job failed, when applicable. |  |
| 

`imageUri` \*

 | `string` **|** `null` | The container image registry path used to run the processing job. Custom or unvetted images are a supply-chain signal. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for processing. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for processing. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isInterContainerTrafficEncryptionEnabled` \*

 | `boolean` | Whether traffic between the nodes of a distributed processing job is encrypted in transit. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` | Whether the processing container is isolated from the network, preventing outbound calls from the container. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the processing outputs written to S3. Absence means an AWS-managed key is used, not that the output is unencrypted. |  |
| 

`outputS3Uris` \*

 | `array` **|** `null` | The S3 URIs the processing job writes its outputs to. Processing jobs are a common bulk data egress path. |  |
| 

`processingJobName` \*

 | `string` | The name of the processing job. |  |
| 

`region` \*

 | `string` | The AWS region the processing job ran in. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM execution role assumed by the processing job to read input data and write results. |  |
| 

`startedOn` \*

 | `number` **|** `null` | The time processing started, in milliseconds since the epoch. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume attached to the processing instances. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` | The security group IDs applied to the processing containers inside the customer VPC. |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` | The VPC subnet IDs the processing containers were attached to. Absent when the job ran outside a customer VPC. |  |

---

### Aws Sagemaker Training Job

`aws_sagemaker_training_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the SageMaker training job. |  |
| 

`checkpointS3Uri` \*

 | `string` **|** `null` | The S3 URI training checkpoints are written to — a second, frequently overlooked sink for training data. |  |
| 

`endedOn` \*

 | `number` **|** `null` | The time training ended, in milliseconds since the epoch. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the training job failed, when applicable. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for training. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for training. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isInterContainerTrafficEncryptionEnabled` \*

 | `boolean` | Whether traffic between the nodes of a distributed training job is encrypted in transit. |  |
| 

`isManagedSpotTrainingEnabled` \*

 | `boolean` | Whether the job used managed spot instances, which explains interruptions and availability gaps. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` | Whether the training container is isolated from the network, preventing outbound calls from the algorithm container. |  |
| 

`modelArtifactsS3Uri` \*

 | `string` **|** `null` | The S3 URI of the model artifacts actually produced by the training job. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the model artifacts written to S3. Absence means an AWS-managed key is used, not that the output is unencrypted. |  |
| 

`outputS3Path` \*

 | `string` **|** `null` | The S3 path the training job writes its model artifacts to. |  |
| 

`region` \*

 | `string` | The AWS region the training job ran in. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM execution role assumed by the training job to read input data and write model artifacts. |  |
| 

`secondaryStatus` \*

 | `string` **|** `null` | The detailed job substatus, which distinguishes cases such as 'Interrupted' and 'MaxRuntimeExceeded'. |  |
| 

`startedOn` \*

 | `number` **|** `null` | The time training started, in milliseconds since the epoch. |  |
| 

`trainingImage` \*

 | `string` **|** `null` | The container image registry path used to train the model. Custom or unvetted images are a supply-chain signal. |  |
| 

`trainingJobName` \*

 | `string` | The name of the training job. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume attached to the training instances. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` | The security group IDs applied to the training containers inside the customer VPC. |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` | The VPC subnet IDs the training containers were attached to. Absent when the job ran outside a customer VPC. |  |

---

### Aws Sagemaker Transform Job

`aws_sagemaker_transform_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the SageMaker batch transform job. |  |
| 

`dataCaptureDestinationS3Uri` \*

 | `string` **|** `null` | The S3 URI captured batch inference payloads are written to. |  |
| 

`dataCaptureKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting captured batch inference data. Absence means an AWS-managed key is used, not that the data is unencrypted. |  |
| 

`endedOn` \*

 | `number` **|** `null` | The time the transform job ended, in milliseconds since the epoch. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the transform job failed, when applicable. |  |
| 

`inputS3Uri` \*

 | `string` **|** `null` | The S3 URI of the dataset the transform job reads. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for the transform job. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for the transform job. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isDataCaptureEnabled` \*

 | `boolean` | Whether inference inputs and outputs are captured to S3. Batch data capture has no explicit enable flag — the presence of the capture configuration is the signal. |  |
| 

`modelName` \*

 | `string` | The name of the SageMaker model used for inference. The model carries the execution role, VPC and network isolation posture of the job. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the inference results written to S3. Absence means an AWS-managed key is used, not that the output is unencrypted. |  |
| 

`outputS3Path` \*

 | `string` **|** `null` | The S3 path the transform job writes inference results to. |  |
| 

`region` \*

 | `string` | The AWS region the transform job ran in. |  |
| 

`startedOn` \*

 | `number` **|** `null` | The time the transform job started, in milliseconds since the epoch. |  |
| 

`transformJobName` \*

 | `string` | The name of the batch transform job. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume attached to the transform instances. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |

---

### Aws Secret

`aws_secret` inherits from [Secret](/data-model/schemas/Secret.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| `encryptionKeyRef` | `string` |  |  |
| `kmsKeyId` | `string` |  |  |
| `lastAccessedDate` | `number` |  |  |
| `lastChangedDate` | `number` |  |  |
| `lastRotatedDate` | `number` |  |  |
| `nextRotationDate` | `number` |  |  |
| `owningService` | `string` |  |  |
| `policyDocument` | `string` |  |  |
| `primaryRegion` | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| `replicationStatus` | `array` of `string`s |  |  |
| `rotateAutomaticallyAfterDays` | `number` |  |  |
| `rotationEnabled` | `boolean` |  |  |
| `rotationLambdaArn` | `string` |  |  |
| `rotationScheduleExpression` | `string` |  |  |
| `rotationWindow` | `string` |  |  |
| `versionIdsToStages` | `string` |  |  |

---

### Aws Secret Version

`aws_secret_version` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `lastAccessedDate` | `number` |  |  |
| 
`versionId` \*

 | `string` |  |  |
| `versionStages` | `array` of `string`s |  |  |

---

### Aws Securityhub Account

`aws_securityhub_account` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`controlFindingGenerator` \*

 | `string` **|** `null` |  |  |
| 

`isAutoEnableControlsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isEnabled` \*

 | `boolean` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`subscribedOn` \*

 | `number` **|** `null` |  |  |

---

### Aws Securityhub Finding

`aws_securityhub_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `companyName` | `string` |  |  |
| `complianceStatus` | `string` |  |  |
| `confidence` | `number` |  |  |
| `criticality` | `number` |  |  |
| `generatorId` | `string` |  |  |
| `id` | `string` |  |  |
| `productArn` | `string` |  |  |
| `productName` | `string` |  |  |
| `recordState` | `string` |  |  |
| `region` | `string` |  |  |
| `remediationUrl` | `string` |  |  |
| `resourceIds` | `array` of `string`s |  |  |
| `resourceTypes` | `array` of `string`s |  |  |
| `sourceUrl` | `string` |  |  |
| `state` | `string` |  |  |
| `types` | `array` of `string`s |  |  |
| `workflowState` | `string` |  |  |
| `workflowStatus` | `string` |  |  |

---

### Aws Securityhub Finding

`aws_securityhub_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `companyName` | `string` |  |  |
| `complianceStatus` | `string` |  |  |
| `confidence` | `number` |  |  |
| `criticality` | `number` |  |  |
| `generatorId` | `string` |  |  |
| `id` | `string` |  |  |
| `productArn` | `string` |  |  |
| `productName` | `string` |  |  |
| `recordState` | `string` |  |  |
| `region` | `string` |  |  |
| `remediationUrl` | `string` |  |  |
| `resourceIds` | `array` of `string`s |  |  |
| `resourceTypes` | `array` of `string`s |  |  |
| `sourceUrl` | `string` |  |  |
| `state` | `string` |  |  |
| `types` | `array` of `string`s |  |  |
| `workflowState` | `string` |  |  |
| `workflowStatus` | `string` |  |  |

---

### Aws Servicecatalog Constraint

`aws_servicecatalog_constraint` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`constraintId` \*

 | `string` | The ID of the Service Catalog constraint. |  |
| 

`constraintParameters` \*

 | `string` **|** `null` | The constraint parameters as a raw JSON string. Structure varies by constraint type. |  |
| 

`productId` \*

 | `string` **|** `null` | The ID of the product this constraint applies to, if product-specific. |  |
| 

`region` \*

 | `string` | AWS region where the constraint is defined. |  |
| 

`type` \*

 | `string` | The type of constraint (LAUNCH, NOTIFICATION, RESOURCE\_UPDATE, STACKSET, TEMPLATE, TAG). |  |

---

### Aws Servicecatalog Launch Path

`aws_servicecatalog_launch_path` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`constraintTypes` \*

 | `array` **|** `null` | The types of constraint applied along this launch path (e.g. LAUNCH, NOTIFICATION, TEMPLATE, STACKSET). The constraint descriptions are not duplicated here; they are carried on the corresponding aws\_servicecatalog\_constraint entities. |  |
| 

`pathId` \*

 | `string` | The ID of the launch path. |  |
| 

`region` \*

 | `string` | AWS region where the launch path is available. |  |

---

### Aws Servicecatalog Portfolio

`aws_servicecatalog_portfolio` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the Service Catalog portfolio. |  |
| 

`portfolioId` \*

 | `string` | The ID of the Service Catalog portfolio. |  |
| 

`providerName` \*

 | `string` **|** `null` | The name of the person or organization who owns the portfolio. |  |
| 

`region` \*

 | `string` | AWS region where the portfolio is defined. |  |

---

### Aws Servicecatalog Product

`aws_servicecatalog_product` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the Service Catalog product. |  |
| 

`distributor` \*

 | `string` **|** `null` | The distributor of the product. |  |
| 

`hasDefaultPath` \*

 | `boolean` **|** `null` | Whether the product has a default launch path. |  |
| 

`productId` \*

 | `string` | The ID of the Service Catalog product. |  |
| 

`region` \*

 | `string` | AWS region where the product is defined. |  |
| 

`supportDescription` \*

 | `string` **|** `null` | The support information about the product, as supplied by the administrator. |  |
| 

`supportEmail` \*

 | `string` **|** `null` | The email address of the support contact for the product. |  |
| 

`supportUrl` \*

 | `string` **|** `null` | The URL for product support. |  |
| 

`type` \*

 | `string` **|** `null` | The product type (e.g. CLOUD\_FORMATION\_TEMPLATE, TERRAFORM\_OPEN\_SOURCE). |  |

---

### Aws Servicecatalog Provisioning Artifact

`aws_servicecatalog_provisioning_artifact` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`artifactId` \*

 | `string` | The ID of the provisioning artifact. |  |
| 

`guidance` \*

 | `string` **|** `null` | The guidance for the provisioning artifact (DEFAULT or DEPRECATED). |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether this provisioning artifact is active. |  |
| 

`region` \*

 | `string` | AWS region where the provisioning artifact is defined. |  |
| 

`sourceRevision` \*

 | `string` **|** `null` | The source revision of the provisioning artifact. |  |
| 

`type` \*

 | `string` **|** `null` | The type of provisioning artifact (CLOUD\_FORMATION\_TEMPLATE, TERRAFORM\_OPEN\_SOURCE, etc.). |  |

---

### Aws Servicecatalog Tag Option

`aws_servicecatalog_tag_option` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isActive` \*

 | `boolean` **|** `null` | Whether this TagOption is active. |  |
| 

`key` \*

 | `string` | The TagOption key. |  |
| 

`region` \*

 | `string` | AWS region where the TagOption is defined. |  |
| 

`tagOptionId` \*

 | `string` | The ID of the TagOption. |  |
| 

`value` \*

 | `string` **|** `null` | The TagOption value. |  |

---

### Aws States State Machine

`aws_states_state_machine` inherits from [Function](/data-model/schemas/Function.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`availabilityZone` \*

 | `string` **|** `null` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`definition` \*

 | `string` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` **|** `null` |  |  |
| 

`encryptedkeyref` \*

 | `string` **|** `null` |  |  |
| 

`encryptionKmsDataKeyReusePeriodSeconds` \*

 | `number` **|** `null` |  |  |
| 

`encryptionKmsKeyId` \*

 | `string` **|** `null` |  |  |
| 

`encryptionType` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`isExecutionDataIncluded` \*

 | `boolean` **|** `null` |  |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isTracingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isVariableReferencesPresent` \*

 | `boolean` **|** `null` |  |  |
| 

`label` \*

 | `string` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`loggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`loggingLevel` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`revisionId` \*

 | `string` **|** `null` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |
| 

`variableReferencesCount` \*

 | `number` **|** `null` |  |  |

---

### Aws Storage Gateway File Share

`aws_storage_gateway_file_share` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`auditDestinationArn` \*

 | `null` **|** `string` |  |  |
| 

`authentication` \*

 | `null` **|** `string` |  |  |
| 

`clientList` \*

 | `null` **|** `array` |  |  |
| 

`defaultStorageClass` \*

 | `null` **|** `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`fileShareId` \*

 | `string` |  |  |
| 

`fileShareStatus` \*

 | `null` **|** `string` |  |  |
| 

`gatewayArn` \*

 | `string` |  |  |
| 

`isAccessBasedEnumeration` \*

 | `null` **|** `boolean` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isEncrypted` \*

 | `null` **|** `boolean` |  |  |
| 

`isLoggingEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`isReadOnly` \*

 | `null` **|** `boolean` |  |  |
| 

`isSmbAclEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`locationArn` \*

 | `null` **|** `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`protocol` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `null` **|** `string` |  |  |
| 

`squash` \*

 | `null` **|** `string` |  |  |

---

### Aws Storage Gateway Gateway

`aws_storage_gateway_gateway` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`availabilityZone` \*

 | `null` **|** `string` |  |  |
| 

`category` \*

 | `array` of `string`s |  |  |
| 

`cloudWatchLogGroupArn` \*

 | `null` **|** `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`ec2InstanceId` \*

 | `null` **|** `string` |  |  |
| 

`endpointType` \*

 | `null` **|** `string` |  |  |
| 

`function` \*

 | `array` of `string`s |  |  |
| 

`gatewayId` \*

 | `string` |  |  |
| 

`gatewayState` \*

 | `null` **|** `string` |  |  |
| 

`gatewayTimezone` \*

 | `null` **|** `string` |  |  |
| 

`gatewayType` \*

 | `string` |  |  |
| 

`hostEnvironment` \*

 | `null` **|** `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isLoggingEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`public` \*

 | `boolean` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`softwareVersion` \*

 | `null` **|** `string` |  |  |
| 

`vpcEndpoint` \*

 | `null` **|** `string` |  |  |
| 

`vpcId` \*

 | `null` **|** `string` |  |  |

---

### Aws Storage Gateway Tape

`aws_storage_gateway_tape` inherits from [DataStore](/data-model/schemas/DataStore.md), [Backup](/data-model/schemas/Backup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`completedOn` \*

 | `null` **|** `number` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`gatewayArn` \*

 | `null` **|** `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isArchived` \*

 | `null` **|** `boolean` |  |  |
| 

`isEncrypted` \*

 | `null` **|** `boolean` |  |  |
| 

`isWorm` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`poolId` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`tapeBarcode` \*

 | `string` |  |  |
| 

`tapeSizeInBytes` \*

 | `null` **|** `number` |  |  |
| 

`tapeStatus` \*

 | `string` |  |  |
| 

`tapeUsedInBytes` \*

 | `null` **|** `number` |  |  |

---

### Aws Storage Gateway Tape Pool

`aws_storage_gateway_tape_pool` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`poolId` \*

 | `string` |  |  |
| 

`poolStatus` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`retentionLockTimeInDays` \*

 | `null` **|** `number` |  |  |
| 

`retentionLockType` \*

 | `null` **|** `string` |  |  |
| 

`storageClass` \*

 | `null` **|** `string` |  |  |

---

### Aws Storage Gateway Volume

`aws_storage_gateway_volume` inherits from [DataStore](/data-model/schemas/DataStore.md), [Disk](/data-model/schemas/Disk.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`gatewayArn` \*

 | `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isChapEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`isEncrypted` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`targetArn` \*

 | `null` **|** `string` |  |  |
| 

`volumeDiskId` \*

 | `null` **|** `string` |  |  |
| 

`volumeId` \*

 | `string` |  |  |
| 

`volumeSizeInBytes` \*

 | `null` **|** `number` |  |  |
| 

`volumeStatus` \*

 | `null` **|** `string` |  |  |
| 

`volumeType` \*

 | `string` |  |  |
| 

`volumeUsedInBytes` \*

 | `null` **|** `number` |  |  |

---

### Aws Vpc Lattice Listener

`aws_vpc_lattice_listener` inherits from [NetworkEndpoint](/data-model/schemas/NetworkEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`port` \*

 | `number` **|** `null` |  |  |
| 

`protocol` \*

 | `string` **|** `null` |  | **Any of**:

-   `HTTP`

-   `HTTPS`

-   `TLS_PASSTHROUGH`

-   `undefined`

 |
| 

`region` \*

 | `string` |  |  |
| 

`serviceArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Vpc Lattice Listener Rule

`aws_vpc_lattice_listener_rule` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isDefault` \*

 | `boolean` **|** `null` |  |  |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`listenerArn` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`priority` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceArn` \*

 | `string` **|** `null` |  |  |
| 

`statusCode` \*

 | `number` **|** `null` |  |  |
| 

`targetGroupIdentifiers` \*

 | `array` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  | **Any of**:

-   `ForwardMember`

-   `FixedResponseMember`

-   `undefined`

 |

---

### Aws Vpc Lattice Service

`aws_vpc_lattice_service` inherits from [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`customDomainName` \*

 | `string` **|** `null` |  |  |
| 

`domainName` \*

 | `string` **|** `null` |  |  |
| 

`hostedZoneId` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Vpc Lattice Service Network

`aws_vpc_lattice_service_network` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`numberOfAssociatedResourceConfigurations` \*

 | `number` **|** `null` |  |  |
| 

`numberOfAssociatedServices` \*

 | `number` **|** `null` |  |  |
| 

`numberOfAssociatedVPCs` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Vpc Lattice Target Group

`aws_vpc_lattice_target_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`ipAddressType` \*

 | `string` **|** `null` |  | **Any of**:

-   `IPV4`

-   `IPV6`

-   `undefined`

 |
| 

`lambdaEventStructureVersion` \*

 | `string` **|** `null` |  | **Any of**:

-   `V1`

-   `V2`

-   `undefined`

 |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`port` \*

 | `number` **|** `null` |  |  |
| 

`protocol` \*

 | `string` **|** `null` |  | **Any of**:

-   `NOT_SET`

-   `HTTP`

-   `HTTPS`

-   `TCP`

-   `undefined`

 |
| 

`region` \*

 | `string` |  |  |
| 

`serviceArns` \*

 | `array` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  | **Any of**:

-   `NOT_SET`

-   `ACTIVE`

-   `CREATE_FAILED`

-   `CREATE_IN_PROGRESS`

-   `DELETE_FAILED`

-   `DELETE_IN_PROGRESS`

-   `undefined`

 |
| 

`type` \*

 | `string` **|** `null` |  | **Any of**:

-   `NOT_SET`

-   `ALB`

-   `INSTANCE`

-   `IP`

-   `LAMBDA`

-   `undefined`

 |
| 

`vpcIdentifier` \*

 | `string` **|** `null` |  |  |

---

### Aws Waf V2 Ip Set

`aws_waf_v2_ip_set` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `addresses` | `array` of `string`s |  |  |
| `arn` | `string` |  |  |
| `description` | `string` |  |  |
| `id` | `string` |  |  |
| `ipAddressVersion` | `string` |  | **Any of**:
-   `IPV4`

-   `IPV6`

 |
| `region` | `string` |  |  |

---

### Aws Waf V2 Rule Group

`aws_waf_v2_rule_group` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `capacity` | `number` |  |  |
| `description` | `string` |  |  |
| `id` | `string` |  |  |
| `isVisibilityConfigCloudWatchMetricsEnabled` | `boolean` |  |  |
| `isVisibilityConfigSampledRequestsEnabled` | `boolean` |  |  |
| `labelNamespace` | `string` |  |  |
| `region` | `string` |  |  |
| `ruleCount` | `number` |  |  |
| `scope` | `string` |  |  |
| `visibilityConfigMetricName` | `string` |  |  |
| `webLink` | `string` |  |  |

---

## Release Notes

-   **2026-10-14** — ECS container docker labels now use more precise masking rules, restoring visibility of non-sensitive labels such as OCI image metadata and service discovery annotations while still redacting credential-like values.
    
-   **2026-10-13** — ECS task container environment variable values, EC2 instance user data, Direct Connect authorization keys, and VPN pre-shared keys are no longer ingested to prevent exposure of sensitive credentials.
    
-   **2026-10-12** — EKS clusters now include public and private endpoint access flags and permitted CIDR blocks, and clusters with API server endpoints open to the internet are linked to the internet entity.
    
-   **2026-10-08** — Added support for AWS Outposts, including sites, individual Outpost units, and hardware assets as queryable entities with relationships to EC2 instances and VPC networking resources.
    
-   **2026-10-05** — Added EKS cluster name, provisioner type, node pool, and node class properties to EC2 instances, plus direct relationships from EKS clusters to their worker instances.
    
-   **2026-10-05** — Enhanced AWS Bedrock AgentCore to include memories, API gateways, and gateway targets as ingested entities with relationships to IAM roles and KMS keys.
    
-   **2026-09-28** — AWS EC2 security group rules are now ingested as individual entities, enabling per-rule querying of inbound and outbound traffic configurations.
    
-   **2026-09-24** — Added support for AWS Security Agent, ingesting the service along with agent spaces, applications, target domains, private connections, threat models, and security artifacts.
    
-   **2026-09-24** — Added support for AWS DevOps Agent, ingesting the service and its agent spaces, applications, and private connection configurations.
    
-   **2026-09-22** — AWS Bedrock now includes imported models and batch model invocation jobs as ingested entities, with relationships to S3 buckets and KMS keys.
    
-   **2026-09-16** — Added support for Amazon Keyspaces (Cassandra), ingesting keyspaces and tables as queryable entities.
    
-   **2026-09-16** — AWS Inspector v2 now ingests CIS scan runs and per-instance CIS findings as queryable entities.
    
-   **2026-09-15** — AWS Bedrock agents, knowledge bases, flows, agent runtimes, and code interpreters now include mapped relationships to the IAM policies they use, and the Bedrock service is linked to its VPC endpoints.
    
-   **2026-09-15** — Enhanced SageMaker data model to include model quality job definitions, model bias job definitions, inference recommendations jobs, and pipeline executions as queryable entities.
    
-   **2026-09-15** — Enhanced AWS Network Manager data model to include core network routes, policy versions, and attachment routing configurations as queryable entities.
    
-   **2026-09-14** — Enhanced Amazon Macie data model to include session configuration, automated discovery configuration, member accounts, and findings publication settings as queryable entities.
    
-   **2026-09-14** — Added support for AWS Nova Act, ingesting models, workflow definitions, and workflow runs as queryable entities.
    
-   **2026-08-10** — Added the KMS key ARN used for server-side encryption to Database Migration Service S3-type endpoint entities.
    
-   **2026-08-10** — Tags on AppConfig applications, environments, deployment strategies, configuration profiles, and deployments, along with Backup vaults, restore testing plans, and IAM Roles Anywhere trust anchors and profiles, are now ingested as queryable properties.
    
-   **2026-08-04** — Added support for AWS EC2 Image Builder, ingesting pipelines, images, components, recipes, distribution configurations, infrastructure configurations, lifecycle policies, and workflows as queryable entities.
    
-   **2026-07-31** — Tags on Cloud Map namespaces and services are now ingested as queryable properties.
    
-   **2026-07-28** — OpenSearch and Elasticsearch domains now expose mapped relationships to cross-account AWS principals defined in their access policies.
    
-   **2026-07-28** — Enhanced GuardDuty data model to include organization configuration details, delegated administrator accounts, and publishing destinations as ingested entities.
    
-   **2026-07-28** — Added support for AWS EventBridge resources, ingesting event buses, archives, connections, API destinations, and endpoints as queryable entities.
    
-   **2026-07-27** — Identity Center users and groups are now linked to the member accounts they are assigned access to.
    
-   **2026-07-23** — Tags are now ingested for API Gateway domain names, API Gateway V2 stages, Batch job definitions, Batch job queues, Batch compute environments, EC2 key pairs, GuardDuty detectors, IAM SAML providers, Network Manager resources, and Redshift cluster parameter groups.
    
-   **2026-07-22** — RDS clusters now include database insights mode, monitoring interval, monitoring role ARN, and Performance Insights configuration as queryable properties.
    
-   **2026-07-21** — Docker image tags on ECR images are now ingested as queryable properties.
    
-   **2026-07-21** — Added support for AWS AppConfig, including applications, environments, deployment strategies, configuration profiles, deployments, and hosted configuration versions.
    
-   **2026-07-20** — Added Neptune Analytics graph snapshots, export tasks, import tasks, and VPC endpoint connections.
    
-   **2026-07-20** — Added support for AWS CodeArtifact, including domains, repositories, and packages with permission policy relationships.
    
-   **2026-07-17** — Added EMR security configurations as queryable entities, with relationships to clusters and VPC endpoints.
    
-   **2026-07-17** — CloudWatch Event Rule targets (Lambda functions, SNS topics, SQS queues, Step Functions, Kinesis streams, ECS clusters, CodePipeline pipelines, and Firehose delivery streams) are now linked to their rules via mapped relationships.
    
-   **2026-07-17** — Added AWS Inspector v2 filter and configuration entities, with relationships to KMS keys and VPC endpoints.
    
-   **2026-07-15** — S3 buckets now include CloudTrail object-level logging status, including whether read and write logging is enabled.
    
-   **2026-07-07** — ECR image finding ingestion now supports filters for minimum severity and maximum scan age, reducing noise from stale or low-priority findings.
    
-   **2026-06-17** — S3 bucket lifecycle rules are now ingested as queryable entities, linked to their parent buckets.
    
-   **2026-06-10** — Security Hub findings ingestion now supports a configurable time window and allows specific workflow statuses to be excluded.
    
-   **2026-06-03** — ECS task definitions now include resource tags.
    
-   **2026-04-29** — Security group ingress and egress rules are now stored as structured JSON properties, enabling rule-level querying on firewall entities.
    
-   **2026-04-08** — Added optional configuration to automatically delete child integration instances when they are no longer needed in AWS Organizations.
    
-   **2026-04-07** — Added Bedrock AgentCore Agent Runtime ingestion, enabling visibility into deployed agent runtime environments.
    
-   **2026-03-25** — Added AWS Detective data model, ingesting investigation graphs and member accounts as new entity types.
    
-   **2026-03-24** — Added ingestion of received and marketplace licenses from AWS License Manager as additional license entity types.
    
-   **2026-03-19** — Added AWS Transit Gateway route tables and attachments as new entity types, enabling routing configuration visibility across VPC environments.
    
-   **2026-03-19** — Added Audit Manager settings, delegation status, and KMS key relationships to the Audit Manager service entity.
    
-   **2026-03-18** — Added AWS X-Ray data model, ingesting sampling rules and groups as new entity types.
    
-   **2026-03-18** — Promoted EKS cluster authentication mode to cluster entities, exposing the access configuration mode for each cluster.
    
-   **2026-03-17** — Added AWS Neptune Database & Analytics integration, ingesting Neptune clusters, instances, and serverless resources.
    
-   **2026-03-11** — Added target group ARNs and load balancer names properties to Auto Scaling group entities.
    
-   **2026-03-11** — Promoted raw data properties for AWS Transfer Server, Shared Image, and related entities.
    
-   **2026-03-03** — Extended AWS Athena data model with additional workgroup, data catalog, and named query properties.
    
-   **2026-02-26** — Added AWS DevOps Guru integration, ingesting anomalies and insights as queryable entities.
    
-   **2026-02-20** — Added Secrets Manager secret versions as ingested entities, linking each version to its parent secret.
    
-   **2026-02-20** — Added DKIM signing enabled status and DKIM status properties to SES identity entities, surfacing DKIM signing configuration.
    
-   **2026-02-20** — Added creation and last-updated timestamps to WorkSpaces bundle entities.
    
-   **2026-02-20** — Added rule names property to WAFv2 web ACL entities listing all configured WAF v2 rule names; added Kerberos configured and cross-realm trust configured properties to EMR cluster entities.
    
-   **2026-02-20** — Added multi-AZ property to DMS replication instance entities; added Kerberos realm and AD domain join user properties to EMR cluster entities for Kerberos authentication details.
    
-   **2026-02-16** — Added AWS Managed Grafana data model, ingesting Grafana workspaces as new entity types.
    
-   **2026-02-16** — Added AWS Storage Gateway integration, ingesting gateways, file shares, and volumes.
    
-   **2026-02-12** — Added AWS CodeGuru integration, ingesting CodeGuru Reviewer and Profiler resources.
    
-   **2026-02-12** — Added KMS key ID, encryption, SMTP SSL, and SMTP port properties to Managed Workflows for Apache Airflow environment entities.
    
-   **2026-02-09** — Added VPC settings and connect settings parameters to Directory Service directory entities, exposing VPC and AD Connector configurations.
    
-   **2026-02-06** — Added AWS CodeDeploy integration, ingesting deployment groups, deployments, and applications.
    
-   **2026-02-04** — Added AWS License Manager integration, ingesting license configurations and received/marketplace licenses as new entity types.
    
-   **2026-01-27** — Added AWS Bedrock AgentCore Code Interpreter support, ingesting sandbox environments for Bedrock agent execution.
    
-   **2026-01-13** — Promoted encryption disabled property on CodeBuild project entities.
    
-   **2025-12-17** — Added ingestion of WAF rule group rules, exposing individual rules within AWS WAF rule groups.
    
-   **2025-12-11** — Added AWS Cloud Map integration, ingesting namespaces and services as queryable entities.
    
-   **2025-12-10** — Added WAF rule groups and WAFv2 web ACL to rule group relationships.
    
-   **2025-12-05** — Promoted additional CloudFront distribution properties including cache behavior and origin settings.
    
-   **2025-11-21** — Added Amazon DataSync data model, ingesting tasks, locations, and agents as new entity types.
    
-   **2025-11-14** — Added configuration option to ingest deprecated EC2 AMI images alongside current images.
    
-   **2025-10-31** — Promoted account state property to AWS account entities, reflecting account suspension or active status.
    
-   **2025-10-31** — Added mapped relationship from AWS accounts to AMIs owned by the account.
    
-   **2025-10-27** — Added relationships from API Gateway stages to associated CloudWatch log groups.
    
-   **2025-10-24** — Added ingestion of EKS cluster version information including Kubernetes version and platform version.
    
-   **2025-10-14** — Promoted deletion protection enabled property on DynamoDB table entities.
    
-   **2025-10-14** — Promoted lifecycle delete after days property on Backup recovery point entities.
    
-   **2025-10-02** — Promoted scheduled deletion date to KMS key entities.
    
-   **2025-09-24** — Promoted delivery stream configuration parameters to Firehose delivery stream entities.
    
-   **2025-09-22** — Added AWS account tag retrieval for non-management member accounts.
    
-   **2025-09-19** — Added additional parameter group parameters property to RDS parameter group entities.
    
-   **2025-09-12** — Added RDS CloudWatch logging metrics (read/write IOPS, latency, throughput) to RDS database instance entities.
    
-   **2025-09-10** — Added EKS cluster to IAM OIDC provider trust relationship, linking EKS clusters to their OIDC identity providers.
    
-   **2025-09-10** — Promoted CPU architecture property to ECS task entities.
    
-   **2025-09-08** — Added AWS Audit Manager integration, ingesting frameworks, assessments, and controls.
    
-   **2025-09-05** — Added AWS Resource Access Manager (RAM) integration, ingesting resource shares and associations.
    
-   **2025-09-04** — Added opt-in configuration to fetch tags for AWS Backup recovery points.
    
-   **2025-09-04** — Added Backup resource to Config Rule relationships, linking backup-protected resources to their Config Rules.
    
-   **2025-09-02** — Enhanced EMR integration with additional cluster properties including security configuration and step details.
    
-   **2025-08-26** — Added ingestion of CloudWatch Log Metric Filters as new entity types.
    
-   **2025-08-26** — Added AWS SageMaker models ingestion, relating models to SageMaker domains.
    
-   **2025-08-25** — Added ingestion of Redshift DataShares for both provisioned and serverless clusters.
    
-   **2025-08-25** — Added Security Hub account entity to represent accounts where Security Hub is enabled.
    
-   **2025-08-22** — Added contact information properties from the account contact information API to AWS account entities.
    
-   **2025-08-13** — Added expiration and upload timestamp properties to IAM signing certificate entities.
    
-   **2025-08-11** — Added tiered storage metrics to S3 bucket entities, including total, standard tier, intelligent tiering, archival, and cold storage bytes for cross-tier capacity visibility.
    
-   **2025-08-07** — Added proper entity class to CloudFront distribution entities, improving classification consistency in the data model.
    
-   **2025-08-06** — Added IAM Roles Anywhere integration, ingesting trust anchors and profiles as new entity types.
    
-   **2025-08-05** — Added CloudWatch metrics ingestion, including custom metrics and metric streams.
    
-   **2025-08-04** — Added support for Valkey as a Redis-compatible engine in ElastiCache classification.
    
-   **2025-07-30** — Added AWS Step Functions integration, ingesting state machines and executions.
    
-   **2025-07-28** — Added ingestion of EC2 Dedicated Hosts as new entity types.
    
-   **2025-07-18** — Added Bedrock evaluation jobs and custom model jobs as new entity types.
    
-   **2025-07-18** — Added tag retrieval for IAM Identity Center permission sets.
    
-   **2025-07-16** — Added OpenSearch domain properties and additional ingestion fields to OpenSearch domain entities.
    
-   **2025-07-16** — Added image allowed and additional security properties (including public access indicators) to AMI entities.
    
-   **2025-07-09** — Added ingestion of AWS Organizations tag policies as new entity types.
    
-   **2025-07-08** — Added Config Rule finding entity type for Config Rule evaluation findings.
    
-   **2025-07-02** — Added entity class and display name to AWS Backup recovery point entities, improving discoverability and classification.
    
-   **2025-07-02** — Added ingestion of shared EBS/RDS snapshots across accounts.
    
-   **2025-07-01** — Added VPN connection ingestion, relating VPN connection entities to customer gateways and virtual private gateways.
    
-   **2025-07-01** — Added ACM certificate to Cognito user pool protection relationship, linking ACM certificates to Cognito user pools.
    
-   **2025-06-18** — Added risk configuration properties to Cognito user pool entities including advanced security settings.
    
-   **2025-06-05** — Added AWS Config Rule resource relationships, linking Config Rules to the AWS resources they evaluate.
    
-   **2025-06-03** — Added Cognito Identity Pools as new entity types with user pool relationships.
    
-   **2025-05-15** — Added WAFv2 IP sets as new entity types related to WAF rules.
    
-   **2025-05-14** — Added improvements to AWS SSO including account assignment relationships.
    
-   **2025-05-14** — Added GuardDuty detector data source properties exposing which data sources are enabled.
    
-   **2025-05-13** — Added API Gateway stage method setting entity type for stage method-level settings.
    
-   **2025-05-13** — Added AWS-managed prefix lists to the EC2 prefix list map, enabling security group and route table relationships to reference managed prefix lists alongside customer-managed ones.
    
-   **2025-05-12** — Added Cognito user pool clients and user pool users ingestion.
    
-   **2025-05-12** — Added entity class and display name to S3 bucket target entities used in CloudFront distribution relationships.
    
-   **2025-05-07** — Added additional AWS resource relationships including subnet-to-NAT-gateway, NLB-to-security-group, and more.
    
-   **2025-04-24** — Added policy document property to AWS OpenSearch access policy entities.
    
-   **2025-04-18** — Promoted device and attach time properties on EC2 instance to EBS volume relationships.
    
-   **2025-04-15** — Added SES as a distinct ingestion source for filtering and cost attribution.
    
-   **2025-04-14** — Added VPC Lattice service entities (services, service networks, target groups).
    
-   **2025-04-14** — Added EKS cluster to KMS key relationships for EKS clusters that use KMS encryption.
    
-   **2025-04-08** — Added IP addresses (from availability zone mappings) to ALB, NLB, and ELB load balancer entities.
    
-   **2025-04-02** — Added tag ingestion for AWS KMS keys, exposing KMS key tags as queryable properties.
    
-   **2025-04-02** — Added properties to Route 53 Resolver firewall rule entities including domain list and action details.

---

Source: /integrations/directory/azure

# Azure

Visualize and map Azure cloud resources, and monitor changes through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within Azure and on JupiterOne. Before enabling in JupiterOne, ensure that you have completed the setup within your Azure.

### Azure configuration

To set up this integration, you will need to authorize access by creating a Service Principal (App Registration) in Azure and provide the credentials to JupiterOne.

The integration is triggered by an event containing the information for a specific integration instance. Users configure the integration by providing API credentials obtained through the Azure portal.

Microsoft Entra ID is authenticated and accessed through the [Microsoft Graph API](https://learn.microsoft.com/en-us/graph/auth-v2-service). Azure Resource Manager is authenticated and accessed through [Resource Manager APIs](https://learn.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-api-authentication).

#### Creating the App Registration in Azure

The first step will be to create your App registration in Azure. From your [Azure portal](https://portal.azure.com/), navigate to **Microsoft Entra ID > Manage > App registrations** and continue through the following steps:

1.  Create a new App registration, using the **Name** `JupiterOne`, selecting **Accounts in this organizational directory only**, with **_no_** "Redirect URI".
2.  With the app created, navigate to the new app's **Overview** page.
3.  Copy both the **Application (client) ID** and the **Directory (tenant) ID**.
4.  Navigate to the **Certificates & secrets** section.
5.  Create a new client secret.
6.  Save and copy the generated secret **Value** (not the **Secret ID**).

With the App created, and the values saved, you will next need to configure the API permissions within Microsoft Entra ID.

#### API Permissions

To grant permissions for reading the Microsoft Graph information:

1.  Navigate to API permissions, select **Microsoft Graph > Application Permissions**
2.  Grant the following permission to the application:

-   `Directory.Read.All`
-   `Policy.Read.All`
-   `AuditLog.Read.All`
-   `Device.Read.All`
-   `EntitlementManagement.Read.All`
-   `Policy.Read.ConditionalAccess`

3.  Grant admin consent for this directory for the permissions above.

#### IAM Roles (Azure Management Groups / Subscriptions)

The next step within Azure is granting the `JupiterOne Reader` RBAC subscription role to read Azure Resource Manager information.

To grant the role:

1.  Navigate to the correct scope for your integration.

-   **RECOMMENDED** _If configuring all subscription for a tenant:_ Navigate to Management Groups > the Tenant Root Group.
    
    > If it is not possible to select the Tenant Root Group first navigate to Microsoft Entra ID > Manage > Properties and select **Yes** on **Access management for Azure resources**. See this [elevating access article](https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin) for more information.
    

> **NOTE**
> 
> If using this feature, in JupiterOne on your integration instance, enable the following flags:
> 
> -   Ingest Microsoft Entra ID
> -   Configure Subscription Instances
>     -   Auto-Delete Removed Subscriptions
>         
>         > _If configuring a single Azure Subscription:_ Navigate to **Subscriptions** and choose the subscription from which you want to ingest resources. Please fill the **Subscription ID** field in your integration instance. In Azure, to get the Subscription ID navigate to **Subscriptions** and Copy the ID of the one to be ingested.
>         

2.  Create the custom role "JupiterOne Reader"
3.  Navigate to **Access control (IAM) > Add > Add custom role**.
4.  Input `JupiterOne Reader` for the **Name**.
5.  Navigate to the **JSON** tab, select **Edit**, and input the following _actions_:

Actions to be added

"Microsoft.Advisor/recommendations/read", "Microsoft.ApiManagement/service/apis/read", "Microsoft.ApiManagement/service/backends/read", "Microsoft.ApiManagement/service/namedValues/read", "Microsoft.ApiManagement/service/portalconfigs/read", "Microsoft.ApiManagement/service/portalsettings/read", "Microsoft.ApiManagement/service/products/read", "Microsoft.ApiManagement/service/products/subscriptions/read", "Microsoft.ApiManagement/service/read", "Microsoft.ApiManagement/service/subscriptions/read", "Microsoft.ApiManagement/service/tenant/read", "Microsoft.App/agents/read", "Microsoft.AppConfiguration/configurationStores/read", "Microsoft.Authorization/classicAdministrators/read", "Microsoft.Authorization/locks/read", "Microsoft.Authorization/policyAssignments/read", "Microsoft.Authorization/policyDefinitions/read", "Microsoft.Authorization/policySetDefinitions/read", "Microsoft.Authorization/roleAssignments/read", "Microsoft.Authorization/roleDefinitions/read", "Microsoft.Automation/automationAccounts/read", "Microsoft.Batch/batchAccounts/applications/read", "Microsoft.Batch/batchAccounts/certificates/read", "Microsoft.Batch/batchAccounts/pools/read", "Microsoft.Batch/batchAccounts/read", "Microsoft.BotService/botServices/channels/read", "Microsoft.BotService/botServices/read", "Microsoft.Cache/redis/firewallRules/read", "Microsoft.Cache/redis/linkedServers/read", "Microsoft.Cache/redis/read", "Microsoft.Cache/redisEnterprise/databases/read", "Microsoft.Cache/redisEnterprise/read", "Microsoft.Cdn/profiles/afdEndpoints/read", "Microsoft.Cdn/profiles/afdEndpoints/routes/read", "Microsoft.Cdn/profiles/customDomains/read", "Microsoft.Cdn/profiles/endpoints/read", "Microsoft.Cdn/profiles/originGroups/origins/read", "Microsoft.Cdn/profiles/originGroups/read", "Microsoft.Cdn/profiles/read", "Microsoft.Chaos/experiments/read", "Microsoft.Chaos/targets/capabilities/read", "Microsoft.Chaos/targets/read", "Microsoft.CognitiveServices/accounts/read", "Microsoft.Compute/disks/read", "Microsoft.Compute/galleries/images/read", "Microsoft.Compute/galleries/images/versions/read", "Microsoft.Compute/galleries/read", "Microsoft.Compute/images/read", "Microsoft.Compute/virtualMachines/extensions/read", "Microsoft.Compute/virtualMachines/read", "Microsoft.Compute/virtualMachineScaleSets/read", "Microsoft.Consumption/usageDetails/read", "Microsoft.ContainerInstance/containerGroups/read", "Microsoft.ContainerRegistry/registries/pull/read", "Microsoft.ContainerRegistry/registries/read", "Microsoft.ContainerRegistry/registries/webhooks/read", "Microsoft.ContainerService/fleets/members/read", "Microsoft.ContainerService/fleets/read", "Microsoft.ContainerService/managedClusters/maintenanceConfigurations/read", "Microsoft.ContainerService/managedClusters/read", "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read", "Microsoft.Databricks/workspaces/read", "Microsoft.DataFactory/factories/integrationRuntimes/read", "Microsoft.DataFactory/factories/linkedservices/read", "Microsoft.DataFactory/factories/managedVirtualNetworks/managedPrivateEndpoints/read", "Microsoft.DataFactory/factories/managedVirtualNetworks/read", "Microsoft.DataFactory/factories/privateEndpointConnections/read", "Microsoft.DataFactory/factories/read", "Microsoft.DataMigration/services/projects/read", "Microsoft.DataMigration/services/read", "Microsoft.DataMigration/services/serviceTasks/read", "Microsoft.DataProtection/backupVaults/read", "Microsoft.DataShare/accounts/read", "Microsoft.DBforMariaDB/servers/databases/read", "Microsoft.DBforMariaDB/servers/read", "Microsoft.DBforMySQL/flexibleServers/databases/read", "Microsoft.DBforMySQL/flexibleServers/firewallRules/read", "Microsoft.DBforMySQL/flexibleServers/read", "Microsoft.DBforMySQL/servers/databases/read", "Microsoft.DBforMySQL/servers/firewallRules/read", "Microsoft.DBforMySQL/servers/read", "Microsoft.DBforPostgreSQL/flexibleServers/administrators/read", "Microsoft.DBforPostgreSQL/flexibleServers/advancedThreatProtectionSettings/read", "Microsoft.DBforPostgreSQL/flexibleServers/configurations/read", "Microsoft.DBforPostgreSQL/flexibleServers/databases/read", "Microsoft.DBforPostgreSQL/flexibleServers/firewallRules/read", "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/read", "Microsoft.DBforPostgreSQL/flexibleServers/read", "Microsoft.DBforPostgreSQL/servers/databases/read", "Microsoft.DBforPostgreSQL/servers/firewallRules/read", "Microsoft.DBforPostgreSQL/servers/read", "Microsoft.DesktopVirtualization/applicationGroups/desktops/read", "Microsoft.DesktopVirtualization/applicationGroups/read", "Microsoft.DesktopVirtualization/hostPools/read", "Microsoft.DesktopVirtualization/workspaces/read", "Microsoft.Devices/iotHubs/Read", "Microsoft.DocumentDB/databaseAccounts/read", "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/read", "Microsoft.Easm/workspaces/read", "Microsoft.EventGrid/domains/read", "Microsoft.EventGrid/domains/topics/eventSubscriptions/read", "Microsoft.EventGrid/domains/topics/read", "Microsoft.EventGrid/topics/eventSubscriptions/read", "Microsoft.EventGrid/topics/read", "Microsoft.EventHub/clusters/read", "Microsoft.EventHub/namespaces/eventHubs/consumergroups/read", "Microsoft.EventHub/namespaces/eventhubs/read", "Microsoft.EventHub/namespaces/read", "Microsoft.Fabric/capacities/read", "Microsoft.HybridCompute/machines/extensions/read", "Microsoft.HybridCompute/machines/read", "Microsoft.Insights/ActivityLogAlerts/Read", "Microsoft.Insights/components/read", "Microsoft.Insights/DiagnosticSettings/Read", "Microsoft.Insights/eventtypes/values/Read", "Microsoft.Insights/LogProfiles/Read", "Microsoft.KeyVault/managedHSMs/read", "Microsoft.KeyVault/vaults/keys/read", "Microsoft.KeyVault/vaults/read", "Microsoft.KeyVault/vaults/secrets/read", "Microsoft.MachineLearningServices/workspaces/computes/read", "Microsoft.MachineLearningServices/workspaces/onlineEndpoints/read", "Microsoft.MachineLearningServices/workspaces/read", "Microsoft.ManagedIdentity/userAssignedIdentities/read", "Microsoft.ManagedServices/registrationAssignments/read", "Microsoft.ManagedServices/registrationDefinitions/read", "Microsoft.Management/managementGroups/read", "Microsoft.NetApp/netAppAccounts/backupVaults/backups/read", "Microsoft.NetApp/netAppAccounts/backupVaults/read", "Microsoft.NetApp/netAppAccounts/capacityPools/read", "Microsoft.NetApp/netAppAccounts/capacityPools/volumes/buckets/read", "Microsoft.NetApp/netAppAccounts/capacityPools/volumes/read", "Microsoft.NetApp/netAppAccounts/capacityPools/volumes/snapshots/read", "Microsoft.NetApp/netAppAccounts/read", "Microsoft.Network/applicationGateways/read", "Microsoft.Network/applicationSecurityGroups/read", "Microsoft.Network/azurefirewalls/read", "Microsoft.Network/bastionHosts/read", "Microsoft.Network/bgpServiceCommunities/read", "Microsoft.Network/ddosProtectionPlans/read", "Microsoft.Network/dnszones/read", "Microsoft.Network/dnszones/recordsets/read", "Microsoft.Network/expressRouteCircuits/peerings/connections/read", "Microsoft.Network/expressRouteCircuits/peerings/peerConnections/read", "Microsoft.Network/expressRouteCircuits/read", "Microsoft.Network/firewallPolicies/Read", "Microsoft.Network/firewallPolicies/ruleCollectionGroups/Read", "Microsoft.Network/frontDoors/read", "Microsoft.Network/loadBalancers/read", "Microsoft.Network/natGateways/read", "Microsoft.Network/networkInterfaces/read", "Microsoft.Network/networkSecurityGroups/read", "Microsoft.Network/networkSecurityGroups/securityRules/read", "Microsoft.Network/networkWatchers/flowLogs/read", "Microsoft.Network/networkWatchers/read", "Microsoft.Network/privateDnsZones/read", "Microsoft.Network/privateDnsZones/recordsets/read", "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read", "Microsoft.Network/privateEndpoints/read", "Microsoft.Network/publicIPAddresses/read", "Microsoft.Network/routeTables/read", "Microsoft.Network/trafficmanagerprofiles/read", "Microsoft.Network/virtualHubs/read", "Microsoft.Network/virtualNetworks/read", "Microsoft.Network/virtualWans/read", "Microsoft.Network/vpnGateways/read", "Microsoft.Network/vpnGateways/vpnConnections/vpnLinkConnections/read", "Microsoft.OperationalInsights/workspaces/read", "Microsoft.PolicyInsights/policyStates/queryResults/read", "Microsoft.RecoveryServices/Vaults/backupProtectedItems/read", "Microsoft.RecoveryServices/vaults/read", "Microsoft.ResourceGraph/resources/read", "Microsoft.Resources/deployments/read", "Microsoft.Resources/subscriptions/locations/read", "Microsoft.Resources/subscriptions/read", "Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.ScVmm/virtualMachineInstances/read", "Microsoft.Search/searchServices/read", "Microsoft.Security/alerts/read", "Microsoft.Security/assessments/read", "Microsoft.Security/autoProvisioningSettings/read", "Microsoft.Security/iotSecuritySolutions/read", "Microsoft.Security/pricings/read", "Microsoft.Security/securityContacts/read", "Microsoft.Security/settings/read", "Microsoft.ServiceBus/namespaces/queues/read", "Microsoft.ServiceBus/namespaces/read", "Microsoft.ServiceBus/namespaces/topics/read", "Microsoft.ServiceBus/namespaces/topics/subscriptions/read", "Microsoft.Sql/managedInstances/administrators/read", "Microsoft.Sql/managedInstances/databases/read", "Microsoft.Sql/managedInstances/read", "Microsoft.Sql/servers/administrators/read", "Microsoft.Sql/servers/databases/read", "Microsoft.Sql/servers/firewallRules/read", "Microsoft.Sql/servers/read", "Microsoft.SqlVirtualMachine/sqlVirtualMachines/read", "Microsoft.Storage/storageAccounts/blobServices/containers/read", "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action", "Microsoft.Storage/storageAccounts/blobServices/read", "Microsoft.Storage/storageAccounts/fileServices/read", "Microsoft.Storage/storageAccounts/fileServices/shares/read", "Microsoft.Storage/storageAccounts/queueServices/read", "Microsoft.Storage/storageAccounts/read", "Microsoft.Storage/storageAccounts/tableServices/read", "Microsoft.Storage/storageAccounts/tableServices/tables/read", "Microsoft.StreamAnalytics/clusters/privateEndpoints/read", "Microsoft.StreamAnalytics/clusters/read", "Microsoft.StreamAnalytics/streamingjobs/read", "Microsoft.Subscription/Policies/default/read", "Microsoft.Synapse/workspaces/keys/read", "Microsoft.Synapse/workspaces/read", "Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/read", "Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/rules/read", "Microsoft.Synapse/workspaces/sqlPools/read", "Microsoft.Web/serverfarms/Read", "Microsoft.Web/sites/config/Read", "Microsoft.Web/sites/functions/read", "Microsoft.Web/sites/Read", "Microsoft.Web/staticSites/builds/Read", "Microsoft.Web/staticSites/customDomains/Read", "Microsoft.Web/staticSites/Read",

Data Actions to be added

"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"

Four optional actions are not in the list above, because each one returns secret values to the caller. JupiterOne never stores those values, and the steps still run without the actions, so leave them out unless you need the properties they provide:

-   `Microsoft.Storage/storageAccounts/listKeys/action` returns the storage account access keys, which give full access to the account's data. It is used only by the **Storage accounts keys** ingestion source (disabled by default) to record each key's name, permissions and creation time. Without it, that source ingests no keys.
-   `Microsoft.Web/sites/config/list/action` returns App Service app settings, connection strings and authentication settings. It is used only to read each app's authentication settings. Without it, apps are still ingested without those properties.
-   `Microsoft.Search/searchServices/listAdminKeys/action` returns AI Search admin keys. It is used only to report whether a search service has admin keys.
-   `Microsoft.Web/staticSites/listAppSettings/action` returns Static Web Apps app setting values. It is used only to report which app setting names a static site has.

4.  Click **Save > Review + Create > Create**.
    
5.  Assign Roles to the "JupiterOne" App:
    
    1.  Navigate to **Access control (IAM) > Add > Add role assignment**
    2.  Assign the `JupiterOne Reader` role to the JupiterOne member.
    3.  Navigate to the **Member** tab. Click on **\+ Select Members**, search for the JupiterOne App, click it, and then press **Select**.
    4.  Navigate to the **Review + assign** tab and click **Review + assign**.

#### Key Vaults

Listing key vault keys and secrets (the `rm-keyvault-keys` and `rm-keyvault-secrets` steps) requires granting the JupiterOne security principal access to each key vault's data plane. Azure supports two authorization models, and which one you use depends on how each vault is configured.

> **NOTE**
> 
> Microsoft now recommends **Azure role-based access control (RBAC)**, and many recently created key vaults use it by default. Check the **Permission model** field under **Settings > Access configuration** on the vault before choosing an option below.

##### Option A: Azure RBAC (default for new vaults)

When a vault's **Permission model** is **Azure role-based access control**, assign the built-in **Key Vault Reader** role to the JupiterOne app:

1.  Navigate to the key vault in the Azure portal.
2.  Click **Access control (IAM) > Add > Add role assignment**.
3.  On the **Role** tab, search for and select **Key Vault Reader**.
4.  On the **Members** tab, click **\+ Select members**, search for the JupiterOne app registration, select it, and click **Select**.
5.  Navigate to the **Review + assign** tab and click **Review + assign**.

You can scope the role assignment to the resource group or subscription that contains your key vaults to cover all of them at once, instead of repeating this for each vault.

[Learn more on Azure about the RBAC guide for Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide)

##### Option B: Vault access policy (legacy model)

When a vault's **Permission model** is **Vault access policy**, grant JupiterOne permissions for the vault keys and secrets (`rm-keyvault-keys` and `rm-keyvault-secrets`).

> **NOTE**
> 
> You are required to grant the permissions to the JupiterOne security principal for each key vault in your account. [Learn more on Azure for assigning a key vault access policy](https://go.microsoft.com/fwlink/?linkid=2125287)

To grant the permissions:

1.  Navigate to **Key Vaults** and select the one you wish to ingest.
2.  Click **Access policies**, then **\+ Create**
3.  On the **Permissions** tab, under **Key permissions** and **Secret Permissions**, select the permissions.

-   Key Permissions
    -   Key Management Operations
        -   List
-   Secret Permissions
    -   Key Management Operations
        -   List

4.  On the Principal tab, assign them to the JupiterOne App.
5.  Navigate to the **Review + Create** tab and click **Create**.

That concludes the setup from within Azure. The last thing to do is initiate the integration from within JupiterOne!

## Data Volume Configuration

Control how much data is ingested from Azure to manage storage and processing.

### Ingestion Windows (Time Ranges)

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Active Device Window** | Maximum number of days in the past a device can be active to be eligible for ingestion. Devices with activity older than this threshold will be excluded. | 30 | 30, 90, 365 days, No limit |

**How it affects data volume:** A longer active device window increases the number of device entities ingested. Setting "No limit" ingests all devices regardless of last activity date.

### Data Filtering Options

| Field | Description | Default |
| --- | --- | --- |
| **Included Defender for cloud Alert Severities** | Select which Defender for Cloud alert severity levels to ingest. | High, Medium |
| **Container Registry Exclude List** | Comma-separated list of container registry names to exclude from repository ingestion. Registries listed here are skipped when the Container registry repositories ingestion source is enabled. | _(none — all registries included)_ |

**How it affects data volume:** Severity filtering reduces Defender alert entities by excluding lower-severity alerts. The Container Registry Exclude List reduces repository ingestion for specific registries.

### Advanced Configuration

| Field | Description | Default |
| --- | --- | --- |
| **Advisor Recommendation Extended Properties to Promote** | A list of Azure Advisor recommendation property names to surface as top-level properties on ingested recommendation entities. Each key is automatically converted to camelCase. Example: `assessmentKey`, `score`, `snake_case_key`. | _(none)_ |

## Configuration in JupiterOne

To add the Azure integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Azure. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Azure account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Azure **Directory (tenant) ID** of the Entra ID to target the Azure API requests.
    
-   The **Application (client) ID** created for JupiterOne and used to authenticate with Azure.
    
-   Enable **Ingest Microsoft Entra ID** to ingest Directory information.
    
    > **NOTE**
    > 
    > The **Ingest Microsoft Entra ID** flag enables the ingestion of `azure_user`, `azure_user_group`, and `azure_service_principal` entities.
    > 
    > This should only be enabled for one integration instance per directory.
    
-   Configure the **Subscription Instances** for your integration:
    
    -   **RECOMMENDED** _If configuring all subscriptions for a tenant_: Select the option **Configure Subscription Instances** to automatically provision new JupiterOne integration instances for each Azure Subscription in this tenant that does not have a "JupiterOne" tag set to `SKIP`. It is recommended that you use this feature when **Ingest Microsoft Entra ID** selected.
    -   _If configuring a single Azure Subscription_: Enter the **Subscription ID** for the subscription you wish to ingest data from. In Azure, to get the Subscription ID, navigate to **Subscriptions** and copy the desired Subscription ID.
    
    With **Configure Subscription Instances** enabled, the following additional options are available:
    
    -   **Auto-delete Removed Subscriptions** — when enabled, automatically deletes JupiterOne integration instances for subscriptions that have been deleted or removed from Azure. Disabled by default.
    -   **Ingest disabled subscriptions** — when enabled, ingests subscriptions that are in a `disabled` state. Disabled by default.
    -   **Auto-delete Child Integrations** — when enabled, automatically deletes child integration instances when the parent integration for this directory is deleted. Enabled by default.

Once all values have been provided, click **Create** to finalize the integration.

### Troubleshooting authentication

If the Azure integration job does not complete, and you encounter a message such as: `[validation_failure] Error occurred while validating integration configuration` in your job log, check the following common configuration errors:

-   **Verify the Application (client) ID and Application (client) Secret:** Make sure that you've verified the proper value for client ID and client secret. The client secret has both a **Value** property and a **Secret ID** property. The **Secret ID** is unused: make sure you haven't accidentally used the **Secret ID** as the **Client ID**.
    
-   **Verify that you've enabled the proper API permissions:** Make sure the required API permissions (described above) are enabled for the application.
    
-   **Verify that the API permissions have been granted as "Application" and not "Delegated":** The integration requires API Permissions of type **Application**. Permissions of type **Delegated** will cause issues in your integration.
    
-   **Verify that your permissions have been "Grant(ed) admin consent for Directory":** If you have added API Permissions to the application, but have not granted Admin Consent, the permissions are not yet active.
    

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (239)

-   `AccessReview.Read.All`
-   `AccessReview.ReadWrite.All`
-   `AccessReview.ReadWrite.Membership`
-   `Microsoft.Advisor/recommendations/read`
-   `Microsoft.ApiManagement/service/apis/read`
-   `Microsoft.ApiManagement/service/backends/read`
-   `Microsoft.ApiManagement/service/namedValues/read`
-   `Microsoft.ApiManagement/service/portalconfigs/read`
-   `Microsoft.ApiManagement/service/portalsettings/read`
-   `Microsoft.ApiManagement/service/products/read`
-   `Microsoft.ApiManagement/service/products/subscriptions/read`
-   `Microsoft.ApiManagement/service/read`
-   `Microsoft.ApiManagement/service/subscriptions/read`
-   `Microsoft.ApiManagement/service/tenant/read`
-   `Microsoft.App/agents/read`
-   `Microsoft.AppConfiguration/configurationStores/read`
-   `Microsoft.Authorization/classicAdministrators/read`
-   `Microsoft.Authorization/locks/read`
-   `Microsoft.Authorization/policyAssignments/read`
-   `Microsoft.Authorization/policyDefinitions/read`
-   `Microsoft.Authorization/policySetDefinitions/read`
-   `Microsoft.Authorization/roleAssignments/read`
-   `Microsoft.Authorization/roleDefinitions/read`
-   `Microsoft.Automation/automationAccounts/read`
-   `Microsoft.AzureArcData/sqlServerInstances/databases/read`
-   `Microsoft.AzureArcData/sqlServerInstances/read`
-   `Microsoft.Batch/batchAccounts/applications/read`
-   `Microsoft.Batch/batchAccounts/certificates/read`
-   `Microsoft.Batch/batchAccounts/pools/read`
-   `Microsoft.Batch/batchAccounts/read`
-   `Microsoft.BotService/botServices/channels/read`
-   `Microsoft.BotService/botServices/read`
-   `Microsoft.Cache/redis/firewallRules/read`
-   `Microsoft.Cache/redis/linkedServers/read`
-   `Microsoft.Cache/redis/read`
-   `Microsoft.Cache/redisEnterprise/databases/read`
-   `Microsoft.Cache/redisEnterprise/read`
-   `Microsoft.Cdn/profiles/afdEndpoints/read`
-   `Microsoft.Cdn/profiles/afdEndpoints/routes/read`
-   `Microsoft.Cdn/profiles/customDomains/read`
-   `Microsoft.Cdn/profiles/endpoints/read`
-   `Microsoft.Cdn/profiles/originGroups/origins/read`
-   `Microsoft.Cdn/profiles/originGroups/read`
-   `Microsoft.Cdn/profiles/read`
-   `Microsoft.Chaos/experiments/read`
-   `Microsoft.Chaos/targets/capabilities/read`
-   `Microsoft.Chaos/targets/read`
-   `Microsoft.CognitiveServices/accounts/read`
-   `Microsoft.Compute/disks/read`
-   `Microsoft.Compute/galleries/images/read`
-   `Microsoft.Compute/galleries/images/versions/read`
-   `Microsoft.Compute/galleries/read`
-   `Microsoft.Compute/images/read`
-   `Microsoft.Compute/virtualMachineScaleSets/read`
-   `Microsoft.Compute/virtualMachines/extensions/read`
-   `Microsoft.Compute/virtualMachines/read`
-   `Microsoft.Consumption/usageDetails/read`
-   `Microsoft.ContainerInstance/containerGroups/read`
-   `Microsoft.ContainerRegistry/registries/pull/read`
-   `Microsoft.ContainerRegistry/registries/read`
-   `Microsoft.ContainerRegistry/registries/webhooks/read`
-   `Microsoft.ContainerService/fleets/members/read`
-   `Microsoft.ContainerService/fleets/read`
-   `Microsoft.ContainerService/managedClusters/maintenanceConfigurations/read`
-   `Microsoft.ContainerService/managedClusters/read`
-   `Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read`
-   `Microsoft.DBforMariaDB/servers/databases/read`
-   `Microsoft.DBforMariaDB/servers/read`
-   `Microsoft.DBforMySQL/flexibleServers/databases/read`
-   `Microsoft.DBforMySQL/flexibleServers/firewallRules/read`
-   `Microsoft.DBforMySQL/flexibleServers/read`
-   `Microsoft.DBforMySQL/servers/databases/read`
-   `Microsoft.DBforMySQL/servers/firewallRules/read`
-   `Microsoft.DBforMySQL/servers/read`
-   `Microsoft.DBforPostgreSQL/flexibleServers/administrators/read`
-   `Microsoft.DBforPostgreSQL/flexibleServers/advancedThreatProtectionSettings/read`
-   `Microsoft.DBforPostgreSQL/flexibleServers/configurations/read`
-   `Microsoft.DBforPostgreSQL/flexibleServers/databases/read`
-   `Microsoft.DBforPostgreSQL/flexibleServers/firewallRules/read`
-   `Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/read`
-   `Microsoft.DBforPostgreSQL/flexibleServers/read`
-   `Microsoft.DBforPostgreSQL/servers/databases/read`
-   `Microsoft.DBforPostgreSQL/servers/firewallRules/read`
-   `Microsoft.DBforPostgreSQL/servers/read`
-   `Microsoft.DataFactory/factories/integrationRuntimes/read`
-   `Microsoft.DataFactory/factories/linkedservices/read`
-   `Microsoft.DataFactory/factories/managedVirtualNetworks/managedPrivateEndpoints/read`
-   `Microsoft.DataFactory/factories/managedVirtualNetworks/read`
-   `Microsoft.DataFactory/factories/privateEndpointConnections/read`
-   `Microsoft.DataFactory/factories/read`
-   `Microsoft.DataMigration/services/projects/read`
-   `Microsoft.DataMigration/services/read`
-   `Microsoft.DataMigration/services/serviceTasks/read`
-   `Microsoft.DataProtection/backupVaults/read`
-   `Microsoft.DataShare/accounts/read`
-   `Microsoft.Databricks/workspaces/read`
-   `Microsoft.DesktopVirtualization/applicationGroups/desktops/read`
-   `Microsoft.DesktopVirtualization/applicationGroups/read`
-   `Microsoft.DesktopVirtualization/hostPools/read`
-   `Microsoft.DesktopVirtualization/workspaces/read`
-   `Microsoft.Devices/iotHubs/Read`
-   `Microsoft.DocumentDB/databaseAccounts/read`
-   `Microsoft.DocumentDB/databaseAccounts/sqlDatabases/read`
-   `Microsoft.Easm/workspaces/read`
-   `Microsoft.EventGrid/domains/read`
-   `Microsoft.EventGrid/domains/topics/eventSubscriptions/read`
-   `Microsoft.EventGrid/domains/topics/read`
-   `Microsoft.EventGrid/topics/eventSubscriptions/read`
-   `Microsoft.EventGrid/topics/read`
-   `Microsoft.EventHub/clusters/read`
-   `Microsoft.EventHub/namespaces/eventHubs/consumergroups/read`
-   `Microsoft.EventHub/namespaces/eventhubs/read`
-   `Microsoft.EventHub/namespaces/read`
-   `Microsoft.Fabric/capacities/read`
-   `Microsoft.HybridCompute/machines/extensions/read`
-   `Microsoft.HybridCompute/machines/read`
-   `Microsoft.Insights/ActivityLogAlerts/Read`
-   `Microsoft.Insights/DiagnosticSettings/Read`
-   `Microsoft.Insights/LogProfiles/Read`
-   `Microsoft.Insights/components/read`
-   `Microsoft.Insights/eventtypes/values/Read`
-   `Microsoft.KeyVault/managedHSMs/read`
-   `Microsoft.KeyVault/vaults/keys/read`
-   `Microsoft.KeyVault/vaults/read`
-   `Microsoft.KeyVault/vaults/secrets/read`
-   `Microsoft.KeyVault/vaults/secrets/readMetadata/action`
-   `Microsoft.MachineLearningServices/workspaces/computes/read`
-   `Microsoft.MachineLearningServices/workspaces/onlineEndpoints/read`
-   `Microsoft.MachineLearningServices/workspaces/read`
-   `Microsoft.ManagedIdentity/userAssignedIdentities/read`
-   `Microsoft.ManagedServices/registrationAssignments/read`
-   `Microsoft.ManagedServices/registrationDefinitions/read`
-   `Microsoft.Management/managementGroups/read`
-   `Microsoft.NetApp/netAppAccounts/backupVaults/backups/read`
-   `Microsoft.NetApp/netAppAccounts/backupVaults/read`
-   `Microsoft.NetApp/netAppAccounts/capacityPools/read`
-   `Microsoft.NetApp/netAppAccounts/capacityPools/volumes/buckets/read`
-   `Microsoft.NetApp/netAppAccounts/capacityPools/volumes/read`
-   `Microsoft.NetApp/netAppAccounts/capacityPools/volumes/snapshots/read`
-   `Microsoft.NetApp/netAppAccounts/read`
-   `Microsoft.Network/applicationGateways/read`
-   `Microsoft.Network/applicationSecurityGroups/read`
-   `Microsoft.Network/azurefirewalls/read`
-   `Microsoft.Network/bastionHosts/read`
-   `Microsoft.Network/bgpServiceCommunities/read`
-   `Microsoft.Network/ddosProtectionPlans/read`
-   `Microsoft.Network/dnszones/read`
-   `Microsoft.Network/dnszones/recordsets/read`
-   `Microsoft.Network/expressRouteCircuits/peerings/connections/read`
-   `Microsoft.Network/expressRouteCircuits/peerings/peerConnections/read`
-   `Microsoft.Network/expressRouteCircuits/read`
-   `Microsoft.Network/firewallPolicies/Read`
-   `Microsoft.Network/firewallPolicies/ruleCollectionGroups/Read`
-   `Microsoft.Network/frontDoors/read`
-   `Microsoft.Network/loadBalancers/read`
-   `Microsoft.Network/natGateways/read`
-   `Microsoft.Network/networkInterfaces/read`
-   `Microsoft.Network/networkSecurityGroups/read`
-   `Microsoft.Network/networkSecurityGroups/securityRules/read`
-   `Microsoft.Network/networkWatchers/flowLogs/read`
-   `Microsoft.Network/networkWatchers/read`
-   `Microsoft.Network/privateDnsZones/read`
-   `Microsoft.Network/privateDnsZones/recordsets/read`
-   `Microsoft.Network/privateDnsZones/virtualNetworkLinks/read`
-   `Microsoft.Network/privateEndpoints/read`
-   `Microsoft.Network/publicIPAddresses/read`
-   `Microsoft.Network/routeTables/read`
-   `Microsoft.Network/trafficmanagerprofiles/read`
-   `Microsoft.Network/virtualHubs/read`
-   `Microsoft.Network/virtualNetworks/read`
-   `Microsoft.Network/virtualWans/read`
-   `Microsoft.Network/vpnGateways/read`
-   `Microsoft.Network/vpnGateways/vpnConnections/vpnLinkConnections/read`
-   `Microsoft.OperationalInsights/workspaces/read`
-   `Microsoft.PolicyInsights/policyStates/queryResults/read`
-   `Microsoft.PowerBI/privateLinkServicesForPowerBI/read`
-   `Microsoft.RecoveryServices/Vaults/backupProtectedItems/read`
-   `Microsoft.RecoveryServices/vaults/read`
-   `Microsoft.ResourceGraph/resources/read`
-   `Microsoft.Resources/deployments/read`
-   `Microsoft.Resources/subscriptions/locations/read`
-   `Microsoft.Resources/subscriptions/read`
-   `Microsoft.Resources/subscriptions/resourceGroups/read`
-   `Microsoft.ScVmm/virtualMachineInstances/read`
-   `Microsoft.Search/searchServices/listAdminKeys/action`
-   `Microsoft.Search/searchServices/read`
-   `Microsoft.Security/alerts/read`
-   `Microsoft.Security/assessments/read`
-   `Microsoft.Security/autoProvisioningSettings/read`
-   `Microsoft.Security/iotSecuritySolutions/read`
-   `Microsoft.Security/pricings/read`
-   `Microsoft.Security/securityContacts/read`
-   `Microsoft.Security/settings/read`
-   `Microsoft.ServiceBus/namespaces/queues/read`
-   `Microsoft.ServiceBus/namespaces/read`
-   `Microsoft.ServiceBus/namespaces/topics/read`
-   `Microsoft.ServiceBus/namespaces/topics/subscriptions/read`
-   `Microsoft.Sql/managedInstances/administrators/read`
-   `Microsoft.Sql/managedInstances/databases/read`
-   `Microsoft.Sql/managedInstances/read`
-   `Microsoft.Sql/servers/administrators/read`
-   `Microsoft.Sql/servers/databases/read`
-   `Microsoft.Sql/servers/firewallRules/read`
-   `Microsoft.Sql/servers/read`
-   `Microsoft.SqlVirtualMachine/sqlVirtualMachines/read`
-   `Microsoft.Storage/storageAccounts/blobServices/containers/read`
-   `Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action`
-   `Microsoft.Storage/storageAccounts/blobServices/read`
-   `Microsoft.Storage/storageAccounts/fileServices/read`
-   `Microsoft.Storage/storageAccounts/fileServices/shares/read`
-   `Microsoft.Storage/storageAccounts/listKeys/action`
-   `Microsoft.Storage/storageAccounts/queueServices/read`
-   `Microsoft.Storage/storageAccounts/read`
-   `Microsoft.Storage/storageAccounts/tableServices/read`
-   `Microsoft.Storage/storageAccounts/tableServices/tables/read`
-   `Microsoft.StreamAnalytics/clusters/privateEndpoints/read`
-   `Microsoft.StreamAnalytics/clusters/read`
-   `Microsoft.StreamAnalytics/streamingjobs/read`
-   `Microsoft.Subscription/Policies/default/read`
-   `Microsoft.Synapse/workspaces/keys/read`
-   `Microsoft.Synapse/workspaces/read`
-   `Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/read`
-   `Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/rules/read`
-   `Microsoft.Synapse/workspaces/sqlPools/read`
-   `Microsoft.Web/serverfarms/Read`
-   `Microsoft.Web/sites/Read`
-   `Microsoft.Web/sites/config/Read`
-   `Microsoft.Web/sites/config/list/action`
-   `Microsoft.Web/sites/functions/read`
-   `Microsoft.Web/staticSites/Read`
-   `Microsoft.Web/staticSites/basicAuth/read`
-   `Microsoft.Web/staticSites/builds/Read`
-   `Microsoft.Web/staticSites/customDomains/Read`
-   `Microsoft.Web/staticSites/listAppSettings/action`
-   `Oracle.Database/cloudExadataInfrastructures/dbServers/read`
-   `Oracle.Database/cloudExadataInfrastructures/read`
-   `Oracle.Database/cloudVmClusters/dbNodes/read`
-   `Oracle.Database/dbSystems/read`
-   `Oracle.Database/exadbVmClusters/read`

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (8)

-   `Application.Read.All`
-   `AuditLog.Read.All`
-   `Device.Read.All`
-   `Directory.Read.All`
-   `Domain.Read.All`
-   `EntitlementManagement.Read.All`
-   `Policy.Read.All`
-   `Policy.Read.ConditionalAccess`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (8)

-   `GET https://management.azure.com/providers/Microsoft.Subscription/policies`
-   `GET https://management.azure.com/subscriptions`
-   `GET https://management.azure.com/subscriptions/{subscriptionId}`
-   `GET https://management.azure.com/subscriptions/{subscriptionId}/locations`
-   `GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Automation/automationAccounts`
-   `GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Consumption/usageDetails`
-   `GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}`
-   `POST https://management.azure.com/providers/Microsoft.ResourceGraph/resources`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (15)

-   [https://learn.microsoft.com/en-us/azure/advisor/advisor-azure-resource-graph](https://learn.microsoft.com/en-us/azure/advisor/advisor-azure-resource-graph)
-   [https://learn.microsoft.com/en-us/azure/advisor/permissions](https://learn.microsoft.com/en-us/azure/advisor/permissions)
-   [https://learn.microsoft.com/en-us/azure/automation/how-to/private-link-security](https://learn.microsoft.com/en-us/azure/automation/how-to/private-link-security)
-   [https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy)
-   [https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide)
-   [https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/general](https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/general)
-   [https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/management-and-governance](https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/management-and-governance)
-   [https://learn.microsoft.com/en-us/azure/virtual-machines/overview](https://learn.microsoft.com/en-us/azure/virtual-machines/overview)
-   [https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface)
-   [https://learn.microsoft.com/en-us/graph/api/conditionalaccesstemplate-get](https://learn.microsoft.com/en-us/graph/api/conditionalaccesstemplate-get)
-   [https://learn.microsoft.com/en-us/graph/api/resources/authenticationcontextclassreference](https://learn.microsoft.com/en-us/graph/api/resources/authenticationcontextclassreference)
-   [https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccesspolicy](https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccesspolicy)
-   [https://learn.microsoft.com/en-us/graph/api/resources/namedlocation](https://learn.microsoft.com/en-us/graph/api/resources/namedlocation)
-   [https://learn.microsoft.com/en-us/rest/api/automation/automation-account/list?view=rest-automation-2024-10-23](https://learn.microsoft.com/en-us/rest/api/automation/automation-account/list?view=rest-automation-2024-10-23)
-   [https://learn.microsoft.com/en-us/rest/api/subscription/subscription-policy/list-policy-for-tenant?view=rest-subscription-2021-10-01](https://learn.microsoft.com/en-us/rest/api/subscription/subscription-policy/list-policy-for-tenant?view=rest-subscription-2021-10-01)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (343)

| Step | Permissions | OAuth Scopes | Endpoints |
| --- | --- | --- | --- |
| Access Package Assignment Contains Access Package Assignment Policy | \- | \- | \- |
| Access Package HAS Access Package Assignment | \- | \- | \- |
| Access Reviews | `AccessReview.Read.All`, `AccessReview.ReadWrite.All`, `AccessReview.ReadWrite.Membership` | \- | \- |
| AI Search Service Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| AI Search Services | `Microsoft.Search/searchServices/read`, `Microsoft.Search/searchServices/listAdminKeys/action`, `Microsoft.Resources/subscriptions/resourceGroups/read` | \- | \- |
| API Management APIs | `Microsoft.ApiManagement/service/apis/read` | \- | \- |
| API Management Backends | `Microsoft.ApiManagement/service/backends/read` | \- | \- |
| API Management Named Values | `Microsoft.ApiManagement/service/namedValues/read` | \- | \- |
| API Management Portal Config | `Microsoft.ApiManagement/service/portalconfigs/read` | \- | \- |
| API Management Product Subscription Relationships | `Microsoft.ApiManagement/service/products/subscriptions/read` | \- | \- |
| API Management Products | `Microsoft.ApiManagement/service/products/read` | \- | \- |
| API Management Services | `Microsoft.ApiManagement/service/read`, `Microsoft.ApiManagement/service/portalsettings/read` | \- | \- |
| API Management Services Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| API Management Subscriptions | `Microsoft.ApiManagement/service/subscriptions/read` | \- | \- |
| API Management Tenant Access | `Microsoft.ApiManagement/service/tenant/read` | \- | \- |
| App Configuration Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| App Configuration Stores | `Microsoft.AppConfiguration/configurationStores/read` | \- | \- |
| App Service Apps | `Microsoft.Web/sites/Read`, `Microsoft.Web/sites/config/Read`, `Microsoft.Web/sites/config/list/action` | \- | \- |
| App Service Functions | `Microsoft.Web/sites/functions/read` | \- | \- |
| App Service Plans | `Microsoft.Web/serverfarms/Read` | \- | \- |
| Application Insights Components | `Microsoft.Insights/components/read` | \- | \- |
| Application Insights Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Application Security Group | `Microsoft.Network/applicationSecurityGroups/read` | \- | \- |
| ARM Deployments | `Microsoft.Resources/deployments/read` | \- | \- |
| Automation Account -> Private Endpoint Relationships | \- | \- | \- |
| Automation Accounts | `Microsoft.Automation/automationAccounts/read` | \- | `GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Automation/automationAccounts`, `GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}` |
| Automation Accounts Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Azure Access Package Has Application | \- | \- | \- |
| Azure Application Gateway | `Microsoft.Network/applicationGateways/read` | \- | \- |
| Azure Arc Machine Extensions | `Microsoft.HybridCompute/machines/extensions/read` | \- | \- |
| Azure Arc Machines | `Microsoft.HybridCompute/machines/read` | \- | \- |
| Azure Arc SCVMM Virtual Machine Instances | `Microsoft.ScVmm/virtualMachineInstances/read` | \- | \- |
| Azure Arc SQL Server Databases | `Microsoft.AzureArcData/sqlServerInstances/databases/read` | \- | \- |
| Azure Arc SQL Server Instances | `Microsoft.AzureArcData/sqlServerInstances/read` | \- | \- |
| Azure Bgp Service Communities | `Microsoft.Network/bgpServiceCommunities/read` | \- | \- |
| Azure Consumer Group | `Microsoft.EventHub/namespaces/eventHubs/consumergroups/read` | \- | \- |
| Azure Content Safety Accounts | `Microsoft.CognitiveServices/accounts/read`, `Microsoft.Resources/subscriptions/resourceGroups/read` | \- | \- |
| Azure Event Hub | `Microsoft.EventHub/namespaces/eventhubs/read` | \- | \- |
| Azure Group assigned to Access Package | \- | \- | \- |
| Azure Language Accounts | `Microsoft.CognitiveServices/accounts/read`, `Microsoft.Resources/subscriptions/resourceGroups/read` | \- | \- |
| Azure OpenAI Accounts | `Microsoft.CognitiveServices/accounts/read`, `Microsoft.Resources/subscriptions/resourceGroups/read` | \- | \- |
| Azure Peer Express Route Connection | `Microsoft.Network/expressRouteCircuits/peerings/peerConnections/read` | \- | \- |
| Azure Speech Accounts | `Microsoft.CognitiveServices/accounts/read`, `Microsoft.Resources/subscriptions/resourceGroups/read` | \- | \- |
| Azure user assigned to Access Package | \- | \- | \- |
| Azure user Created Entitlement Management Access Package Request | \- | \- | \- |
| Bastion Hosts | `Microsoft.Network/bastionHosts/read` | \- | \- |
| Batch Accounts | `Microsoft.Batch/batchAccounts/read` | \- | \- |
| Batch Accounts Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Batch Applications | `Microsoft.Batch/batchAccounts/applications/read` | \- | \- |
| Batch Certificates | `Microsoft.Batch/batchAccounts/certificates/read` | \- | \- |
| Batch Pools | `Microsoft.Batch/batchAccounts/pools/read` | \- | \- |
| Bot Service Bot -> Private Endpoint Relationships | `Microsoft.BotService/botServices/read` | \- | \- |
| Bot Service Bots | `Microsoft.BotService/botServices/read` | \- | \- |
| Bot Service Channels | `Microsoft.BotService/botServices/channels/read` | \- | \- |
| Bot Service Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Build Azure Application Ownership Relationships | \- | `Application.Read.All` | \- |
| Build Ddos Protection Plan Public Ip Relationship | \- | \- | \- |
| Build Ddos Protection Plan Vnet Relationship | \- | \- | \- |
| Build Fabric Capacity–Workspace Relationship | \- | \- | \- |
| Build Fabric Report-Semantic Model Relationships | \- | \- | \- |
| Build Fabric Semantic Model-Data Source Relationships | \- | \- | \- |
| Build Key Vault Service Synapse Keys Relationship | \- | \- | \- |
| Build Power BI Private Link Service–Private Endpoint Relationship | \- | \- | \- |
| Build Resource Group Ddos Protection Plan Relationship | \- | \- | \- |
| Build Synapse Service and key Relationship | \- | \- | \- |
| Build Synapse Service and SQL Pool Relationship | \- | \- | \- |
| Build Synapse Service and Workspace Relationship | \- | \- | \- |
| Build Synapse SQL Pool Data Masking Policy Relationship | \- | \- | \- |
| Build Synapse Sql Pool Data Masking Rule Relationship | \- | \- | \- |
| Build Synapse Workspace and Keys Relationship | \- | \- | \- |
| Build Synapse Workspace and SQL Pool Relationship | \- | \- | \- |
| CDN Endpoints | `Microsoft.Cdn/profiles/endpoints/read` | \- | \- |
| CDN Endpoints Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| CDN Profiles | `Microsoft.Cdn/profiles/read` | \- | \- |
| CDN Profiles Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Chaos Studio Capabilities | `Microsoft.Chaos/targets/capabilities/read` | \- | \- |
| Chaos Studio Experiment Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Chaos Studio Experiments | `Microsoft.Chaos/experiments/read` | \- | \- |
| Chaos Studio Targets | `Microsoft.Chaos/targets/read` | \- | \- |
| Classic Administrators | `Microsoft.Authorization/classicAdministrators/read` | \- | \- |
| Cognitive Services Accounts | `Microsoft.CognitiveServices/accounts/read`, `Microsoft.Resources/subscriptions/resourceGroups/read` | \- | \- |
| Compute Network Relationships | \- | \- | \- |
| Conditional Access Has Conditional Access Auth Context Relationships | \- | \- | \- |
| Conditional Access Has Conditional Access Policy Relationships | \- | \- | \- |
| Conditional Access Has Conditional Access Template Relationships | \- | \- | \- |
| Conditional Access Policy Assigned AD Groups Relationships | \- | \- | \- |
| Conditional Access Policy Assigned AD Users Relationships | \- | \- | \- |
| Conditional Access Policy Contains Named Location Relationships | \- | \- | \- |
| Container Groups | `Microsoft.ContainerInstance/containerGroups/read` | \- | \- |
| Container Registries | `Microsoft.ContainerRegistry/registries/read` | \- | \- |
| Container Registries Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Container Registry Repositories | `Microsoft.ContainerRegistry/registries/pull/read` | \- | \- |
| Container Registry Webhooks | `Microsoft.ContainerRegistry/registries/webhooks/read` | \- | \- |
| CosmosDB SQL Databases | `Microsoft.DocumentDB/databaseAccounts/read`, `Microsoft.DocumentDB/databaseAccounts/sqlDatabases/read` | \- | \- |
| Data Factory -> Private Endpoint Relationships | `Microsoft.DataFactory/factories/privateEndpointConnections/read` | \- | \- |
| Data Factory Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Data Factory Instances | `Microsoft.DataFactory/factories/read` | \- | \- |
| Data Factory Integration Runtimes | `Microsoft.DataFactory/factories/integrationRuntimes/read` | \- | \- |
| Data Factory Linked Services | `Microsoft.DataFactory/factories/linkedservices/read` | \- | \- |
| Data Factory Managed Private Endpoints | `Microsoft.DataFactory/factories/managedVirtualNetworks/managedPrivateEndpoints/read` | \- | \- |
| Data Factory Managed Virtual Networks | `Microsoft.DataFactory/factories/managedVirtualNetworks/read` | \- | \- |
| Data Migration Projects | `Microsoft.DataMigration/services/projects/read` | \- | \- |
| Data Migration Service Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Data Migration Services | `Microsoft.DataMigration/services/read` | \- | \- |
| Data Migration Tasks | `Microsoft.DataMigration/services/serviceTasks/read` | \- | \- |
| Data Protection Backup Vaults | `Microsoft.DataProtection/backupVaults/read` | \- | \- |
| Data Protection Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Data Share Accounts | `Microsoft.DataShare/accounts/read` | \- | \- |
| Data Share Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Databricks Workspaces | `Microsoft.Databricks/workspaces/read` | \- | \- |
| Defender Alerts | `Microsoft.Security/alerts/read` | \- | \- |
| Defender EASM Workspaces | `Microsoft.Easm/workspaces/read` | \- | \- |
| Desktop Virtualization Application Groups | `Microsoft.DesktopVirtualization/applicationGroups/read` | \- | \- |
| Desktop Virtualization Desktops | `Microsoft.DesktopVirtualization/applicationGroups/desktops/read` | \- | \- |
| Desktop Virtualization Host Pool Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Desktop Virtualization Host Pools | `Microsoft.DesktopVirtualization/hostPools/read` | \- | \- |
| Desktop Virtualization Workspace Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Desktop Virtualization Workspaces | `Microsoft.DesktopVirtualization/workspaces/read` | \- | \- |
| DNS Record Sets | `Microsoft.Network/dnszones/recordsets/read` | \- | \- |
| DNS Zones | `Microsoft.Network/dnszones/read` | \- | \- |
| Document Intelligence Accounts | `Microsoft.CognitiveServices/accounts/read`, `Microsoft.Resources/subscriptions/resourceGroups/read` | \- | \- |
| Document Intelligence Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Entitlement Management Access Package Approver IS Azure User | \- | \- | \- |
| Entitlement Management Access Package Assignment Approver | \- | `EntitlementManagement.Read.All` | \- |
| Entitlement Management Resource Application Assigned To Access Catalog | \- | \- | \- |
| Entra ID Authentication Methods Policy | \- | `Policy.Read.All` | \- |
| Entra ID Authentication Strength Policy | \- | `Policy.Read.All` | \- |
| Entra ID Authorization Policy | \- | `Policy.Read.All` | \- |
| Entra ID Device Registration Policy | \- | `Policy.Read.All` | \- |
| Entra ID Group Members | \- | `Directory.Read.All` | \- |
| Entra ID Groups | \- | `Directory.Read.All` | \- |
| Entra ID OAuth2 Permission Grants | \- | `Directory.Read.All` | \- |
| Entra ID Role Definitions | \- | `Directory.Read.All` | \- |
| Entra ID Service Principal Access | \- | `Directory.Read.All` | \- |
| Entra ID Service Principals | \- | `Directory.Read.All` | \- |
| Entra ID Users | \- | `Directory.Read.All` | \- |
| Event Grid Domain Topic Subscriptions | `Microsoft.EventGrid/domains/topics/eventSubscriptions/read` | \- | \- |
| Event Grid Domain Topics | `Microsoft.EventGrid/domains/topics/read` | \- | \- |
| Event Grid Domains | `Microsoft.EventGrid/domains/read` | \- | \- |
| Event Grid Domains Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Event Grid Topic Subscriptions | `Microsoft.EventGrid/topics/eventSubscriptions/read` | \- | \- |
| Event Grid Topics | `Microsoft.EventGrid/topics/read`, `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Event Grid Topics Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Event Hub Cluster | `Microsoft.EventHub/clusters/read` | \- | \- |
| Event Hub Namespace | `Microsoft.EventHub/namespaces/read` | \- | \- |
| Express Route Circuit | `Microsoft.Network/expressRouteCircuits/read` | \- | \- |
| Express Route Circuit Connection | `Microsoft.Network/expressRouteCircuits/peerings/connections/read` | \- | \- |
| Fetch application credentials | \- | \- | \- |
| Fetch Container Maintenance Configurations | `Microsoft.ContainerService/managedClusters/maintenanceConfigurations/read` | \- | \- |
| Fetch Container Services Clusters | `Microsoft.ContainerService/managedClusters/read` | \- | \- |
| Fetch Ddos Protection Plan | `Microsoft.Network/ddosProtectionPlans/read` | \- | \- |
| Fetch Fabric Capacities | `Microsoft.Fabric/capacities/read` | \- | \- |
| Fetch Fabric Capacity Tenant Setting Overrides | \- | \- | \- |
| Fetch Fabric Domain Tenant Setting Overrides | \- | \- | \- |
| Fetch Fabric Domains | \- | \- | \- |
| Fetch Fabric Tenant Settings | \- | \- | \- |
| Fetch Fabric Workspace Artifacts | \- | \- | \- |
| Fetch Fabric Workspace Tenant Setting Overrides | \- | \- | \- |
| Fetch Fabric Workspaces | \- | \- | \- |
| Fetch Front Door AFD Custom Domains | `Microsoft.Cdn/profiles/customDomains/read` | \- | \- |
| Fetch Front Door AFD Endpoints | `Microsoft.Cdn/profiles/afdEndpoints/read` | \- | \- |
| Fetch Front Door AFD Origin Groups | `Microsoft.Cdn/profiles/originGroups/read` | \- | \- |
| Fetch Front Door AFD Origins | `Microsoft.Cdn/profiles/originGroups/origins/read` | \- | \- |
| Fetch Front Door AFD Profiles | `Microsoft.Cdn/profiles/read` | \- | \- |
| Fetch Front Door AFD Routes | `Microsoft.Cdn/profiles/afdEndpoints/routes/read` | \- | \- |
| Fetch FrontDoors | `Microsoft.Network/frontDoors/read` | \- | \- |
| Fetch Power BI Private Link Services | `Microsoft.PowerBI/privateLinkServicesForPowerBI/read` | \- | \- |
| Fetch Synapse Data Masking Policy | `Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/read` | \- | \- |
| Fetch Synapse Data Masking Rule | `Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/rules/read` | \- | \- |
| Fetch Synapse Keys | `Microsoft.Synapse/workspaces/keys/read` | \- | \- |
| Fetch Traffic Manager Profiles | `Microsoft.Network/trafficmanagerprofiles/read` | \- | \- |
| Fetch Trusted Access Roles | `Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read` | \- | \- |
| Fetch Virtual Hubs | `Microsoft.Network/virtualHubs/read` | \- | \- |
| Fetch Virtual WANs | `Microsoft.Network/virtualWans/read` | \- | \- |
| Fetch VPN Connections | `Microsoft.Network/vpnGateways/read` | \- | \- |
| Fetch VPN Gateways | `Microsoft.Network/vpnGateways/read` | \- | \- |
| Fetch VPN Link Connections | `Microsoft.Network/vpnGateways/vpnConnections/vpnLinkConnections/read` | \- | \- |
| Front Door AFD Profile Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Galleries | `Microsoft.Compute/galleries/read` | \- | \- |
| Gallery Shared Image Versions | `Microsoft.Compute/galleries/images/versions/read` | \- | \- |
| Gallery Shared Images | `Microsoft.Compute/galleries/images/read` | \- | \- |
| Group Setting Templates | \- | `Directory.Read.All` | \- |
| Group Settings | \- | `Directory.Read.All` | \- |
| IoT Hub Security Solution Relationships | \- | \- | \- |
| IoT Hubs | `Microsoft.Devices/iotHubs/Read` | \- | \- |
| IoT Security Solutions | `Microsoft.Security/iotSecuritySolutions/read` | \- | \- |
| Key Vault Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Key Vault Keys | `Microsoft.KeyVault/vaults/keys/read` | \- | \- |
| Key Vault Secrets | `Microsoft.KeyVault/vaults/secrets/readMetadata/action`, `Microsoft.KeyVault/vaults/secrets/read` | \- | \- |
| Key Vaults | `Microsoft.KeyVault/vaults/read` | \- | \- |
| Kubernetes Fleet Managers | `Microsoft.ContainerService/fleets/read` | \- | \- |
| Kubernetes Fleet Members | `Microsoft.ContainerService/fleets/members/read` | \- | \- |
| Load Balancer Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Load Balancers | `Microsoft.Network/loadBalancers/read` | \- | \- |
| Load Balancers NIC Relationships | \- | \- | \- |
| Log Analytics Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Log Analytics Workspaces | `Microsoft.OperationalInsights/workspaces/read` | \- | \- |
| Machine Learning Compute | `Microsoft.MachineLearningServices/workspaces/computes/read` | \- | \- |
| Machine Learning Online Endpoints | `Microsoft.MachineLearningServices/workspaces/onlineEndpoints/read` | \- | \- |
| Machine Learning Workspace -> Private Endpoint Relationships | `Microsoft.MachineLearningServices/workspaces/read` | \- | \- |
| Machine Learning Workspace Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Machine Learning Workspaces | `Microsoft.MachineLearningServices/workspaces/read` | \- | \- |
| Managed HSMs | `Microsoft.KeyVault/managedHSMs/read` | \- | \- |
| Managed Identities (User-Assigned) | `Microsoft.ManagedIdentity/userAssignedIdentities/read` | \- | \- |
| Managed Services Registration Assignments | `Microsoft.ManagedServices/registrationAssignments/read` | \- | \- |
| Managed Services Registration Definitions | `Microsoft.ManagedServices/registrationDefinitions/read` | \- | \- |
| Management Groups | `Microsoft.Management/managementGroups/read` | \- | \- |
| MariaDB Databases | `Microsoft.DBforMariaDB/servers/databases/read`, `Microsoft.DBforMariaDB/servers/read` | \- | \- |
| MariaDB Databases Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Monitor Activity Log Alerts | `Microsoft.Insights/ActivityLogAlerts/Read` | \- | \- |
| Monitor Activity Log Events | `Microsoft.Insights/eventtypes/values/Read` | \- | \- |
| Monitor Log Profiles | `Microsoft.Insights/LogProfiles/Read` | \- | \- |
| MySQL Databases | `Microsoft.DBforMySQL/servers/read`, `Microsoft.DBforMySQL/servers/databases/read` | \- | \- |
| MySQL Databases Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| MySQL Flexible Databases | `Microsoft.DBforMySQL/flexibleServers/databases/read` | \- | \- |
| MySQL Flexible Server Firewall Rules | `Microsoft.DBforMySQL/flexibleServers/firewallRules/read` | \- | \- |
| MySQL Flexible Servers | `Microsoft.DBforMySQL/flexibleServers/read` | \- | \- |
| MySQL Server Firewall Rules | `Microsoft.DBforMySQL/servers/firewallRules/read` | \- | \- |
| NetApp Account Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| NetApp Accounts | `Microsoft.NetApp/netAppAccounts/read` | \- | \- |
| NetApp Backups | `Microsoft.NetApp/netAppAccounts/backupVaults/read`, `Microsoft.NetApp/netAppAccounts/backupVaults/backups/read` | \- | \- |
| NetApp Buckets | `Microsoft.NetApp/netAppAccounts/capacityPools/volumes/buckets/read` | \- | \- |
| NetApp Capacity Pool Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| NetApp Capacity Pools | `Microsoft.NetApp/netAppAccounts/capacityPools/read` | \- | \- |
| NetApp Snapshots | `Microsoft.NetApp/netAppAccounts/capacityPools/volumes/snapshots/read` | \- | \- |
| NetApp Volume Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| NetApp Volumes | `Microsoft.NetApp/netAppAccounts/capacityPools/volumes/read` | \- | \- |
| Network Application Gateway Ip Relationships | \- | \- | \- |
| Network Azure Firewalls | `Microsoft.Network/azurefirewalls/read` | \- | \- |
| Network Azure Firewalls Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Network Firewall IP Relationships | \- | \- | \- |
| Network Firewall Policies | `Microsoft.Network/firewallPolicies/Read` | \- | \- |
| Network Firewall Rules Relationships | `Microsoft.Network/firewallPolicies/ruleCollectionGroups/Read` | \- | \- |
| Network Interfaces | `Microsoft.Network/networkInterfaces/read` | \- | \- |
| Network Load Balancers IP Relationships | \- | \- | \- |
| Network NAT Gateways | `Microsoft.Network/natGateways/read` | \- | \- |
| Network NAT Gateways IP Relationships | \- | \- | \- |
| Network Security Group Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Network Security Group NIC Relationships | \- | \- | \- |
| Network Security Groups | `Microsoft.Network/networkSecurityGroups/read` | \- | \- |
| Network Security Rules | `Microsoft.Network/networkSecurityGroups/securityRules/read` | \- | \- |
| Network Securtiy Group Flow Logs | `Microsoft.Network/networkWatchers/flowLogs/read` | \- | \- |
| Network Watchers | `Microsoft.Network/networkWatchers/read` | \- | \- |
| Oracle DB Nodes | `Oracle.Database/cloudVmClusters/dbNodes/read` | \- | \- |
| Oracle DB Servers | `Oracle.Database/cloudExadataInfrastructures/dbServers/read` | \- | \- |
| Oracle DB Systems | `Oracle.Database/dbSystems/read` | \- | \- |
| Oracle Exadata Infrastructures | `Oracle.Database/cloudExadataInfrastructures/read` | \- | \- |
| Oracle ExaDB VM Clusters | `Oracle.Database/exadbVmClusters/read` | \- | \- |
| Policy Assignments | `Microsoft.Authorization/policyAssignments/read` | \- | \- |
| Policy Definitions | `Microsoft.Authorization/policyDefinitions/read`, `Microsoft.Authorization/policySetDefinitions/read` | \- | \- |
| Policy States | `Microsoft.PolicyInsights/policyStates/queryResults/read` | \- | \- |
| PostgreSQL Databases | `Microsoft.DBforPostgreSQL/servers/databases/read` | \- | \- |
| PostgreSQL Flexible Databases | `Microsoft.DBforPostgreSQL/flexibleServers/databases/read` | \- | \- |
| PostgreSQL Flexible Server Configurations | `Microsoft.DBforPostgreSQL/flexibleServers/configurations/read` | \- | \- |
| PostgreSQL Flexible Server Entra Admins | `Microsoft.DBforPostgreSQL/flexibleServers/administrators/read` | \- | \- |
| PostgreSQL Flexible Server Firewall Rules | `Microsoft.DBforPostgreSQL/flexibleServers/firewallRules/read` | \- | \- |
| PostgreSQL Flexible Server Key Vault Relationships | \- | \- | \- |
| PostgreSQL Flexible Server Private Endpoint Relationships | `Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/read` | \- | \- |
| PostgreSQL Flexible Server Replicas | `Microsoft.DBforPostgreSQL/flexibleServers/read` | \- | \- |
| PostgreSQL Flexible Server Subnet Relationships | \- | \- | \- |
| PostgreSQL Flexible Servers | `Microsoft.DBforPostgreSQL/flexibleServers/read`, `Microsoft.DBforPostgreSQL/flexibleServers/advancedThreatProtectionSettings/read` | \- | \- |
| PostgreSQL Flexible Servers Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| PostgreSQL Server Firewall Rules | `Microsoft.DBforPostgreSQL/servers/firewallRules/read` | \- | \- |
| PostgreSQL Servers | `Microsoft.DBforPostgreSQL/servers/read` | \- | \- |
| PostgreSQL Servers Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Private DNS Record Sets | `Microsoft.Network/privateDnsZones/recordsets/read` | \- | \- |
| Private DNS Virtual Network Links | `Microsoft.Network/privateDnsZones/virtualNetworkLinks/read` | \- | \- |
| Private DNS Zones | `Microsoft.Network/privateDnsZones/read` | \- | \- |
| Private Endpoints | `Microsoft.Network/privateEndpoints/read` | \- | \- |
| Public IP Addresses | `Microsoft.Network/publicIPAddresses/read` | \- | \- |
| Public IP Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Recommendations | `Microsoft.ResourceGraph/resources/read`, `Microsoft.Advisor/recommendations/read` | \- | `POST https://management.azure.com/providers/Microsoft.ResourceGraph/resources` |
| Recovery Services Backup Protected Items | `Microsoft.RecoveryServices/Vaults/backupProtectedItems/read` | \- | \- |
| Recovery Services Vault -> Private Endpoint Relationships | `Microsoft.RecoveryServices/vaults/read` | \- | \- |
| Recovery Services Vaults | `Microsoft.RecoveryServices/vaults/read` | \- | \- |
| Redis Caches | `Microsoft.Cache/redis/read` | \- | \- |
| Redis Enterprise Cluster Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Redis Enterprise Clusters | `Microsoft.Cache/redisEnterprise/read` | \- | \- |
| Redis Enterprise Database Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Redis Enterprise Databases | `Microsoft.Cache/redisEnterprise/databases/read` | \- | \- |
| Redis Firewall Rules | `Microsoft.Cache/redis/firewallRules/read` | \- | \- |
| Redis Linked Servers | `Microsoft.Cache/redis/linkedServers/read` | \- | \- |
| Resource Groups | `Microsoft.Resources/subscriptions/resourceGroups/read` | \- | \- |
| Resource Locks | `Microsoft.Authorization/locks/read` | \- | \- |
| Role Assignments | `Microsoft.Authorization/roleAssignments/read` | \- | \- |
| Role Definitions | `Microsoft.Authorization/roleDefinitions/read` | \- | \- |
| Route Table Routes | \- | \- | \- |
| Route Tables | `Microsoft.Network/routeTables/read` | \- | \- |
| Security Assessments | `Microsoft.Security/assessments/read` | \- | \- |
| Security Center Auto-Provisioning Settings | `Microsoft.Security/autoProvisioningSettings/read` | \- | \- |
| Security Center Pricing Configurations | `Microsoft.Security/pricings/read` | \- | \- |
| Security Center Settings | `Microsoft.Security/settings/read` | \- | \- |
| Security Contacts | `Microsoft.Security/securityContacts/read` | \- | \- |
| Service Bus Namespaces | `Microsoft.ServiceBus/namespaces/read` | \- | \- |
| Service Bus Queues | `Microsoft.ServiceBus/namespaces/queues/read` | \- | \- |
| Service Bus Topic Subscriptions | `Microsoft.ServiceBus/namespaces/topics/subscriptions/read` | \- | \- |
| Service Bus Topics | `Microsoft.ServiceBus/namespaces/topics/read` | \- | \- |
| Skipped Subscriptions | `Microsoft.Resources/subscriptions/read` | \- | `GET https://management.azure.com/subscriptions` |
| SQL Databases | `Microsoft.Sql/servers/databases/read` | \- | \- |
| SQL Managed Instance Databases | `Microsoft.Sql/managedInstances/databases/read` | \- | \- |
| SQL Managed Instance Entra ID Admins | `Microsoft.Sql/managedInstances/administrators/read` | \- | \- |
| SQL Managed Instance Private Endpoint Relationships | \- | \- | \- |
| SQL Managed Instances | `Microsoft.Sql/managedInstances/read` | \- | \- |
| SQL Server Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| SQL Server Entra ID Admins | `Microsoft.Sql/servers/administrators/read` | \- | \- |
| SQL Server Firewall Rules | `Microsoft.Sql/servers/firewallRules/read` | \- | \- |
| SQL Servers | `Microsoft.Sql/servers/read` | \- | \- |
| SQL Virtual Machines | `Microsoft.SqlVirtualMachine/sqlVirtualMachines/read` | \- | \- |
| SRE Agent Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| SRE Agents | `Microsoft.App/agents/read` | \- | \- |
| Static Web App Builds | `Microsoft.Web/staticSites/builds/Read` | \- | \- |
| Static Web App Custom Domains | `Microsoft.Web/staticSites/customDomains/Read` | \- | \- |
| Static Web App Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Static Web App Sites | `Microsoft.Web/staticSites/Read`, `Microsoft.Web/staticSites/listAppSettings/action`, `Microsoft.Web/staticSites/basicAuth/read` | \- | \- |
| Storage Accounts | `Microsoft.Storage/storageAccounts/read`, `Microsoft.Storage/storageAccounts/blobServices/read`, `Microsoft.Storage/storageAccounts/queueServices/read`, `Microsoft.Storage/storageAccounts/tableServices/read`, `Microsoft.Storage/storageAccounts/fileServices/read` | \- | \- |
| Storage Accounts Keys | `Microsoft.Storage/storageAccounts/listKeys/action` | \- | \- |
| Storage Blob Services | `Microsoft.Storage/storageAccounts/blobServices/read` | \- | \- |
| Storage Containers | `Microsoft.Storage/storageAccounts/blobServices/containers/read`, `Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action` | \- | \- |
| Storage File Shares | `Microsoft.Storage/storageAccounts/fileServices/shares/read` | \- | \- |
| Storage Queues | `Microsoft.Storage/storageAccounts/queueServices/read` | \- | \- |
| Storage Tables | `Microsoft.Storage/storageAccounts/tableServices/tables/read` | \- | \- |
| Stream Analytics Clusters | `Microsoft.StreamAnalytics/clusters/read` | \- | \- |
| Stream Analytics Jobs | `Microsoft.StreamAnalytics/streamingjobs/read` | \- | \- |
| Stream Analytics Private Endpoints | `Microsoft.StreamAnalytics/clusters/privateEndpoints/read` | \- | \- |
| Subscription Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Subscription Locations | `Microsoft.Resources/subscriptions/locations/read` | \- | `GET https://management.azure.com/subscriptions/{subscriptionId}/locations` |
| Subscription Policies | `Microsoft.Subscription/Policies/default/read` | \- | `GET https://management.azure.com/providers/Microsoft.Subscription/policies` |
| Subscription Usage Details | `Microsoft.Consumption/usageDetails/read` | \- | `GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Consumption/usageDetails` |
| Subscriptions | `Microsoft.Resources/subscriptions/read` | \- | `GET https://management.azure.com/subscriptions/{subscriptionId}` |
| Synapse Service | \- | \- | \- |
| Synapse SQL Pool | `Microsoft.Synapse/workspaces/sqlPools/read` | \- | \- |
| Synapse Workspaces | `Microsoft.Synapse/workspaces/read` | \- | \- |
| Traffic Manager Profile Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Virtual Hub Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Virtual Machine Disk Images | `Microsoft.Compute/images/read` | \- | \- |
| Virtual Machine Disks | `Microsoft.Compute/disks/read` | \- | \- |
| Virtual Machine Extensions | `Microsoft.Compute/virtualMachines/extensions/read` | \- | \- |
| Virtual Machine Scale Sets | `Microsoft.Compute/virtualMachineScaleSets/read` | \- | \- |
| Virtual Machines | `Microsoft.Compute/virtualMachines/read`, `Microsoft.Network/networkInterfaces/read`, `Microsoft.Network/publicIPAddresses/read` | \- | \- |
| Virtual Network Diagostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| Virtual Networks | `Microsoft.Network/virtualNetworks/read` | \- | \- |
| Virtual WAN Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |
| VPN Gateway Diagnostic Settings | `Microsoft.Insights/DiagnosticSettings/Read` | \- | \- |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| \[AD\] Access Review | `azure_access_review` | [Review](https://docs.jupiterone.io/data-model/schemas/Review) |
| \[AD\] Account | `azure_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| \[AD\] Authentication Methods Policy | `azure_authentication_methods_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[AD\] Authentication Strength Policy | `azure_authentication_strength_policy` | [PasswordPolicy](https://docs.jupiterone.io/data-model/schemas/PasswordPolicy) |
| \[AD\] Authorization Policy | `azure_authorization_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[AD\] Conditional Access | `azure_conditional_access_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[AD\] Conditional Access Authorization Context | `azure_conditional_access_authorization_context` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[AD\] Conditional Access Named location | `azure_conditional_access_named_location` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[AD\] Conditional Access Policy | `azure_conditional_access_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[AD\] Conditional Access Template | `azure_conditional_access_template` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[AD\] Device Registration Policy | `azure_device_registration_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[AD\] Domain | `azure_domain` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[AD\] Group | `azure_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[AD\] Group Member | `azure_group_member` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| \[AD\] Group.Unified Setting | `azure_group_unified_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[AD\] Group.Unified Setting Template | `azure_group_unified_setting_template` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[AD\] Group.Unified.Guest Setting | `azure_group_unified_guest_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[AD\] Group.Unified.Guest Setting Template | `azure_group_unified_guest_setting_template` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[AD\] Role Definition | `azure_ad_role_definition` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| \[AD\] Service Principal | `azure_service_principal` | [Service](https://docs.jupiterone.io/data-model/schemas/Service), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| \[AD\] User | `azure_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| \[RM\] Access Role | `azure_kube_trusted_access_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| \[RM\] Advisor Recommendation | `azure_advisor_recommendation` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| \[RM\] AI Search Service | `azure_search_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] API Management API | `azure_api_management_api` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| \[RM\] API Management Backend | `azure_api_management_backend` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| \[RM\] API Management Named Value | `azure_api_management_named_value` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| \[RM\] API Management Portal Config | `azure_api_management_portal_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] API Management Product | `azure_api_management_product` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] API Management Service | `azure_api_management_service` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| \[RM\] API Management Subscription | `azure_api_management_subscription` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| \[RM\] API Management Tenant Access | `azure_api_management_tenant_access` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] App Configuration Store | `azure_app_configuration_store` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] App Service Plan | `azure_app_service_plan` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Application Insights | `azure_application_insights` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[RM\] Automation Account | `azure_automation_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Azure Arc Machine | `azure_arc_machine` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] Azure Arc Machine Extension | `azure_arc_machine_extension` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[RM\] Azure Arc SCVMM Virtual Machine | `azure_scvmm_virtual_machine` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] Azure Arc SQL Server Database | `azure_arc_sql_server_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Azure Arc SQL Server Instance | `azure_arc_sql_server_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Azure Bgp Service Communities | `azure_bgp_service_communities` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Azure Consumer Group | `azure_event_hub_consumer_group` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| \[RM\] Azure Content Safety Account | `azure_content_safety_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Azure Ddos Protection Plans | `azure_ddos_protection_plan` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Azure Event Hub | `azure_event_hub` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Azure Express Route | `azure_expressroute` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Azure Express Route Circuit | `azure_expressroute_circuit` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Azure Express Route Circuit Connections | `azure_expressroute_circuit_connection` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Azure Kubernetes Cluster | `azure_kubernetes_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Azure Language Account | `azure_language_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Azure Managed Disk | `azure_managed_disk` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| \[RM\] Azure OpenAI Account | `azure_openai_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Azure Peer Express Route Circuit Connection | `azure_peer_expressroute_circut_connection` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Azure Speech Account | `azure_speech_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Backup Protected Item | `azure_backup_protected_item` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| \[RM\] Bastion Host | `azure_bastion_host` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] Batch Account | `azure_batch_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Batch Application | `azure_batch_application` | [Process](https://docs.jupiterone.io/data-model/schemas/Process) |
| \[RM\] Batch Certificate | `azure_batch_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| \[RM\] Batch Pool | `azure_batch_pool` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Bot Service Bot | `azure_bot_service_bot` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Bot Service Channel | `azure_bot_service_channel` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| \[RM\] CDN Endpoint | `azure_cdn_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| \[RM\] CDN Profile | `azure_cdn_profile` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Chaos Studio Capability | `azure_chaos_studio_capability` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Chaos Studio Experiment | `azure_chaos_studio_experiment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| \[RM\] Chaos Studio Target | `azure_chaos_studio_target` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Classic Admin | `azure_classic_admin_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| \[RM\] Cognitive Services Account | `azure_cognitive_services_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Container | `azure_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| \[RM\] Container Group | `azure_container_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] Container Registry | `azure_container_registry` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Container Registry Webhook | `azure_container_registry_webhook` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| \[RM\] Container Volume | `azure_container_volume` | [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| \[RM\] Cosmos DB Account | `azure_cosmosdb_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account), [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Cosmos DB Database | `azure_cosmosdb_sql_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Data Factory | `azure_data_factory` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Data Factory Integration Runtime | `azure_data_factory_integration_runtime` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| \[RM\] Data Factory Linked Service | `azure_data_factory_linked_service` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Data Factory Managed Private Endpoint | `azure_data_factory_managed_private_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| \[RM\] Data Factory Managed Virtual Network | `azure_data_factory_managed_virtual_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Data Masking Policy | `azure_synapse_masking_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| \[RM\] Data Masking Rule | `azure_synapse_masking_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| \[RM\] Data Migration Project | `azure_datamigration_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| \[RM\] Data Migration Service | `azure_datamigration_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Data Migration Task | `azure_datamigration_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| \[RM\] Data Protection Backup Vault | `azure_data_protection_backup_vault` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Data Share Account | `azure_data_share_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| \[RM\] Databricks Workspace | `azure_databricks_workspace` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Deployment | `azure_rm_deployment` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| \[RM\] Desktop Virtualization Application Group | `azure_desktop_virtualization_application_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] Desktop Virtualization Desktop | `azure_desktop_virtualization_desktop` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Desktop Virtualization Host Pool | `azure_desktop_virtualization_host_pool` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Desktop Virtualization Workspace | `azure_desktop_virtualization_workspace` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] DNS Record Set | `azure_dns_record_set` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| \[RM\] DNS Zone | `azure_dns_zone` | [DomainZone](https://docs.jupiterone.io/data-model/schemas/DomainZone) |
| \[RM\] Document Intelligence Account | `azure_document_intelligence_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] EASM Workspace | `azure_easm_workspace` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Event Grid Domain | `azure_event_grid_domain` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Event Grid Domain Topic | `azure_event_grid_domain_topic` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| \[RM\] Event Grid Topic | `azure_event_grid_topic` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| \[RM\] Event Grid Topic Subscription | `azure_event_grid_topic_subscription` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| \[RM\] Event Hub Cluster | `azure_event_hub_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Event Hub Keys | `azure_event_hub_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| \[RM\] Event Hub Namespace | `azure_event_hub_namespace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] Fabric Capacity | `azure_fabric_capacity` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Fabric Dashboard | `azure_fabric_dashboard` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[RM\] Fabric Data Source | `azure_fabric_datasource` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Fabric Dataflow | `azure_fabric_dataflow` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| \[RM\] Fabric Datamart | `azure_fabric_datamart` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Fabric Domain | `azure_fabric_domain` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] Fabric Report | `azure_fabric_report` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[RM\] Fabric Semantic Model | `azure_fabric_semantic_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| \[RM\] Fabric Tenant Setting | `azure_fabric_tenant_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Fabric Tenant Setting Override | `azure_fabric_tenant_setting_override` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Fabric Workspace | `azure_fabric_workspace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] Firewall Policy | `azure_network_firewall_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| \[RM\] Front Door AFD Endpoint | `azure_frontdoor_afd_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| \[RM\] Front Door Custom Domain | `azure_frontdoor_custom_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| \[RM\] Front Door Origin | `azure_frontdoor_origin` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Front Door Origin Group | `azure_frontdoor_origin_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Front Door Profile | `azure_frontdoor_profile` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Front Door Route | `azure_frontdoor_route` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Function | `azure_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| \[RM\] Function App | `azure_function_app` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| \[RM\] Gallery | `azure_gallery` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| \[RM\] Image | `azure_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| \[RM\] IoT Hub | `azure_iot_hub` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] IoT Security Solution | `azure_iot_security_solution` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Key Vault | `azure_keyvault_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Key Vault Key | `azure_keyvault_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| \[RM\] Key Vault Secret | `azure_keyvault_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| \[RM\] Kubernetes Fleet Manager | `azure_kubernetes_fleet_manager` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Kubernetes Fleet Member | `azure_kubernetes_fleet_member` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Kubernetes Service | `azure_kube_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Load Balancer | `azure_lb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| \[RM\] Log Analytics | `azure_log_analytics_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Log Analytics Workspace | `azure_log_analytics_workspace` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| \[RM\] Machine Learning Compute | `azure_machine_learning_compute` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Machine Learning Online Endpoint | `azure_machine_learning_online_endpoint` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Machine Learning Workspace | `azure_machine_learning_workspace` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Managed Cluster | `azure_kube_maintenance_configuration` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Managed HSM | `azure_managed_hsm` | [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| \[RM\] Managed Identity | `azure_managed_identity` | [Service](https://docs.jupiterone.io/data-model/schemas/Service), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| \[RM\] Managed Services Registration Assignment | `azure_managed_services_registration_assignment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Managed Services Registration Definition | `azure_managed_services_registration_definition` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[RM\] Management Group | `azure_management_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] MariaDB Database | `azure_mariadb_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] MariaDB Server | `azure_mariadb_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] Monitor Activity Log Alert | `azure_monitor_activity_log_alert` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| \[RM\] Monitor Activity Log Event | `azure_activity_log_event` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| \[RM\] Monitor Diagnostic Settings Resource | `azure_diagnostic_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Monitor Log Profile | `azure_monitor_log_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] MySQL Database | `azure_mysql_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] MySQL Flexible Database | `azure_mysql_flexible_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] MySQL Flexible Server | `azure_mysql_flexible_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] MySQL Flexible Server Firewall Rule | `azure_mysql_flexible_server_firewall_rule` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] MySQL Server | `azure_mysql_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] MySQL Server Firewall Rule | `azure_mysql_server_firewall_rule` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] NAT Gateway | `azure_nat_gateway` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] NetApp Account | `azure_netapp_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| \[RM\] NetApp Backup | `azure_netapp_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| \[RM\] NetApp Bucket | `azure_netapp_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] NetApp Capacity Pool | `azure_netapp_capacity_pool` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] NetApp Snapshot | `azure_netapp_snapshot` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] NetApp Volume | `azure_netapp_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Network Firewall | `azure_network_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] Network Interface | `azure_nic` | [NetworkInterface](https://docs.jupiterone.io/data-model/schemas/NetworkInterface) |
| \[RM\] Network Watcher | `azure_network_watcher` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Oracle Cloud Exadata Infrastructure | `azure_oracle_exadata_infrastructure` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Oracle DB Node | `azure_oracle_db_node` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Oracle DB Server | `azure_oracle_db_server` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Oracle DB System | `azure_oracle_db_system` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| \[RM\] Oracle Exadb VM Cluster | `azure_oracle_exadb_vm_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Policy Assignment | `azure_policy_assignment` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| \[RM\] Policy Definition | `azure_policy_definition` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| \[RM\] Policy Set Definition | `azure_policy_set_definition` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| \[RM\] Policy State | `azure_policy_state` | [Review](https://docs.jupiterone.io/data-model/schemas/Review) |
| \[RM\] PostgreSQL Database | `azure_postgresql_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] PostgreSQL Flexible Database | `azure_postgresql_flexible_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] PostgreSQL Flexible Server | `azure_postgresql_flexible_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] PostgreSQL Flexible Server Configuration | `azure_postgresql_flexible_server_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] PostgreSQL Flexible Server Entra Admin | `azure_postgresql_flexible_server_entra_admin` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| \[RM\] PostgreSQL Flexible Server Firewall Rule | `azure_postgresql_flexible_server_firewall_rule` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] PostgreSQL Server | `azure_postgresql_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] PostgreSQL Server Firewall Rule | `azure_postgresql_server_firewall_rule` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] Power BI Private Link Service | `azure_powerbi_private_link_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Private DNS Record Set | `azure_private_dns_record_set` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| \[RM\] Private DNS Zone | `azure_private_dns_zone` | [DomainZone](https://docs.jupiterone.io/data-model/schemas/DomainZone) |
| \[RM\] Private DNS Zone Virtual Network Link | `azure_private_dns_zone_virtual_network_link` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Private Endpoint | `azure_private_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| \[RM\] Public IP Address | `azure_public_ip` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| \[RM\] Recovery Services Vault | `azure_recovery_services_vault` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Redis Cache | `azure_redis_cache` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Redis Enterprise Cluster | `azure_redis_enterprise_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Redis Enterprise Database | `azure_redis_enterprise_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Redis Firewall Rule | `azure_firewall_rule` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] Resource Group | `azure_resource_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] Resource Lock | `azure_resource_lock` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| \[RM\] Role Assignment | `azure_role_assignment` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[RM\] Role Binding | `azure_kube_cluster_role_binding` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| \[RM\] Role Definition | `azure_role_definition` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| \[RM\] Route | `azure_route` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| \[RM\] Route Table | `azure_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Security Assessment | `azure_security_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| \[RM\] Security Center Auto Provisioning Setting | `azure_security_center_auto_provisioning_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Security Center Setting | `azure_security_center_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Security Center Subscription Pricing | `azure_security_center_subscription_pricing` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Security Contact | `azure_security_center_contact` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| \[RM\] Security Group | `azure_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] Security Group Flow Logs | `azure_security_group_flow_logs` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| \[RM\] Security Rule | `azure_security_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| \[RM\] Service Bus Namespace | `azure_service_bus_namespace` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Service Bus Queue | `azure_service_bus_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| \[RM\] Service Bus Subscription | `azure_service_bus_subscription` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| \[RM\] Service Bus Topic | `azure_service_bus_topic` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| \[RM\] Shared Image | `azure_shared_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| \[RM\] Shared Image Version | `azure_shared_image_version` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| \[RM\] SQL Database | `azure_sql_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] SQL Managed Instance | `azure_sql_managed_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| \[RM\] SQL Managed Instance Database | `azure_sql_managed_instance_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| \[RM\] SQL Managed Instance Entra ID Admin | `azure_sql_managed_instance_active_directory_admin` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| \[RM\] SQL Pool | `azure_synapse_sql_pool` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] SQL Server | `azure_sql_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] SQL Server Entra ID Admin | `azure_sql_server_active_directory_admin` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| \[RM\] SQL Server Firewall Rule | `azure_sql_server_firewall_rule` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| \[RM\] SQL Virtual Machine | `azure_sql_vm` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] SRE Agent | `azure_sre_agent` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[RM\] Static Web App | `azure_static_site` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[RM\] Static Web App Build | `azure_static_site_build` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Static Web App Custom Domain | `azure_static_site_custom_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| \[RM\] Storage Account | `azure_storage_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Storage Account Key | `azure_storage_account_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| \[RM\] Storage Blob Service | `azure_storage_blob_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| \[RM\] Storage Container | `azure_storage_container` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Storage File Share | `azure_storage_file_share` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[RM\] Storage Queue | `azure_storage_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| \[RM\] Storage Table | `azure_storage_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| \[RM\] Stream Analytics Cluster | `azure_stream_analytics_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| \[RM\] Stream Analytics Job | `azure_stream_analytics_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| \[RM\] Stream Analytics Private Endpoint | `azure_stream_analytics_private_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| \[RM\] Subnet | `azure_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Subscription | `azure_subscription` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| \[RM\] Subscription Policy | `azure_subscription_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| \[RM\] Synapse Keys | `azure_synapse_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| \[RM\] Traffic Manager Endpoint | `azure_traffic_manager_endpoint` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| \[RM\] Traffic Manager Profile | `azure_traffic_manager_profile` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| \[RM\] Usage Details | `azure_usage_details` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| \[RM\] Virtual Hub | `azure_virtual_hub` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Virtual Machine | `azure_vm` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| \[RM\] Virtual Machine Extension | `azure_vm_extension` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[RM\] Virtual Machine Scale Set | `azure_vm_scale_set` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| \[RM\] Virtual Network | `azure_vnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Virtual WAN | `azure_virtual_wan` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] VPN Connection | `azure_vpn_connection` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] VPN Gateway | `azure_vpn_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| \[RM\] VPN Link Connection | `azure_vpn_link_connection` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| \[RM\] Web App | `azure_web_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[RM\] Workspaces | `azure_synapse_workspace` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Access Package Assignment Approvers | `azure_access_packages_approver` | [Review](https://docs.jupiterone.io/data-model/schemas/Review) |
| Access Package Assignment Policies | `azure_access_packages_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Access Package Assignment Requests | `azure_access_packages_request` | [Requirement](https://docs.jupiterone.io/data-model/schemas/Requirement) |
| Access Package Assignments | `azure_access_packages_service_assignment` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Access Package Catalogs | `azure_access_packages_catalog` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Access Packages | `azure_access_packages_services` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Application Credentials | `azure_application_credential` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Applications | `azure_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Azure Application Gateway | `azure_application_gateway` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Azure Application Security Groups | `azure_application_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Azure Synapse Analytics | `azure_synapse` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Container Registry Repository | `azure_container_registry_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Device | `azure_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Finding | `azure_defender_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| FrontDoor | `azure_frontdoor` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| FrontDoor Backend Pool | `azure_frontdoor_backend_pool` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| FrontDoor Frontend Endpoint | `azure_frontdoor_frontend_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| FrontDoor Routing Rule | `azure_frontdoor_routing_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| FrontDoor Rules Engine | `azure_frontdoor_rules_engine` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| OAuth2 Permission Grant | `azure_oauth2_permission_grant` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Security Assessment Finding | `azure_security_assessment_finding` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Service Principal Key Credential | `azure_service_principal_key_credential` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `ANY_RESOURCE` | **GENERATED** | `azure_shared_image_version` |
| `ANY_RESOURCE` | **HAS** | `azure_security_assessment` |
| `ANY_RESOURCE` | **HAS** | `azure_defender_alert` |
| `ANY_RESOURCE` | **HAS** | `azure_policy_state` |
| `ANY_SCOPE` | **HAS** | `azure_diagnostic_setting` |
| `ANY_SCOPE` | **HAS** | `azure_resource_lock` |
| `ANY_SCOPE` | **HAS** | `azure_advisor_recommendation` |
| `ANY_SCOPE` | **HAS** | `azure_policy_assignment` |
| `azure_access_packages_approver` | **IS** | `azure_user` |
| `azure_access_packages_catalog` | **ASSIGNED** | `azure_application` |
| `azure_access_packages_service_assignment` | **CONTAINS** | `azure_access_packages_policy` |
| `azure_access_packages_services` | **HAS** | `azure_application` |
| `azure_access_packages_services` | **HAS** | `azure_access_packages_service_assignment` |
| `azure_account` | **HAS** | `azure_domain` |
| `azure_account` | **HAS** | `azure_user` |
| `azure_account` | **HAS** | `azure_group` |
| `azure_account` | **HAS** | `azure_oauth2_permission_grant` |
| `azure_account` | **ENFORCES** | `azure_authorization_policy` |
| `azure_account` | **ENFORCES** | `azure_authentication_methods_policy` |
| `azure_account` | **HAS** | `azure_group_unified_setting_template` |
| `azure_account` | **HAS** | `azure_group_unified_guest_setting_template` |
| `azure_account` | **HAS** | `azure_group_unified_setting` |
| `azure_account` | **ENFORCES** | `azure_authentication_strength_policy` |
| `azure_account` | **ENFORCES** | `azure_device_registration_policy` |
| `azure_account` | **HAS** | `azure_access_review` |
| `azure_account` | **HAS** | `azure_keyvault_service` |
| `azure_account` | **HAS** | `azure_subscription_policy` |
| `azure_account` | **HAS** | `azure_management_group` |
| `azure_api_management_product` | **HAS** | `azure_api_management_subscription` |
| `azure_api_management_service` | **HAS** | `azure_api_management_api` |
| `azure_api_management_service` | **HAS** | `azure_api_management_named_value` |
| `azure_api_management_service` | **HAS** | `azure_api_management_product` |
| `azure_api_management_service` | **HAS** | `azure_api_management_subscription` |
| `azure_api_management_service` | **HAS** | `azure_api_management_portal_config` |
| `azure_api_management_service` | **HAS** | `azure_api_management_tenant_access` |
| `azure_api_management_service` | **HAS** | `azure_api_management_backend` |
| `azure_app_configuration_store` | **USES** | `azure_private_endpoint` |
| `azure_app_configuration_store` | **USES** | `azure_managed_identity` |
| `azure_app_configuration_store` | **ASSIGNED** | `azure_managed_identity` |
| `azure_application` | **HAS** | `azure_application_credential` |
| `azure_application_gateway` | **HAS** | `azure_public_ip` |
| `azure_application_insights` | **USES** | `azure_private_endpoint` |
| `azure_application_insights` | **USES** | `azure_log_analytics_workspace` |
| `azure_application_security_group` | **PROTECTS** | `azure_vm` |
| `azure_arc_machine` | **USES** | `azure_arc_machine_extension` |
| `azure_arc_machine` | **HAS** | `azure_scvmm_virtual_machine` |
| `azure_arc_machine` | **HAS** | `azure_arc_sql_server_instance` |
| `azure_arc_sql_server_instance` | **HAS** | `azure_arc_sql_server_database` |
| `azure_authorization_policy` | **USES** | `azure_ad_role_definition` |
| `azure_automation_account` | **HAS** | `azure_private_endpoint` |
| `azure_automation_account` | **USES** | `azure_managed_identity` |
| `azure_automation_account` | **ASSIGNED** | `azure_managed_identity` |
| `azure_backup_protected_item` | **PROTECTS** | `azure_vm` |
| `azure_backup_protected_item` | **PROTECTS** | `azure_storage_file_share` |
| `azure_backup_protected_item` | **PROTECTS** | `azure_storage_account` |
| `azure_backup_protected_item` | **PROTECTS** | `azure_sql_database` |
| `azure_bastion_host` | **USES** | `azure_subnet` |
| `azure_bastion_host` | **USES** | `azure_public_ip` |
| `azure_batch_account` | **HAS** | `azure_batch_pool` |
| `azure_batch_account` | **HAS** | `azure_batch_application` |
| `azure_batch_account` | **HAS** | `azure_batch_certificate` |
| `azure_bgp_service_communities` | **HAS** | `azure_expressroute` |
| `azure_bot_service_bot` | **HAS** | `azure_bot_service_channel` |
| `azure_bot_service_bot` | **USES** | `azure_storage_account` |
| `azure_bot_service_bot` | **HAS** | `azure_private_endpoint` |
| `azure_bot_service_bot` | **USES** | `azure_managed_identity` |
| `azure_bot_service_bot` | **ASSIGNED** | `azure_managed_identity` |
| `azure_cdn_profile` | **HAS** | `azure_cdn_endpoint` |
| `azure_chaos_studio_experiment` | **HAS** | `azure_chaos_studio_target` |
| `azure_chaos_studio_experiment` | **USES** | `azure_managed_identity` |
| `azure_chaos_studio_experiment` | **ASSIGNED** | `azure_managed_identity` |
| `azure_chaos_studio_target` | **HAS** | `azure_chaos_studio_capability` |
| `azure_classic_admin_group` | **HAS** | `azure_user` |
| `azure_cognitive_services_account` | **USES** | `azure_managed_identity` |
| `azure_cognitive_services_account` | **ASSIGNED** | `azure_managed_identity` |
| `azure_conditional_access_policy` | **CONTAINS** | `azure_conditional_access_named_location` |
| `azure_conditional_access_policy` | **ASSIGNED** | `azure_user` |
| `azure_conditional_access_policy` | **ASSIGNED** | `azure_group` |
| `azure_conditional_access_service` | **HAS** | `azure_conditional_access_policy` |
| `azure_conditional_access_service` | **HAS** | `azure_conditional_access_authorization_context` |
| `azure_conditional_access_service` | **HAS** | `azure_conditional_access_template` |
| `azure_container` | **USES** | `azure_container_volume` |
| `azure_container_group` | **HAS** | `azure_container` |
| `azure_container_group` | **HAS** | `azure_container_volume` |
| `azure_container_group` | **USES** | `azure_managed_identity` |
| `azure_container_group` | **ASSIGNED** | `azure_managed_identity` |
| `azure_container_registry` | **HAS** | `azure_container_registry_webhook` |
| `azure_container_registry` | **HAS** | `azure_container_registry_repository` |
| `azure_container_registry` | **USES** | `azure_managed_identity` |
| `azure_container_registry` | **ASSIGNED** | `azure_managed_identity` |
| `azure_container_volume` | **USES** | `azure_storage_file_share` |
| `azure_content_safety_account` | **HAS** | `azure_private_endpoint` |
| `azure_cosmosdb_account` | **HAS** | `azure_cosmosdb_sql_database` |
| `azure_data_factory` | **HAS** | `azure_data_factory_integration_runtime` |
| `azure_data_factory` | **HAS** | `azure_data_factory_managed_virtual_network` |
| `azure_data_factory` | **HAS** | `azure_data_factory_linked_service` |
| `azure_data_factory` | **USES** | `azure_private_endpoint` |
| `azure_data_factory` | **USES** | `azure_managed_identity` |
| `azure_data_factory` | **ASSIGNED** | `azure_managed_identity` |
| `azure_data_factory_integration_runtime` | **USES** | `azure_data_factory_managed_virtual_network` |
| `azure_data_factory_linked_service` | **USES** | `azure_data_factory_integration_runtime` |
| `azure_data_factory_managed_virtual_network` | **HAS** | `azure_data_factory_managed_private_endpoint` |
| `azure_data_protection_backup_vault` | **USES** | `azure_managed_identity` |
| `azure_data_protection_backup_vault` | **ASSIGNED** | `azure_managed_identity` |
| `azure_data_share_account` | **USES** | `azure_managed_identity` |
| `azure_data_share_account` | **ASSIGNED** | `azure_managed_identity` |
| `azure_databricks_workspace` | **HAS** | `azure_private_endpoint` |
| `azure_databricks_workspace` | **USES** | `azure_vnet` |
| `azure_databricks_workspace` | **USES** | `azure_machine_learning_workspace` |
| `azure_databricks_workspace` | **USES** | `azure_lb` |
| `azure_databricks_workspace` | **USES** | `azure_managed_identity` |
| `azure_databricks_workspace` | **ASSIGNED** | `azure_managed_identity` |
| `azure_datamigration_service` | **HAS** | `azure_datamigration_project` |
| `azure_datamigration_service` | **HAS** | `azure_datamigration_task` |
| `azure_ddos_protection_plan` | **ASSIGNED** | `azure_public_ip` |
| `azure_ddos_protection_plan` | **ASSIGNED** | `azure_vnet` |
| `azure_desktop_virtualization_application_group` | **HAS** | `azure_desktop_virtualization_desktop` |
| `azure_desktop_virtualization_host_pool` | **HAS** | `azure_desktop_virtualization_application_group` |
| `azure_desktop_virtualization_host_pool` | **HAS** | `azure_private_endpoint` |
| `azure_desktop_virtualization_workspace` | **HAS** | `azure_desktop_virtualization_application_group` |
| `azure_desktop_virtualization_workspace` | **HAS** | `azure_private_endpoint` |
| `azure_device_registration_policy` | **ALLOWS** | `azure_user` |
| `azure_device_registration_policy` | **ALLOWS** | `azure_group` |
| `azure_diagnostic_setting` | **USES** | `azure_storage_account` |
| `azure_diagnostic_setting` | **USES** | `azure_log_analytics_workspace` |
| `azure_dns_zone` | **HAS** | `azure_dns_record_set` |
| `azure_document_intelligence_account` | **HAS** | `azure_private_endpoint` |
| `azure_document_intelligence_account` | **USES** | `azure_managed_identity` |
| `azure_document_intelligence_account` | **ASSIGNED** | `azure_managed_identity` |
| `azure_event_grid_domain` | **HAS** | `azure_event_grid_domain_topic` |
| `azure_event_grid_domain_topic` | **HAS** | `azure_event_grid_topic_subscription` |
| `azure_event_grid_topic` | **HAS** | `azure_event_grid_topic_subscription` |
| `azure_event_hub` | **HAS** | `azure_location` |
| `azure_event_hub_cluster` | **ASSIGNED** | `azure_event_hub_namespace` |
| `azure_event_hub_consumer_group` | **HAS** | `azure_event_hub` |
| `azure_event_hub_key` | **USES** | `azure_keyvault_service` |
| `azure_event_hub_namespace` | **HAS** | `azure_event_hub` |
| `azure_event_hub_namespace` | **HAS** | `azure_event_hub_key` |
| `azure_event_hub_namespace` | **USES** | `azure_managed_identity` |
| `azure_event_hub_namespace` | **ASSIGNED** | `azure_managed_identity` |
| `azure_expressroute` | **HAS** | `azure_expressroute` |
| `azure_expressroute` | **HAS** | `azure_peer_expressroute_circut_connection` |
| `azure_expressroute` | **HAS** | `azure_application_gateway` |
| `azure_expressroute` | **HAS** | `azure_expressroute_circuit_connection` |
| `azure_expressroute_circuit` | **HAS** | `azure_peer_expressroute_circut_connection` |
| `azure_expressroute_circuit` | **HAS** | `azure_expressroute_circuit_connection` |
| `azure_fabric_capacity` | **HAS** | `azure_fabric_tenant_setting_override` |
| `azure_fabric_capacity` | **HAS** | `azure_fabric_workspace` |
| `azure_fabric_domain` | **HAS** | `azure_fabric_tenant_setting_override` |
| `azure_fabric_report` | **USES** | `azure_fabric_semantic_model` |
| `azure_fabric_semantic_model` | **USES** | `azure_fabric_datasource` |
| `azure_fabric_tenant_setting_override` | **OVERRIDES** | `azure_fabric_tenant_setting` |
| `azure_fabric_workspace` | **HAS** | `azure_fabric_tenant_setting_override` |
| `azure_fabric_workspace` | **HAS** | `azure_fabric_report` |
| `azure_fabric_workspace` | **HAS** | `azure_fabric_semantic_model` |
| `azure_fabric_workspace` | **HAS** | `azure_fabric_dashboard` |
| `azure_fabric_workspace` | **HAS** | `azure_fabric_dataflow` |
| `azure_fabric_workspace` | **HAS** | `azure_fabric_datamart` |
| `azure_frontdoor` | **HAS** | `azure_frontdoor_rules_engine` |
| `azure_frontdoor` | **HAS** | `azure_frontdoor_routing_rule` |
| `azure_frontdoor` | **HAS** | `azure_frontdoor_backend_pool` |
| `azure_frontdoor` | **HAS** | `azure_frontdoor_frontend_endpoint` |
| `azure_frontdoor_afd_endpoint` | **HAS** | `azure_frontdoor_route` |
| `azure_frontdoor_origin_group` | **HAS** | `azure_frontdoor_origin` |
| `azure_frontdoor_profile` | **HAS** | `azure_frontdoor_afd_endpoint` |
| `azure_frontdoor_profile` | **HAS** | `azure_frontdoor_origin_group` |
| `azure_frontdoor_profile` | **HAS** | `azure_frontdoor_custom_domain` |
| `azure_function_app` | **USES** | `azure_app_service_plan` |
| `azure_function_app` | **HAS** | `azure_function` |
| `azure_function_app` | **USES** | `azure_managed_identity` |
| `azure_function_app` | **ASSIGNED** | `azure_managed_identity` |
| `azure_gallery` | **CONTAINS** | `azure_shared_image` |
| `azure_group` | **HAS** | `azure_user` |
| `azure_group` | **HAS** | `azure_group` |
| `azure_group` | **HAS** | `azure_group_member` |
| `azure_group` | **HAS** | `azure_device` |
| `azure_group` | **HAS** | `azure_ad_role_definition` |
| `azure_group` | **APPROVED** | `azure_access_packages_policy` |
| `azure_group` | **ASSIGNED** | `azure_access_packages_services` |
| `azure_group_unified_guest_setting` | **MANAGES** | `azure_group` |
| `azure_group_unified_setting` | **MANAGES** | `azure_group` |
| `azure_image` | **GENERATED** | `azure_shared_image_version` |
| `azure_iot_hub` | **HAS** | `azure_iot_security_solution` |
| `azure_keyvault_service` | **ALLOWS** | `ANY_PRINCIPAL` |
| `azure_keyvault_service` | **CONTAINS** | `azure_keyvault_key` |
| `azure_keyvault_service` | **CONTAINS** | `azure_keyvault_secret` |
| `azure_keyvault_service` | **USES** | `azure_private_endpoint` |
| `azure_keyvault_service` | **HAS** | `azure_synapse_key` |
| `azure_kube_cluster_role_binding` | **IS** | `kube_cluster_role_binding` |
| `azure_kube_service` | **CONTAINS** | `azure_kube_trusted_access_role` |
| `azure_kubernetes_cluster` | **HAS** | `azure_kube_maintenance_configuration` |
| `azure_kubernetes_cluster` | **CONTAINS** | `azure_kube_cluster_role_binding` |
| `azure_kubernetes_cluster` | **USES** | `azure_managed_identity` |
| `azure_kubernetes_cluster` | **ASSIGNED** | `azure_managed_identity` |
| `azure_kubernetes_fleet_manager` | **HAS** | `azure_kubernetes_fleet_member` |
| `azure_kubernetes_fleet_manager` | **USES** | `azure_managed_identity` |
| `azure_kubernetes_fleet_manager` | **ASSIGNED** | `azure_managed_identity` |
| `azure_kubernetes_fleet_member` | **USES** | `azure_kubernetes_cluster` |
| `azure_language_account` | **HAS** | `azure_private_endpoint` |
| `azure_lb` | **CONNECTS** | `azure_nic` |
| `azure_lb` | **HAS** | `azure_public_ip` |
| `azure_log_analytics_service` | **HAS** | `azure_log_analytics_workspace` |
| `azure_log_analytics_workspace` | **USES** | `azure_private_endpoint` |
| `azure_machine_learning_workspace` | **USES** | `azure_storage_account` |
| `azure_machine_learning_workspace` | **USES** | `azure_keyvault_service` |
| `azure_machine_learning_workspace` | **USES** | `azure_container_registry` |
| `azure_machine_learning_workspace` | **HAS** | `azure_private_endpoint` |
| `azure_machine_learning_workspace` | **HAS** | `azure_machine_learning_compute` |
| `azure_machine_learning_workspace` | **HAS** | `azure_machine_learning_online_endpoint` |
| `azure_machine_learning_workspace` | **USES** | `azure_managed_identity` |
| `azure_machine_learning_workspace` | **ASSIGNED** | `azure_managed_identity` |
| `azure_managed_hsm` | **MANAGES** | `ANY_PRINCIPAL` |
| `azure_managed_hsm` | **USES** | `azure_private_endpoint` |
| `azure_managed_services_registration_assignment` | **USES** | `azure_managed_services_registration_definition` |
| `azure_management_group` | **CONTAINS** | `azure_management_group` |
| `azure_mariadb_server` | **HAS** | `azure_mariadb_database` |
| `azure_monitor_activity_log_alert` | **MONITORS** | `ANY_SCOPE` |
| `azure_monitor_log_profile` | **USES** | `azure_storage_account` |
| `azure_mysql_flexible_server` | **HAS** | `azure_mysql_flexible_database` |
| `azure_mysql_flexible_server` | **HAS** | `azure_mysql_server_firewall_rule` |
| `azure_mysql_server` | **HAS** | `azure_mysql_database` |
| `azure_mysql_server` | **HAS** | `azure_mysql_server_firewall_rule` |
| `azure_nat_gateway` | **HAS** | `azure_public_ip` |
| `azure_netapp_account` | **HAS** | `azure_netapp_capacity_pool` |
| `azure_netapp_account` | **HAS** | `azure_netapp_backup` |
| `azure_netapp_account` | **USES** | `azure_keyvault_service` |
| `azure_netapp_backup` | **PROTECTS** | `azure_netapp_volume` |
| `azure_netapp_capacity_pool` | **HAS** | `azure_netapp_volume` |
| `azure_netapp_volume` | **HAS** | `azure_netapp_snapshot` |
| `azure_netapp_volume` | **HAS** | `azure_netapp_bucket` |
| `azure_netapp_volume` | **USES** | `azure_keyvault_service` |
| `azure_netapp_volume` | **CONNECTS** | `azure_private_endpoint` |
| `azure_network_firewall` | **HAS** | `azure_network_firewall_policy` |
| `azure_network_firewall` | **HAS** | `azure_public_ip` |
| `azure_network_firewall_policy` | **EXTENDS** | `azure_network_firewall_policy` |
| `azure_network_watcher` | **HAS** | `azure_security_group_flow_logs` |
| `azure_openai_account` | **HAS** | `azure_private_endpoint` |
| `azure_oracle_exadata_infrastructure` | **HAS** | `azure_oracle_db_server` |
| `azure_oracle_exadb_vm_cluster` | **HAS** | `azure_oracle_db_node` |
| `azure_oracle_exadb_vm_cluster` | **USES** | `azure_vnet` |
| `azure_oracle_exadb_vm_cluster` | **USES** | `azure_subnet` |
| `azure_policy_assignment` | **USES** | `azure_policy_set_definition` |
| `azure_policy_assignment` | **USES** | `azure_policy_definition` |
| `azure_policy_assignment` | **HAS** | `azure_policy_state` |
| `azure_policy_definition` | **DEFINES** | `azure_policy_state` |
| `azure_policy_set_definition` | **CONTAINS** | `azure_policy_definition` |
| `azure_postgresql_flexible_server` | **HAS** | `azure_postgresql_flexible_database` |
| `azure_postgresql_flexible_server` | **HAS** | `azure_postgresql_server_firewall_rule` |
| `azure_postgresql_flexible_server` | **HAS** | `azure_postgresql_flexible_server_entra_admin` |
| `azure_postgresql_flexible_server` | **HAS** | `azure_postgresql_flexible_server_configuration` |
| `azure_postgresql_flexible_server` | **HAS** | `azure_postgresql_flexible_server` |
| `azure_postgresql_flexible_server` | **HAS** | `azure_private_endpoint` |
| `azure_postgresql_flexible_server` | **USES** | `azure_subnet` |
| `azure_postgresql_flexible_server` | **USES** | `azure_keyvault_key` |
| `azure_postgresql_server` | **HAS** | `azure_postgresql_database` |
| `azure_postgresql_server` | **HAS** | `azure_postgresql_server_firewall_rule` |
| `azure_powerbi_private_link_service` | **USES** | `azure_private_endpoint` |
| `azure_private_dns_zone` | **HAS** | `azure_private_dns_record_set` |
| `azure_private_dns_zone` | **HAS** | `azure_private_dns_zone_virtual_network_link` |
| `azure_private_dns_zone_virtual_network_link` | **USES** | `azure_vnet` |
| `azure_private_endpoint` | **USES** | `azure_nic` |
| `azure_private_endpoint` | **CONNECTS** | `ANY_RESOURCE` |
| `azure_recovery_services_vault` | **HAS** | `azure_private_endpoint` |
| `azure_recovery_services_vault` | **HAS** | `azure_backup_protected_item` |
| `azure_recovery_services_vault` | **USES** | `azure_managed_identity` |
| `azure_recovery_services_vault` | **ASSIGNED** | `azure_managed_identity` |
| `azure_redis_cache` | **HAS** | `azure_firewall_rule` |
| `azure_redis_cache` | **CONNECTS** | `azure_redis_cache` |
| `azure_redis_enterprise_cluster` | **HAS** | `azure_redis_enterprise_database` |
| `azure_redis_enterprise_cluster` | **USES** | `azure_private_endpoint` |
| `azure_resource_group` | **HAS** | `azure_gallery` |
| `azure_resource_group` | **HAS** | `azure_image` |
| `azure_resource_group` | **HAS** | `azure_managed_disk` |
| `azure_resource_group` | **HAS** | `azure_vm` |
| `azure_resource_group` | **HAS** | `azure_vm_scale_set` |
| `azure_resource_group` | **HAS** | `azure_cosmosdb_account` |
| `azure_resource_group` | **HAS** | `azure_data_factory` |
| `azure_resource_group` | **HAS** | `azure_netapp_account` |
| `azure_resource_group` | **HAS** | `azure_data_protection_backup_vault` |
| `azure_resource_group` | **HAS** | `azure_datamigration_service` |
| `azure_resource_group` | **HAS** | `azure_data_share_account` |
| `azure_resource_group` | **HAS** | `azure_mariadb_server` |
| `azure_resource_group` | **HAS** | `azure_mysql_server` |
| `azure_resource_group` | **HAS** | `azure_mysql_flexible_server` |
| `azure_resource_group` | **HAS** | `azure_postgresql_server` |
| `azure_resource_group` | **HAS** | `azure_postgresql_flexible_server` |
| `azure_resource_group` | **HAS** | `azure_sql_server` |
| `azure_resource_group` | **HAS** | `azure_sql_managed_instance` |
| `azure_resource_group` | **HAS** | `azure_databricks_workspace` |
| `azure_resource_group` | **HAS** | `azure_keyvault_service` |
| `azure_resource_group` | **HAS** | `azure_managed_hsm` |
| `azure_resource_group` | **HAS** | `azure_machine_learning_workspace` |
| `azure_resource_group` | **HAS** | `azure_desktop_virtualization_workspace` |
| `azure_resource_group` | **HAS** | `azure_desktop_virtualization_host_pool` |
| `azure_resource_group` | **HAS** | `azure_desktop_virtualization_application_group` |
| `azure_resource_group` | **HAS** | `azure_document_intelligence_account` |
| `azure_resource_group` | **HAS** | `azure_search_service` |
| `azure_resource_group` | **HAS** | `azure_cognitive_services_account` |
| `azure_resource_group` | **HAS** | `azure_openai_account` |
| `azure_resource_group` | **HAS** | `azure_content_safety_account` |
| `azure_resource_group` | **HAS** | `azure_language_account` |
| `azure_resource_group` | **HAS** | `azure_speech_account` |
| `azure_resource_group` | **HAS** | `azure_public_ip` |
| `azure_resource_group` | **HAS** | `azure_nic` |
| `azure_resource_group` | **HAS** | `azure_vnet` |
| `azure_resource_group` | **HAS** | `azure_security_group` |
| `azure_resource_group` | **HAS** | `azure_lb` |
| `azure_resource_group` | **HAS** | `azure_network_firewall` |
| `azure_resource_group` | **HAS** | `azure_network_watcher` |
| `azure_resource_group` | **HAS** | `azure_private_endpoint` |
| `azure_resource_group` | **HAS** | `azure_nat_gateway` |
| `azure_resource_group` | **HAS** | `azure_bastion_host` |
| `azure_resource_group` | **HAS** | `azure_route_table` |
| `azure_resource_group` | **HAS** | `azure_storage_account` |
| `azure_resource_group` | **HAS** | `azure_api_management_service` |
| `azure_resource_group` | **HAS** | `azure_arc_machine` |
| `azure_resource_group` | **HAS** | `azure_arc_sql_server_instance` |
| `azure_resource_group` | **HAS** | `azure_dns_zone` |
| `azure_resource_group` | **HAS** | `azure_private_dns_zone` |
| `azure_resource_group` | **HAS** | `azure_container_registry` |
| `azure_resource_group` | **HAS** | `azure_service_bus_namespace` |
| `azure_resource_group` | **HAS** | `azure_cdn_profile` |
| `azure_resource_group` | **HAS** | `azure_batch_account` |
| `azure_resource_group` | **HAS** | `azure_bot_service_bot` |
| `azure_resource_group` | **HAS** | `azure_recovery_services_vault` |
| `azure_resource_group` | **HAS** | `azure_redis_cache` |
| `azure_resource_group` | **HAS** | `azure_redis_enterprise_cluster` |
| `azure_resource_group` | **HAS** | `azure_container_group` |
| `azure_resource_group` | **HAS** | `azure_frontdoor` |
| `azure_resource_group` | **HAS** | `azure_frontdoor_profile` |
| `azure_resource_group` | **HAS** | `azure_traffic_manager_profile` |
| `azure_resource_group` | **HAS** | `azure_event_grid_domain` |
| `azure_resource_group` | **HAS** | `azure_event_grid_topic` |
| `azure_resource_group` | **HAS** | `azure_automation_account` |
| `azure_resource_group` | **HAS** | `azure_chaos_studio_experiment` |
| `azure_resource_group` | **HAS** | `azure_kubernetes_fleet_manager` |
| `azure_resource_group` | **HAS** | `azure_monitor_activity_log_alert` |
| `azure_resource_group` | **HAS** | `azure_web_app` |
| `azure_resource_group` | **HAS** | `azure_function_app` |
| `azure_resource_group` | **HAS** | `azure_app_service_plan` |
| `azure_resource_group` | **HAS** | `azure_kubernetes_cluster` |
| `azure_resource_group` | **HAS** | `azure_ddos_protection_plan` |
| `azure_resource_group` | **HAS** | `azure_event_hub_namespace` |
| `azure_resource_group` | **HAS** | `azure_event_hub` |
| `azure_resource_group` | **HAS** | `azure_app_configuration_store` |
| `azure_resource_group` | **HAS** | `azure_virtual_wan` |
| `azure_resource_group` | **HAS** | `azure_virtual_hub` |
| `azure_resource_group` | **HAS** | `azure_vpn_gateway` |
| `azure_resource_group` | **HAS** | `azure_log_analytics_workspace` |
| `azure_resource_group` | **HAS** | `azure_application_insights` |
| `azure_resource_group` | **HAS** | `azure_rm_deployment` |
| `azure_resource_group` | **HAS** | `azure_managed_identity` |
| `azure_resource_group` | **HAS** | `azure_oracle_exadata_infrastructure` |
| `azure_resource_group` | **HAS** | `azure_oracle_exadb_vm_cluster` |
| `azure_resource_group` | **HAS** | `azure_oracle_db_system` |
| `azure_resource_group` | **HAS** | `azure_sql_vm` |
| `azure_resource_group` | **HAS** | `azure_stream_analytics_cluster` |
| `azure_resource_group` | **HAS** | `azure_stream_analytics_job` |
| `azure_resource_group` | **HAS** | `azure_static_site` |
| `azure_resource_group` | **HAS** | `azure_sre_agent` |
| `azure_role_assignment` | **ALLOWS** | `ANY_SCOPE` |
| `azure_role_assignment` | **USES** | `azure_role_definition` |
| `azure_route_table` | **HAS** | `azure_route` |
| `azure_search_service` | **USES** | `azure_private_endpoint` |
| `azure_security_assessment` | **IDENTIFIED** | `azure_advisor_recommendation` |
| `azure_security_assessment` | **HAS** | `azure_security_assessment_finding` |
| `azure_security_assessment` | **SCANS** | `azure_container_registry` |
| `azure_security_group` | **PROTECTS** | `azure_vm_scale_set` |
| `azure_security_group` | **PROTECTS** | `azure_subnet` |
| `azure_security_group` | **PROTECTS** | `azure_nic` |
| `azure_security_group` | **HAS** | `azure_security_rule` |
| `azure_security_group` | **ALLOWS** | `azure_subnet` |
| `azure_security_group` | **DENIES** | `azure_subnet` |
| `azure_security_group` | **HAS** | `azure_security_group_flow_logs` |
| `azure_security_group_flow_logs` | **USES** | `azure_storage_account` |
| `azure_service_bus_namespace` | **HAS** | `azure_service_bus_queue` |
| `azure_service_bus_namespace` | **HAS** | `azure_service_bus_topic` |
| `azure_service_bus_topic` | **HAS** | `azure_service_bus_subscription` |
| `azure_service_principal` | **USES** | `azure_service_principal_key_credential` |
| `azure_service_principal` | **USES** | `azure_oauth2_permission_grant` |
| `azure_service_principal` | **HAS** | `azure_ad_role_definition` |
| `azure_service_principal` | **ASSIGNED** | `azure_group` |
| `azure_service_principal` | **ASSIGNED** | `azure_user` |
| `azure_service_principal` | **ASSIGNED** | `azure_service_principal` |
| `azure_service_principal` | **OWNS** | `azure_application` |
| `azure_shared_image` | **HAS** | `azure_shared_image_version` |
| `azure_speech_account` | **HAS** | `azure_private_endpoint` |
| `azure_sql_managed_instance` | **HAS** | `azure_sql_managed_instance_database` |
| `azure_sql_managed_instance` | **HAS** | `azure_sql_managed_instance_active_directory_admin` |
| `azure_sql_managed_instance` | **HAS** | `azure_private_endpoint` |
| `azure_sql_server` | **HAS** | `azure_sql_database` |
| `azure_sql_server` | **HAS** | `azure_sql_server_firewall_rule` |
| `azure_sql_server` | **HAS** | `azure_sql_server_active_directory_admin` |
| `azure_sql_vm` | **USES** | `azure_vm` |
| `azure_sre_agent` | **USES** | `azure_managed_identity` |
| `azure_sre_agent` | **ASSIGNED** | `azure_managed_identity` |
| `azure_sre_agent` | **USES** | `azure_application_insights` |
| `azure_sre_agent` | **USES** | `azure_subnet` |
| `azure_static_site` | **HAS** | `azure_static_site_build` |
| `azure_static_site` | **HAS** | `azure_static_site_custom_domain` |
| `azure_static_site` | **USES** | `azure_private_endpoint` |
| `azure_storage_account` | **USES** | `azure_keyvault_service` |
| `azure_storage_account` | **HAS** | `azure_storage_file_share` |
| `azure_storage_account` | **HAS** | `azure_storage_container` |
| `azure_storage_account` | **HAS** | `azure_storage_queue` |
| `azure_storage_account` | **HAS** | `azure_storage_table` |
| `azure_storage_account` | **HAS** | `azure_storage_blob_service` |
| `azure_storage_account` | **HAS** | `azure_storage_account_key` |
| `azure_storage_account` | **USES** | `azure_managed_identity` |
| `azure_storage_account` | **ASSIGNED** | `azure_managed_identity` |
| `azure_stream_analytics_cluster` | **HAS** | `azure_stream_analytics_job` |
| `azure_stream_analytics_cluster` | **HAS** | `azure_stream_analytics_private_endpoint` |
| `azure_subnet` | **ALLOWS** | `azure_security_group` |
| `azure_subnet` | **DENIES** | `azure_security_group` |
| `azure_subnet` | **HAS** | `azure_private_endpoint` |
| `azure_subnet` | **HAS** | `azure_security_group_flow_logs` |
| `azure_subnet` | **USES** | `azure_route_table` |
| `azure_subnet` | **HAS** | `azure_vm` |
| `azure_subscription` | **CONTAINS** | `azure_role_definition` |
| `azure_subscription` | **HAS** | `azure_resource_group` |
| `azure_subscription` | **HAS** | `azure_usage_details` |
| `azure_subscription` | **PERFORMED** | `azure_security_assessment` |
| `azure_subscription` | **HAS** | `azure_security_center_contact` |
| `azure_subscription` | **HAS** | `azure_security_center_subscription_pricing` |
| `azure_subscription` | **HAS** | `azure_security_center_setting` |
| `azure_subscription` | **HAS** | `azure_security_center_auto_provisioning_setting` |
| `azure_subscription` | **HAS** | `azure_defender_alert` |
| `azure_subscription` | **HAS** | `azure_monitor_log_profile` |
| `azure_subscription` | **HAS** | `azure_activity_log_event` |
| `azure_subscription` | **HAS** | `azure_kube_service` |
| `azure_subscription` | **HAS** | `azure_synapse` |
| `azure_subscription` | **HAS** | `azure_ddos_protection_plan` |
| `azure_subscription` | **HAS** | `azure_event_hub` |
| `azure_subscription` | **HAS** | `azure_iot_hub` |
| `azure_subscription` | **HAS** | `azure_iot_security_solution` |
| `azure_subscription` | **HAS** | `azure_expressroute` |
| `azure_subscription` | **HAS** | `azure_bgp_service_communities` |
| `azure_subscription` | **HAS** | `azure_easm_workspace` |
| `azure_subscription` | **HAS** | `azure_rm_deployment` |
| `azure_subscription` | **HAS** | `azure_managed_services_registration_definition` |
| `azure_subscription` | **HAS** | `azure_managed_services_registration_assignment` |
| `azure_subscription` | **HAS** | `azure_fabric_capacity` |
| `azure_subscription` | **HAS** | `azure_powerbi_private_link_service` |
| `azure_synapse` | **HAS** | `azure_synapse_workspace` |
| `azure_synapse` | **HAS** | `azure_synapse_sql_pool` |
| `azure_synapse` | **HAS** | `azure_synapse_key` |
| `azure_synapse_sql_pool` | **HAS** | `azure_synapse_masking_rule` |
| `azure_synapse_sql_pool` | **ASSIGNED** | `azure_synapse_masking_policy` |
| `azure_synapse_workspace` | **HAS** | `azure_synapse_sql_pool` |
| `azure_synapse_workspace` | **HAS** | `azure_synapse_key` |
| `azure_traffic_manager_profile` | **HAS** | `azure_traffic_manager_endpoint` |
| `azure_user` | **OWNS** | `azure_device` |
| `azure_user` | **ASSIGNED** | `azure_oauth2_permission_grant` |
| `azure_user` | **HAS** | `azure_ad_role_definition` |
| `azure_user` | **APPROVED** | `azure_access_packages_policy` |
| `azure_user` | **OWNS** | `azure_application` |
| `azure_user` | **CREATED** | `azure_access_packages_request` |
| `azure_user` | **ASSIGNED** | `azure_access_packages_services` |
| `azure_virtual_hub` | **HAS** | `azure_vpn_gateway` |
| `azure_virtual_hub` | **USES** | `azure_network_firewall` |
| `azure_virtual_wan` | **HAS** | `azure_virtual_hub` |
| `azure_vm` | **GENERATED** | `azure_shared_image_version` |
| `azure_vm` | **USES** | `azure_storage_account` |
| `azure_vm` | **USES** | `azure_managed_disk` |
| `azure_vm` | **USES** | `azure_vm_extension` |
| `azure_vm` | **USES** | `azure_image` |
| `azure_vm` | **USES** | `azure_shared_image` |
| `azure_vm` | **USES** | `azure_shared_image_version` |
| `azure_vm` | **USES** | `azure_vm_scale_set` |
| `azure_vm` | **USES** | `azure_nic` |
| `azure_vm` | **USES** | `azure_public_ip` |
| `azure_vm_scale_set` | **USES** | `azure_lb` |
| `azure_vm_scale_set` | **USES** | `azure_subnet` |
| `azure_vm_scale_set` | **USES** | `azure_shared_image` |
| `azure_vm_scale_set` | **USES** | `azure_shared_image_version` |
| `azure_vm_scale_set` | **USES** | `azure_managed_identity` |
| `azure_vm_scale_set` | **ASSIGNED** | `azure_managed_identity` |
| `azure_vnet` | **CONTAINS** | `azure_subnet` |
| `azure_vnet` | **HAS** | `azure_security_group_flow_logs` |
| `azure_vpn_connection` | **HAS** | `azure_vpn_link_connection` |
| `azure_vpn_gateway` | **HAS** | `azure_vpn_connection` |
| `azure_web_app` | **USES** | `azure_app_service_plan` |
| `azure_web_app` | **USES** | `azure_managed_identity` |
| `azure_web_app` | **ASSIGNED** | `azure_managed_identity` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `azure_backup_protected_item` | **PROTECTS** | `azure_vm` | FORWARD |
| `azure_backup_protected_item` | **PROTECTS** | `azure_storage_account` | FORWARD |
| `azure_backup_protected_item` | **PROTECTS** | `azure_sql_database` | FORWARD |
| `azure_data_factory_managed_private_endpoint` | **CONNECTS** | `azure_resource` | FORWARD |
| `azure_fabric_workspace` | **HAS** | `azure_user` | FORWARD |
| `azure_fabric_workspace` | **HAS** | `azure_service_principal` | FORWARD |
| `azure_kube_trusted_access_role` | **IS** | `kube_cluster_role` | FORWARD |
| `azure_managed_identity` | **IS** | `azure_service_principal` | FORWARD |
| `azure_management_group` | **HAS** | `azure_subscription` | FORWARD |
| `azure_netapp_backup` | **PROTECTS** | `azure_resource` | FORWARD |
| `azure_netapp_volume` | **CONNECTS** | `azure_resource` | FORWARD |
| `azure_network_firewall` | **ALLOWS** | `internet` | FORWARD |
| `azure_network_firewall` | **ALLOWS** | `internet` | REVERSE |
| `azure_network_firewall` | **DENIES** | `internet` | FORWARD |
| `azure_network_firewall` | **DENIES** | `internet` | REVERSE |
| `azure_network_watcher` | **HAS** | `azure_location` | REVERSE |
| `azure_postgresql_flexible_server_entra_admin` | **IS** | `azure_user` | FORWARD |
| `azure_postgresql_flexible_server_entra_admin` | **IS** | `azure_group` | FORWARD |
| `azure_postgresql_flexible_server_entra_admin` | **IS** | `azure_service_principal` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_unknown_principal_type` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_application` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_directory` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_directory_role_template` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_everyone` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_foreign_group` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_group` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_msi` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_service_principal` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_unknown` | FORWARD |
| `azure_role_assignment` | **ASSIGNED** | `azure_user` | FORWARD |
| `azure_subscription` | **USES** | `azure_location` | FORWARD |
| `azure_vm` | **USES** | `azure_image` | FORWARD |
| `azure_vm` | **ASSIGNED** | `azure_service_principal` | FORWARD |

### Azure Access Review

`azure_access_review` inherits from [Review](/data-model/schemas/Review.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `autoApplyDecisions` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `defaultDecision` | `string` |  |  |
| `defaultDecisionEnabled` | `boolean` |  |  |
| `descriptionForAdmins` | `string` |  |  |
| `descriptionForReviewers` | `string` |  |  |
| `durationInDays` | `number` |  |  |
| `id` | `string` |  |  |
| `justificationRequired` | `boolean` |  |  |
| `mailNotificationsEnabled` | `boolean` |  |  |
| `recommendationsEnabled` | `boolean` |  |  |
| `recurrenceDayOfMonth` | `number` |  |  |
| `recurrenceDaysOfWeek` | `array` of `string`s |  |  |
| `recurrenceEndDate` | `string` |  |  |
| `recurrenceFirstDayOfWeek` | `string` |  |  |
| `recurrenceIndex` | `string` |  |  |
| `recurrenceInterval` | `number` |  |  |
| `recurrenceMonth` | `number` |  |  |
| `recurrenceOccurrences` | `number` |  |  |
| `recurrenceRangeType` | `string` |  |  |
| `recurrenceStartDate` | `string` |  |  |
| `recurrenceTimeZone` | `string` |  |  |
| `recurrenceType` | `string` |  |  |
| `reminderNotificationsEnabled` | `boolean` |  |  |
| `updatedOn` | `number` |  |  |

---

### Azure Activity Log Event

`azure_activity_log_event` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authorizationAction` \*

 | `string` **|** `null` |  |  |
| 

`authorizationRole` \*

 | `string` **|** `null` |  |  |
| 

`authorizationScope` \*

 | `string` **|** `null` |  |  |
| 

`caller` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `string` **|** `null` |  |  |
| 

`clientIpAddress` \*

 | `string` **|** `null` |  |  |
| 

`correlationId` \*

 | `string` **|** `null` |  |  |
| 

`eventDataId` \*

 | `string` **|** `null` |  |  |
| 

`eventTimestamp` \*

 | `number` **|** `null` |  |  |
| 

`httpMethod` \*

 | `string` **|** `null` |  |  |
| 

`level` \*

 | `string` **|** `null` |  |  |
| 

`numericSeverity` \*

 | `number` |  |  |
| 

`open` \*

 | `boolean` |  |  |
| 

`operationId` \*

 | `string` **|** `null` |  |  |
| 

`operationName` \*

 | `string` **|** `null` |  |  |
| 

`operationStatus` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroupName` \*

 | `string` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` **|** `null` |  |  |
| 

`resourceProviderName` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`severity` \*

 | `string` **|** `null` |  |  |
| 

`submissionTimestamp` \*

 | `number` **|** `null` |  |  |
| 

`subscriptionId` \*

 | `string` **|** `null` |  |  |
| 

`subStatus` \*

 | `string` **|** `null` |  |  |

---

### Azure Api Management Backend

`azure_api_management_backend` inherits from [NetworkEndpoint](/data-model/schemas/NetworkEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`address` \*

 | `string` | The backend upstream URL (runtime URL). |  |
| 

`hasAuthorizationHeader` \*

 | `boolean` **|** `null` | Whether an authorization header is configured for backend credentials. |  |
| 

`hasClientCertificate` \*

 | `boolean` **|** `null` | Whether the backend is configured with a client certificate. |  |
| 

`hasServiceFabricCluster` \*

 | `boolean` **|** `null` | Whether this backend connects to a Service Fabric cluster. |  |
| 

`isTlsCertificateChainValidationEnabled` \*

 | `boolean` **|** `null` | Whether SSL certificate chain validation is performed for self-signed certificates. |  |
| 

`isTlsCertificateNameValidationEnabled` \*

 | `boolean` **|** `null` | Whether SSL certificate name validation is performed for self-signed certificates. |  |
| 

`protocol` \*

 | `string` | Communication protocol ('http' or 'soap'). |  |
| 

`proxyUrl` \*

 | `string` **|** `null` | WebProxy URL used for requests to this backend. |  |
| 

`resourceId` \*

 | `string` **|** `null` | ARM resource ID of the external resource (e.g. Logic App, Function App). |  |
| 

`title` \*

 | `string` **|** `null` | Backend title. |  |

---

### Azure Api Management Named Value

`azure_api_management_named_value` inherits from [Secret](/data-model/schemas/Secret.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isKeyVaultBacked` \*

 | `boolean` | Whether the named value resolves its value from an Azure Key Vault secret rather than storing it inline. Azure forces secret=true on Key Vault-backed named values, so isSecret=true with isKeyVaultBacked=false identifies a secret stored inline in API Management. |  |
| 

`isSecret` \*

 | `boolean` | Whether the named value is encrypted/secret. If true, the value is never returned by the API. |  |
| `keyVaultIdentityClientId` | `string` **|** `null` | Client ID of the user-assigned managed identity used to fetch the Key Vault secret. Null when the system-assigned identity is used. |  |
| `keyVaultLastStatusCheckedOn` | `number` **|** `null` | Timestamp (ms since epoch) of the most recent attempt to refresh the secret from Key Vault. |  |
| `keyVaultLastStatusCode` | `string` **|** `null` | Status code of the most recent Key Vault secret refresh ('Success' when the secret was retrieved). A non-success code means the gateway is serving a stale value. |  |
| `keyVaultLastStatusMessage` | `string` **|** `null` | Details of the most recent Key Vault secret refresh failure, when one occurred. |  |
| `keyVaultSecretIdentifier` | `string` **|** `null` | Data-plane URI of the backing Key Vault secret (https://<vault>.vault.azure.net/secrets/<name>\[/<version>\]). A URI without a version is refreshed automatically; a versioned URI is pinned. |  |

---

### Azure Api Management Portal Config

`azure_api_management_portal_config` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`corsAllowedOrigins` \*

 | `array` **|** `null` | Allowed origins for CORS on the developer portal. |  |
| 

`cspAllowedSources` \*

 | `array` **|** `null` | Allowed sources for the Content Security Policy. |  |
| 

`cspMode` \*

 | `string` **|** `null` | Content Security Policy mode ('enabled', 'disabled', or 'reportOnly'). |  |
| 

`delegationUrl` \*

 | `string` **|** `null` | URL of the external delegation service. |  |
| 

`isBasicAuthEnabled` \*

 | `boolean` **|** `null` | Whether basic authentication is enabled on the portal. |  |
| 

`isDelegateRegistrationEnabled` \*

 | `boolean` **|** `null` | Whether user registration is delegated to an external service. |  |
| 

`isDelegateSubscriptionEnabled` \*

 | `boolean` **|** `null` | Whether product subscription management is delegated to an external service. |  |
| 

`isSigninRequired` \*

 | `boolean` **|** `null` | Whether anonymous users are redirected to the sign-in page. |  |
| 

`isSignupTermsConsentRequired` \*

 | `boolean` **|** `null` | Whether user consent to terms of service is required during sign-up. |  |
| 

`isSignupTermsOfServiceEnabled` \*

 | `boolean` **|** `null` | Whether terms of service are displayed during sign-up. |  |

---

### Azure Api Management Product

`azure_api_management_product` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isApprovalRequired` \*

 | `boolean` **|** `null` | Whether administrator approval is required before a subscription is active. |  |
| 

`isSubscriptionRequired` \*

 | `boolean` **|** `null` | Whether a product subscription is required to access the APIs. If false, the product is "open". |  |
| 

`state` \*

 | `string` **|** `null` | Publication state of the product ('published' or 'notPublished'). |  |
| 

`subscriptionsLimit` \*

 | `number` **|** `null` | Maximum number of simultaneous subscriptions a user can have. Null means unlimited. |  |
| 

`terms` \*

 | `string` **|** `null` | Terms of use text that developers must accept before subscribing. |  |

---

### Azure Api Management Service

`azure_api_management_service` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `certificateExpiryDates` | `array` **|** `null` | Expiry timestamps (ms since epoch) of the service certificates. |  |
| 
`delegationUrl` \*

 | `string` **|** `null` | URL of the external delegation service, when configured. |  |
| `hasCertificates` | `boolean` **|** `null` | Whether the service has any custom CA/client certificates configured. |  |
| `hostnameConfigurationsKeyVaultIds` | `array` **|** `null` | Key Vault secret identifiers backing the custom hostname TLS certificates. |  |
| `identityType` | `string` **|** `null` | The managed identity type configured on the service (e.g. 'SystemAssigned', 'UserAssigned'). |  |
| `isClientCertificateEnabled` | `boolean` **|** `null` | Whether client certificate authentication is required at the gateway (Consumption tier). |  |
| 

`isDelegateRegistrationEnabled` \*

 | `boolean` **|** `null` | Whether user registration is delegated to an external service. |  |
| 

`isDelegateSubscriptionEnabled` \*

 | `boolean` **|** `null` | Whether product subscription management is delegated to an external service. |  |
| 

`isSignInEnabled` \*

 | `boolean` **|** `null` | Whether anonymous users must sign in to access the developer portal. |  |
| 

`isSignUpEnabled` \*

 | `boolean` **|** `null` | Whether self-service sign-up is enabled on the developer portal. |  |
| 

`isSignUpTermsConsentRequired` \*

 | `boolean` **|** `null` | Whether consent to the terms of service is required during sign-up. |  |
| 

`isSignUpTermsOfServiceEnabled` \*

 | `boolean` **|** `null` | Whether terms of service are displayed during developer portal sign-up. |  |
| `minApiVersion` | `string` **|** `null` | The minimum control-plane API version clients may use, when an apiVersionConstraint is configured. |  |
| `publicNetworkAccess` | `string` **|** `null` | Whether public network access is allowed for this API Management service. 'Enabled' when public traffic is accepted; 'Disabled' when the service is private-only. This is the authoritative source for the entity's `public` property. |  |
| `skuName` | `string` **|** `null` | The pricing tier (SKU) name of the service (e.g. 'Developer', 'Basic', 'Standard', 'Premium', 'Consumption'). |  |
| `virtualNetworkSubnetResourceId` | `string` **|** `null` | ARM resource ID of the subnet the service is injected into, when VNet-integrated. |  |

---

### Azure Api Management Subscription

`azure_api_management_subscription` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`endedOn` \*

 | `number` **|** `null` | Timestamp (ms since epoch) when the subscription was cancelled or expired. |  |
| 

`isAllowTracingEnabled` \*

 | `boolean` **|** `null` | Whether request tracing is enabled for this subscription. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The user resource identifier of the subscription owner (e.g. /users/{userId}). |  |
| 

`scope` \*

 | `string` | Subscription scope: /products/{productId}, /apis, or /apis/{apiId}. |  |
| 

`startedOn` \*

 | `number` **|** `null` | Timestamp (ms since epoch) when the subscription was activated. |  |
| 

`state` \*

 | `string` | Subscription state: 'active', 'suspended', 'submitted', 'rejected', 'cancelled', or 'expired'. |  |
| 

`stateComment` \*

 | `string` **|** `null` | Optional comment added by an administrator. |  |

---

### Azure Api Management Tenant Access

`azure_api_management_tenant_access` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessId` \*

 | `string` **|** `null` | The tenant access identifier. |  |
| 

`isEnabled` \*

 | `boolean` | Whether direct tenant management API access is enabled. |  |

---

### Azure Arc Sql Server Database

`azure_arc_sql_server_database` inherits from [Database](/data-model/schemas/Database.md), [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`collation` \*

 | `string` **|** `null` | Database-level collation, such as SQL\_Latin1\_General\_CP1\_CI\_AS. |  |
| 

`compatibilityLevel` \*

 | `number` **|** `null` | SQL Server compatibility level of the database, such as 150 for SQL Server 2019. |  |
| 

`databaseCreatedOn` \*

 | `number` **|** `null` | Timestamp (milliseconds since epoch) when the database was created on the SQL Server instance. |  |
| 

`isAutoCloseOn` \*

 | `boolean` **|** `null` | Whether the database shuts down cleanly and frees resources after the last user disconnects. |  |
| 

`isAutoCreateStatsOn` \*

 | `boolean` **|** `null` | Whether the query optimizer automatically creates single-column statistics. |  |
| 

`isAutoShrinkOn` \*

 | `boolean` **|** `null` | Whether the database files are periodically shrunk automatically. |  |
| 

`isAutoUpdateStatsOn` \*

 | `boolean` **|** `null` | Whether the query optimizer automatically updates out-of-date statistics. |  |
| 

`isChangeTrackingOn` \*

 | `boolean` **|** `null` | Whether change tracking is enabled on the database. |  |
| 

`isFullTextIndexingOn` \*

 | `boolean` **|** `null` | Whether full-text indexing is enabled on the database. |  |
| 

`isReadOnly` \*

 | `boolean` **|** `null` | Whether the database is in read-only mode. |  |
| 

`isRemoteDataArchiveEnabled` \*

 | `boolean` **|** `null` | Whether Remote Data Archive (Stretch Database) is enabled for the database. |  |
| 

`isTrustworthyOn` \*

 | `boolean` **|** `null` | Whether the TRUSTWORTHY database option is enabled, allowing database modules to access resources outside the database. |  |
| 

`lastFullBackupOn` \*

 | `number` **|** `null` | Timestamp (milliseconds since epoch) of the most recent full backup. |  |
| 

`lastLogBackupOn` \*

 | `number` **|** `null` | Timestamp (milliseconds since epoch) of the most recent transaction log backup. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | ARM provisioning state of the resource, such as Succeeded, Failed, or Deleting. |  |
| 

`recoveryMode` \*

 | `string` **|** `null` | Recovery model of the database: FULL, SIMPLE, or BULK\_LOGGED. |  |
| 

`region` \*

 | `string` **|** `null` | Azure region the parent Arc SQL Server instance is registered in. |  |
| 

`resourceGroup` \*

 | `string` **|** `null` | Name of the Azure resource group containing the database. |  |
| 

`sizeMB` \*

 | `number` **|** `null` | Total size of the database in megabytes. |  |
| 

`spaceAvailableMB` \*

 | `number` **|** `null` | Unused space available within the database files, in megabytes. |  |
| 

`state` \*

 | `string` **|** `null` | Current database state: Online, Offline, Restoring, Recovering, Suspect, Emergency, or OfflineSecondary. |  |

---

### Azure Arc Sql Server Instance

`azure_arc_sql_server_instance` inherits from [Database](/data-model/schemas/Database.md), [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`azureDefenderStatus` \*

 | `string` **|** `null` | Microsoft Defender for SQL status reported for the instance: Protected, Unprotected, or Unknown. |  |
| 

`azureDefenderStatusLastUpdatedOn` \*

 | `number` **|** `null` | Timestamp (milliseconds since epoch) when the Microsoft Defender for SQL status was last updated. |  |
| 

`backupFullFrequency` \*

 | `string` **|** `null` | Configured frequency of full backups, such as Weekly or Daily. |  |
| 

`backupRetentionDays` \*

 | `number` **|** `null` | Number of days automated backups are retained for the instance. |  |
| 

`backupStorageRedundancy` \*

 | `string` **|** `null` | Redundancy configured for backup storage, such as Local, Zone, or Geo. |  |
| 

`collation` \*

 | `string` **|** `null` | Server-level collation, such as SQL\_Latin1\_General\_CP1\_CI\_AS. |  |
| 

`connectionStatus` \*

 | `string` **|** `null` | Connection status of the instance to Azure Arc: Connected, Disconnected, Registered, or Unknown. |  |
| 

`containerResourceId` \*

 | `string` **|** `null` | Resource ID of the Azure Arc-enabled server hosting this SQL Server instance. |  |
| 

`cores` \*

 | `string` **|** `null` | Number of physical cores on the host running the instance. |  |
| 

`currentVersion` \*

 | `string` **|** `null` | Exact SQL Server build number currently installed. |  |
| 

`edition` \*

 | `string` **|** `null` | SQL Server edition: Evaluation, Enterprise, Standard, Web, Developer, or Express. |  |
| 

`hostType` \*

 | `string` **|** `null` | Type of host running the instance, such as Physical Server, Virtual Machine, or Container. |  |
| 

`instanceName` \*

 | `string` **|** `null` | SQL Server instance name as reported by the host, such as MSSQLSERVER for a default instance. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Arc SQL Server instance type, such as Single or AvailabilityGroup. |  |
| 

`isAzureDefenderEnabled` \*

 | `boolean` **|** `null` | Whether Microsoft Defender for SQL reports the instance as Protected. Null when the Defender status is unknown or has not been reported. |  |
| 

`licenseType` \*

 | `string` **|** `null` | License type applied to the instance: Undefined, Free, HADR, ServerCAL, LicenseOnly, PAYG, or Paid. |  |
| 

`monitoringStatus` \*

 | `string` **|** `null` | Monitoring state of the instance, such as Enabled or Disabled. |  |
| 

`patchLevel` \*

 | `string` **|** `null` | Patch level of the SQL Server installation, such as 15.0.4316.3. |  |
| 

`productId` \*

 | `string` **|** `null` | SQL Server product ID of the installation. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | ARM provisioning state of the resource, such as Succeeded, Failed, or Deleting. |  |
| 

`region` \*

 | `string` **|** `null` | Azure region the Arc SQL Server instance is registered in. |  |
| 

`resourceGroup` \*

 | `string` **|** `null` | Name of the Azure resource group containing the instance. |  |
| 

`tcpDynamicPorts` \*

 | `string` **|** `null` | Comma-separated list of dynamic TCP ports the instance listens on. |  |
| 

`tcpStaticPorts` \*

 | `string` **|** `null` | Comma-separated list of static TCP ports the instance listens on. |  |
| 

`vCore` \*

 | `string` **|** `null` | Number of virtual cores available to the instance. |  |
| 

`version` \*

 | `string` **|** `null` | SQL Server product version, such as "SQL Server 2019" or "SQL Server 2022". |  |

---

### Azure Authentication Methods Policy

`azure_authentication_methods_policy` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `attestationEnforced` | `boolean` |  |  |
| `certificateValidationEnabled` | `boolean` |  |  |
| `defaultLifetimeMinutes` | `number` |  |  |
| `disabledAuthenticationMethods` | `array` of `string`s |  |  |
| `enabledAuthenticationMethods` | `array` of `string`s |  |  |
| `externalIdEmailOtpAllowed` | `string` |  |  |
| `hasExclusions` | `array` of `string`s |  |  |
| `includeAllUsers` | `array` of `string`s |  |  |
| `isRegistrationEnforced` | `boolean` |  |  |
| `isUsableOnce` | `boolean` |  |  |
| `keyRestrictionsEnforced` | `boolean` |  |  |
| `lastModifiedDateTime` | `number` **|** `null` |  |  |
| `maximumLifetimeMinutes` | `number` |  |  |
| `minimumLifetimeMinutes` | `number` |  |  |
| `officePhoneAllowed` | `boolean` |  |  |
| `policyMigrationState` | `string` **|** `null` |  |  |
| `policyVersion` | `string` **|** `null` |  |  |
| `registrationCampaignState` | `string` |  |  |
| `registrationSnoozeDays` | `number` |  |  |
| `requiresRegistration` | `array` of `string`s |  |  |
| `selfServiceRegistrationAllowed` | `boolean` |  |  |
| `softwareOathEnabled` | `boolean` |  |  |

---

### Azure Authentication Strength Policy

`azure_authentication_strength_policy` inherits from [PasswordPolicy](/data-model/schemas/PasswordPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowedCombinations` | `array` of `string`s |  |  |
| `description` | `string` |  |  |
| `policyType` | `string` |  |  |
| `requirementsSatisfied` | `string` |  |  |

---

### Azure Authorization Policy

`azure_authorization_policy` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowedToSignUpEmailBasedSubscriptions` | `boolean` |  |  |
| `allowedToUseSSPR` | `boolean` |  |  |
| `allowEmailVerifiedUsersToJoinOrganization` | `boolean` |  |  |
| `allowInvitesFrom` | `string` **|** `null` |  |  |
| `allowUserConsentForRiskyApps` | `boolean` **|** `null` |  |  |
| `blockMsolPowerShell` | `boolean` **|** `null` |  |  |
| `defaultUserRolePermissions.allowedToCreateApps` | `boolean` |  |  |
| `defaultUserRolePermissions.allowedToCreateSecurityGroups` | `boolean` |  |  |
| `defaultUserRolePermissions.allowedToCreateTenants` | `boolean` **|** `null` |  |  |
| `defaultUserRolePermissions.allowedToReadBitlockerKeysForOwnedDevice` | `boolean` **|** `null` |  |  |
| `defaultUserRolePermissions.allowedToReadOtherUsers` | `boolean` |  |  |
| `defaultUserRolePermissions.permissionGrantPoliciesAssigned` | `array` **|** `null` |  |  |

---

### Azure Backup Protected Item

`azure_backup_protected_item` inherits from [Backup](/data-model/schemas/Backup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `backupEngineName` | `string` **|** `null` | Name of the DPM/MABS backup engine managing the item. |  |
| `backupManagementType` | `string` **|** `null` | Backup management engine handling the item: "AzureIaasVM", "AzureWorkload", "AzureStorage", "AzureSql", "MAB", or "DPM". |  |
| `backupSetName` | `string` **|** `null` | Name of the backup set the item belongs to. |  |
| `computerName` | `string` **|** `null` | Name of the on-premises machine backed up by a MAB (Azure Backup agent) item. |  |
| `containerName` | `string` **|** `null` | Name of the protection container holding the item; the only stable identifier for MAB/DPM items that have no ARM resource ID. |  |
| `deferredDeleteOn` | `number` **|** `null` | Timestamp (ms since epoch) at which the soft-deleted item is scheduled for permanent deletion. |  |
| `deferredDeleteTimeRemaining` | `string` **|** `null` | Free-form time remaining before permanent deletion, as reported by Azure (e.g. "13 days"). |  |
| `friendlyName` | `string` **|** `null` | Human-readable name of the protected datasource - the file share name, the "instance/database" pair, or the VM name depending on subtype. |  |
| `hasResourceGuardOperationRequests` | `boolean` **|** `null` | Whether a Resource Guard (Multi-User Authorization) protects critical operations on this item. |  |
| `healthStatus` | `string` **|** `null` | Backup health of an IaaS VM item: "Passed", "ActionRequired", "ActionSuggested", or "Invalid". Only populated for IaaS VM subtypes - null for SQL, SAP HANA, and file share items. |  |
| `isArchiveEnabled` | `boolean` **|** `null` | Whether recovery points for this item are moved to the archive tier, which changes restore latency. |  |
| `isDeferredDeleteScheduleUpcoming` | `boolean` **|** `null` | Whether permanent deletion of the soft-deleted backup data is imminent. |  |
| `isPolicyInconsistent` | `boolean` **|** `null` | Whether the effective backup policy is inconsistent with the assigned policy, normalized from `policyInconsistent` (IaaS VM) and `policyState === "Inconsistent"` (all other subtypes). May be null if the vault-scoped listing omits extended info. |  |
| `isRehydrate` | `boolean` **|** `null` | Whether an archived recovery point for this item is currently being rehydrated. |  |
| `isScheduledForDeferredDelete` | `boolean` **|** `null` | Whether the item has been soft-deleted and its backup data is on a countdown to permanent deletion. |  |
| `lastBackupErrorCode` | `string` **|** `null` | Error code from the most recent failed backup, flattened from the error detail object. |  |
| `lastBackupErrorMessage` | `string` **|** `null` | Error message from the most recent failed backup, flattened from the error detail object. |  |
| `lastBackupOn` | `number` **|** `null` | Timestamp (ms since epoch) of the most recent backup attempt. Null for Azure SQL protected items, which do not report it. A stale value indicates backups have stopped running. |  |
| `lastBackupStatus` | `string` **|** `null` | Status of the most recent backup. The vocabulary varies by subtype (IaaS VM items report free-form values such as "Completed"; workload items report "Healthy"/"Unhealthy"/"IRPending"), so treat it as an opaque string. |  |
| `lastRecoveryPointOn` | `number` **|** `null` | Timestamp (ms since epoch) of the newest recovery point available for this item. |  |
| `oldestRecoveryPointOn` | `number` **|** `null` | Timestamp (ms since epoch) of the oldest recovery point still retained - the floor of the restore window. May be null if the vault-scoped listing omits extended info. |  |
| `parentName` | `string` **|** `null` | SQL instance or availability group containing the protected database. Not an ARM resource ID. |  |
| `parentType` | `string` **|** `null` | Kind of parent recorded in `parentName`, e.g. "SQLInstance" or "SQLAG". |  |
| `policyName` | `string` **|** `null` | Name of the backup policy assigned to this item, which determines backup frequency and retention. |  |
| `policyType` | `string` **|** `null` | Backup policy generation for IaaS VM items: "V1" or "V2". Null for other subtypes. |  |
| `protectedItemHealthStatus` | `string` **|** `null` | Health of an in-VM workload item: "Healthy", "Unhealthy", "NotReachable", or "IRPending". Only populated for AzureVmWorkload subtypes. |  |
| `protectedItemType` | `string` **|** `null` | Wire discriminator for the protected item, e.g. "Microsoft.Compute/virtualMachines", "AzureFileShareProtectedItem", or "AzureVmWorkloadSQLDatabase". |  |
| `protectionState` | `string` **|** `null` | Backup protection state. Anything other than "Protected" (e.g. "ProtectionStopped", "ProtectionError", "ProtectionPaused", "BackupsSuspended", "IRPending") means the datasource is not currently being protected. |  |
| `protectionStatus` | `string` **|** `null` | Overall protection status reported for IaaS VM items: "Healthy" or "Unhealthy". Null for non-IaaS-VM workloads. |  |
| `recoveryPointCount` | `number` **|** `null` | Number of recovery points retained for this item. Zero means the datasource has never been successfully backed up. May be null if the vault-scoped listing omits extended info. |  |
| `region` | `string` **|** `null` | Azure region of the Recovery Services vault holding this item. |  |
| `resourceGroup` | `string` **|** `null` | Resource group of the Recovery Services vault holding this item. |  |
| `serverName` | `string` **|** `null` | Host or cluster name running the in-VM workload. Only populated for AzureVmWorkload subtypes. |  |
| `softDeleteRetentionPeriodInDays` | `number` **|** `null` | Number of days soft-deleted backup data is retained before permanent deletion - the ransomware recovery window. |  |
| `workloadType` | `string` **|** `null` | Datasource type being backed up, e.g. "VM", "AzureFileShare", "SQLDataBase", or "SAPHanaDatabase". |  |

---

### Azure Bot Service Bot

`azure_bot_service_bot` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`appPasswordHint` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `array` **|** `null` |  |  |
| 

`cmekEncryptionStatus` \*

 | `string` **|** `null` |  |  |
| 

`cmekKeyVaultUrl` \*

 | `string` **|** `null` |  |  |
| 

`configuredChannels` \*

 | `array` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`developerAppInsightKey` \*

 | `string` **|** `null` |  |  |
| 

`developerAppInsightsApiKey` \*

 | `string` **|** `null` |  |  |
| 

`developerAppInsightsApplicationId` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` **|** `null` |  |  |
| 

`enabledChannels` \*

 | `array` **|** `null` |  |  |
| 

`endpoint` \*

 | `string` **|** `null` |  |  |
| 

`endpointVersion` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`iconUrl` \*

 | `string` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| 

`isCmekEnabled` \*

 | `boolean` |  |  |
| 

`isDeveloperAppInsightsApiKeySet` \*

 | `boolean` **|** `null` |  |  |
| 

`isLocalAuthenticationEnabled` \*

 | `boolean` |  |  |
| 

`isStreamingSupported` \*

 | `boolean` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`luisAppIds` \*

 | `array` **|** `null` |  |  |
| 

`luisKey` \*

 | `string` **|** `null` |  |  |
| 

`manifestUrl` \*

 | `string` **|** `null` |  |  |
| 

`migrationToken` \*

 | `string` **|** `null` |  |  |
| 

`msaAppId` \*

 | `string` **|** `null` |  |  |
| 

`msaAppMSIResourceId` \*

 | `string` **|** `null` |  |  |
| 

`msaAppTenantId` \*

 | `string` **|** `null` |  |  |
| 

`msaAppType` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`openWithHint` \*

 | `string` **|** `null` |  |  |
| 

`provisioningState` \*

 | `string` **|** `null` |  |  |
| 

`publicNetworkAccess` \*

 | `string` **|** `null` |  |  |
| 

`publishingCredentials` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`schemaTransformationVersion` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`storageResourceId` \*

 | `string` **|** `null` |  |  |
| 

`tenantId` \*

 | `string` **|** `null` |  |  |
| 

`zones` \*

 | `array` **|** `null` |  |  |

---

### Azure Bot Service Channel

`azure_bot_service_channel` inherits from [Channel](/data-model/schemas/Channel.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` **|** `null` |  |  |
| 

`channelName` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |

---

### Azure Container Registry Repository

`azure_container_registry_repository` inherits from [Repository](/data-model/schemas/Repository.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`registry` \*

 | `string` | The registry login server this repository belongs to. |  |
| 

`repositoryName` \*

 | `string` | The repository (image) name within the registry. |  |

---

### Azure Data Factory

`azure_data_factory` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encryptionIdentityUserAssigned` | `string` **|** `null` | ARM ID of the user-assigned identity used to reach the customer-managed key. Null when the system-assigned identity is used. |  |
| `encryptionKeyName` | `string` **|** `null` | Name of the Key Vault key used as the customer-managed key (CMK) for the factory. Null when Microsoft-managed encryption is used. |  |
| `encryptionKeyVersion` | `string` **|** `null` | Version of the customer-managed key. Null when the latest version is tracked automatically. |  |
| `encryptionVaultBaseUrl` | `string` **|** `null` | Base URL of the Key Vault holding the customer-managed key. |  |
| `etag` | `string` **|** `null` | ARM entity tag of the factory resource. |  |
| `identityPrincipalId` | `string` **|** `null` | Object ID of the factory system-assigned managed identity. |  |
| `identityTenantId` | `string` **|** `null` | Entra ID tenant ID of the factory managed identity. |  |
| `identityType` | `string` **|** `null` | Managed identity type: "SystemAssigned", "UserAssigned", or "SystemAssigned,UserAssigned". |  |
| `identityUserAssignedIdentityIds` | `array` **|** `null` | ARM IDs of the user-assigned managed identities attached to the factory. |  |
| `isPublicNetworkAccessEnabled` | `boolean` **|** `null` | Whether the factory accepts traffic from public networks. False when access is restricted to private endpoints. |  |
| `isRepoPublishDisabled` | `boolean` **|** `null` | Whether manual publishing from the Data Factory studio is disabled in favor of automated CI/CD publishing. |  |
| `provisioningState` | `string` **|** `null` | Provisioning state of the factory, e.g. "Succeeded" or "Failed". |  |
| `purviewResourceId` | `string` **|** `null` | ARM ID of the Microsoft Purview account the factory reports lineage to. |  |
| `region` | `string` **|** `null` | Azure region hosting the factory. |  |
| `repoAccountName` | `string` **|** `null` | Git account or organization name. |  |
| `repoClientId` | `string` **|** `null` | Client ID of the GitHub bring-your-own-app used for repository access. Null for GitHub Enterprise apps and Azure DevOps repositories. |  |
| `repoCollaborationBranch` | `string` **|** `null` | Git branch that factory publishes are made from, e.g. "main". |  |
| `repoHostName` | `string` **|** `null` | GitHub Enterprise host name. Null for github.com and for Azure DevOps repositories. |  |
| `repoLastCommitId` | `string` **|** `null` | Commit ID of the most recent publish from the collaboration branch. |  |
| `repoProjectName` | `string` **|** `null` | Azure DevOps project name. Null for GitHub repositories. |  |
| `repoRepositoryName` | `string` **|** `null` | Git repository name backing the factory. |  |
| `repoRootFolder` | `string` **|** `null` | Folder within the repository holding the factory resources. |  |
| `repoTenantId` | `string` **|** `null` | Entra ID tenant ID of the Azure DevOps organization. Null for GitHub repositories. |  |
| `repoType` | `string` **|** `null` | Git repository configuration type: "FactoryGitHubConfiguration" or "FactoryVSTSConfiguration". Null when the factory is in live mode with no Git integration. |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |
| `version` | `string` **|** `null` | Data Factory version, e.g. "2018-06-01". |  |

---

### Azure Data Factory Integration Runtime

`azure_data_factory_integration_runtime` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authorizationType` | `string` **|** `null` | Authorization used to share a self-hosted integration runtime: "Key" or "RBAC". Null when the runtime is not linked from another factory. |  |
| `computeLocation` | `string` **|** `null` | Region the managed integration runtime compute runs in. May differ from the factory region. |  |
| `customerVirtualNetworkSubnetId` | `string` **|** `null` | ARM ID of the customer subnet an Azure-SSIS integration runtime joins. |  |
| `dataFlowComputeType` | `string` **|** `null` | Data flow cluster compute type: "General", "MemoryOptimized", or "ComputeOptimized". |  |
| `dataFlowCoreCount` | `number` **|** `null` | Core count of the data flow cluster. |  |
| `dataFlowTimeToLive` | `number` **|** `null` | Minutes the data flow cluster stays alive after a run before being recycled. |  |
| `edition` | `string` **|** `null` | SSIS integration runtime edition: "Standard" or "Enterprise". Null for non-SSIS runtimes. |  |
| `factoryId` | `string` **|** `null` | ARM ID of the factory that owns this integration runtime. |  |
| `isManagedVirtualNetworkEnabled` | `boolean` **|** `null` | Whether the integration runtime runs inside a Data Factory managed virtual network. |  |
| `licenseType` | `string` **|** `null` | SSIS license model: "BasePrice" (bring your own license) or "LicenseIncluded". Null for non-SSIS runtimes. |  |
| `linkedFactoryResourceId` | `string` **|** `null` | ARM ID of the shared integration runtime this runtime links to. |  |
| `managedVirtualNetworkName` | `string` **|** `null` | Name of the managed virtual network the integration runtime runs in. |  |
| `publicIps` | `array` **|** `null` | ARM IDs of the static public IP addresses the integration runtime uses for outbound traffic. |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |
| `runtimeType` | `string` **|** `null` | Integration runtime type: "Managed" or "SelfHosted". |  |
| `ssisCustomSetupBlobContainerUri` | `string` **|** `null` | URI of the blob container holding the custom setup script for an Azure-SSIS integration runtime. |  |
| `state` | `string` **|** `null` | Integration runtime state, e.g. "Started", "Stopped", "Online", "Offline", or "AccessDenied". |  |
| `subnetId` | `string` **|** `null` | ARM ID of the subnet the integration runtime joins within the customer virtual network. |  |
| `subnetName` | `string` **|** `null` | Name of the subnet the integration runtime joins. |  |
| `vNetId` | `string` **|** `null` | ARM ID of the customer virtual network the integration runtime joins. Null for runtimes not joined to a virtual network. |  |

---

### Azure Data Factory Linked Service

`azure_data_factory_linked_service` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `connectViaIntegrationRuntime` | `string` **|** `null` | Name of the integration runtime this linked service connects through. Null when the default AutoResolve runtime is used. |  |
| `connectViaIntegrationRuntimeType` | `string` **|** `null` | Reference type of the integration runtime, always "IntegrationRuntimeReference" when set. |  |
| `factoryId` | `string` **|** `null` | ARM ID of the factory that owns this linked service. |  |
| `isCredentialStoredInKeyVault` | `boolean` **|** `null` | Whether at least one credential for this linked service resolves from Key Vault rather than being stored inline. |  |
| `keyVaultBaseUrl` | `string` **|** `null` | Base URL of the Key Vault this linked service connects to. Only set for "AzureKeyVault" linked services. |  |
| `keyVaultSecretNames` | `array` **|** `null` | Names of the Key Vault secrets this linked service resolves its credentials from. Empty when credentials are stored inline instead of in Key Vault. |  |
| `keyVaultStoreLinkedServiceNames` | `array` **|** `null` | Names of the Key Vault linked services holding the secrets this linked service references. |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |
| `serviceType` | `string` **|** `null` | Linked service type, e.g. "AzureBlobStorage", "AzureSqlDatabase", or "AzureKeyVault". |  |

---

### Azure Data Factory Managed Private Endpoint

`azure_data_factory_managed_private_endpoint` inherits from [NetworkEndpoint](/data-model/schemas/NetworkEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `connectionActionsRequired` | `string` **|** `null` | Actions the consumer must take on the private link connection, e.g. "None". |  |
| `connectionDescription` | `string` **|** `null` | Description recorded with the private link connection approval or rejection. |  |
| `connectionStatus` | `string` **|** `null` | Private link connection status: "Pending", "Approved", "Rejected", or "Disconnected". |  |
| `factoryId` | `string` **|** `null` | ARM ID of the factory that owns this managed private endpoint. |  |
| `fqdns` | `array` **|** `null` | Fully qualified domain names resolved through this managed private endpoint. |  |
| `groupId` | `string` **|** `null` | Private link sub-resource the endpoint targets, e.g. "blob", "sqlServer", or "vault". |  |
| `isReserved` | `boolean` **|** `null` | Whether the managed private endpoint is reserved by Data Factory rather than user-created. |  |
| `managedVirtualNetworkName` | `string` **|** `null` | Name of the managed virtual network containing this managed private endpoint. |  |
| `privateLinkResourceId` | `string` **|** `null` | ARM ID of the Azure resource this managed private endpoint connects outbound to. |  |
| `provisioningState` | `string` **|** `null` | Provisioning state of the managed private endpoint, e.g. "Succeeded". |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |

---

### Azure Data Factory Managed Virtual Network

`azure_data_factory_managed_virtual_network` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alias` | `string` **|** `null` | Managed virtual network alias, usually the factory name. |  |
| `factoryId` | `string` **|** `null` | ARM ID of the factory that owns this managed virtual network. |  |
| `isPreventDataExfiltration` | `boolean` **|** `null` | Whether data exfiltration protection is enabled, restricting outbound traffic to approved managed private endpoints. |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |
| `vNetId` | `string` **|** `null` | Managed virtual network ID assigned by Data Factory. |  |

---

### Azure Data Protection Backup Vault

`azure_data_protection_backup_vault` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`bcdrSecurityLevel` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `array` **|** `null` |  |  |
| 

`crossRegionRestoreState` \*

 | `string` **|** `null` |  |  |
| 

`crossSubscriptionRestoreState` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| 

`immutabilityState` \*

 | `string` **|** `null` |  |  |
| 

`isVaultProtectedByResourceGuard` \*

 | `boolean` |  |  |
| 

`keyVaultUri` \*

 | `string` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`replicatedRegions` \*

 | `array` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`secureScore` \*

 | `string` **|** `null` |  |  |
| 

`softDeleteRetentionDurationInDays` \*

 | `number` **|** `null` |  |  |
| 

`softDeleteState` \*

 | `string` **|** `null` |  |  |
| 

`storageSettingDataStoreType` \*

 | `string` **|** `null` |  |  |
| 

`storageSettingType` \*

 | `string` **|** `null` |  |  |

---

### Azure Databricks Workspace

`azure_databricks_workspace` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`amlWorkspaceId` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `array` **|** `null` |  |  |
| 

`customPrivateSubnetName` \*

 | `string` **|** `null` |  |  |
| 

`customPublicSubnetName` \*

 | `string` **|** `null` |  |  |
| 

`customVirtualNetworkId` \*

 | `string` **|** `null` |  |  |
| 

`diskEncryptionSetId` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`isInfrastructureEncryptionRequired` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublicIpEnabled` \*

 | `boolean` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`loadBalancerBackendPoolName` \*

 | `string` **|** `null` |  |  |
| 

`loadBalancerId` \*

 | `string` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`managedDiskEncryptionKeySource` \*

 | `string` **|** `null` |  |  |
| 

`managedDiskIdentityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`managedDiskIdentityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`managedDiskIdentityType` \*

 | `string` **|** `null` |  |  |
| 

`managedResourceGroupId` \*

 | `string` **|** `null` |  |  |
| 

`managedServicesEncryptionKeySource` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`natGatewayName` \*

 | `string` **|** `null` |  |  |
| 

`privateEndpointConnections` \*

 | `array` **|** `null` |  |  |
| 

`publicIpName` \*

 | `string` **|** `null` |  |  |
| 

`publicNetworkAccess` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`requiredNsgRules` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`storageAccountIdentityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`storageAccountIdentityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`storageAccountIdentityType` \*

 | `string` **|** `null` |  |  |
| 

`storageAccountName` \*

 | `string` **|** `null` |  |  |
| 

`vnetAddressPrefix` \*

 | `string` **|** `null` |  |  |
| 

`workspaceId` \*

 | `string` **|** `null` |  |  |
| 

`workspaceUrl` \*

 | `string` **|** `null` |  |  |

---

### Azure Defender Alert

`azure_defender_alert` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`blocking` \*

 | `boolean` |  |  |
| `id` | `string` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Azure Desktop Virtualization Application Group

`azure_desktop_virtualization_application_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationGroupType` \*

 | `string` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`friendlyName` \*

 | `string` **|** `null` |  |  |
| 

`hostPoolArmPath` \*

 | `string` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| 

`isCloudPcResource` \*

 | `boolean` **|** `null` |  |  |
| 

`isShownInFeed` \*

 | `boolean` **|** `null` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`objectId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`workspaceArmPath` \*

 | `string` **|** `null` |  |  |

---

### Azure Desktop Virtualization Desktop

`azure_desktop_virtualization_desktop` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`friendlyName` \*

 | `string` **|** `null` |  |  |
| 

`iconHash` \*

 | `string` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`objectId` \*

 | `string` **|** `null` |  |  |

---

### Azure Desktop Virtualization Host Pool

`azure_desktop_virtualization_host_pool` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentUpdateType` \*

 | `string` **|** `null` |  |  |
| 

`customRdpProperty` \*

 | `string` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`friendlyName` \*

 | `string` **|** `null` |  |  |
| 

`hostPoolType` \*

 | `string` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| 

`isAgentUpdateUseSessionHostLocalTime` \*

 | `boolean` **|** `null` |  |  |
| 

`isCloudPcResource` \*

 | `boolean` **|** `null` |  |  |
| 

`isStartVMOnConnectEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isValidationEnvironment` \*

 | `boolean` **|** `null` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`loadBalancerType` \*

 | `string` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`maxSessionLimit` \*

 | `number` **|** `null` |  |  |
| 

`objectId` \*

 | `string` **|** `null` |  |  |
| 

`personalDesktopAssignmentType` \*

 | `string` **|** `null` |  |  |
| 

`preferredAppGroupType` \*

 | `string` **|** `null` |  |  |
| 

`privateEndpointConnectionIds` \*

 | `array` **|** `null` |  |  |
| 

`publicNetworkAccess` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`registrationTokenExpirationOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`ring` \*

 | `number` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`ssoadfsAuthority` \*

 | `string` **|** `null` |  |  |
| 

`ssoClientId` \*

 | `string` **|** `null` |  |  |
| 

`ssoSecretType` \*

 | `string` **|** `null` |  |  |
| 

`vmTemplate` \*

 | `string` **|** `null` |  |  |

---

### Azure Desktop Virtualization Workspace

`azure_desktop_virtualization_workspace` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationGroupReferences` \*

 | `array` **|** `null` |  |  |
| 

`category` \*

 | `array` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`friendlyName` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| 

`isCloudPcResource` \*

 | `boolean` **|** `null` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`objectId` \*

 | `string` **|** `null` |  |  |
| 

`privateEndpointConnectionIds` \*

 | `array` **|** `null` |  |  |
| 

`publicNetworkAccess` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |

---

### Azure Device

`azure_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aadDeviceId` | `string` |  |  |
| `active` | `boolean` |  |  |
| `alternativeSecurityIds` | `array` of `string`s |  |  |
| `approximateLastSignInDateTime` | `number` |  |  |
| `complianceExpirationDateTime` | `string` |  |  |
| `deviceMetadata` | `string` |  |  |
| `deviceVersion` | `number` |  |  |
| `isCompliant` | `boolean` |  |  |
| `isManaged` | `boolean` |  |  |
| `manufacturer` | `string` |  |  |
| `name` | `string` |  |  |
| `onPremisesLastSyncDateTime` | `number` |  |  |
| `onPremisesSyncEnabled` | `boolean` |  |  |
| `operatingSystem` | `string` |  |  |
| `operatingSystemVersion` | `string` |  |  |
| `physicalIds` | `array` of `string`s |  |  |
| `profileType` | `string` |  |  |
| `registeredUsers` | `array` of `string`s |  |  |
| `systemLabels` | `array` of `string`s |  |  |
| `trustType` | `string` |  |  |

---

### Azure Device Registration Policy

`azure_device_registration_policy` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` |  |  |
| `isAdminConfigurable` | `boolean` |  |  |
| `isLocalAdminPasswordEnabled` | `boolean` |  |  |
| `multiFactorAuthConfiguration` | `string` |  |  |
| `userDeviceQuota` | `number` |  |  |

---

### Azure Easm Workspace

`azure_easm_workspace` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dataPlaneEndpoint` | `string` |  |  |
| `location` | `string` |  |  |
| `provisioningState` | `string` |  |  |
| `type` | `string` |  |  |
| `webLink` | `string` |  |  |

---

### Azure Fabric Capacity

`azure_fabric_capacity` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `administrationMembers` | `array` **|** `null` | User principal names or object IDs of the capacity administrators. |  |
| `location` | `string` **|** `null` | Azure region the capacity is provisioned in. |  |
| `provisioningState` | `string` **|** `null` | Provisioning state of the capacity, e.g. "Succeeded", "Failed". |  |
| `resourceGroupName` | `string` **|** `null` | Name of the resource group containing the capacity. |  |
| `skuName` | `string` **|** `null` | Capacity SKU name, e.g. "F2", "F64". |  |
| `skuTier` | `string` **|** `null` | Capacity SKU tier, e.g. "Fabric". |  |
| `state` | `string` **|** `null` | Capacity lifecycle state, e.g. "Active", "Paused", "Suspended". |  |
| `type` | `string` **|** `null` | Azure resource type, always "Microsoft.Fabric/capacities". |  |
| `webLink` | `string` | Azure portal URL for the capacity. |  |

---

### Azure Fabric Dashboard

`azure_fabric_dashboard` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appId` | `string` **|** `null` | Identifier of the Power BI app the dashboard belongs to, if any. |  |
| `dataClassification` | `string` **|** `null` | Data classification tag applied to the dashboard in Power BI. |  |
| `isReadOnly` | `boolean` **|** `null` | Whether the dashboard is read-only. |  |
| `sensitivityLabelId` | `string` **|** `null` | Identifier of the Microsoft Purview sensitivity label applied to the dashboard. |  |

---

### Azure Fabric Dataflow

`azure_fabric_dataflow` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `certifiedBy` | `string` **|** `null` | Display name of the user who certified the dataflow. |  |
| `configuredBy` | `string` **|** `null` | Display name of the dataflow owner. |  |
| `endorsement` | `string` **|** `null` | Endorsement status, e.g. "Promoted" or "Certified". |  |
| `modelUrl` | `string` **|** `null` | URL of the dataflow definition file (model.json). |  |
| `sensitivityLabelId` | `string` **|** `null` | Identifier of the Microsoft Purview sensitivity label applied to the dataflow. |  |

---

### Azure Fabric Datamart

`azure_fabric_datamart` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `certifiedBy` | `string` **|** `null` | Display name of the user who certified the datamart. |  |
| `configuredBy` | `string` **|** `null` | Display name of the datamart owner. |  |
| `configuredById` | `string` **|** `null` | Identifier of the datamart owner. |  |
| `datamartType` | `string` **|** `null` | Datamart type, e.g. "Sql" or "Kusto". |  |
| `endorsement` | `string` **|** `null` | Endorsement status, e.g. "Promoted" or "Certified". |  |
| `modifiedById` | `string` **|** `null` | Identifier of the user who last modified the datamart. |  |
| `sensitivityLabelId` | `string` **|** `null` | Identifier of the Microsoft Purview sensitivity label applied to the datamart. |  |
| `state` | `string` **|** `null` | Current datamart state, e.g. "Active" or "Deleted". |  |

---

### Azure Fabric Datasource

`azure_fabric_datasource` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `connectionDatabase` | `string` **|** `null` | Database named in the connection details. |  |
| `connectionKind` | `string` **|** `null` | Connection kind reported for the data source. |  |
| `connectionPath` | `string` **|** `null` | Path named in the connection details. |  |
| `connectionServer` | `string` **|** `null` | Server named in the connection details. |  |
| `connectionUrl` | `string` **|** `null` | URL named in the connection details. |  |
| `datasourceType` | `string` **|** `null` | Type of the data source, e.g. "Sql", "AnalysisServices", "Web", "SharePointList". |  |
| `gatewayId` | `string` **|** `null` | Identifier of the on-premises data gateway the source is bound to, when it is bound to one. |  |

---

### Azure Fabric Domain

`azure_fabric_domain` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `contributorsScope` | `string` **|** `null` | Who may contribute to the domain, e.g. "AllTenant", "SpecificUsersAndGroups", "AdminsOnly". |  |
| `parentDomainId` | `string` **|** `null` | Identifier of the parent domain, when this is a subdomain. |  |

---

### Azure Fabric Report

`azure_fabric_report` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appId` | `string` **|** `null` | Identifier of the Power BI app the report belongs to, if any. |  |
| `certifiedBy` | `string` **|** `null` | Display name of the user who certified the report. |  |
| `createdById` | `string` **|** `null` | Identifier of the user who created the report. |  |
| `endorsement` | `string` **|** `null` | Endorsement status, e.g. "Promoted" or "Certified". |  |
| `modifiedById` | `string` **|** `null` | Identifier of the user who last modified the report. |  |
| `reportType` | `string` **|** `null` | Report type, either "PowerBIReport" or "PaginatedReport". |  |
| `sensitivityLabelId` | `string` **|** `null` | Identifier of the Microsoft Purview sensitivity label applied to the report. |  |

---

### Azure Fabric Semantic Model

`azure_fabric_semantic_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `certifiedBy` | `string` **|** `null` | Display name of the user who certified the model. |  |
| `configuredBy` | `string` **|** `null` | Display name of the semantic model owner. |  |
| `contentProviderType` | `string` **|** `null` | How the model was authored, e.g. "PowerBIDesktop", "PbixInImportMode", "Excel". |  |
| `endorsement` | `string` **|** `null` | Endorsement status, e.g. "Promoted" or "Certified". |  |
| `sensitivityLabelId` | `string` **|** `null` | Identifier of the Microsoft Purview sensitivity label applied to the model. |  |
| `targetStorageMode` | `string` **|** `null` | Storage mode of the model, e.g. "Abf" (import) or "PremiumFiles". |  |

---

### Azure Fabric Tenant Setting

`azure_fabric_tenant_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `enabledSecurityGroupIds` | `array` **|** `null` | Microsoft Graph IDs of the security groups the setting is enabled for. |  |
| `enabledSecurityGroupNames` | `array` **|** `null` | Names of the security groups the setting is enabled for. |  |
| `excludedSecurityGroupIds` | `array` **|** `null` | Microsoft Graph IDs of the security groups excluded from the setting. |  |
| `excludedSecurityGroupNames` | `array` **|** `null` | Names of the security groups excluded from the setting. |  |
| `isDelegableToCapacity` | `boolean` **|** `null` | Whether a capacity administrator may override this setting for their capacity. |  |
| `isDelegableToDomain` | `boolean` **|** `null` | Whether a domain administrator may override this setting for their domain. |  |
| `isDelegableToWorkspace` | `boolean` **|** `null` | Whether a workspace administrator may override this setting for their workspace. |  |
| `isEnabled` | `boolean` **|** `null` | Whether the setting is turned on for the tenant. True - enabled, False - disabled. |  |
| `isGroupRestricted` | `boolean` **|** `null` | Whether the setting applies only to specific security groups rather than the entire organization. |  |
| 
`settingName` \*

 | `string` | Programmatic name of the tenant setting, e.g. "ExportToExcel". |  |
| `settingProperties` | `array` **|** `null` | Configuration values attached to the setting, formatted as `name=value` strings (or just `name` when the value is empty). |  |
| `tenantSettingGroup` | `string` **|** `null` | Admin portal group the setting belongs to, e.g. "Export and sharing settings". |  |
| `title` | `string` **|** `null` | Human readable title of the setting as shown in the Fabric admin portal. |  |

---

### Azure Fabric Tenant Setting Override

`azure_fabric_tenant_setting_override` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `delegatedFrom` | `string` **|** `null` | Level the setting was delegated from: "Tenant", "Capacity" or "Domain". |  |
| `enabledSecurityGroupIds` | `array` **|** `null` | Microsoft Graph IDs of the security groups the override is enabled for. |  |
| `enabledSecurityGroupNames` | `array` **|** `null` | Names of the security groups the override is enabled for. |  |
| `excludedSecurityGroupIds` | `array` **|** `null` | Microsoft Graph IDs of the security groups excluded from the override. |  |
| `excludedSecurityGroupNames` | `array` **|** `null` | Names of the security groups excluded from the override. |  |
| `isDelegableToWorkspace` | `boolean` **|** `null` | Whether a workspace administrator may further override this setting. |  |
| `isEnabled` | `boolean` **|** `null` | Whether the setting is turned on for this scope, which may differ from the tenant default. |  |
| `isGroupRestricted` | `boolean` **|** `null` | Whether the override applies only to specific security groups rather than everyone in scope. |  |
| 
`scopeType` \*

 | `string` | Level the override was applied at: "Workspace", "Capacity" or "Domain". |  |
| 

`settingName` \*

 | `string` | Programmatic name of the overridden tenant setting, e.g. "ExportToExcel". |  |
| `settingProperties` | `array` **|** `null` | Configuration values attached to the override, formatted as `name=value` strings (or just `name` when the value is empty). |  |
| `tenantSettingGroup` | `string` **|** `null` | Admin portal group the setting belongs to, e.g. "Export and sharing settings". |  |
| `title` | `string` **|** `null` | Human readable title of the setting as shown in the Fabric admin portal. |  |

---

### Azure Fabric Workspace

`azure_fabric_workspace` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `capacityId` | `string` **|** `null` | Power BI identifier (GUID) of the dedicated capacity the workspace is assigned to. |  |
| `capacityMigrationStatus` | `string` **|** `null` | Status of an in-progress migration of the workspace between capacities. |  |
| `dataflowStorageId` | `string` **|** `null` | Identifier of the storage account assigned for dataflow storage. |  |
| `defaultDatasetStorageFormat` | `string` **|** `null` | Default storage format for semantic models in the workspace, e.g. "Small", "Large". |  |
| `isOnDedicatedCapacity` | `boolean` **|** `null` | Whether the workspace is assigned to a dedicated Fabric capacity rather than shared capacity. |  |
| `isOrphaned` | `boolean` **|** `null` | Whether the workspace has no assigned administrator. |  |
| `isReadOnly` | `boolean` **|** `null` | Whether the workspace is in a read-only state. |  |
| `isWorkspaceLevelSettingsEnabled` | `boolean` **|** `null` | Whether workspace administrators can override tenant settings for this workspace. |  |
| `state` | `string` **|** `null` | Workspace state, e.g. "Active", "Deleted", "Removing". |  |
| `type` | `string` **|** `null` | Workspace type, e.g. "Workspace", "PersonalGroup", "Group". |  |

---

### Azure Function

`azure_function` inherits from [Function](/data-model/schemas/Function.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` **|** `null` |  |  |
| 

`configHref` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`functionAppId` \*

 | `string` |  |  |
| 

`href` \*

 | `string` **|** `null` |  |  |
| 

`invokeUrlTemplate` \*

 | `string` **|** `null` |  |  |
| 

`isEnabled` \*

 | `boolean` |  |  |
| 

`language` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`scriptHref` \*

 | `string` **|** `null` |  |  |
| 

`scriptRootPathHref` \*

 | `string` **|** `null` |  |  |
| 

`secretsFileHref` \*

 | `string` **|** `null` |  |  |
| 

`testDataHref` \*

 | `string` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Azure Function App

`azure_function_app` inherits from [Function](/data-model/schemas/Function.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appConfigCorsAllowedOrigins` | `array` **|** `null` | CORS allowed origins configured for the app. |  |
| `appConfigIpSecurityRestrictions` | `string` **|** `null` | JSON-stringified IP security restrictions from the site configuration. Stringified shape retained for back-compat. |  |
| `appConfigScmIpSecurityRestrictions` | `string` **|** `null` | JSON-stringified SCM IP security restrictions from the site configuration. Stringified shape retained for back-compat. |  |
| `authAadClaimsAuthorization` | `string` **|** `null` | JSON describing AAD claim-based authorization configuration. |  |
| `authAdditionalLoginParams` | `array` **|** `null` | Additional login parameters appended to the authorization endpoint request. |  |
| `authAllowedAudiences` | `array` **|** `null` | Token audiences allowed by the App Service auth module. |  |
| `authAllowedExternalRedirectUrls` | `array` **|** `null` | External redirect URLs allowed after a successful authentication. |  |
| `authClientId` | `string` **|** `null` | Azure AD application client ID configured for App Service authentication. |  |
| `authClientSecretCertificateThumbprint` | `string` **|** `null` | Certificate thumbprint used to authenticate to AAD as an alternative to a client secret. |  |
| `authClientSecretSettingName` | `string` **|** `null` | App setting name holding the AAD client secret (the secret itself is not ingested). |  |
| `authConfigVersion` | `string` **|** `null` | Version marker emitted by Azure for the auth configuration payload. |  |
| `authDefaultProvider` | `string` **|** `null` | Default authentication provider used when an unauthenticated request arrives. |  |
| `authEnabled` | `boolean` **|** `null` | Whether App Service Authentication is enabled (CIS 9.1). Name retained for back-compat. |  |
| `authFacebookAppId` | `string` **|** `null` | Facebook App ID configured for App Service auth. |  |
| `authFacebookAppSecretSettingName` | `string` **|** `null` | App setting name holding the Facebook App secret. |  |
| `authFacebookOAuthScopes` | `array` **|** `null` | OAuth scopes requested from Facebook. |  |
| `authGitHubClientId` | `string` **|** `null` | GitHub OAuth client ID configured for App Service auth. |  |
| `authGitHubClientSecretSettingName` | `string` **|** `null` | App setting name holding the GitHub OAuth client secret. |  |
| `authGitHubOAuthScopes` | `array` **|** `null` | OAuth scopes requested from GitHub. |  |
| `authGoogleClientId` | `string` **|** `null` | Google OAuth client ID configured for App Service auth. |  |
| `authGoogleClientSecretSettingName` | `string` **|** `null` | App setting name holding the Google OAuth client secret. |  |
| `authGoogleOAuthScopes` | `array` **|** `null` | OAuth scopes requested from Google. |  |
| `authIsAuthFromFile` | `string` **|** `null` | Whether auth configuration is loaded from a file. Azure returns the string "True" or "False". |  |
| `authIssuer` | `string` **|** `null` | OpenID Connect issuer URL used to validate tokens. |  |
| `authMicrosoftAccountClientId` | `string` **|** `null` | Microsoft Account client ID configured for App Service auth. |  |
| `authMicrosoftAccountClientSecretSettingName` | `string` **|** `null` | App setting name holding the Microsoft Account client secret. |  |
| `authMicrosoftAccountOAuthScopes` | `array` **|** `null` | OAuth scopes requested from Microsoft Account. |  |
| `authRuntimeVersion` | `string` **|** `null` | Runtime version of the App Service auth module. |  |
| `authTokenRefreshExtensionHours` | `number` **|** `null` | Hours after token expiration during which a session token may still be refreshed. |  |
| `authTwitterConsumerKey` | `string` **|** `null` | Twitter consumer key configured for App Service auth. |  |
| `authTwitterConsumerSecretSettingName` | `string` **|** `null` | App setting name holding the Twitter consumer secret. |  |
| `authUnauthenticatedClientAction` | `string` **|** `null` | Action to take for unauthenticated requests (e.g. "AllowAnonymous", "RedirectToLoginPage"). |  |
| `clientCertEnabled` | `boolean` **|** `null` | Whether incoming client certificates are required (CIS 9.4). Pre-existing name retained for back-compat. |  |
| `ftpsState` | `string` **|** `null` | FTPS state of the app (FtpsOnly, Disabled, AllAllowed). |  |
| `http20Enabled` | `boolean` **|** `null` | Whether HTTP/2 is enabled (CIS 9.9). Pre-existing name retained for back-compat. |  |
| `httpLoggingEnabled` | `boolean` **|** `null` | Whether HTTP logging is enabled. Pre-existing name retained for back-compat. |  |
| `httpsOnly` | `boolean` **|** `null` | Whether the app redirects all HTTP traffic to HTTPS (CIS 9.2). Pre-existing name retained for back-compat (would be `isHttpsOnly` under current naming rules). |  |
| `identityType` | `string` **|** `null` | Managed identity type (e.g. "SystemAssigned", "UserAssigned"). |  |
| `isAuthTokenStoreEnabled` | `boolean` **|** `null` | Whether the auth token store is enabled. |  |
| `javaVersion` | `string` **|** `null` | Java runtime version, when used (CIS 9.8). |  |
| `kind` | `array` **|** `null` | Tokenized app kind from the Azure resource (e.g. \["app", "linux"\] for web apps, \["functionapp"\] for function apps). |  |
| `linuxFxVersion` | `string` **|** `null` | Linux runtime stack version string. |  |
| `location` | `string` **|** `null` | Azure region of the app. |  |
| `minTlsVersion` | `string` **|** `null` | Minimum TLS version accepted by the app (CIS 9.3). |  |
| `netFrameworkVersion` | `string` **|** `null` | .NET Framework runtime version. |  |
| `nodeVersion` | `string` **|** `null` | Node.js runtime version, when used. |  |
| `phpVersion` | `string` **|** `null` | PHP runtime version, when used (CIS 9.6). |  |
| `powerShellVersion` | `string` **|** `null` | PowerShell runtime version. |  |
| `principalId` | `string` **|** `null` | Service principal ID assigned to the app via managed identity (CIS 9.5). |  |
| `publicNetworkAccess` | `string` **|** `null` | Public network access setting (Enabled / Disabled). |  |
| `pythonVersion` | `string` **|** `null` | Python runtime version, when used (CIS 9.7). |  |
| `redundancyMode` | `string` **|** `null` | Site redundancy mode (None, Manual, Failover, ActiveActive, GeoRedundant). |  |
| `remoteDebuggingEnabled` | `boolean` **|** `null` | Whether remote debugging is enabled. Pre-existing name retained for back-compat. |  |
| `requestTracingEnabled` | `boolean` **|** `null` | Whether request tracing is enabled. Pre-existing name retained for back-compat. |  |
| `storageAccountRequired` | `boolean` **|** `null` | Whether the app requires a linked storage account. Pre-existing name retained for back-compat. |  |
| `type` | `string` **|** `null` | Azure resource type, e.g. "Microsoft.Web/sites". |  |
| `virtualNetworkSubnetId` | `string` **|** `null` | VNet subnet ID used for VNet integration. |  |
| `windowsFxVersion` | `string` **|** `null` | Windows runtime stack version string. |  |

---

### Azure Group Unified Guest Setting

`azure_group_unified_guest_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowToAddGuests` | `boolean` |  |  |
| `groupId` | `string` |  |  |
| `templateId` | `string` |  |  |

---

### Azure Group Unified Guest Setting Template

`azure_group_unified_guest_setting_template` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` |  |  |
| `templateId` | `string` |  |  |

---

### Azure Group Unified Setting

`azure_group_unified_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowGuestsToAccessGroups` | `boolean` |  |  |
| `allowGuestsToBeGroupOwner` | `boolean` |  |  |
| `allowToAddGuests` | `boolean` |  |  |
| `classificationDescriptions` | `string` **|** `null` |  |  |
| `classificationList` | `string` **|** `null` |  |  |
| `customBlockedWordsList` | `string` **|** `null` |  |  |
| `defaultClassification` | `string` **|** `null` |  |  |
| `enableGroupCreation` | `boolean` |  |  |
| `enableMIPLabels` | `boolean` |  |  |
| `groupCreationAllowedGroupId` | `string` **|** `null` |  |  |
| `guestUsageGuidelinesUrl` | `string` **|** `null` |  |  |
| `newUnifiedGroupWritebackDefault` | `boolean` |  |  |
| `prefixSuffixNamingRequirement` | `string` **|** `null` |  |  |
| `templateId` | `string` |  |  |
| `usageGuidelinesUrl` | `string` **|** `null` |  |  |

---

### Azure Group Unified Setting Template

`azure_group_unified_setting_template` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` |  |  |
| `templateId` | `string` |  |  |

---

### Azure Iot Hub

`azure_iot_hub` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `comments` | `string` |  |  |
| `defaultTtlAsIso8601` | `string` |  |  |
| `deviceStreamingEndpoints` | `array` of `string`s |  |  |
| `enableFileUploadNotifications` | `boolean` |  |  |
| `enrichmentKeys` | `array` of `string`s |  |  |
| `etag` | `string` |  |  |
| `eventHubEndpoint` | `string` |  |  |
| `eventHubPartitionCount` | `number` |  |  |
| `eventHubPartitionIds` | `array` of `string`s |  |  |
| `eventHubPath` | `string` |  |  |
| `eventHubRetentionTimeInDays` | `number` |  |  |
| `features` | `string` |  |  |
| `feedbackLockDurationAsIso8601` | `string` |  |  |
| `feedbackMaxDeliveryCount` | `number` |  |  |
| `feedbackTtlAsIso8601` | `string` |  |  |
| `hostName` | `string` |  |  |
| `location` | `string` |  |  |
| `maxDeliveryCount` | `number` |  |  |
| `provisioningState` | `string` |  |  |
| `region` | `string` |  |  |
| `routeNames` | `array` of `string`s |  |  |
| `skuCapacity` | `number` |  |  |
| `skuName` | `string` |  |  |
| `skuTier` | `string` |  |  |
| `state` | `string` |  |  |
| `tags` | `array` of `string`s |  |  |
| `type` | `string` |  |  |
| `webLink` | `string` |  |  |

---

### Azure Iot Security Solution

`azure_iot_security_solution` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `additionalWorkspacesCount` | `number` |  |  |
| `autoDiscoveredResources` | `array` of `string`s |  |  |
| `createdBy` | `string` |  |  |
| `createdByType` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `disabledDataSources` | `array` of `string`s |  |  |
| `displayName` | `string` |  |  |
| `export` | `array` of `string`s |  |  |
| `iotHubs` | `array` of `string`s |  |  |
| `lastModifiedBy` | `string` |  |  |
| `lastModifiedByType` | `string` |  |  |
| `lastModifiedOn` | `number` |  |  |
| `location` | `string` |  |  |
| `recommendationsConfigurationCount` | `number` |  |  |
| `region` | `string` |  |  |
| `status` | `string` |  |  |
| `tags` | `array` of `string`s |  |  |
| `type` | `string` |  |  |
| `unmaskedIpLoggingStatus` | `string` |  |  |
| `userDefinedResourcesQuery` | `string` **|** `null` |  |  |
| `userDefinedResourcesQuerySubscriptions` | `array` **|** `null` |  |  |
| `webLink` | `string` |  |  |
| `workspace` | `string` |  |  |

---

### Azure Machine Learning Compute

`azure_machine_learning_compute` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` **|** `null` |  |  |
| 

`computeLocation` \*

 | `string` **|** `null` |  |  |
| 

`computeType` \*

 | `string` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| 

`isComputeAttached` \*

 | `boolean` **|** `null` |  |  |
| 

`isLocalAuthEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`provisioningState` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`sshPublicAccess` \*

 | `string` **|** `null` |  |  |
| 

`subnetId` \*

 | `string` **|** `null` |  |  |
| 

`vmSize` \*

 | `string` **|** `null` |  |  |

---

### Azure Machine Learning Online Endpoint

`azure_machine_learning_online_endpoint` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` |  |  |
| `aiPlatform` | `string` |  |  |
| 
`authMode` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `array` of `string`s |  |  |
| `createdOn` | `number` |  |  |
| `function` | `array` of `string`s |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`provisioningState` \*

 | `string` **|** `null` |  |  |
| 

`publicNetworkAccess` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`scoringUri` \*

 | `string` **|** `null` |  |  |

---

### Azure Machine Learning Workspace

`azure_machine_learning_workspace` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` |  |  |
| `aiPlatform` | `string` |  |  |
| 
`applicationInsights` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `array` **|** `null` |  |  |
| 

`containerRegistry` \*

 | `string` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`discoveryUrl` \*

 | `string` **|** `null` |  |  |
| 

`encryptionIdentityClientId` \*

 | `string` **|** `null` |  |  |
| 

`encryptionKeyIdentifier` \*

 | `string` **|** `null` |  |  |
| 

`encryptionKeyVaultArmId` \*

 | `string` **|** `null` |  |  |
| 

`encryptionStatus` \*

 | `string` **|** `null` |  |  |
| 

`friendlyName` \*

 | `string` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`hbiWorkspace` \*

 | `boolean` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` |  |  |
| 

`isDataIsolationEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublicAccessAllowedWhenBehindVnet` \*

 | `boolean` **|** `null` |  |  |
| 

`isStorageHnsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`keyVault` \*

 | `string` **|** `null` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`publicNetworkAccess` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`storageAccount` \*

 | `string` **|** `null` |  |  |
| 

`v1LegacyMode` \*

 | `boolean` **|** `null` |  |  |
| 

`workspaceId` \*

 | `string` **|** `null` |  |  |

---

### Azure Netapp Account

`azure_netapp_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encryptionKeySource` | `string` **|** `null` | Source of the key used to encrypt data at rest: "Microsoft.NetApp" (platform-managed key) or "Microsoft.KeyVault" (customer-managed key). |  |
| `etag` | `string` **|** `null` | ARM entity tag of the account resource. |  |
| `isActiveDirectoryConfigured` | `boolean` **|** `null` | Whether at least one Active Directory connection is configured on the account. |  |
| `isAesEncryptionEnabled` | `boolean` **|** `null` | Whether AES encryption is enabled for SMB communication on the first configured Active Directory. Null when no Active Directory is configured. |  |
| `isLdapSigningEnabled` | `boolean` **|** `null` | Whether LDAP traffic to the first configured Active Directory must be signed. Null when no Active Directory is configured. |  |
| `keyVaultId` | `string` **|** `null` | UUID v4 identifying the Key Vault configuration used for customer-managed keys. This is a configuration identifier, not the vault ARM ID. |  |
| `keyVaultKeyName` | `string` **|** `null` | Name of the Key Vault key used as the customer-managed key. Null when platform-managed encryption is used. |  |
| `keyVaultResourceId` | `string` **|** `null` | ARM resource ID of the Key Vault holding the customer-managed key. Null when platform-managed encryption is used. |  |
| `location` | `string` **|** `null` | Azure region hosting the NetApp account. |  |
| `provisioningState` | `string` **|** `null` | Provisioning state of the account, e.g. "Succeeded" or "Failed". |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |

---

### Azure Netapp Backup

`azure_netapp_backup` inherits from [Backup](/data-model/schemas/Backup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `backupId` | `string` **|** `null` | UUID v4 assigned by Azure NetApp Files to identify the backup. |  |
| `backupPolicyResourceId` | `string` **|** `null` | ARM resource ID of the backup policy that produced this backup. Null for manual backups. |  |
| `backupType` | `string` **|** `null` | Type of backup: "Manual" or "Scheduled". |  |
| `completedOn` | `number` **|** `null` | Timestamp (milliseconds since epoch) when the backup completed. |  |
| `provisioningState` | `string` **|** `null` | Provisioning state of the backup, e.g. "Succeeded". |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |
| `size` | `number` **|** `null` | Size of the backup in bytes. |  |
| `snapshotName` | `string` **|** `null` | Name of the snapshot the backup was taken from. |  |
| `volumeResourceId` | `string` **|** `null` | ARM resource ID of the volume this backup protects. |  |

---

### Azure Netapp Bucket

`azure_netapp_bucket` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `certificateCommonName` | `string` **|** `null` | Common name of the certificate installed on the bucket server. |  |
| `certificateExpiresOn` | `number` **|** `null` | Timestamp (milliseconds since epoch) when the bucket server certificate expires. |  |
| `certificateKeyVaultUri` | `string` **|** `null` | Base URI of the Key Vault the bucket server certificate is retrieved from. Null when the certificate was uploaded directly. |  |
| `cifsUsername` | `string` **|** `null` | Effective CIFS username used when the bucket accesses volume data. |  |
| `credentialsKeyVaultUri` | `string` **|** `null` | Base URI of the Key Vault the bucket credentials are stored in. |  |
| `credentialsStatus` | `string` **|** `null` | Status of the bucket access/secret key pair: "NoCredentialsSet", "CredentialsExpired", or "Active". |  |
| `nfsGroupId` | `number` **|** `null` | Effective NFS group ID (GID) used when the bucket accesses volume data. |  |
| `nfsUserId` | `number` **|** `null` | Effective NFS user ID (UID) used when the bucket accesses volume data. |  |
| `path` | `string` **|** `null` | Volume path mounted inside the bucket. "/" exposes the whole volume. |  |
| `permissions` | `string` **|** `null` | Access permissions for the bucket: "ReadOnly" or "ReadWrite". |  |
| `provisioningState` | `string` **|** `null` | Provisioning state of the bucket, e.g. "Succeeded". |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |
| `serverFqdn` | `string` **|** `null` | Host part of the bucket URL, resolving to the bucket server IP address. |  |
| `serverIpAddress` | `string` **|** `null` | IPv4 address of the bucket server. |  |

---

### Azure Netapp Capacity Pool

`azure_netapp_capacity_pool` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `encryptionType` | `string` **|** `null` | At-rest encryption type for the pool and all its volumes: "Single" or "Double". |  |
| `etag` | `string` **|** `null` | ARM entity tag of the capacity pool resource. |  |
| `location` | `string` **|** `null` | Azure region hosting the capacity pool. |  |
| `poolId` | `string` **|** `null` | UUID v4 assigned by Azure NetApp Files to identify the pool. |  |
| `provisioningState` | `string` **|** `null` | Provisioning state of the pool, e.g. "Succeeded". |  |
| `qosType` | `string` **|** `null` | QoS type of the pool: "Auto" or "Manual". |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |
| `serviceLevel` | `string` **|** `null` | Service level of the pool: "Standard", "Premium", "Ultra", or "Flexible". |  |
| `size` | `number` **|** `null` | Provisioned size of the pool in bytes. |  |

---

### Azure Netapp Snapshot

`azure_netapp_snapshot` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `provisioningState` | `string` **|** `null` | Provisioning state of the snapshot, e.g. "Succeeded". |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |
| `snapshotId` | `string` **|** `null` | UUID v4 assigned by Azure NetApp Files to identify the snapshot. |  |

---

### Azure Netapp Volume

`azure_netapp_volume` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowedClients` | `array` **|** `null` | Flattened set of client ingress specifications from every export policy rule (each entry is the comma-separated allowedClients string of a rule). |  |
| `encryptionKeySource` | `string` **|** `null` | Source of the key used to encrypt data in the volume: "Microsoft.NetApp" (platform-managed key) or "Microsoft.KeyVault" (customer-managed key). |  |
| `etag` | `string` **|** `null` | ARM entity tag of the volume resource. |  |
| `fileAccessLogs` | `string` **|** `null` | Whether file access logs are enabled for the volume: "Enabled" or "Disabled". |  |
| `fileSystemId` | `string` **|** `null` | Unique file system identifier of the volume. |  |
| `hasRootAccessRule` | `boolean` **|** `null` | Whether any export policy rule grants root access to the volume. |  |
| `isKerberosEnabled` | `boolean` **|** `null` | Whether Kerberos is enabled for the volume. |  |
| `isLdapEnabled` | `boolean` **|** `null` | Whether LDAP is enabled for the volume. |  |
| `isSmbContinuouslyAvailable` | `boolean` **|** `null` | Whether the continuously available share property is enabled. Only applicable to SMB volumes. |  |
| `isSmbEncryptionEnabled` | `boolean` **|** `null` | Whether in-flight SMB3 encryption is enabled. Only applicable to SMB or dual-protocol volumes. |  |
| `isSnapshotDirectoryVisible` | `boolean` **|** `null` | Whether the read-only snapshot directory is visible on the volume. |  |
| `keyVaultPrivateEndpointResourceId` | `string` **|** `null` | ARM resource ID of the private endpoint used to reach the Key Vault holding the customer-managed key. Only set when encryptionKeySource is "Microsoft.KeyVault". |  |
| `networkFeatures` | `string` **|** `null` | Network features available to the volume: "Basic" or "Standard". |  |
| `protocolTypes` | `array` **|** `null` | Set of protocol types the volume serves, e.g. "NFSv3", "NFSv4.1", or "CIFS". |  |
| `provisioningState` | `string` **|** `null` | Provisioning state of the volume, e.g. "Succeeded". |  |
| `resourceGroup` | `string` **|** `null` | Resource group name extracted from the ARM ID. |  |
| `securityStyle` | `string` **|** `null` | Security style of the volume: "unix" or "ntfs". |  |
| `serviceLevel` | `string` **|** `null` | Service level of the volume: "Standard", "Premium", "Ultra", or "Flexible". |  |
| `subnetId` | `string` **|** `null` | ARM resource ID of the delegated subnet the volume is attached to. |  |
| `usageThreshold` | `number` **|** `null` | Maximum storage quota allowed for the volume in bytes (a soft quota used for alerting). |  |

---

### Azure Oauth2 Permission Grant

`azure_oauth2_permission_grant` inherits from [AccessKey](/data-model/schemas/AccessKey.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `clientId` | `string` | Service principal ID of the OAuth client that received the grant |  |
| `consentType` | `string` | Scope of the grant: Principal (per-user) or AllPrincipals (tenant-wide) | **Any of**:
-   `Principal`

-   `AllPrincipals`

 |
| `expiresOn` | `number` | Epoch ms when the grant expires |  |
| `principalId` | `string` | User ID when consentType is Principal; undefined when consentType is AllPrincipals |  |
| `resourceId` | `string` | Service principal ID of the API resource the scopes apply to (e.g. Microsoft Graph) |  |
| `scope` | `string` | Space-delimited list of OAuth scopes granted (kept as a single string for substring J1QL matching) |  |
| `startedOn` | `number` | Epoch ms when the grant became effective |  |

---

### Azure Postgresql Flexible Server Configuration

`azure_postgresql_flexible_server_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allowedValues` \*

 | `string` **|** `null` | The allowed values for the configuration parameter. |  |
| 

`dataType` \*

 | `string` **|** `null` | The data type of the configuration parameter (Boolean, Numeric, Integer, or Enumeration). |  |
| 

`defaultValue` \*

 | `string` **|** `null` | The default value of the configuration parameter. |  |
| 

`isConfigPendingRestart` \*

 | `boolean` **|** `null` | Whether a value change to this parameter is pending a server restart. |  |
| 

`isDynamicConfig` \*

 | `boolean` **|** `null` | Whether the parameter can be applied dynamically without a restart. |  |
| 

`isReadOnly` \*

 | `boolean` **|** `null` | Whether the parameter is read-only. |  |
| 

`source` \*

 | `string` **|** `null` | The source of the configuration value (e.g. system-default or user-override). |  |
| 

`unit` \*

 | `string` **|** `null` | The unit of the configuration parameter, when applicable. |  |
| 

`value` \*

 | `string` **|** `null` | The effective value of the configuration parameter. |  |

---

### Azure Postgresql Flexible Server Entra Admin

`azure_postgresql_flexible_server_entra_admin` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`objectId` \*

 | `string` **|** `null` | The Microsoft Entra object id of the administrator principal. |  |
| 

`principalName` \*

 | `string` **|** `null` | The display name / user principal name of the Entra administrator. |  |
| 

`principalType` \*

 | `string` **|** `null` | The type of the Entra principal that is an administrator (User, Group, or ServicePrincipal). |  |
| 

`tenantId` \*

 | `string` **|** `null` | The Microsoft Entra tenant id that the administrator belongs to. |  |
| 

`type` \*

 | `string` **|** `null` | The Azure resource type of the administrator resource. |  |

---

### Azure Powerbi Private Link Service

`azure_powerbi_private_link_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `location` | `string` **|** `null` | Azure region the private link service is provisioned in. |  |
| `resourceGroupName` | `string` **|** `null` | Name of the resource group containing the private link service. |  |
| `tenantId` | `string` **|** `null` | Microsoft Entra tenant ID the private link service grants access to. |  |
| `type` | `string` **|** `null` | Azure resource type, always "Microsoft.PowerBI/privateLinkServicesForPowerBI". |  |
| `webLink` | `string` | Azure portal URL for the private link service. |  |

---

### Azure Recovery Services Vault

`azure_recovery_services_vault` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`identityPrincipalId` \*

 | `string` **|** `null` |  |  |
| 

`identityTenantId` \*

 | `string` **|** `null` |  |  |
| 

`identityType` \*

 | `string` **|** `null` |  |  |
| 

`immutabilityState` \*

 | `string` **|** `null` |  |  |
| 

`keyVaultUri` \*

 | `string` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`privateEndpointConnections` \*

 | `array` **|** `null` |  |  |
| 

`privateEndpointStateForBackup` \*

 | `string` **|** `null` |  |  |
| 

`privateEndpointStateForSiteRecovery` \*

 | `string` **|** `null` |  |  |
| 

`publicNetworkAccess` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`skuCapacity` \*

 | `string` **|** `null` |  |  |
| 

`skuFamily` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuSize` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`softDeleteState` \*

 | `string` **|** `null` |  |  |
| 

`standardTierStorageRedundancy` \*

 | `string` **|** `null` |  |  |

---

### Azure Security Assessment Finding

`azure_security_assessment_finding` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`blocking` \*

 | `boolean` | Whether this finding blocks the affected resource from operation. |  |
| 

`cveId` \*

 | `string` | Normalized CVE identifier (e.g. CVE-2023-12345). |  |

---

### Azure Service Principal Key Credential

`azure_service_principal_key_credential` inherits from [Certificate](/data-model/schemas/Certificate.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `expiresOn` | `number` |  |  |
| `keyId` | `string` |  |  |
| `type` | `string` |  |  |
| `usage` | `string` |  |  |

---

### Azure Sql Managed Instance

`azure_sql_managed_instance` inherits from [Database](/data-model/schemas/Database.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`administratorLogin` \*

 | `string` **|** `null` |  |  |
| 

`administratorLoginPassword` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `array` **|** `null` |  |  |
| 

`collation` \*

 | `string` **|** `null` |  |  |
| 

`dnsZone` \*

 | `string` **|** `null` |  |  |
| 

`encryptionKeySource` \*

 | `string` **|** `null` |  |  |
| 

`fqdn` \*

 | `string` **|** `null` |  |  |
| 

`hostname` \*

 | `string` **|** `null` |  |  |
| 

`instancePoolId` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublicDataEndpointEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isZoneRedundant` \*

 | `boolean` **|** `null` |  |  |
| 

`licenseType` \*

 | `string` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`minimalTlsVersion` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`primaryUserAssignedIdentityId` \*

 | `string` **|** `null` |  |  |
| 

`privateEndpointConnections` \*

 | `array` **|** `null` |  |  |
| 

`proxyOverride` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`servicePrincipalType` \*

 | `string` **|** `null` |  |  |
| 

`skuCapacity` \*

 | `number` **|** `null` |  |  |
| 

`skuFamily` \*

 | `string` **|** `null` |  |  |
| 

`skuName` \*

 | `string` **|** `null` |  |  |
| 

`skuTier` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`storageAccountType` \*

 | `string` **|** `null` |  |  |
| 

`subnetId` \*

 | `string` **|** `null` |  |  |
| 

`timezoneId` \*

 | `string` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Azure Sql Managed Instance Database

`azure_sql_managed_instance_database` inherits from [Database](/data-model/schemas/Database.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`catalogCollation` \*

 | `string` **|** `null` |  |  |
| 

`collation` \*

 | `string` **|** `null` |  |  |
| 

`createMode` \*

 | `string` **|** `null` |  |  |
| 

`creationDate` \*

 | `number` **|** `null` |  |  |
| 

`currentServiceObjectiveName` \*

 | `string` **|** `null` |  |  |
| 

`defaultSecondaryLocation` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`isAutoCompleteRestore` \*

 | `boolean` **|** `null` |  |  |
| 

`lastBackupName` \*

 | `string` **|** `null` |  |  |
| 

`location` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`requestedServiceObjectiveName` \*

 | `string` **|** `null` |  |  |
| 

`resourceGroup` \*

 | `string` **|** `null` |  |  |
| 

`sourceDatabaseId` \*

 | `string` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`storageContainerUri` \*

 | `string` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Azure Storage Container

`azure_storage_container` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `containerSize` | `number` **|** `null` | The total size of the container in bytes. If retrieving this value takes longer than 5 minutes while scanning blobs, the result will be null. |  |
| `deleted` | `boolean` |  |  |
| `leaseState` | `string` |  |  |
| `leaseStatus` | `string` |  |  |
| `publicAccess` | `string` |  | **Any of**:
-   `Container`

-   `Blob`

-   `None`

 |
| `resourceGroup` | `string` |  |  |

---

### Azure Vm

`azure_vm` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `applicationSecurityGroup` | `array` of `string`s |  |  |
| `instanceStatus` | `array` of `string`s |  |  |
| `provisioningState` | `string` |  |  |
| `region` | `string` |  |  |
| `resourceGroup` | `string` |  |  |
| `state` | `string` |  |  |
| `type` | `string` |  |  |
| `usesManagedDisks` | `boolean` |  |  |
| `vmId` | `string` |  |  |
| `vmSize` | `string` |  |  |
| `webLink` | `string` |  |  |

---

### Azure Web App

`azure_web_app` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appConfigCorsAllowedOrigins` | `array` **|** `null` | CORS allowed origins configured for the app. |  |
| `appConfigIpSecurityRestrictions` | `string` **|** `null` | JSON-stringified IP security restrictions from the site configuration. Stringified shape retained for back-compat. |  |
| `appConfigScmIpSecurityRestrictions` | `string` **|** `null` | JSON-stringified SCM IP security restrictions from the site configuration. Stringified shape retained for back-compat. |  |
| `authAadClaimsAuthorization` | `string` **|** `null` | JSON describing AAD claim-based authorization configuration. |  |
| `authAdditionalLoginParams` | `array` **|** `null` | Additional login parameters appended to the authorization endpoint request. |  |
| `authAllowedAudiences` | `array` **|** `null` | Token audiences allowed by the App Service auth module. |  |
| `authAllowedExternalRedirectUrls` | `array` **|** `null` | External redirect URLs allowed after a successful authentication. |  |
| `authClientId` | `string` **|** `null` | Azure AD application client ID configured for App Service authentication. |  |
| `authClientSecretCertificateThumbprint` | `string` **|** `null` | Certificate thumbprint used to authenticate to AAD as an alternative to a client secret. |  |
| `authClientSecretSettingName` | `string` **|** `null` | App setting name holding the AAD client secret (the secret itself is not ingested). |  |
| `authConfigVersion` | `string` **|** `null` | Version marker emitted by Azure for the auth configuration payload. |  |
| `authDefaultProvider` | `string` **|** `null` | Default authentication provider used when an unauthenticated request arrives. |  |
| `authEnabled` | `boolean` **|** `null` | Whether App Service Authentication is enabled (CIS 9.1). Name retained for back-compat. |  |
| `authFacebookAppId` | `string` **|** `null` | Facebook App ID configured for App Service auth. |  |
| `authFacebookAppSecretSettingName` | `string` **|** `null` | App setting name holding the Facebook App secret. |  |
| `authFacebookOAuthScopes` | `array` **|** `null` | OAuth scopes requested from Facebook. |  |
| `authGitHubClientId` | `string` **|** `null` | GitHub OAuth client ID configured for App Service auth. |  |
| `authGitHubClientSecretSettingName` | `string` **|** `null` | App setting name holding the GitHub OAuth client secret. |  |
| `authGitHubOAuthScopes` | `array` **|** `null` | OAuth scopes requested from GitHub. |  |
| `authGoogleClientId` | `string` **|** `null` | Google OAuth client ID configured for App Service auth. |  |
| `authGoogleClientSecretSettingName` | `string` **|** `null` | App setting name holding the Google OAuth client secret. |  |
| `authGoogleOAuthScopes` | `array` **|** `null` | OAuth scopes requested from Google. |  |
| `authIsAuthFromFile` | `string` **|** `null` | Whether auth configuration is loaded from a file. Azure returns the string "True" or "False". |  |
| `authIssuer` | `string` **|** `null` | OpenID Connect issuer URL used to validate tokens. |  |
| `authMicrosoftAccountClientId` | `string` **|** `null` | Microsoft Account client ID configured for App Service auth. |  |
| `authMicrosoftAccountClientSecretSettingName` | `string` **|** `null` | App setting name holding the Microsoft Account client secret. |  |
| `authMicrosoftAccountOAuthScopes` | `array` **|** `null` | OAuth scopes requested from Microsoft Account. |  |
| `authRuntimeVersion` | `string` **|** `null` | Runtime version of the App Service auth module. |  |
| `authTokenRefreshExtensionHours` | `number` **|** `null` | Hours after token expiration during which a session token may still be refreshed. |  |
| `authTwitterConsumerKey` | `string` **|** `null` | Twitter consumer key configured for App Service auth. |  |
| `authTwitterConsumerSecretSettingName` | `string` **|** `null` | App setting name holding the Twitter consumer secret. |  |
| `authUnauthenticatedClientAction` | `string` **|** `null` | Action to take for unauthenticated requests (e.g. "AllowAnonymous", "RedirectToLoginPage"). |  |
| `clientCertEnabled` | `boolean` **|** `null` | Whether incoming client certificates are required (CIS 9.4). Pre-existing name retained for back-compat. |  |
| `ftpsState` | `string` **|** `null` | FTPS state of the app (FtpsOnly, Disabled, AllAllowed). |  |
| `http20Enabled` | `boolean` **|** `null` | Whether HTTP/2 is enabled (CIS 9.9). Pre-existing name retained for back-compat. |  |
| `httpLoggingEnabled` | `boolean` **|** `null` | Whether HTTP logging is enabled. Pre-existing name retained for back-compat. |  |
| `httpsOnly` | `boolean` **|** `null` | Whether the app redirects all HTTP traffic to HTTPS (CIS 9.2). Pre-existing name retained for back-compat (would be `isHttpsOnly` under current naming rules). |  |
| `identityType` | `string` **|** `null` | Managed identity type (e.g. "SystemAssigned", "UserAssigned"). |  |
| `isAuthTokenStoreEnabled` | `boolean` **|** `null` | Whether the auth token store is enabled. |  |
| `javaVersion` | `string` **|** `null` | Java runtime version, when used (CIS 9.8). |  |
| `kind` | `array` **|** `null` | Tokenized app kind from the Azure resource (e.g. \["app", "linux"\] for web apps, \["functionapp"\] for function apps). |  |
| `linuxFxVersion` | `string` **|** `null` | Linux runtime stack version string. |  |
| `location` | `string` **|** `null` | Azure region of the app. |  |
| `minTlsVersion` | `string` **|** `null` | Minimum TLS version accepted by the app (CIS 9.3). |  |
| `netFrameworkVersion` | `string` **|** `null` | .NET Framework runtime version. |  |
| `nodeVersion` | `string` **|** `null` | Node.js runtime version, when used. |  |
| `phpVersion` | `string` **|** `null` | PHP runtime version, when used (CIS 9.6). |  |
| `powerShellVersion` | `string` **|** `null` | PowerShell runtime version. |  |
| `principalId` | `string` **|** `null` | Service principal ID assigned to the app via managed identity (CIS 9.5). |  |
| `publicNetworkAccess` | `string` **|** `null` | Public network access setting (Enabled / Disabled). |  |
| `pythonVersion` | `string` **|** `null` | Python runtime version, when used (CIS 9.7). |  |
| `redundancyMode` | `string` **|** `null` | Site redundancy mode (None, Manual, Failover, ActiveActive, GeoRedundant). |  |
| `remoteDebuggingEnabled` | `boolean` **|** `null` | Whether remote debugging is enabled. Pre-existing name retained for back-compat. |  |
| `requestTracingEnabled` | `boolean` **|** `null` | Whether request tracing is enabled. Pre-existing name retained for back-compat. |  |
| `storageAccountRequired` | `boolean` **|** `null` | Whether the app requires a linked storage account. Pre-existing name retained for back-compat. |  |
| `type` | `string` **|** `null` | Azure resource type, e.g. "Microsoft.Web/sites". |  |
| `virtualNetworkSubnetId` | `string` **|** `null` | VNet subnet ID used for VNet integration. |  |
| `windowsFxVersion` | `string` **|** `null` | Windows runtime stack version string. |  |

---

## Release Notes

-   **2026-09-24** — Added support for Azure NetApp Files, ingesting accounts, capacity pools, volumes, snapshots, buckets, and backups as queryable entities.
-   **2026-09-15** — Added support for Azure SRE Agent, ingesting agent configurations with relationships to Application Insights, subnets, and managed identities.
-   **2026-09-15** — Azure SQL databases now expose earliest restore timestamp, current backup storage redundancy, and requested backup storage redundancy as queryable properties.
-   **2026-09-14** — Azure users now include job title, registered MFA methods, preferred secondary authentication method, default MFA method, and system-preferred authentication method as queryable properties.
-   **2026-09-14** — Added support for Azure AI services, ingesting Azure OpenAI, Azure AI Content Safety, Azure AI Language, and Azure AI Speech accounts as queryable entities.
-   **2026-08-26** — Added support for Azure Arc-enabled SQL Server, ingesting Arc SQL Server instances and their databases as queryable entities.
-   **2026-08-24** — Added support for Microsoft Fabric, ingesting capacities, workspaces, workspace artifacts including reports, semantic models, dashboards, dataflows, and datamarts, plus tenant configuration settings.
-   **2026-08-20** — Azure Recovery Services vaults are now linked to the backup-protected resources they protect.
-   **2026-08-13** — Added support for Azure Data Factory, ingesting factories, integration runtimes, managed virtual networks, managed private endpoints, and linked services as queryable entities.
-   **2026-08-11** — Azure Private DNS zone virtual network links are now ingested as queryable entities, linked to their parent DNS zones and virtual networks.
-   **2026-08-11** — Added support for Azure AI Search, ingesting services with security posture data including authentication mode, encryption settings, and network access rules.
-   **2026-08-04** — Added support for Azure API Management resources, ingesting named values, products, subscriptions, portal configurations, tenant access settings, and backends as queryable entities.
-   **2026-08-04** — Added support for Azure Redis Enterprise, ingesting clusters and databases with private endpoint relationships and diagnostic settings.
-   **2026-07-22** — Added an optional enhanced ingestion source for Azure PostgreSQL Flexible Server, including Entra administrators, server configurations, replicas, private endpoint and subnet relationships, customer-managed key usage, and diagnostic settings.
-   **2026-07-14** — Added Azure managed identity entities, linked to the resources that use them.
-   **2026-07-09** — Added Azure Container Registry repository ingestion, with security assessment scanning relationships to registries.
-   **2026-04-08** — Added configuration option to automatically delete child integration instances when their parent subscription or management group is removed from the Azure integration.
-   **2026-04-08** — Improved OS name accuracy for Azure virtual machine entities by mapping marketplace image names to human-readable OS names.
-   **2026-04-07** — Added Azure Traffic Manager data model, ingesting Traffic Manager profiles and endpoints.
-   **2026-04-07** — Added Azure Activity Log Events ingestion as a new optionally enabled data source for monitoring control-plane operations.
-   **2026-04-02** — Added Azure ARM Deployments and Managed Services as new entity types, exposing resource deployment and delegated management configurations.
-   **2026-04-02** — Promoted network access control list default action and bypass settings to Azure Key Vault entities.
-   **2026-04-02** — Promoted public network access property to Azure Event Hub namespace entities.
-   **2026-04-01** — Added Azure Log Analytics workspaces and Application Insights components as new entity types with subscription relationships.
-   **2026-04-01** — Added Azure Arc hybrid compute data model, ingesting Arc-enabled servers and machines as new entity types.
-   **2026-03-23** — Added Azure Virtual WAN data model, ingesting Virtual WANs, Virtual Hubs, and hub connections.
-   **2026-03-23** — Added Azure Kubernetes Fleet Manager data model, ingesting Fleet and Fleet Member entities.
-   **2026-03-17** — Added Azure Desktop Virtualization data model, ingesting Host Pools, Application Groups, and Workspaces.
-   **2026-03-17** — Added Azure Database Migration Service data model, ingesting migration services and projects.
-   **2026-03-16** — Promoted SKU tier property to Azure Firewall and Firewall Policy entities.
-   **2026-03-16** — Promoted shared private link request message to Azure Front Door backend pool entities.
-   **2026-03-11** — Promoted request tracing enabled property to Azure Web App entities.
-   **2026-03-10** — Added Azure App Configuration data model, ingesting App Configuration stores with encryption and access key details.
-   **2026-03-06** — Added Azure Front Door Standard/Premium data model, ingesting Front Door profiles, endpoints, and routes.
-   **2026-03-06** — Promoted 13 new properties to Azure Kubernetes cluster entities including network profile, add-on settings, and SKU tier.
-   **2026-03-04** — Added Azure Chaos Studio data model, ingesting experiments and targets.
-   **2026-03-04** — Added Azure Data Share data model, ingesting share accounts and invitations.
-   **2026-02-19** — Promoted identity type and authentication settings to Azure API Management entities, exposing managed identity and authentication configuration.
-   **2026-02-19** — Promoted identity type property to Azure VM scale set entities, exposing the managed identity type assigned to VM scale sets.
-   **2026-02-17** — Added raw data properties for Azure private endpoint and subnet entities, including network interface references and IP configuration details.
-   **2026-02-17** — Added flow analytics parameters (flow analytics enabled, traffic analytics interval) to Azure security group flow logs entities.
-   **2026-02-12** — Added Enterprise Application attributes including service principal properties and app role assignments to Azure AD entities.
-   **2026-02-11** — Promoted additional configuration properties to Azure Function App entities including runtime version and CORS settings.
-   **2026-02-11** — Promoted service provider provisioning state, bandwidth, and circuit location properties to Azure ExpressRoute circuit entities.
-   **2026-02-10** — Promoted VNet properties including DDoS protection enabled, flow timeout in minutes, and BGP community settings to Azure VNet entities.
-   **2026-02-09** — Promoted properties on API management, ExpressRoute, and additional Azure resource types from raw data.
-   **2026-01-22** — Added OWNS relationship between Azure service principals and their registered applications.
-   **2026-01-20** — Promoted identity and network interface properties to Azure VM and related entities.
-   **2025-12-15** — Preserved security rule properties (direction, port, protocol) in Azure NSG relationships for direct querying without traversal.
-   **2025-12-04** — Added support for Azure NSG Rules, Route Tables, and Routes as queryable entity types.
-   **2025-10-24** — Added Azure Bastion Host to public IP relationship, linking Bastion Host resources to their associated public IP addresses.
-   **2025-10-22** — Promoted SKU name and SKU tier properties to Azure managed disk entities.
-   **2025-10-20** — Promoted inbound IP rules to Azure Event Grid topic and Event Grid domain entities.
-   **2025-10-16** — Promoted additional properties to Azure Machine Learning workspace and related entities.
-   **2025-10-13** — Added is public property to Azure load balancer entities, derived from frontend IP configurations using public IP addresses.
-   **2025-10-07** — Added ingestion of Azure AD group settings and group setting templates.
-   **2025-10-01** — Added grant controls property to Azure conditional access policy entities, exposing required grant control conditions.
-   **2025-09-30** — Added is trusted field to Azure conditional access named location entities.
-   **2025-09-30** — Added Azure AD Authentication Strength Policies as new ingested entities.
-   **2025-09-30** — Added ingestion of Azure subscription policies.
-   **2025-09-30** — Added ingestion of Azure AD access reviews.
-   **2025-09-25** — Added Azure External Attack Surface Management (EASM) workspaces as new entity types.
-   **2025-09-22** — Added Azure Bastion Host ingestion with VNet relationship mapping.
-   **2025-09-22** — Added SMB protocol version property to Azure storage account entities.
-   **2025-09-22** — Added IoT Hub security solution and alert properties.
-   **2025-09-22** — Promoted MySQL server properties from raw data to Azure MySQL server entities.
-   **2025-09-15** — Added Azure IoT Hub security module ingestion.
-   **2025-09-10** — Added Azure AD Authentication Methods Policy ingestion.
-   **2025-09-09** — Promoted Azure Service Bus namespace properties including zone redundancy and premium tier settings.
-   **2025-09-09** — Added SMB channel encryption property to Azure storage account entities.
-   **2025-09-09** — Added Azure AD authorization policy ingestion.
-   **2025-09-08** — Added blob versioning enabled property to Azure storage account entities.
-   **2025-09-08** — Added key rotation reminder fields to Azure Key Vault key entities.
-   **2025-09-05** — Added additional Azure Function App fields including identity, scale, and networking configurations.
-   **2025-08-29** — Added ingestion of Azure AD service principal key credentials.
-   **2025-08-27** — Added Azure Managed HSM and key rotation policy ingestion.
-   **2025-08-27** — Added Azure private endpoint to Key Vault relationship.
-   **2025-08-20** — Added relationships between Azure Automation accounts and Azure Policy states and private endpoints.
-   **2025-08-20** — Added support for ingesting Azure SQL Managed Instances as new entity types.
-   **2025-08-11** — Added Azure Databricks workspace ingestion as new entity types.
-   **2025-08-06** — Added Azure Backup Vaults (Recovery Services backup container) as new entity types.
-   **2025-08-06** — Added Azure Recovery Service Vaults ingestion with backup policy relationships.
-   **2025-08-01** — Added Azure Bot Service ingestion as new entity types.
-   **2025-07-31** — Added Azure Document Intelligence service ingestion as new entity types.
-   **2025-07-30** — Added Azure Machine Learning workspace and compute resources ingestion.
-   **2025-07-16** — Added advisor extended properties to Azure entities for recommendation querying.
-   **2025-05-28** — Added exclusion properties to Azure conditional access policy entities for exclusion group/user details.
-   **2025-05-28** — Related access package policies to primary approver users and groups.
-   **2025-05-23** — Added user principal name property to Azure user entities.
-   **2025-05-22** — Added Azure Automation Accounts ingestion with runbooks and schedules.
-   **2025-05-01** — Added is guest property to Azure user entities distinguishing guest from member accounts.
-   **2025-04-29** — Added Azure storage account access keys as queryable relationship properties.
-   **2025-04-17** — Upgraded Azure Storage SDK; added minimum TLS version property to Azure storage account entities.
-   **2025-04-03** — Added IP security restrictions and SCM IP security restrictions properties to Azure App Service entities, surfacing IP-based access restriction configurations.

---

Source: /integrations/directory/azure-devops

# Azure DevOps

Visualize Azure DevOps projects, teams, and users, and monitor changes through queries and alerts.

## Installation

The Azure DevOps integration uses a read-only Personal Access Token (PAT) to ingest projects, teams, users, repositories, pipelines, pull requests, work items, and security findings from Azure DevOps Services (cloud). Before enabling the integration in JupiterOne, generate a PAT and grant the required permissions.

### Prerequisites

-   An Azure DevOps **organization** on Azure DevOps Services (cloud). On-premises Azure DevOps Server is partially supported — the Service Endpoints, Audit Streams, and Advanced Security steps require Azure DevOps Services.
-   An account with permission to **create Personal Access Tokens** in your organization.
-   Access to JupiterOne with permission to configure integrations.

### Creating a Personal Access Token in Azure DevOps

1.  Sign in to your Azure DevOps organization at `https://dev.azure.com/{yourOrganization}`.
    
2.  In the upper-right corner, click your profile picture and select **Personal access tokens**.
    
3.  Click **New Token** and provide a descriptive name (for example, `JupiterOne Integration`).
    
4.  Set the **Expiration** to a value appropriate for your organization's security policy.
    
5.  Under **Scopes**, select **Custom defined**, then enable the following permissions:
    
    | Scope | Required permission |
    | --- | --- |
    | Project and Team | Read |
    | Work Items | Read |
    | Build | Read |
    | Environment | Read & Manage |
    | Code | Read |
    | Advanced Security | Read |
    
    > **NOTE**
    > 
    > **Optional ingestion sources** — if you enable **Service Endpoints** or **Audit Streams** in the JupiterOne integration settings, also grant:
    > 
    > | Scope | Required permission |
    > | --- | --- |
    > | Service Connections | Read |
    > | Auditing | Read |
    
6.  Click **Create** and copy the generated token — it is shown only once.
    

For full instructions on creating PATs, see the [Azure DevOps documentation](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops).

### Configuration in JupiterOne

To install the Azure DevOps integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Azure DevOps. Click **New Instance** to begin configuring the integration.

Creating an Azure DevOps instance requires the following:

-   The **Account Name** used to identify the Azure DevOps account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Account ID** — your Azure DevOps organization URL in the form `https://dev.azure.com/{yourOrganization}`. This is the URL you use to access your organization in the browser.
    
-   **Personal Access Token** — the token generated above.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (8)

-   `vso.advsec`
-   `vso.auditstreams_manage`
-   `vso.build`
-   `vso.code`
-   `vso.environment_manage`
-   `vso.project`
-   `vso.serviceendpoint`
-   `vso.work`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (13)

-   `https://advsec.dev.azure.com/{organization}/{projectId}/_apis/management/repositories/{repositoryId}/enablement?includeAllProperties=true&api-version=7.2-preview.3`
-   `https://auditservice.dev.azure.com/{organization}/_apis/audit/streams?api-version=7.1-preview.1`
-   `https://dev.azure.com/{organization}/_apis/projects/{projectId}/teams/{teamId}/members?api-version=7.1`
-   `https://dev.azure.com/{organization}/_apis/projects?api-version=7.1`
-   `https://dev.azure.com/{organization}/_apis/teams?api-version=7.1`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/alert/repositories/{repositoryId}/alerts?api-version=7.2`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/build/builds?api-version=7.1`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/build/definitions?api-version=7.1`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/build/generalsettings?api-version=7.1`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/git/repositories/{repositoryId}/pullrequests?api-version=7.1`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/pipelines/environments?api-version=7.1`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/serviceendpoint/endpoints?api-version=7.1-preview.4`
-   `https://dev.azure.com/{organization}/{projectId}/_apis/wit/reporting/workItemRevisions?api-version=7.1`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (15)

-   [https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops#scopes](https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops#scopes)
-   [https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/organization-management?view=azure-devops](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/organization-management?view=azure-devops)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/advancedsecurity/alerts/list?view=azure-devops-rest-7.2](https://learn.microsoft.com/en-us/rest/api/azure/devops/advancedsecurity/alerts/list?view=azure-devops-rest-7.2)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/advancedsecurity/repo-enablement/get?view=azure-devops-rest-7.2](https://learn.microsoft.com/en-us/rest/api/azure/devops/advancedsecurity/repo-enablement/get?view=azure-devops-rest-7.2)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/audit/streams/query-all-streams?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/audit/streams/query-all-streams?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/build/builds/list?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/build/builds/list?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/build/definitions/list?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/build/definitions/list?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/build/general-settings/get?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/build/general-settings/get?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/core/projects/list?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/core/projects/list?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/core/teams/get-all-teams?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/core/teams/get-all-teams?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/core/teams/get-team-members-with-extended-properties?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/core/teams/get-team-members-with-extended-properties?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/distributedtask/environments/list?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/distributedtask/environments/list?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/git/pull-requests/get-pull-requests?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/git/pull-requests/get-pull-requests?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/serviceendpoint/endpoints/get-service-endpoints?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/serviceendpoint/endpoints/get-service-endpoints?view=azure-devops-rest-7.1)
-   [https://learn.microsoft.com/en-us/rest/api/azure/devops/wit/reporting-work-item-revisions/read-reporting-revisions-get?view=azure-devops-rest-7.1](https://learn.microsoft.com/en-us/rest/api/azure/devops/wit/reporting-work-item-revisions/read-reporting-revisions-get?view=azure-devops-rest-7.1)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (12)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Build Account Service Relationship | \- | \- |
| Build DevOps Service Project Relationship | \- | \- |
| Fetch Advanced Security Settings | `vso.advsec` | `https://advsec.dev.azure.com/{organization}/{projectId}/_apis/management/repositories/{repositoryId}/enablement?includeAllProperties=true&api-version=7.2-preview.3` |
| Fetch Alerts | `vso.advsec` | `https://dev.azure.com/{organization}/{projectId}/_apis/alert/repositories/{repositoryId}/alerts?api-version=7.2` |
| Fetch Build Settings | `vso.build` | `https://dev.azure.com/{organization}/{projectId}/_apis/build/generalsettings?api-version=7.1` |
| Fetch Environment | `vso.environment_manage` | `https://dev.azure.com/{organization}/{projectId}/_apis/pipelines/environments?api-version=7.1` |
| Fetch Pipelines | `vso.build` | `https://dev.azure.com/{organization}/{projectId}/_apis/build/definitions?api-version=7.1` |
| Fetch PullRequests | `vso.code` | `https://dev.azure.com/{organization}/{projectId}/_apis/git/repositories/{repositoryId}/pullrequests?api-version=7.1` |
| Fetch Repositories | `vso.build` | `https://dev.azure.com/{organization}/{projectId}/_apis/build/builds?api-version=7.1` |
| Fetch Service Endpoints | `vso.serviceendpoint` | `https://dev.azure.com/{organization}/{projectId}/_apis/serviceendpoint/endpoints?api-version=7.1-preview.4` |
| Fetch Teams | `vso.project` | `https://dev.azure.com/{organization}/_apis/teams?api-version=7.1`, `https://dev.azure.com/{organization}/_apis/projects/{projectId}/teams/{teamId}/members?api-version=7.1` |
| Fetch Workitems | `vso.work` | `https://dev.azure.com/{organization}/_apis/projects?api-version=7.1`, `https://dev.azure.com/{organization}/{projectId}/_apis/wit/reporting/workItemRevisions?api-version=7.1` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| ADO Project | `azure_devops_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| ADO Team | `azure_devops_team` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| ADO User | `azure_devops_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| ADO WorkItem | `azure_devops_work_item` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AuditStream | `azure_devops_audit_stream` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| Azure Devops Account | `azure_devops_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Azure DevOps Alerts | `azure_devops_alert_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| AzureBuildSettings | `azure_devops_build_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AzureDevOps | `azure_devops` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AzureDevOpsPipeline | `azure_devops_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AzureDevOpsPullRequest | `azure_devops_pr` | [PR](https://docs.jupiterone.io/data-model/schemas/PR) |
| Environments | `azure_devops_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RepoAdvancedSecuritySettings | `azure_devops_repo_advanced_security_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Repository | `azure_devops_repo` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| ServiceEndpoint | `azure_devops_service_endpoint` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `azure_devops` | **SCANS** | `azure_devops_project` |
| `azure_devops_account` | **HAS** | `azure_devops_project` |
| `azure_devops_account` | **HAS** | `azure_devops_user` |
| `azure_devops_account` | **HAS** | `azure_devops_team` |
| `azure_devops_account` | **OWNS** | `azure_devops_repo` |
| `azure_devops_account` | **HAS** | `azure_devops` |
| `azure_devops_account` | **HAS** | `azure_devops_audit_stream` |
| `azure_devops_project` | **HAS** | `azure_devops_team` |
| `azure_devops_project` | **HAS** | `azure_devops_work_item` |
| `azure_devops_project` | **USES** | `azure_devops_repo` |
| `azure_devops_project` | **HAS** | `azure_devops_pipeline` |
| `azure_devops_project` | **HAS** | `azure_devops_environment` |
| `azure_devops_project` | **HAS** | `azure_devops_build_settings` |
| `azure_devops_project` | **HAS** | `azure_devops_service_endpoint` |
| `azure_devops_repo` | **HAS** | `azure_devops_pr` |
| `azure_devops_repo` | **HAS** | `azure_devops_alert_finding` |
| `azure_devops_repo` | **HAS** | `azure_devops_repo_advanced_security_settings` |
| `azure_devops_team` | **HAS** | `azure_devops_user` |
| `azure_devops_user` | **MANAGES** | `azure_devops_account` |
| `azure_devops_user` | **CREATED** | `azure_devops_work_item` |
| `azure_devops_user` | **ASSIGNED** | `azure_devops_work_item` |
| `azure_devops_user` | **OPENED** | `azure_devops_pr` |
| `azure_devops_user` | **REVIEWED** | `azure_devops_pr` |
| `azure_devops_user` | **APPROVED** | `azure_devops_pr` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `azure_devops_project` | **USES** | `github_repo` | FORWARD |
| `azure_devops_project` | **USES** | `bitbucket_repo` | FORWARD |

### Azure Devops Audit Stream

`azure_devops_audit_stream` inherits from [Logs](/data-model/schemas/Logs.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `azureWorkspaceId` | `string` **|** `null` | Azure Monitor / Log Analytics workspace id. |  |
| `blobStorageUrl` | `string` **|** `null` | Azure Blob Storage URL when consumerType is AzureBlobStorage. |  |
| 
`consumerType` \*

 | `string` | Destination type for the stream — Splunk, AzureMonitorLogs, AzureEventGrid, AzureBlobStorage, Sentinel, SumoLogic, Custom, etc. |  |
| `eventGridTopicHostname` | `string` **|** `null` | Azure Event Grid topic hostname when consumerType is AzureEventGrid. |  |
| 

`isEnabled` \*

 | `boolean` | True when the stream status is "enabled". |  |
| 

`isSecretConfigured` \*

 | `boolean` | True when the stream has a secret/access-token credential configured (the secret itself is never persisted). |  |
| 

`isSumoConfigured` \*

 | `boolean` | True when the stream targets Sumo Logic. The collector URL itself encodes the token in its path and is therefore treated as a secret; only the hostname is persisted via sumoLogicCollectorHost. |  |
| 

`isWebhookConfigured` \*

 | `boolean` | True when the stream targets a custom webhook. Webhook URLs frequently carry an access token in the path or query string and are therefore treated as secrets; only the hostname is persisted via webhookHost. |  |
| `sentinelWorkspaceId` | `string` **|** `null` | Microsoft Sentinel workspace id. |  |
| `splunkUrl` | `string` **|** `null` | Splunk HTTP event collector URL when consumerType is Splunk. |  |
| `statusReason` | `string` **|** `null` | Reason populated when the stream is disabled by the system (e.g. invalid credentials). |  |
| `sumoLogicCollectorHost` | `string` **|** `null` | Hostname of the Sumo Logic HTTP collector when consumerType is SumoLogic. The full URL embeds the collector token in its path and is intentionally not persisted. |  |
| `webhookHost` | `string` **|** `null` | Hostname of the custom webhook when consumerType is Custom. The full URL frequently embeds an auth token in the path or query string and is intentionally not persisted. |  |

---

### Azure Devops Repo Advanced Security Settings

`azure_devops_repo_advanced_security_settings` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `codeSecurityChangedById` | `string` **|** `null` | Identity UUID of the actor who last toggled code-security. |  |
| `codeSecurityEnablementLastChangedOn` | `number` **|** `null` | Epoch milliseconds when the code-security enablement state was last changed. |  |
| `isAdvancedSecurityEnabled` | `boolean` **|** `null` | Whether GitHub Advanced Security is enabled on the repository (parent flag). |  |
| `isAutofixEnabled` | `boolean` **|** `null` | Whether auto-fix for code-scanning findings is enabled on the repository. |  |
| `isCodeQlEnabled` | `boolean` **|** `null` | Whether CodeQL static analysis is enabled on the repository. |  |
| `isCodeSecurityEnabled` | `boolean` **|** `null` | Whether GitHub Advanced Security code security (CodeQL, dependency scanning) is enabled on the repository. |  |
| `isDependencyScanningInjectionEnabled` | `boolean` **|** `null` | Whether dependency-scanning injection is enabled on the repository. |  |
| `isPushBlockingOnSecretDetected` | `boolean` **|** `null` | Whether pushes containing detected secrets are blocked on the repository. |  |
| `isSecretProtectionEnabled` | `boolean` **|** `null` | Whether GitHub Advanced Security secret protection is enabled on the repository. |  |
| 
`projectId` \*

 | `string` | Azure DevOps project id that owns the repository the settings describe. |  |
| 

`repositoryId` \*

 | `string` | Azure DevOps repository id the settings entity describes. |  |
| `secretProtectionChangedById` | `string` **|** `null` | Identity UUID of the actor who last toggled secret-protection. |  |
| `secretProtectionEnablementLastChangedOn` | `number` **|** `null` | Epoch milliseconds when the secret-protection enablement state was last changed. |  |

---

### Azure Devops Service Endpoint

`azure_devops_service_endpoint` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authScheme` \*

 | `string` | Authorization scheme — e.g. UsernamePassword, Token, OAuth2, ServicePrincipal, WorkloadIdentityFederation, ManagedServiceIdentity, Certificate, None. |  |
| `authUsername` | `string` **|** `null` | Username carried by the endpoint when the authorization scheme uses a username/secret pair. |  |
| `azureEnvironment` | `string` **|** `null` | Azure environment (e.g. AzureCloud, AzureUSGovernment) for the endpoint. |  |
| `azureTenantId` | `string` **|** `null` | Azure AD tenant id used by the endpoint when the scheme is Azure-flavored. |  |
| `createdById` | `string` **|** `null` | Identity UUID of the user that created the endpoint. |  |
| `createdByUniqueName` | `string` **|** `null` | Unique name (UPN/email) of the user that created the endpoint. |  |
| `creationMode` | `string` **|** `null` | Creation mode (Manual or Automatic) — security-relevant for service-principal endpoints. |  |
| 

`endpointType` \*

 | `string` | Provider type for the service endpoint (e.g. azurerm, github, dockerregistry, kubernetes, sonarqube). |  |
| `isReady` | `boolean` **|** `null` | True when the endpoint has been initialized and is healthy. |  |
| 

`isShared` \*

 | `boolean` | True when the service endpoint is shared with other projects in the same organization. |  |
| `ownerScope` | `string` **|** `null` | Owner scope of the endpoint (e.g. Library or agentcloud). Renamed to avoid clobbering the inherited owner property. |  |
| `registryType` | `string` **|** `null` | Registry type label (used when endpointType is dockerregistry). |  |
| `registryUrl` | `string` **|** `null` | Registry URL (used when endpointType is dockerregistry). |  |
| `scopeLevel` | `string` **|** `null` | Scope level for the endpoint (e.g. Subscription, ManagementGroup). |  |
| `servicePrincipalId` | `string` **|** `null` | Service principal id used by the endpoint when the scheme is ServicePrincipal. |  |
| `sharedProjectIds` | `array` **|** `null` | IDs of additional projects the endpoint is shared with (preserves audit fidelity for projects not ingested). |  |
| `statusMessage` | `string` **|** `null` | Operation status message when the endpoint is failed or pending. |  |
| `subscriptionId` | `string` **|** `null` | Azure subscription id targeted by the endpoint (azurerm). |  |
| `subscriptionName` | `string` **|** `null` | Azure subscription display name targeted by the endpoint (azurerm). |  |
| `targetUrl` | `string` **|** `null` | Remote endpoint URL the service connection targets. |  |

---

## Release Notes

-   **2025-07-31** — Azure DevOps repository entities now carry the CodeRepo entity class in addition to Repository, enabling cross-integration code repository queries.

---

Source: /integrations/directory/backstage

# Backstage

Visualize your Backstage software catalog in JupiterOne — components, APIs, systems, domains, resources, groups, and users — map which components provide and consume which APIs and depend on which resources, how systems roll up into domains, and which teams and people own each catalog entity, then monitor ownership gaps and catalog changes through queries and alerts.

## Installation

This integration connects to your self-hosted Backstage instance using the Backstage [Software Catalog API](https://backstage.io/docs/features/software-catalog/software-catalog-api/) and ingests the catalog entities of seven kinds: Components, APIs, Systems, Domains, Resources, Groups, and Users. It only reads `GET /entities/by-query`, filtered by kind. Backstage is usually hosted on your own network, so the integration normally runs on a [JupiterOne Collector](/integrations/development/collector.md) that can reach the Backstage backend over HTTP or HTTPS.

### Configuration in Backstage

Before you configure the integration in JupiterOne, prepare the following:

-   The **Catalog API base URL** of your Backstage backend. This is usually your `backend.baseUrl` with `/api/catalog` appended, for example `https://backstage.example.com/api/catalog`. The JupiterOne Collector must be able to reach it.
    
-   A **static access token** for the integration, unless your catalog allows unauthenticated reads. Backstage backends are secure by default, so in most installations you need one. To create it, add a `static` entry under the `backend.auth.externalAccess` key of your app-config (for example `app-config.production.yaml`) and restart the backend:
    
    ```yaml
    backend:
      auth:
        externalAccess:
          - type: static
            options:
              token: ${JUPITERONE_BACKSTAGE_TOKEN}
              subject: jupiterone-integration
            accessRestrictions:
              - plugin: catalog
                permissionAttribute:
                  action: read
    ```
    
    The token can be any string without whitespace, but should be long enough that it cannot be guessed. Backstage suggests generating one with `node -p 'require("crypto").randomBytes(24).toString("base64")'`. The subject is any string without whitespace that identifies the caller in Backstage.
    
    The `accessRestrictions` block is optional, but recommended: without it, the token has unlimited access to every Backstage backend plugin. `plugin: catalog` limits the token to the catalog, and `permissionAttribute` with `action: read` limits it to read actions. Backstage applies the `permissionAttribute` restriction only where permission checks are enabled. See [Service to Service Auth](https://backstage.io/docs/auth/service-to-service-auth/) for details.
    
    The integration sends the token in the `Authorization: Bearer <token>` request header.
    
-   If the Backstage backend presents a self-signed or internal-CA TLS certificate, get the **CA certificate** in PEM format so the collector can verify the connection.
    

Once you have obtained the information above, proceed to JupiterOne to finalize the integration.

### Configuration in JupiterOne

To install the Backstage integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Backstage**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Backstage account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Catalog API Base URL** of your Backstage catalog, for example `https://backstage.example.com/api/catalog`. It is required and must be an `http` or `https` URL that includes the `/api/catalog` path.
    
-   Optionally, the **API Token** created above. Leave it blank only if your catalog allows unauthenticated reads.
    
-   Optionally, under **Additional Options**, a **CA Certificate** to trust a self-signed or internal-CA certificate, or enable **Disable TLS Verification** to skip certificate validation (not recommended).
    

When you save the instance, JupiterOne checks the configuration by requesting one catalog entity. A rejected token, or a URL that cannot be reached, fails this check.

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default.** If you enable none of them, the integration ingests only the `backstage_account` entity that represents your Backstage instance, so enable the catalog kinds you want to ingest. To get the full catalog graph, enable all seven.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Fetch Components** | Backstage catalog Components (`kind=component`), with their type, lifecycle, and namespace | `backstage_component` |
| **Fetch APIs** | Backstage catalog APIs (`kind=api`), with their type, lifecycle, and namespace | `backstage_api` |
| **Fetch Systems** | Backstage catalog Systems (`kind=system`) | `backstage_system` |
| **Fetch Domains** | Backstage catalog Domains (`kind=domain`) | `backstage_domain` |
| **Fetch Resources** | Backstage catalog Resources (`kind=resource`), such as databases, buckets, and queues | `backstage_resource` |
| **Fetch Groups** | Backstage catalog Groups (`kind=group`), such as teams and business units | `backstage_group` |
| **Fetch Users** | Backstage catalog Users (`kind=user`), with their display name and email | `backstage_user` |

Every ingested entity is linked to the `backstage_account` entity with a `HAS` relationship. The relationships between catalog entities are built only when the data sources on both sides are enabled:

-   Component to API (`PROVIDES` and `USES`) requires **Fetch Components** and **Fetch APIs**.
-   Component to resource (`USES`) requires **Fetch Components** and **Fetch Resources**.
-   Component to subcomponent (`HAS`) requires **Fetch Components**.
-   System to component, API, and resource (`HAS`) requires **Fetch Systems** and, respectively, **Fetch Components**, **Fetch APIs**, or **Fetch Resources**.
-   Domain to system (`HAS`) requires **Fetch Domains** and **Fetch Systems**.
-   Domain to subdomain (`HAS`) requires **Fetch Domains**.
-   Group to subgroup (`HAS`) requires **Fetch Groups**.
-   Group to user (`HAS`) requires **Fetch Groups** and **Fetch Users**.
-   Group ownership (`OWNS`) of components, APIs, systems, domains, and resources requires **Fetch Groups** and the data source of the owned kind.
-   User ownership (`OWNS`) of components and APIs requires **Fetch Users** and, respectively, **Fetch Components** or **Fetch APIs**.

Relationships are built from the relations Backstage reports for each entity. A relation that points at an entity that was not ingested, because its data source is disabled or it is not registered in the catalog, is skipped. An owner written without a kind (for example `owner: team-a`) is treated as a Group, as in Backstage. The integration does not create mapped relationships to entities from other integrations.

The integration does not collect:

-   Entity annotations (`metadata.annotations`).
-   API definitions (`spec.definition`). Each `backstage_api` only records whether a definition is configured, in `isDefinitionConfigured`.
-   Catalog kinds other than the seven listed above, such as Locations and Templates.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Backstage Software Catalog API](https://backstage.io/docs/features/software-catalog/software-catalog-api/)
-   [Backstage Service to Service Auth (external access tokens)](https://backstage.io/docs/auth/service-to-service-auth/)
-   [Backstage System Model](https://backstage.io/docs/features/software-catalog/system-model/)
-   [Backstage Descriptor Format of Catalog Entities](https://backstage.io/docs/features/software-catalog/descriptor-format/)

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `GET /api/catalog/entities/by-query?filter=kind=api`
-   `GET /api/catalog/entities/by-query?filter=kind=component`
-   `GET /api/catalog/entities/by-query?filter=kind=domain`
-   `GET /api/catalog/entities/by-query?filter=kind=group`
-   `GET /api/catalog/entities/by-query?filter=kind=resource`
-   `GET /api/catalog/entities/by-query?filter=kind=system`
-   `GET /api/catalog/entities/by-query?filter=kind=user`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://backstage.io/docs/features/software-catalog/software-catalog-api/](https://backstage.io/docs/features/software-catalog/software-catalog-api/)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `backstage_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| API | `backstage_api` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| Component | `backstage_component` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Domain | `backstage_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| Group | `backstage_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Resource | `backstage_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| System | `backstage_system` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `backstage_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `backstage_account` | **HAS** | `backstage_component` |
| `backstage_account` | **HAS** | `backstage_api` |
| `backstage_account` | **HAS** | `backstage_system` |
| `backstage_account` | **HAS** | `backstage_domain` |
| `backstage_account` | **HAS** | `backstage_resource` |
| `backstage_account` | **HAS** | `backstage_group` |
| `backstage_account` | **HAS** | `backstage_user` |
| `backstage_component` | **PROVIDES** | `backstage_api` |
| `backstage_component` | **USES** | `backstage_api` |
| `backstage_component` | **USES** | `backstage_resource` |
| `backstage_component` | **HAS** | `backstage_component` |
| `backstage_domain` | **HAS** | `backstage_system` |
| `backstage_domain` | **HAS** | `backstage_domain` |
| `backstage_group` | **HAS** | `backstage_group` |
| `backstage_group` | **HAS** | `backstage_user` |
| `backstage_group` | **OWNS** | `backstage_component` |
| `backstage_group` | **OWNS** | `backstage_api` |
| `backstage_group` | **OWNS** | `backstage_system` |
| `backstage_group` | **OWNS** | `backstage_domain` |
| `backstage_group` | **OWNS** | `backstage_resource` |
| `backstage_system` | **HAS** | `backstage_component` |
| `backstage_system` | **HAS** | `backstage_api` |
| `backstage_system` | **HAS** | `backstage_resource` |
| `backstage_user` | **OWNS** | `backstage_component` |
| `backstage_user` | **OWNS** | `backstage_api` |

### Backstage Account

`backstage_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`host` \*

 | `string` | The host of the Backstage catalog API base URL. |  |

---

### Backstage Api

`backstage_api` inherits from [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiType` \*

 | `string` **|** `null` | The API spec.type (e.g. 'openapi', 'asyncapi', 'graphql', 'grpc'). |  |
| 

`isDefinitionConfigured` \*

 | `boolean` | Whether the API has a spec.definition configured. The definition text itself is not ingested (it is large, changes on edit, and may embed credentialed URLs). |  |
| 

`lifecycle` \*

 | `string` **|** `null` | The API lifecycle stage (e.g. 'experimental', 'production', 'deprecated'). |  |
| 

`namespace` \*

 | `string` **|** `null` | The catalog namespace the API belongs to. |  |
| 

`uid` \*

 | `string` **|** `null` | The Backstage-generated uid of the API (not a stable external reference). |  |

---

### Backstage Component

`backstage_component` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`componentType` \*

 | `string` **|** `null` | The Component spec.type (e.g. 'service', 'website', 'library'). |  |
| 

`lifecycle` \*

 | `string` **|** `null` | The Component lifecycle stage (e.g. 'experimental', 'production', 'deprecated'). |  |
| 

`namespace` \*

 | `string` **|** `null` | The catalog namespace the Component belongs to. |  |
| 

`uid` \*

 | `string` **|** `null` | The Backstage-generated uid of the Component (not a stable external reference). |  |

---

### Backstage Domain

`backstage_domain` inherits from [Domain](/data-model/schemas/Domain.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainType` \*

 | `string` **|** `null` | The Domain spec.type, if set. |  |
| 

`uid` \*

 | `string` **|** `null` | The Backstage-generated uid of the Domain (not a stable external reference). |  |

---

### Backstage Group

`backstage_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`groupType` \*

 | `string` **|** `null` | The Group spec.type (e.g. 'team', 'business-unit', 'product-area'). |  |
| 

`uid` \*

 | `string` **|** `null` | The Backstage-generated uid of the Group (not a stable external reference). |  |

---

### Backstage Resource

`backstage_resource` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`resourceType` \*

 | `string` **|** `null` | The Resource spec.type (e.g. 'database', 's3-bucket', 'queue'). |  |
| 

`uid` \*

 | `string` **|** `null` | The Backstage-generated uid of the Resource (not a stable external reference). |  |

---

### Backstage System

`backstage_system` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`systemType` \*

 | `string` **|** `null` | The System spec.type, if set. |  |
| 

`uid` \*

 | `string` **|** `null` | The Backstage-generated uid of the System (not a stable external reference). |  |

---

### Backstage User

`backstage_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`namespace` \*

 | `string` **|** `null` | The catalog namespace the User belongs to. |  |
| 

`uid` \*

 | `string` **|** `null` | The Backstage-generated uid of the User (not a stable external reference). |  |

---

## Release Notes

-   **2026-10-06** — New Backstage integration: ingests the Backstage software catalog, including components, APIs, systems, domains, and resources with their relationships.

---

Source: /integrations/directory/bamboohr

# BambooHR

Visualize BambooHR users and files, map BambooHR users to employees and managers, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to [generate a REST API key](https://documentation.bamboohr.com/docs/getting-started) before initiating the integration in JupiterOne. Once the API key has been retrieved, proceed to JupiterOne to continue.

> **INFO**
> 
> As described in the BambooHR documentation, the API key will have the permissions of the associated user. This means the user must have sufficient permissions to create an API key, [list users metadata](https://www.bamboohr.com/api/documentation/metadata.php), and [list employee files](https://www.bamboohr.com/api/documentation/employees.php) (we do not read the content).

### Configuration in JupiterOne

To complete the BambooHR integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select BambooHR. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the BambooHR account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Client Namespace** (subdomain) for your BoombooHR account.
    
-   The BambooHR **API Key** generated for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

> **NOTE**
> 
> The users listing API includes user records of employees that have been terminated (`status: 'disabled'`, `active: false` in the User entity). BambooHR employee records also have an `employeeNumber` that is assigned when the employee is created and which may later be modified. There is a permanent `id` property that does not change and very likely is not equal to the `employeeNumber`.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `bamboohr_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Employee | `bamboohr_employee` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| File | `bamboohr_file` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| User | `bamboohr_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `bamboohr_account` | **HAS** | `bamboohr_employee` |
| `bamboohr_account` | **HAS** | `bamboohr_user` |
| `bamboohr_account` | **HAS** | `bamboohr_file` |
| `bamboohr_user` | **IS** | `bamboohr_employee` |
| `bamboohr_user` | **HAS** | `bamboohr_file` |

### Bamboohr User

`bamboohr_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `department` | `string` |  |  |
| `division` | `string` |  |  |
| `employeeId` | `string` |  |  |
| `jobTitle` | `string` |  |  |
| `lastLogin` | `number` |  |  |
| `location` | `string` |  |  |
| `mobilePhone` | `string` |  |  |
| `supervisor` | `string` |  |  |
| `webLink` | `string` |  |  |
| `workEmail` | `string` |  |  |
| `workPhone` | `string` |  |  |

---

---

Source: /integrations/directory/bigid

# BigID

Visualize BigID data sources, finding objects, and users, map BigID users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to create an API Token within BigID. During creation, set the desired expiration period for the token, and copy the token for use within JupiterOne.

> **INFO**
> 
> For more information on BigID API Token generation, see [their documentation](https://developer.bigid.com/wiki/BigID_API/Token_Authentication).

### Required Permissions in BigID

The API Token must have **read-only access** to the following resources:

-   **Data Sources** (`/api/v1/ds-connections`) - to retrieve data source configurations
-   **PII Findings** (`/api/v1/piiRecords/objects/file-download/export`) - to retrieve privacy and compliance findings
-   **Users** (`/api/v1/access-management/users`) - to retrieve user accounts and access information

The integration uses session-based authentication via `/api/v1/refresh-access-token` and requires no write or modification permissions.

### Configuration in JupiterOne

To install the Rumble integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Rumble. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Rumble account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Lastly, depending on your authentication preference, input either of the following credentials:
    
    -   For configuring the integration with an Account API Key then put the key in the Rumble **Account API Key** field.
    -   For configuring the integration with an Export Token, provide the token in the **Export Token** field.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `bigid_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| BigID User | `bigid_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Data Source | `bigid_datasource` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| PII Object | `bigid_pii_object` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `bigid_account` | **SCANS** | `bigid_datasource` |
| `bigid_account` | **HAS** | `bigid_user` |
| `bigid_datasource` | **HAS** | `bigid_pii_object` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `bigid_account` | **SCANS** | `aws_s3_bucket` | FORWARD |
| `bigid_datasource` | **IS** | `aws_s3_bucket` | FORWARD |
| `bigid_pii_object` | **HAS** | `aws_s3_bucket` | REVERSE |

### Bigid User

`bigid_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `lastLoginOn` | `number` |  |  |

---

---

Source: /integrations/directory/bitbucket

# Bitbucket

Visualize Bitbucket Cloud workspaces, map Bitbucket Cloud users to employees, and monitor changes through queries and alerts.

## Installation

To install the Bitbucket Cloud integration, you will need to configure settings both within Bitbucket and on JupiterOne. Before enabling in JupiterOne, ensure that you have completed the setup within Bitbucket.

This integration only works with Bitbucket Cloud and not Bitbucket Server.

### Bitbucket configuration

To set up this integration, you will need to ensure your Bitbucket workspace has an OAuth consumer configured. You will also need to provide the name of your **Bitbucket Workspace** and obtain the Oauth **Client Key** and **Secret Key** for use within JupiterOne.

To ensure your Bitbucket Workspace Oauth consumer is configured:

1.  From your profile avatar in the bottom left, click on the workspace in the **Recent workspaces** list or click **All workspaces** to open an entire list from which to choose.
2.  Click **Settings** on the left sidebar to open the Workspace settings.
3.  From the left-hand navigation, select **Apps and features > OAuth consumers**.
4.  If you already have an OAuth consumer for this workspace, you can use it for JupiterOne. However, Bitbucket enforces rate-limiting per OAuth consumer, so it may be wise to configure a new OAuth consumer specifically for JupiterOne's use. To configure a new OAuth consumer, click the **Add consumer**.
5.  Add a **Name** for this consumer. This only appears in your list of OAuth consumers for this workspace. For example, `JupiterOne integration`.
6.  Add a **Callback URL**. This URL is not used for anything, but the OAuth 2 authentication flow requires it, and it must be in URL format. For example, `https://jupiterone.com/`.
7.  Check the box labeled **This is a private consumer**. This is required for the way the integration authenticates.
8.  Set permissions for this consumer. The integration requires Read access to **Account**, **Projects**, and **Repositories**. If you plan to ingest pull requests into the JupiterOne graph, or think you might later, the integration also needs Read access to **Pull requests**. If you want to, you can also enable Admin access to **Repositories** to ingest permissions and branch restrictions.
9.  Click **Save**. The system generates a key and a secret for you. Make a note of the client id and client secret, along with the name of the workspace to be accessed.

With the above completed, continue to JupiterOne to complete the integration setup.

### Configuration in JupiterOne

To install the BitBucket integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Bitbucket. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Bitbucket account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Bitbucket **Client Key**, **Secret Key**, and **Bitbucket Workspace** (the name of your BitBucket Workspace).
    
    -   **Optional** set the **Bitbucket Ingest Pull Requests** field to false if you want to disable the ingestion of pull requests into the JupiterOne graph. By default, whenever the integration is run, JupiterOne will ingest any PR created or modified in the last 24 hours.
    -   **Optional** set the **Bitbucket Enriched PRs** field to true to get additional information on each PR, such as who reviewed it. Note that this has performance implications, which is why it is disabled by default. See below.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Details on pull request data ingestion

Generally, when JupiterOne ingests data from an integration, any entities not ingested are deleted from the JupiterOne graph if they exist. For example, if a Project gets deleted from your Bitbucket account, it will disappear from the JupiterOne graph the next time the integration runs.

Since Pull Requests are only ingested from the last 24 hours (for performance reasons), previous Pull Requests in the JupiterOne graph are not deleted. Even if the PR is deleted from Bitbucket, the JupiterOne integration will have no way of knowing if the PR was deleted or is merely untouched in the last 24 hours.

That said, if the Repo that owns that Pull Request is deleted from Bitbucket, the JupiterOne graph will delete the Repo, and then it will delete any orphaned Pull Request entities that were owned by it. This same "cascading delete" would apply if higher-level objects (Projects, Workspaces) were deleted from your Bitbucket account.

### Details on rate limiting

Bitbucket enforces a rate-limit of 1000 per hour per OAuth consumer, on API calls related to Repositories and Pull Requests. JupiterOne ingestion exceeds this rate, so you might see a rate-limit error on your account if your workspace has enough data.

You can get around this limit by adding additional OAuth consumers to your Bitbucket workspace, and then updating your JupiterOne Bitbucket integration configuration to use a comma-delimited list of OAuth keys and secrets.

To do so, put the comma-delimited list of OAuth client keys in the **Bitbucket Client Key** field of your integration configuration. Do the same for the matching OAuth client secrets in the **Bitbucket Client Secret** field, being careful to make sure the secrets are in the same order as the keys.

> **NOTE**
> 
> The integration will attempt to validate all of the key/secret pairs before starting ingestion, and throw an error if any of them is invalid. Assuming they are all valid, the integration will automatically switch to each new OAuth consumer sequentially when it encounters a Bitbucket rate limit, and will not throw a rate-limit error unless is exhausts all OAuth consumers.

You can calculate the minimum number of API calls that count against this limit as:

-   If not ingesting Pull Requests: (#Repos)/10
-   With Pull Requests (default status): (#Repos)/10 + (#PRs)/10 + (2\*#PRs)
-   With Enriched PRs: (#Repos)/10 + (#PRs)/10 + (3\*#PRs)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Bitbucket Branch Restriction | `bitbucket_branch_restriction` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Bitbucket Group | `bitbucket_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Bitbucket Permission | `bitbucket_permission` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Bitbucket Project | `bitbucket_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Bitbucket Pull Request | `bitbucket_pullrequest` | [Review](https://docs.jupiterone.io/data-model/schemas/Review), [PR](https://docs.jupiterone.io/data-model/schemas/PR) |
| Bitbucket Repo | `bitbucket_repo` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Bitbucket User | `bitbucket_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Bitbucket Workspace | `bitbucket_workspace` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `bitbucket_branch_restriction` | **ALLOWS** | `bitbucket_group` |
| `bitbucket_branch_restriction` | **ALLOWS** | `bitbucket_user` |
| `bitbucket_group` | **HAS** | `bitbucket_user` |
| `bitbucket_group` | **HAS** | `bitbucket_permission` |
| `bitbucket_project` | **HAS** | `bitbucket_repo` |
| `bitbucket_repo` | **ALLOWS** | `bitbucket_permission` |
| `bitbucket_repo` | **HAS** | `bitbucket_branch_restriction` |
| `bitbucket_repo` | **HAS** | `bitbucket_pullrequest` |
| `bitbucket_user` | **OWNS** | `bitbucket_group` |
| `bitbucket_user` | **HAS** | `bitbucket_permission` |
| `bitbucket_user` | **OPENED** | `bitbucket_pullrequest` |
| `bitbucket_user` | **APPROVED** | `bitbucket_pullrequest` |
| `bitbucket_user` | **REVIEWED** | `bitbucket_pullrequest` |
| `bitbucket_workspace` | **HAS** | `bitbucket_user` |
| `bitbucket_workspace` | **HAS** | `bitbucket_group` |
| `bitbucket_workspace` | **OWNS** | `bitbucket_project` |
| `bitbucket_workspace` | **OWNS** | `bitbucket_repo` |

---

Source: /integrations/directory/bitdefender

# Bitdefender

Visualize Bitdefender accounts, users, policies, and endpoints, and monitor changes through queries and alerts.

# Installation Guide

## Requirements

To set up this integration, you must have a Bitdefender account with Administrator user access.

### Authentication

This integration uses **API Key Authentication** for making API calls.

#### Generating an API Key in GravityZone Control Center

Follow these steps to generate an API key:

1.  **Log in** to [GravityZone Control Center](https://gravityzone.bitdefender.com).
    
2.  Click your **username** in the upper-right corner of the console and select **My Account:**
    
    ![My Account](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAVsAAADFCAIAAAB1tsY9AAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAydpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDkuMS1jMDAyIDc5LmE2YTYzOTY4YSwgMjAyNC8wMy8wNi0xMTo1MjowNSAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIDI1LjEyIChXaW5kb3dzKSIgeG1wTU06SW5zdGFuY2VJRD0ieG1wLmlpZDpCMjA0MUY4NDkyRDMxMUVGQTc1QkREMzIwQkNBQ0EzQSIgeG1wTU06RG9jdW1lbnRJRD0ieG1wLmRpZDpCMjA0MUY4NTkyRDMxMUVGQTc1QkREMzIwQkNBQ0EzQSI+IDx4bXBNTTpEZXJpdmVkRnJvbSBzdFJlZjppbnN0YW5jZUlEPSJ4bXAuaWlkOkIyMDQxRjgyOTJEMzExRUZBNzVCREQzMjBCQ0FDQTNBIiBzdFJlZjpkb2N1bWVudElEPSJ4bXAuZGlkOkIyMDQxRjgzOTJEMzExRUZBNzVCREQzMjBCQ0FDQTNBIi8+IDwvcmRmOkRlc2NyaXB0aW9uPiA8L3JkZjpSREY+IDwveDp4bXBtZXRhPiA8P3hwYWNrZXQgZW5kPSJyIj8+pFsVnQAAF3tJREFUeNrsnQlcE9fah08SIGwBVEBZDJsIyqYgIC64FlGhKN6q9Xrtrdf+KrXVbtJaq2211WoXrrXWpVY//Vy+1opL4Yr0qhRxQcAFURYLEoQiyCKySAIh3yujEdDaoAET+T+/GGfOnDmzZM5z3ncSEp5EImEAANCMDv0Ti8U4EQCAgoICPs4CAEAJjAAAaJ01FBQW4EQAAO4aQWyL+wigk+hp1x8nofMpkVxWpRruIwAAWgEjAABgBAAAjAAAeDQ6OAVAwzF0H288aIq+rTsT6D1+K3JZfWFGTereuoxDWnTs010NnrPXG2ip28uQR7PX6xTnSht+zZf9X9ZtGAF0RboFvSUK+IcaGhLo6dt506Pa2rUyPkorXBDpZ2Rj3CqKtzHm2RgLQxyFtGj1mdqO8AKyBqDR0YF6dNACapCa1fAD/2y4aM1oURsdtFYDnypQNRgBdCEoWdCiZtWogzkeBqrUpGpqlwKMADSXO/cOtKdZdSULKupAKQVaBfcRQNfgL24l8nw9dF524Lua8oRcgVxxtbIp7nzjjmLFEzR7h7EfbPj4BX+xkNVfT961Yu7H/+WKbcOXLF80dUBPAasv/PXzdyO3pKvlOG0jftjyVoAFqzwv2LawucSKBS1jHnaM6bGmYnbybZZcfKcw5HPmZsekZ9m/31auHOlnpMYbCogRgFZi7ai7Y4bwO1+BrzlPpMv0uIc+z8VKsGC88OjzusEmj9+4+NWt370a6NxdyHSEpk6BEV9sjbBv1sQXG/49x19s0lzuErJyy4YZajmY+asXjbU1NRKaVlYa6zR3yb4RbKAdO/c+++pFdl3EBkbc0UHY18xFxAqLH7ynoMYwAUYA2sdQX70dIwUu+i2K5EzWdH9OZC5YHqK34HH/Xmf2JH9TJk39JkjcN+jjU9Wsu/+iLcvHjl3+cZijkFUnraDyKVuyGbMYOOWfT3os4oCXo8Y73Y1xck/dLc1ZynYvZefOMlbMqsqZvjFjxoxfzBLeY5WyBxt5zl5PXecWWQPQtujAQ2+5B//+/TRZ056TDavzKE3gBQ/RjXS9t0ifP3OYXnmMbMetdm/CVEBP1TevFdJ/66dvGHtu4TCnkC3fCYVC6ZWfFk7ZeKf8Vp2UQnp9kyc5FNvZ3235eKKtUFlQnHV/YcHp5v8GM1s7Vp7I2BW2rzlTmPCQhgZa6sIIoEtiovPpgBY6YIoTybLVeXen407KhMbCD2157J4UIgJ1jsY0/tHOjey9kDfDxXHsp4lJc5p1UkdhgkhIHbe2mnlFJsVHMh0TMY3r0syUg49/KJSDtNLBHQvdaF3Fik2LZCIJS/rPo5viPr+ErAF0OXy9BR4th0OZIvVKqwoHihXVLWb1LAURNu3eStLC1etTypjQ3NnF8c7D9p6CjO6VOJkLa/Nily/4OP+xfbBm5VRH4aNqOLMX1zFbKUv4lF0u7rQzjBgBaBGCv1vx2ly/PdpUMWSt36Dn+fYTsCK5Co1/+N/LU/q2mJdK2Z24gFWnblz+w71w3nPWkoiBItZIC23GLvqlYNHd8pJTX/j+a5fqR/Lm3MCH3OUQWbBbJXeThX98yHoUs0NLVdHB9ToFjAC6YMrAd2hzT53PHz2Kv+aY8qYif7Vd27C3hxnfmslVSByE+kbChw7a9aUx0dF3p3tOXdLcb4TC1l3H1EjYniOZMdzpYfWtXO8awXcqszZmTXZs3DY2jubLWeKLzH43E/dgfD2mY8feime3z7IN73PrnSttgBFA16M378EP6Fk76MWJ5Ad+byoz4If1Fbg8+DacPm80Yzs060iED+95TgEs+7c7Eylvs5QHlqa9+GfN/ZovgxEAuBcFmAtmmwuehSPxCGZJW+8lDqpSVNOkxk8owQhAe7h5565hyzBBVtN0NFd+oup+iYO1INiBb93SDzJFtsYdiWPPP3vbctjL7D+ft6ut1Wdq1bhnMALQHooURTJmfe/DOLIqeeTehhNt6vwuX5+v+9MogcM9KVRXK1JUan3j+68lW06cv36ibfv26tb59R/tSik+345Vwi1MHxEmlOSwtGgVW9p88bZ6/yYa7z4CLaIxtVI5rbiQ84AOOAoaDpbev/eeX9yoWuOFSbEx0bWPkZBLS6JjYk8VtmMNNwvLRywdO5/5hKuog8XHq9V7imEEoE1sOS+/2tSeFark689r3FFEuP1VGEJSmPA+M+n5iHsHC45Wq10HMALQusShYU2uonkc5/l66UU6PvhZPV7wEL3Z3McW5IoDKQ0pGncMIcP6qPClBpQ+RPzIJrxbKZBS/5c3KehBEzF5UnKB9/ayDvpiNdxHAFrGieOy9YZ6C2x4TI//wkhh8KCm9KKmEyWKaj3eIFu+ryX/7o2GJkXKWdmnmvhzZblbV0TuVT0nKRa1LyWBEUAXQ7HjsKxsiG5kX76Iz0TG/KEu9GhdRaaIS5UtyVLLJ/lEvnNjkqbenTG1f/LvLMr8b3Rmq4IX16QsCbybIeTsFU/69CmeXGQNoPNoampSlxTiTspGxzTc+SuG1h9QltUrUrIbZu6QPqYOUnJLH7gRKbRwvPvnDC6OlsIHx/DCi094NLv3JhUyoZFQKKxOOfQ/T/c14kkkErEYv/sIOskIA/xHlZTeULG++KOzKl7Gvg584/qmY8WqWqDgE+8/XWbvP9HbQtXPJEtvpMYmqyU1EQf4m55KvtgBp93M1CQ7/bRKp6WgAFkD6MSIlM/v1aun6kZQPWRIuSpXW2P5ybH5T+HkFJxK7qCWbWyskTUADcXTvT2/DS2XdchOdFCzmsoAT3cYAWgo3gM8Va9cX5jREfvQQc1qLH6DBsIIQEMZ7OfTv5+LipVrUvd2xD50ULOaiZeH29AAPxgBaCiODnaTQieoWLku41D1qf9V7w5Qg9r1049PyMTg53rbtuNrpHBnEXQ2f5sckpJ27tcjCapUroyPkv6R1WV/CfYJGTNyeFho+37SDkYAnY2NtdXsl2bkXc3PzctXMVLoUt1YXbj07fPqnJfs7Xq3ay1kDeApMHrEsMi333Dv74pT0XE6eOv1V0cMH9LeFREjgKfDpNDxJiaijZu3JSSewNlQe7JA0cFj6ABGAE85UnBxdvo5+pf9MYcuZ2bjhDw5Xh5uE4OfCwsd395kQQk+xQyePtdLSo8mJKWknr2UlZOVfUUqleKcqI6ZqYmNjfUAT3e/QQOHBvi1652FNhQUFMAIAID7RsCdRQDAfWAEAACMAACAEQAAj6bz3n3clco2nmDJEiZtxGkHoGMR6jB/O/bqUDZjkEYa4d39LOEKWxLMglyZgS5eLwA6ltsNLD6LLY9jZwvZl5M0LGug6IB0cPxNFuYBHQDQGVBHo+5GnY66HnVAzTICJQsUHcAFAHS+F6jrbTyhYUZIltxJFgAAnQ91PeqAmmUEaSMCBACeWpjQrnv5ePcRAAAjAABgBAAAjAAAgBEAADACAABGAADACAAAGAEAACMAAGAEAACMAACAEQAAMAIAAEboaNLT01esWCGRSPACA6D1RoiPj1+5cuW1a9e42eLi4lWrVq1bt662tpYrycrKWrZs2fnz5/H6AfDsG0EsFjc0NJSXl3OzJSUlt2/frqqqKisrUzpCKBT27NkTrx8Az74RevToYWBgUFRUxM1evXrVzMyMz+eXlpbSrFwuLywspJJu3brh9QNAvWjir8WLRCJTU1Pq/xQpUP+nCXt7+8rKSlKDr69vXV0dTffu3VtfX58q5+TkxMXFUYmOjo6bm9v48eMpfGjToLIOacXJySksLMzIyKixsTExMfH06dMymczQ0HDMmDHe3t48Hi89PT0mJsbBwSEvL4/qUP3Ro0cfOnSINESbCAwMHDZsGFXjgpf9+/fTM81S/dDQUNptXFIAMYKaoa5uYWFx8+ZNShaoG9+6dcvV1dXS0vLGjRu1tbVUTs+2trZUUyKRUJ/08PBYvHjxSy+9RMqgrqtQKFq2RkI5cOCAubn566+/PmXKFMo4YmNjSTSkg5SUlHHjxi1YsMDf3//w4cMXL17kViFHUIU5c+aEh4eTCLZt29anTx9a3cvLi9airVCdioqK3bt3U+by3nvvzZs3j3Zp3759tCIuKQAjqB8ackkH1OtoBObyCAoTqNeRHa5fv05DPWeEs2fP0qKhQ4fS6E0lfn5+NLBXVVW1bOrSpUt6enohISFUs3///jNnzqTBnAKNjIwMn2Yo+6CRn2KBtLQ0ikpoFapPgQD1dqpvY2PTvXt3UgatTs+0iHsLIzMzk0IDCh8oJKEKI0aMoF0l3eCSAsgaOuRWAvU3CgpoiKbh3czMjAqphHodlRgbG5uYmNTX11OFmpoaCgG4tcgFVNjGCLSKgYEB9WRulrsfSb2aVqS4gyuklmmL1DKZQllCzwKBQFdXl5vmTEEyovCBpq9duyaVSikkoRKapRVpts2mAYAR1AONutTnc3NzKSigUZq6Jc3SYJ6dnV1dXU05hZGREfVA6o00HRQUpFyReq+hoWEn9EzatEgkGjVqVMvbFrRpXFIAWYP6oa5FoUF+fn5ZWRnF81RCHc/KyorGdhrzKafgSmhgp+SCJkybUSgUFPZTBtGyKQoKqI4ywy8vLy8tLSXjUKDBvXlB0IpUToWqd2nyFDVLUQO3adoozZK5cEkBGEH90FBva2tLKQB1OeXnDuzt7anX0eDcq1cvrsTHx6eysjI2Npb6c05OzrZt2+Li4rionqitrSVBuLm5kQ5iYmK4Otu3b4+Pj6c8wt3dPa0ZaiExMZHiEWpN9S7dv39/yin2799fXFxMGcTOnTv37dtHu5eRkREVFfXbb7/h2gLIGtQJDcKkA4oCaDDnSijtN2yGBnOuRCwWT548mZL5tWvXUv90dXWdMGECTVA0QYHDTz/9FB4e7unpGRYWRqb49ttvySZcHe59RGrh8OHD3LuP48aN8/DwUH33KIWZPn16dHT0pk2byF+0JyEhISSampoaymsqKipwbQFthEdxOF3NHbuN+UzxTVc5oUVFRbt27SI79OvXD5cX0IhOrnIHLCgowN8+qhMKN5KSkiihcHZ2xtkAyBq6OpTmTJs2DecBaC+IEQAAMAIAAEYAAMAIAAAYAQAAIwAAYAQAAIwAAIAR2nDs+GmvYaGXMq+ovsqZtHQ3//E/H4jDyw+ANhnhSm6+76hwetCEGpt1sLN97ZW/+wxwx8sPQBs0+lPMyakXqmtqFQoFTTg72aurWQvz7vPmzMRrD4A2xQhSqSwhKXl04OCh/t40QbN4tQDoukYoKPzjQkZW8NjAoDHDaYJmlYsST5wJeG6qy6Cg4cHTE0+mtryn4Dk0JHLpavfBE2jpgvc//T1P8q/XF9E0lezac5D7muZLmVe8hoVSZeUqn3y+lp6p2ow5b5eUluGyADCCJqYMQqHeQM/+Pl5u3CxXTp088qMvKHA49suODVHLz1241CaykDU0xPz0/YaoZSeTz0795/wRw/yo5ssz/7bi643nL2Y+NBiprLp1cPfGHZu+vFZYvGrNpsZ738IEAIygQSlDf9c+luY9xLbWXu6uysTh+KnUbmam77/1qrWVpVs/59de+XvLFUki/5r5N3uxzfAhvgG+A1z7Ok55PphqTp083sxU9FAjKFfx9fYMfz4oPSP75s1buDIAjKBxKYO3p1tVdTU9XJwdlYlDVk5uj+5mhoYGXE3d1t+zyuPxuK9L1xEIDAz0+XwB993q1O11dHQaGxsf3JZyFcLYyJAChCZFE64M0DXR0PcaKEe4VV0T9d1WerQsVOM7DgAA7YgRuJSBYvhzxw9mp8bTIzVhnzJxcO3rVF5xs67uNle54WHDPgDg2TEClzKMGOpraKDPlYiMjQKH+HKJw/CAQZU3qz6P2vhHcemlzCvffb8TryIAz7IRuLcVRg7zb1k4dLDP7XopLerjaLf6k4Unks+OCp355qLPhg/xxasIgLrAt7MD8Kx3cnw7OwDg2ckaAAAwAgAARgAAwAgAABgBAAAjAABgBAAAjAAAgBEAADACAABGAADACAAAGAEAACMAAGAEAACAEQAAMAIAAEYAAMAIAADV6aRfcJFIJDjXADwl7DTOCHZ2dnhZAEDWAACAEQAAMAIAAEYAAMAIAAAYAQAAIwAAYAQAAIwAAIARAAAARgAAwAgAABgBAAAjAABgBAAAjAAAgBEAADACAABGAADACAAAGAEAACMAAGAEAACMAACAEQAAMAIAAEYAAMAIAAAYAQAAIwAAYAQAAIwAAIARAAAwwlPmxx9/fP7551etWiWXy5WFlZWVERER06dPz8nJ0dLTXdMMLjsAIzwOaWlp2dnZytn4+PiioiKtPt0bmsFlB2CEdqPfzP79+xsbG2m2tLT06NGjvXr10t5zTQdSV1eHaw7ACI+DiYnJhAkT0tPTMzMzafbYsWNSqTQoKIhbmpKSMmPGjMuXL3OztbW177zzzrp16xQKhbKF6urqb775ZurUqWFhYfPmzbtw4QJXTnUSEhJmz55NiQkt3bJli0wmo/KKioqVK1dOmTKFq8+FJ9SNf/75Z0pVqPKsWbNoRW4Tp06dapm/UJozZ86c8vJymv7yyy/nz5//2WefTZo0iVqj9qkRqjlz5szU1NTExERqilbHxQdghPbh7+9vbW29d+9eiURy+PDhkSNH0iy3qE+fPqampsnJydwsVSguLvbz8+PxeMrV9+zZQ8r46quvqLtS/TVr1ly/fp3KMzIyKHQPDAykvvrKK69QMrJv3z7qtFR49epV6snkEUtLy6+//poCk/3NzJ07lyqHh4dTHVU6M2U3bm5umzdvJmvExsYeP37c0dGRGuzbty8d1NatW318fHDxAQ1ER5N3jsIE6oRr166NiorS1dWlkCE3N5db1K1bN09PT4ogKBAQiUSkBiqh/tZydRqfaTQ2Nzen6bFjx1JPLigooLzjyJEjzs7OFGLo6elROU2TaPLz8ykYobHd1dWV6r/55pu3b98WCoUUm4SGhpKMqJBih7y8PHLToEGDHr3nTk5OFM4YGhoGBwefPHmSwpNRo0bRHuro6FCbPXr0wJUHECM8DjSWOjg4UD8cPXo0jdttIggaiq9cuVJVVUXROPVSihpaVqBZTgcE9UM+ny+Xy6mfU6RAi0gHVE4xhb29PU3fuHGjoaFB2QJNkDtKSkooERCLxVwhVbaxsaGNkob+4rTy+Vy0wimAuxUCAGKEJ8XAwOCFF17YsWOH8g6CEhrbqX9yiUNlZSUJok0FGpl/+OGHmzdvUnxBvZ1cgNcbAO02AuHl5UXRAYXcbcopWRg4cCAZgXRgZWVlZ2fXcikFDps2bfL29p49ezYN1zk5OUuXLuUUQ4M/jfwymYwLEyQSibGxsYWFBYmD1uJWr6+vp3LaLkX4lGsEBASw5luSFCCQhmjTAoGgqalJKpXiGgLIGjpXWjo6vXv3fugiyhQo2j99+rSfn5+RkVGbtfT19SsqKqjTUvemZJ5ihNraWgrgx4wZQ7nGrl27ysrKEhISPvjgg19++YWE0q9fv++//z4rK6uwsDAqKmrlypV1dXWU/9NSqkaVDxw4cObMmXHjxpFKKJUgj+zZs4fEQcHIkSNHVDwc2h9SGPIIgBhB/Tg4ODg6Ol67do2M0GYRCWLWrFkUJkybNo267uTJk318fDZv3kw92d3dfe7cudu3b4+OjjY0NJw4cSLVoQCBCjdu3Lh48WLqrk5OTh9++CGFA5MmTWLNnywiO5iZmVEdLl6gQIOmv/322zfeeIOqkbNIDY/eWzIUxSw7d+68ePHismXL2twHBUAT4NF1rLxz1lHbmM8U33RIy3K5nEZyGnWXLFnCpQAAgMfugJQga/FfOslkst+bGTx4MHQAQFe5j/BnpKWlLVy4UCQSPfguAwCgy91HoHz+4MGDeAkBQIwAAIARAAAwAgAARgAAwAgAABgBAAAjAABgBAAAjAAAgBEAADACAABGAADACAAAGAEAACMAAGAEAACMAACAEQAAMAIAAMAIAIAH4P3l744AALoO/y/AACtK/yTfOSpQAAAAAElFTkSuQmCC)
    
3.  Navigate to the **API Keys** section and select **companies, accounts, policies, network** and click the **Add** button:
    
    ![Add API Key](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAARkAAABqCAIAAAAHs7KbAAAACXBIWXMAAAsTAAALEwEAmpwYAAAGMmlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgOS4wLWMwMDAgMTM3LmRhNGE3ZTUsIDIwMjIvMTEvMjctMDk6MzU6MDMgICAgICAgICI+IDxyZGY6UkRGIHhtbG5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI+IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6ZGM9Imh0dHA6Ly9wdXJsLm9yZy9kYy9lbGVtZW50cy8xLjEvIiB4bWxuczpwaG90b3Nob3A9Imh0dHA6Ly9ucy5hZG9iZS5jb20vcGhvdG9zaG9wLzEuMC8iIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIiB4bWxuczpzdEV2dD0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlRXZlbnQjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hvcCAyNC4xIChXaW5kb3dzKSIgeG1wOkNyZWF0ZURhdGU9IjIwMjMtMDMtMTRUMTA6MDY6NTUrMDI6MDAiIHhtcDpNb2RpZnlEYXRlPSIyMDIzLTAzLTE0VDEwOjMxOjM4KzAyOjAwIiB4bXA6TWV0YWRhdGFEYXRlPSIyMDIzLTAzLTE0VDEwOjMxOjM4KzAyOjAwIiBkYzpmb3JtYXQ9ImltYWdlL3BuZyIgcGhvdG9zaG9wOkNvbG9yTW9kZT0iMyIgeG1wTU06SW5zdGFuY2VJRD0ieG1wLmlpZDpmNzhmOGQ0YS01NDIwLTVhNDMtYTBkNi1kNTJmNTE4NGZiMjIiIHhtcE1NOkRvY3VtZW50SUQ9ImFkb2JlOmRvY2lkOnBob3Rvc2hvcDo5MmQyOTJlZS1lYzFkLWQzNDYtOGNlOC1lYjFjNWJjZWVjMDAiIHhtcE1NOk9yaWdpbmFsRG9jdW1lbnRJRD0ieG1wLmRpZDo3ZmU0NzJhZS05NzQ2LTYxNGItODllYS01YTExNzMzNzQxNDkiPiA8eG1wTU06SGlzdG9yeT4gPHJkZjpTZXE+IDxyZGY6bGkgc3RFdnQ6YWN0aW9uPSJjcmVhdGVkIiBzdEV2dDppbnN0YW5jZUlEPSJ4bXAuaWlkOjdmZTQ3MmFlLTk3NDYtNjE0Yi04OWVhLTVhMTE3MzM3NDE0OSIgc3RFdnQ6d2hlbj0iMjAyMy0wMy0xNFQxMDowNjo1NSswMjowMCIgc3RFdnQ6c29mdHdhcmVBZ2VudD0iQWRvYmUgUGhvdG9zaG9wIDI0LjEgKFdpbmRvd3MpIi8+IDxyZGY6bGkgc3RFdnQ6YWN0aW9uPSJjb252ZXJ0ZWQiIHN0RXZ0OnBhcmFtZXRlcnM9ImZyb20gYXBwbGljYXRpb24vdm5kLmFkb2JlLnBob3Rvc2hvcCB0byBpbWFnZS9wbmciLz4gPHJkZjpsaSBzdEV2dDphY3Rpb249InNhdmVkIiBzdEV2dDppbnN0YW5jZUlEPSJ4bXAuaWlkOmY3OGY4ZDRhLTU0MjAtNWE0My1hMGQ2LWQ1MmY1MTg0ZmIyMiIgc3RFdnQ6d2hlbj0iMjAyMy0wMy0xNFQxMDozMTozOCswMjowMCIgc3RFdnQ6c29mdHdhcmVBZ2VudD0iQWRvYmUgUGhvdG9zaG9wIDI0LjEgKFdpbmRvd3MpIiBzdEV2dDpjaGFuZ2VkPSIvIi8+IDwvcmRmOlNlcT4gPC94bXBNTTpIaXN0b3J5PiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRGPiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI/PvGGDd0AAA6vSURBVHic7d1fUFvXnQfwnwAF/THoSuavJP5JOEZgPDbGqWdgbAymsw9xYsckNk0mHTO78NI+7GQ3Ux7SpWlmvLPbp7YPNQ94nIE4cUidrftUDBYOdNL6bxNAuA7XgJASKpBkgf44AmkfTnV7IwkhXR1Acn+fyWTkc8/VPQP6nn/3WhYN9PcDQihpWQDwg9df3+lmIJTePhgYyNjpNiD0jMAsIUQHZgkhOjBLCNGBWUKIDswSQnRglhCiA7OEEB2YJYTowCwhREeWsNO6urpYlm1ubu7u7uYKW1tbw6r19fWVlJSQQzqd7uLFi2EVNipHKO0IGZfMZjPLsjqdbmRkJOyQTqcbCgGAjo4Os9lMoZkIpTwhWRobGwOAN998EwBiRKWjowMA5ufnhbYNoXQiJEtGo7G5ubmhoQFCuUrehQsXWltbx8fHyR9bQ7q6ukhJV1cXN4ccHx/nKpNyfk2EdkTCWSITvPLycgDQ6XRGo3Gjmn19fQBAIrfpe46MjHR0dJDKZBFFJoosy5KQNDU1AQDJz61btwCgtLT0ypUrLMv29PR0dHSwLMtFEaHtl3CWyEDU2NgIAE1NTSzL8qd5LMtyQwqE4rSp9957r7m5ub29HUJpIckBABISs9lMrkhSNDIyotPpyK4GKWxvbx8aGoontwhtkYT38chARD7HpaWlADA2NkZiAAACNuVYliX/J1uCZH3V19fHz+H8/HxDQwPZ7XjjjTcgFLb29naj0TgyMkJ2QXp6ejBOaKckNi6RCR6E1jM9PT0QSlcyyPtcuXIFQvns6OgY4iEJIbsd/f39EBoYAeDixYtDQ0PkHciohdCOSCxLZILH/6DrdLqwaV6idDpdQ0NDc3NzX1+f2WwmseHyyd9yIIf4Ezxux4IkkKziENoRiWWJfMS5MQFCc63kd/PIzI2MOWTLgQx9LMuSW1VEc3Mz8FZT3d3dOp2O7D3odDpuqonQ9hMN9Pen0XenXLhwYWRkBNdFKNWk33enkD0GDBJKQWmTJXJ/FkIbFQilGoHPtm6/hoYG/sIJoVSTNuMSQikOs4QQHZglhOjALCFERwJ7DzMzM+QBIoRQpASypNfr9Xr91jUFofSVfvdqEUpZmCWE6MAsIUQHZgkhOjBLCNGBWUKIDswSQnRglhCiA7OEEB2YJYTowCwhRAdmCSE6MEsI0YFZQogOzBJCdGCWEKIDs4QQHZglhOjALCFEB2YJITowSwjRgVlCiA7MEkJ0YJYQogOzhBAdmCWE6MAsIUQHZgkhOjBLCNGBWUKIDswSQnRglhCiA7OEEB2YJYTowCwhREcC/15tVGvB4C2b7bbdbvF6nwYCVNpES3ZGhkYqPaxSHc3PzxKJdro56BmXVJacfv+vv/rK7PHQag1dTwMB1u1m3e4/Li//qLKSEYt3ukXoWSY8S2vBIAlSQXb2K1qtISdHkplJsWXJ862vm1ZWfruwYPZ4fvXoUbfBgKMT2jrC10uf2Wxmj6dQIuk2GA4yTKoFCQAkmZkHGabbYCiUSBa83s9stp1uEXqWCc/Sn+12ADit0chSL0V8sszM0xoNhBqM0BYRPseb93gAwJCTE3lo2u67s7j60O61+9YAQCXJ2quS1hfuqlJJBF8uGaSR8zTWdVardWZmxmq1rq6uAsCuXbvUarVer1er1cm/OUprSa2XACBsaveNxz9gWlr5dr1Rk3OiTJEnFQOAzeOfXPZ8+HAp57nM1w15RbLt3gMgjSQNFszpdI6NjXm93qqqqtra2tzcXABwuVxms3l8fFwqlTY2NjIMQ6XBKS7V+soUkeyeON9fHb7f/GXxpUrlMW0uf41fLBcXyxUtpYrPLCu/uG3t3F/4vDLNfuhff/310NBQfX19dXU1v5xhGIZhamtrTSbT9evXT5w4UVxcvFON3Aap2VemCGpZ+sbj7/1i8d/2FxhU0qgVRABHNTkFUnHvF4v/cVidRj9xp9N548aNlpYWjUazUR2DwaBQKG7cuHHy5MlndXR6hvtKKug89xAEuDxpe1Gv3ChInCqV5EW98vKkLan51vYaHR09dOhQjCARarX60KFDo6Oj29Oqbcb1lU3fDRKH9JX/WlvY+8XiNx7/drcvBdAZl6btXt9a4Kg2N6y8a4gFgIutOn7hUW3uqNk1bfduGjzOR4/d54xLX55S71NGH81El+Yij0YtTJTFYvH7/QaDIZ7KBoNhamrKYrFsGjy73T44OMgvqaurq6+vj12/s7MznmZQF9lXPrB5huefzLmeigB0Csn3yxUGlfTTrxynKpWkr3z7sHrTe3kTDn/tp9bwa50vi3FK203bJ7MeAyOeOp3wZg+5XOz3TwadLN1ddDdqcuMc4zIAGjQ5dxfd8WfpZw+enCmX9TxwDh7PF9xIYViWraqqEsV3k1ckEu3du5dl2U2zRPCz0dvbCwAx4hTDVictrK/85JF9Yslzeo+qSiUNBGFyydNvWlJmZz1yeE9VKhPtK/kf7rabtupr1hg5+WTWk3z/uEXozPGm7d6avHiDAQA1u2XTdm+clSccfpPT33OA+WR2Bx5WslgsWq02/volJSUWi0XAhVpaWu7duyfgxG3A7yvv/80zseT5yQua/Xmy5zJEkkzRoUL5vt2yR46//0IzABo1uXcX3QIu1HOAMTk3nB9OOPwAkJpBAlrjksO3RrZ0CDK1i/wjN9nLl4kdvrU43/zqrPtMuWyfUnymXPbT+853DzKknEz8AOBMuYyrHLUwGW63m2x/E2T0iMSNCbm5uW63kI+RXq8fHh622+0qlYp/oaijTdhRMl3s7e1ta2uL5/RETdu9J8oU5PXQnPPM87uzM/8xUP/fjMNofsKvX5MnvfndEmFEl+bIi+D5Mm5CKLo097+HlX2PVgHA5PSTYY1fk7zgPgkAwB/KuPIPm/LOVsiTbySHzriUlbGFz7n9/MGTngMMALxaLhvkDU3njEsfNuUFz5dVM+LYhcnI3ManOhiGcTgcAHD16tWWlpbOzs66urqrV6+GVYs82tbWBgCdnZ0kSLFPF4DfV86vPK367uTtZb3yYquO/EdK8qQJ9JV8PQ+cXCdYfc1KfpXvHFBUX7PuU4q/PKUGgOD5sn/RSE1O/38dUJDkhNUkp5MFdvB82YdNea8Z//H42MezHlLIJY0WOuOSIjtzyevntrm5n2nUvQcAsHn8jCSuS3/02G1gxKRTOVshP2dc+uix+2yFnJSTfuXdg8zPHzzhKocVJkkmk7lcLm6be9Nu3uVyyeVJ9XZ2u93pdOr1egCor6+/d++enff0U+yjG1UgGROM31f+urkiap2n68H/vDX3y+PlALAeSGCblhtSAOCdAwoy7yATe/6vkkzw+GqY5zaqST4wk85v9ynFZyvk/PGH9MvkXLroZKlCIZlc8haVxjsUTC17K5m4bkH87METk9PP/3F/POs5WyGfjDarjlqYpIKCgoWFhfhvGS0sLBQVFQm7ltPpVCqV5PVGk8l4jsZTISH8vpKbsZ/Uq17UMVydhw5veW42eb3sW4uzr4TQrIxM4WqY8J3YGCfyF06RNYPny0SX5iKnc1u33KKTpReKdg3+dfl4aVxbeQGAMYvr1b27N61Juhz+Pg/5iU84/DWMeDCiftTCJFVWVn7++ec1NTXxbOUFg8Hp6ekjR44IuNDMzAwAqFQqMs6EDYBhg0/so5EVkhTZV7aUKfhB8qwFfvvI/sqev49+prj7Ss4+pZjMu2qY57iPe9j+deTQxIm6000KyQKJ7tIoKjrrperdUklWxq0FV1g5fw7NubXgkmRlxLNhyp89E2QH4uqs+2yF3OT0f/TYDQA/ve8kR6MWJkmr1YrFYpPJFE9lk8kkFosT2vfjDA8P19XVAYBKpWIYhkTLbreHjTAxjpJExT5dmBeKdo1ZXNzfmn5eJf2LzXN70e1ZC/jWgw9snv+5bT1YIN+fJ4NQX/m94l2JXuVshfxMuYysbfYpxQZGTH6VEw5/jAEqak3yIkb2tgKdcUkE8MOa/F/cthbKxLFDMm33/X7G8Vb95jfyIHQzIazw1XLZOePSuweZL0+paz+1njMuvXNAwR2NWpikY8eOXb9+XaFQxL5rZLVa7969e/Lkyfjfmf9Bb2lpIYscAHjttdd6e3uHh4chtK/AF3mU5GdwcJC8SezTBeD6yiZtLpnaTdt9f5hzfmBaCgSD5YrsV/aoSJAgkb4y0uDxfNGlubabtsHj+VOn1dwkLfJjwBdZk4xy3I3g2KdTM9DfHxSk886dzjt3+CUP7d5/vzl70/wkEK1+IBgcXXC9ZZx9aPcKu2IyIlubEKvVevny5cnJyY0qTE1Nvf/++1arVfAlUtzX7m/fMs5OLXtiVzMte98yzlpXv92eVqWOgf5+ms+JP6+UvP2C+vKkbdTsatTk7suT5knFa4Hgsm/NtOwds7gkWRnp9VQrp7i4+KWXXhodHZ2amqqqqiopKcnJyQkEAisrKxaLZXp6WiwWP8NPtQJAkUzcub8w6rOtRBDgM8vK776yd+4vLJan3684ecKzlCUSrQWDvvV1/l9hKpKJ3z6sNtm99xbdI+YnDt9aVoZImZ21Ryl5de9ug0q6I9+3QL4gKTsjqcUhwzAvv/zywsLC48ePJyYmVldXMzMz5XJ5cXHxkSNHhK2R0ssz3FdSITxLpTIZ63abVlYOfrczFgFUq6TVgqbLW2TK5QIAjZRCk7Ra7T9DbDaSmn1lihCepcMqFet2X7NY9ubkpPJXPnjW169ZLABwOLn7lYhIwb4yRQif9hzNz9dKpYs+3wWT6b7T6Vtfp9gsKnzr6/edzv+enl70+bRS6dH87X7GHP1TSWq99OM9e8hX5P1mZoZim6jTSqU/3rMHvxwPbamk9vEYsfgnVVWjNtuflpe/8flS8DuQiySS7+3efQy/AxltvWT3xLNEopaCgpaCAiqtQSh94b9zgRAdmCWE6MAsIUQHZgkhOjBLCNGBWUKIDswSQnRglhCiA7OEEB1ZAPDBwMBONwOhtPf/KgarpVnlP34AAAAASUVORK5CYII=)
    
4.  Enter a **description** for the API key and select the necessary APIs from the list:
    
    ![API Key Configuration](/assets/images/api-key-configuration-0a24b68d34e2821daa3e3232cd3ebcdb.png)
    
5.  Click **Generate** to create the API key.
    
6.  Click the **Copy** button to copy the key to your clipboard and **store it securely**.
    
7.  Close the API Key window.
    

Make sure to **keep your API key secure** and use while configuring integration.

## Configuration in JupiterOne

1.  From the top navigation bar of the **J1 Search** homepage, go to **Integrations**.
    
2.  Search for **Bitdefender** and select it.
    
3.  Click the **Add Instance** button and configure the following settings:
    
    -   **Bitdefender API Key**: Paste the Bitdefender API Key generated in Authentication Section.
    -   **Account Name**: Provide a name to identify this Bitdefender instance in JupiterOne. When the **Tag with Account Name** option is checked, ingested entities will store this value in `tag.AccountName`.
    -   **Description**: Add a description to assist your team in identifying this integration instance.
    -   **Polling Interval (optional)**: Select a polling interval that fits your monitoring needs. If unsure, leave this as `DISABLED` and manually execute the integration.
4.  Click **Create Configuration** to save your settings.
    

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Prerequisites

You must have a **Bitdefender account** with **Administrator user access**.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `bitdefender_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Endpoint | `bitdefender_endpoint` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Policy | `bitdefender_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| User | `bitdefender_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `bitdefender_account` | **HAS** | `bitdefender_user` |
| `bitdefender_account` | **HAS** | `bitdefender_endpoint` |
| `bitdefender_policy` | **ENFORCES** | `bitdefender_endpoint` |

### Bitdefender Account

`bitdefender_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountType` \*

 | `string` |  |  |
| `address` | `string` |  |  |
| 

`canBeManagedByParentCompany` \*

 | `boolean` |  |  |
| `contactPersonCompanyRole` | `string` |  |  |
| `contactPersonEmail` | `string` |  |  |
| `contactPersonName` | `string` |  |  |
| `contactPersonPhoneNumber` | `string` |  |  |
| 

`country` \*

 | `string` |  |  |
| `industry` | `number` |  |  |
| `mdrContactPersonEmail` | `string` |  |  |
| `mdrContactPersonName` | `string` |  |  |
| `mdrContactPersonPhoneNumber` | `string` |  |  |
| 

`phone` \*

 | `string` |  |  |
| `riskScoreAppVulnerabilities` | `string` |  |  |
| `riskScoreHumanRisk` | `string` |  |  |
| `riskScoreImpact` | `string` |  |  |
| `riskScoreIndustryModifier` | `string` |  |  |
| `riskScoreMisconfigurations` | `string` |  |  |
| `riskScoreValue` | `string` |  |  |
| `skip2FAPeriod` | `number` |  |  |
| 

`state` \*

 | `string` |  |  |

---

### Bitdefender Endpoint

`bitdefender_endpoint` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isContainerHost` | `boolean` |  |  |
| `isManaged` | `boolean` |  |  |
| `isManagedExchangeServer` | `boolean` |  |  |
| `isManagedRelay` | `boolean` | if this endpoint has Relay role |  |
| `isProductOutdated` | `boolean` | if the endpoint is missing one ore more agent updates. |  |
| `isSecurityServer` | `boolean` |  |  |
| `lastSuccessfulScanName` | `string` |  |  |
| `lastSuccessfulScanOn` | `number` |  |  |
| `machineType` | `string` |  |  |
| `managedWithBest` | `boolean` | if BEST is installed on this endpoint |  |
| `movingDestinationCompanyName` | `string` |  |  |
| `movingState` | `string` | Indicates the transfer status of the endpoint between two companies. |  |
| `ssid` | `string` |  |  |

---

### Bitdefender Policy

`bitdefender_policy` inherits from [Policy](/data-model/schemas/Policy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`createdBy` \*

 | `string` |  |  |
| `lastSuccessfulScanName` | `string` |  |  |
| `lastSuccessfulScanOn` | `number` |  |  |

---

### Bitdefender User

`bitdefender_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountID` \*

 | `string` |  |  |
| 

`accountLockdown` \*

 | `boolean` |  |  |
| `passwordLifetime` | `number` |  |  |
| 

`permissions` \*

 | `array` of `string`s |  |  |
| 

`role` \*

 | `string` |  |  |
| 

`timezone` \*

 | `string` |  |  |

---

---

Source: /integrations/directory/black-duck

# Black Duck

Visualize your Black Duck SCA projects, project versions, BOM components and their known vulnerabilities in JupiterOne. Find released versions that still carry open critical vulnerabilities, see every project affected by a given CVE, and monitor changes through queries and alerts.

## Installation

This integration connects to **Black Duck SCA** (formerly Black Duck Hub) using the Black Duck REST API (`https://<your-black-duck-host>/api/...`) and ingests projects, project versions, the components in each version's bill of materials (BOM), and the known vulnerabilities on those components. Black Duck can be hosted by Black Duck or deployed in your own environment, so the integration supports both ways of running it. It can run in the **JupiterOne cloud** when your Black Duck instance is reachable from the internet, or on a **JupiterOne collector** inside your network when the instance is only reachable internally. For self-managed instances that use a self-signed or internal-CA TLS certificate, you can supply the CA certificate.

### Prerequisites

-   A **Black Duck SCA** instance, hosted or self-managed, and its base URL, for example `https://blackduck.example.com`.
-   A **Black Duck user account** that can view the projects you want to ingest, and an **access token** for that user.
-   Network access from where the integration runs to the Black Duck instance: from the JupiterOne cloud for an internet-reachable instance, or from a JupiterOne collector for an instance that is only reachable inside your network.
-   Access to **JupiterOne** with permission to configure integrations.

### Configuration in Black Duck

The integration authenticates in two steps, as described in the Black Duck API documentation:

1.  It sends your access token to `POST /api/tokens/authenticate` in the header `Authorization: token <access-token>`.
2.  Black Duck returns a short-lived **bearer token**, which the integration sends as `Authorization: Bearer <bearer-token>` on every other request. When the bearer token expires, the integration requests a new one.

Every other request is a `GET`. The integration never writes to Black Duck.

#### Choose the account

Black Duck access tokens have **the same role as the user who created them**, so the integration can see exactly what that user can see. Projects the user cannot view are not returned by the API and are not ingested. We recommend a dedicated user that has:

-   The **Global Project Viewer** global role. Black Duck describes it as read-only access to all projects, with permission to view all projects and BOMs, but not to modify BOMs or project settings.

To limit ingestion to some projects only, you can instead leave the user without global roles and give it the **Project Viewer** project role ("read-only access to assigned projects") on just those projects.

The integration does not need any role that changes data, such as Project Manager, BOM Manager or Security Manager. Black Duck describes Security Manager as managing vulnerability remediation, which the integration never does.

> **CAUTION**
> 
> The **Authorization** information generated for this integration lists **Security Manager** next to Global Project Viewer for the **Vulnerabilities** data source. Start with Global Project Viewer only. If the **Vulnerabilities** data source fails with a `403 Forbidden` error while **Projects** and **Components** succeed, the user cannot read vulnerability data on your instance, and you need to review its roles.

#### Create the access token

Access tokens can only be created by the user they belong to, so sign in to Black Duck as the dedicated user.

1.  From the user menu in the top navigation bar, select **My Access Tokens**.
2.  Click **Create New Token**.
3.  Enter a name and, optionally, a description. For the scope, select **read** access only. The integration does not need write access.
4.  Click **Create**, then copy the token. Black Duck shows the token value only once. Store it somewhere safe; you will paste it into JupiterOne.
5.  Click **Close**.

Black Duck access tokens do not expire, but:

-   A Black Duck user administrator can purge tokens that have been inactive for a set number of weeks, or purge all tokens. Running the integration on a polling interval keeps the token in use.
-   Deactivating the user invalidates its tokens.

If the token is purged or invalidated, the integration stops ingesting until you add a new token to the instance.

### Configuration in JupiterOne

To install the Black Duck integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Black Duck**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Black Duck account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   If your Black Duck instance cannot be reached from the internet, set the instance to run on a JupiterOne **collector** in your network.
    
-   The **Authentication** fields below.
    

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **Black Duck URL** | Yes | The base URL of your Black Duck instance, including `https://`, for example `https://blackduck.example.com`. Do not add `/api`. Trailing slashes are removed. |
| **API Token** | Yes | The access token created above. It is exchanged for a bearer token at `POST /api/tokens/authenticate`. |

When you save the instance, JupiterOne checks the credentials by exchanging the access token for a bearer token and reading `GET /api/current-version`. This confirms that the token is valid and the instance is reachable. It does not check which projects the user can view.

#### Connection Options

Both options are optional. They are only needed for a self-managed Black Duck instance whose TLS certificate is not signed by a publicly trusted certificate authority.

| Field | Default | Description |
| --- | --- | --- |
| **Disable TLS Certificate Verification** | Off | Skip TLS certificate verification for the Black Duck instance. Not recommended: use **CA Certificate** instead. |
| **CA Certificate** | Empty | The PEM-encoded certificate of the CA that signed your Black Duck instance's TLS certificate. Used to verify a self-signed or internal-CA certificate. |

#### Filters

All filters are optional. Leave them empty to ingest everything the user can view.

| Field | Default | Description |
| --- | --- | --- |
| **Project Version Phases** | Empty (all phases) | Ingest only project versions in these phases. Options are **Planning**, **Development**, **Pre-release**, **Released**, **Deprecated** and **Archived**. Components and vulnerabilities are read only for the project versions that are ingested. When set, project versions with no phase are skipped. |
| **Vulnerability Severities** | Empty (all severities) | Ingest only vulnerabilities at these severities. Options are **Critical**, **High**, **Medium** and **Low**. When set, vulnerabilities with no severity are skipped. |

Click **Create** once all values are provided to finalize the integration.

Both filters are applied by the integration after the data is read, not by the Black Duck API:

-   **Project Version Phases** still lists every version of every project, but components and vulnerabilities are only requested for the versions that match. Setting it to, for example, **Released** reduces the number of requests on instances with many development versions.
-   **Vulnerability Severities** does not reduce the number of requests. Every vulnerable component is still read, and the ones outside the selected severities are dropped.

> **CAUTION**
> 
> Narrowing a filter later removes data from JupiterOne. On the next run, project versions that no longer match **Project Version Phases** are deleted from the graph together with their vulnerabilities and their links to components, and vulnerabilities that no longer match **Vulnerability Severities** are deleted as well.

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default**, so enable the ones you want to ingest. The `blackduck_account` entity for the Black Duck instance and the `blackduck_service` entity are always created, even with every data source disabled.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Projects** | Projects tracked in Black Duck, with their name, description and created and updated dates, and each project's versions, with their phase, distribution and created date. Project versions are limited by **Project Version Phases** when set. | `blackduck_project`, `blackduck_project_version` |
| **Components** | The open-source and third-party components in the BOM of each ingested project version, with their name, version and license names. Requires **Projects**. | `blackduck_component` |
| **Vulnerabilities** | Known vulnerabilities on the components of each ingested project version, with their severity, numeric score, CVE and CWE identifiers, source (for example NVD or BDSA), published date and remediation status. Limited by **Vulnerability Severities** when set. Requires **Projects**. **Components** is not required. | `blackduck_vulnerability`, `blackduck_component` |

To ingest everything the integration supports, enable all three data sources.

> **CAUTION**
> 
> **Projects must be enabled for any other Black Duck data to be ingested.** Components and vulnerabilities are read per project version, and project versions belong to the **Projects** data source. If **Projects** is disabled, the **Components** and **Vulnerabilities** data sources do not run at all, even when they are enabled.

**Vulnerabilities** does not depend on **Components**. When **Components** is disabled, **Vulnerabilities** still creates a `blackduck_component` entity, with its name and version, for each component that has a vulnerability, so that the vulnerability can be linked to its component. It does not create the `blackduck_project_version` **HAS** `blackduck_component` relationship, and components without vulnerabilities are not ingested.

Relationships are built only when every data source they need is enabled:

| Relationship | Requires |
| --- | --- |
| `blackduck_account` **PROVIDES** `blackduck_service` | Always created |
| `blackduck_account` **HAS** `blackduck_project` | **Projects** |
| `blackduck_project` **HAS** `blackduck_project_version` | **Projects** |
| `blackduck_project_version` **HAS** `blackduck_component` | **Projects** and **Components** |
| `blackduck_project_version` **HAS** `blackduck_vulnerability` | **Projects** and **Vulnerabilities** |
| `blackduck_component` **HAS** `blackduck_vulnerability` | **Projects** and **Vulnerabilities** |
| `blackduck_service` **IDENTIFIED** `blackduck_vulnerability` | **Projects** and **Vulnerabilities** |

The `blackduck_project_version` **HAS** `blackduck_component` relationship describes how that project version uses the component. It carries the component's `usages`, `policyStatus` and `reviewStatus` in that version's BOM.

#### Components and vulnerabilities in the graph

-   **A component is shared across project versions.** Each component name and version, for example `log4j-core 2.14.1`, is one `blackduck_component` entity, linked to every ingested project version whose BOM contains it. BOM entries without a resolved component version are skipped.
-   **A vulnerability is scoped to one project version.** Black Duck records the remediation status of a vulnerability separately in each project version, so the same CVE on the same component appears as one `blackduck_vulnerability` per affected project version, each with its own `remediationStatus`.
-   **Remediated vulnerabilities are ingested too.** `open` is `false` when the remediation status is `PATCHED`, `MITIGATED`, `IGNORED`, `REMEDIATION_COMPLETE` or `DUPLICATE`, and `true` otherwise. Filter on `open = true` to see what still needs work.
-   **CVE and BDSA advisories.** When a vulnerability is a CVE, or a Black Duck Security Advisory (BDSA) linked to a CVE, the entity has the classes `Finding` and `Vulnerability` and its `cveId` is set. A BDSA advisory without a related CVE has only the `Finding` class.
-   **Severity and score.** `severity` is normalized to `critical`, `high`, `medium` or `low`. `numericSeverity` is the vulnerability's overall score from Black Duck, or its base score when no overall score is reported.

#### Example queries

Open critical and high vulnerabilities in released project versions:

```j1ql
FIND blackduck_project_version WITH phase = 'RELEASED' AS v
  THAT HAS blackduck_vulnerability WITH open = true AND severity = ('critical' or 'high') AS f
RETURN v.displayName, f.displayName, f.severity, f.remediationStatus
```

Every project version affected by a given CVE:

```j1ql
FIND blackduck_project_version
  THAT HAS blackduck_vulnerability WITH cveId = 'CVE-2021-44228'
```

Every project version that ships a given component (requires **Components**):

```j1ql
FIND blackduck_project_version AS v
  THAT HAS blackduck_component WITH name = 'log4j-core' AS c
RETURN v.displayName, v.phase, c.displayName
```

#### What the integration does not collect

-   Users, groups, and their roles.
-   Policy rules and policy violations. Only each component's `policyStatus` in a project version is recorded.
-   Licenses as separate entities, license risk, and license obligations. Only license names are recorded on components.
-   Scans, code locations, and the files in which components were found.
-   Remediation comments and the Black Duck users who created or changed a remediation status.
-   Vulnerability reports, notifications, and project tags.

#### Rate limits and request volume

The integration makes requests in this order: the projects list, then the versions of each project, then, for each ingested project version, its BOM components (**Components**) and its vulnerable BOM components (**Vulnerabilities**). Lists are read 100 items per page. On an instance with many projects and versions, most requests come from the per-version BOM reads, so each run takes longer as the number of ingested project versions grows. Use **Project Version Phases** to reduce it.

The integration does not throttle its own requests. When Black Duck answers with `429 Too Many Requests` or a `5xx` error, the integration makes up to three attempts with an increasing delay between them, and waits for the time in the `Retry-After` header when Black Duck sends one.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Managing user access tokens](https://docs.blackduck.com/r/blackduck/latest/black-duck-documentation/managing-user-access-tokens.html) — creating access tokens and their scope
-   [Access Tokens](https://docs.blackduck.com/r/blackduck/latest/black-duck-documentation/access-tokens.html) — how administrators purge inactive tokens
-   [Authenticating with the API](https://docs.blackduck.com/r/blackduck/latest/black-duck-documentation/authenticating-with-the-api.html) — exchanging an access token for a bearer token
-   [Getting started with the Black Duck API](https://docs.blackduck.com/r/blackduck/latest/black-duck-documentation/getting-started-with-the-black-duck-api.html)
-   [Understanding roles](https://docs.blackduck.com/r/blackduck/latest/black-duck-documentation/understanding-roles.html)
-   [Global Roles Reference](https://docs.blackduck.com/r/blackduck/latest/black-duck-documentation/global-roles-reference.html) — Global Project Viewer
-   [Project Roles Reference](https://docs.blackduck.com/r/blackduck/latest/black-duck-documentation/project-roles-reference.html) — Project Viewer

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (3)

-   `Any authenticated Black Duck token`
-   `Global Project Viewer`
-   `Security Manager`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (5)

-   `https://<black-duck-host>/api/current-version`
-   `https://<black-duck-host>/api/projects`
-   `https://<black-duck-host>/api/projects/{projectId}/versions`
-   `https://<black-duck-host>/api/projects/{projectId}/versions/{versionId}/components`
-   `https://<black-duck-host>/api/projects/{projectId}/versions/{versionId}/vulnerable-bom-components`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (2)

-   [https://community.blackduck.com/s/article/How-to-get-started-with-Black-Duck-API-authentication](https://community.blackduck.com/s/article/How-to-get-started-with-Black-Duck-API-authentication)
-   [https://github.com/blackducksoftware/hub-rest-api-python/wiki/Client-User-Guide](https://github.com/blackducksoftware/hub-rest-api-python/wiki/Client-User-Guide)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (3)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Fetch Components | `Global Project Viewer` | `https://<black-duck-host>/api/projects/{projectId}/versions/{versionId}/components` |
| Fetch Project Versions | `Global Project Viewer` | `https://<black-duck-host>/api/projects/{projectId}/versions` |
| Fetch Vulnerabilities | `Global Project Viewer`, `Security Manager` | `https://<black-duck-host>/api/projects/{projectId}/versions/{versionId}/vulnerable-bom-components` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `blackduck_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Component | `blackduck_component` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Project | `blackduck_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Project Version | `blackduck_project_version` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Service | `blackduck_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Vulnerability | `blackduck_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `blackduck_account` | **PROVIDES** | `blackduck_service` |
| `blackduck_account` | **HAS** | `blackduck_project` |
| `blackduck_component` | **HAS** | `blackduck_vulnerability` |
| `blackduck_project` | **HAS** | `blackduck_project_version` |
| `blackduck_project_version` | **HAS** | `blackduck_component` |
| `blackduck_project_version` | **HAS** | `blackduck_vulnerability` |
| `blackduck_service` | **IDENTIFIED** | `blackduck_vulnerability` |

### Blackduck Account

`blackduck_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`version` \*

 | `string` **|** `null` | Black Duck Hub software version, from GET /api/current-version. |  |

---

### Blackduck Component

`blackduck_component` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`version` \*

 | `string` **|** `null` | The component version name as reported by Black Duck. |  |

---

### Blackduck Project

`blackduck_project` inherits from [Project](/data-model/schemas/Project.md)

---

### Blackduck Project Version

`blackduck_project_version` inherits from [Project](/data-model/schemas/Project.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`distribution` \*

 | `string` **|** `null` | Distribution type of the project version (e.g. EXTERNAL, INTERNAL). |  |
| 

`phase` \*

 | `string` **|** `null` | Lifecycle phase of the project version (e.g. RELEASED, DEVELOPMENT). |  |

---

### Blackduck Service

`blackduck_service` inherits from [Service](/data-model/schemas/Service.md)

---

### Blackduck Vulnerability

`blackduck_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cweId` \*

 | `string` **|** `null` | CWE identifier reported for the vulnerability, if any. |  |
| 

`publishedOn` \*

 | `number` **|** `null` | Timestamp (ms) the vulnerability was published. |  |
| 

`remediationStatus` \*

 | `string` **|** `null` | Black Duck remediation status in this project version (e.g. NEW, NEEDS\_REVIEW, PATCHED). |  |
| 

`source` \*

 | `string` **|** `null` | Vulnerability data source as reported by Black Duck (e.g. NVD, BDSA). |  |

---

## Release Notes

-   **2026-10-13** — Component license data is now preserved when vulnerability ingestion runs alongside component ingestion, ensuring component entities retain their full license information and vulnerability relationships.

---

Source: /integrations/directory/box

# Box

Visualize your Box users, groups, folders, files and the collaborations that grant access to them. Find content shared through public links or with external collaborators, and monitor sharing changes through queries and alerts.

## Installation

This integration connects to **Box** through the Box Platform API (`https://api.box.com/2.0`). It ingests your enterprise account, managed users, groups, folders, files, and the collaborations that share folders and files with users and groups. It is built for data protection use cases: who owns which content, which content has a public shared link, and which collaborators are outside your enterprise. The integration is managed by JupiterOne and runs in the JupiterOne cloud, so no collector is needed.

### Prerequisites

-   A **Box enterprise** account.
-   Access to the **Box Developer Console** to create a Platform App, and a **Box Admin or Co-Admin** to authorize that app for the enterprise.
-   Access to **JupiterOne** with permission to configure integrations.

### Configuration in Box

The integration authenticates as a Box **Platform App** that uses **Server Authentication with Client Credentials Grant (CCG)**. It requests a token at `https://api.box.com/oauth2/token` with `box_subject_type=enterprise` and your Enterprise ID as `box_subject_id`. The token belongs to the app's **Service Account**. Every API call is read-only.

The Service Account's own folder tree holds only content that has been shared with it. To read the rest of the enterprise, the integration lists your managed users and reads each user's folder tree on their behalf with the `As-User` header. The app must be set up for this. Otherwise only content shared with the Service Account is ingested.

#### Create the app

1.  Sign in to Box and open the [Developer Console](https://app.box.com/developers/console).
2.  Select **New App**, choose **Server** as the app type, and leave **Client Credentials Grant** selected as the authentication method.
3.  Name the app and select **Create**.

#### Configure the app

On the app's **Configuration** tab:

1.  Set **App Access Level** to **App + Enterprise Access**. With the default, **App Access Only**, the app can reach only its Service Account and App Users, not your managed users or their content.
    
2.  Under **Application Scopes**, select only the scopes below. The integration never writes, so you can clear any write scope.
    
    | Scope | Used for |
    | --- | --- |
    | **Read all files and folders stored in Box** (`root_readonly`) | Listing folder contents and the collaborations on folders and files. |
    | **Manage users** (`manage_managed_users`) | Listing enterprise users (`GET /users`), which the folder walk and the collaboration data sources also need, and making calls as those users. |
    | **Manage groups** (`manage_groups`) | Listing groups (`GET /groups`) for the **Box Groups** data source. |
    
3.  In the **Additional Configuration** section, enable **Make API calls using the as-user header**. Some versions of the console label this section **Advanced Features**.
    
4.  Save the changes.
    

You do not need **Generate User Access Tokens**. The integration authenticates only as the Service Account.

#### Authorize the app

A Box Admin or Co-Admin must authorize the app before it can be used:

1.  Copy the app's **Client ID** from its **Configuration** tab.
2.  In the Box **Admin Console**, open **Platform**, then the **Platform Apps** tab, and add the app by its Client ID. An Admin or Co-Admin can also authorize it directly from the app's **Configuration** tab in the Developer Console.

When the app is authorized, Box creates its Service Account.

> **CAUTION**
> 
> **Re-authorize the app after every change.** Changes to the access level, scopes or the As-User setting take effect only after the app is re-authorized. To do that, open **Platform** > **Platform Apps** in the Admin Console, select **...** on the app's row, and choose **Reauthorize**. Until then, the integration keeps the old permissions. For example, if As-User calls are not yet allowed, only content shared with the Service Account is ingested.

#### Collect the values for JupiterOne

-   **Client ID** and **Client Secret**, from the app's **Configuration** tab. Box shows the client secret only when your account has multi-factor authentication turned on.
-   **Enterprise ID**. In the Admin Console it is under **Account & Billing** > **Account Information**. In the Developer Console, select your account icon in the top right and choose **Copy Enterprise ID**.

### Configuration in JupiterOne

To install the Box integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Box**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Box account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Authentication** fields below.
    

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **Client ID** | Yes | The Client ID of the Box app created above. |
| **Client Secret** | Yes | The Client Secret of the Box app. |
| **Enterprise ID** | Yes | The ID of the Box enterprise the app is authorized for. It is used to request the Service Account token and to identify the `box_account` entity. |

When you save the instance, JupiterOne checks that all three fields are set, requests an access token, and calls `GET /users/me`. This check confirms that the credentials work. It does not confirm the scopes or the As-User setting. Those problems show up in the first run.

#### Filters

Both filters are optional.

| Field | Default | Description |
| --- | --- | --- |
| **Ingest files** | No default | Turn on to ingest files. When it is turned off, the **Box Files** data source ingests nothing and no file collaborations are ingested, but folders and folder collaborations still are. Turn it off on very large tenants to ingest only folders and their collaborations. |
| **Maximum folder depth** | Empty (the full tree) | A whole number that limits how deep each user's folder tree is read, counted from that user's root (**All Files**). `1` reads only the folders and files directly in the root, `2` also reads the contents of those top-level folders, and so on. `0` behaves like `1`. A value that is not a non-negative whole number is ignored, and the full tree is read. The limit applies to both folders and files. |

Click **Create** once all values are provided to finalize the integration.

> **CAUTION**
> 
> Narrowing a filter later removes entities from JupiterOne. When you lower **Maximum folder depth** or turn off **Ingest files**, folders and files that are no longer read on the next run are deleted from the graph, along with their collaborations.

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default**, so enable the ones you want to ingest. The `box_account` and `box_service` entities are always created. That step has no data source and always runs. It calls `GET /users/me` to read the enterprise name.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Box Users** | Users in the enterprise, with their login (email), active status, job title, language, time zone, and created and updated dates. | `box_user` |
| **Box Groups** | Groups in the enterprise, with their group type and description. | `box_group` |
| **Box Folders** | Folders in the Service Account's tree and in every managed user's tree, with their shared-link access level and status. | `box_folder` |
| **Box Files** | Files found the same way as folders, with their size, SHA-1 hash, extension, shared-link access level, status, and whether they are owned outside the enterprise. | `box_file` |
| **Box Collaborations** | Collaborations on the ingested folders and files, with the role, status, expiration date, invite email, and whether the collaborator is external. Requires **Box Folders**, **Box Files**, or both. | `box_collaboration` |

To ingest everything the integration supports, enable all five data sources.

> **CAUTION**
> 
> **Box Collaborations needs Box Folders or Box Files.** Folder collaborations are read only when **Box Folders** is enabled, and file collaborations only when **Box Files** is enabled. With neither enabled, **Box Collaborations** does not run at all. Ownership (`OWNS`) and collaborator (`ASSIGNED`) relationships also need **Box Users** and, for groups, **Box Groups**. Enable those data sources if you want to know who owns content and who it is shared with.

Relationships are built only when every data source they need is enabled:

| Relationship | Requires |
| --- | --- |
| `box_account` **PROVIDES** `box_service` | Always created |
| `box_account` **HAS** `box_user` | **Box Users** |
| `box_account` **HAS** `box_group` | **Box Groups** |
| `box_user` **OWNS** `box_folder` | **Box Users** and **Box Folders** |
| `box_user` **OWNS** `box_file` | **Box Users** and **Box Files** |
| `box_folder` **CONTAINS** `box_folder` (parent folder to subfolder) | **Box Folders** |
| `box_folder` **CONTAINS** `box_file` | **Box Folders** and **Box Files** |
| `box_folder` **ALLOWS** `box_collaboration` | **Box Folders** and **Box Collaborations** |
| `box_file` **ALLOWS** `box_collaboration` | **Box Files** and **Box Collaborations** |
| `box_collaboration` **ASSIGNED** `box_user` | **Box Users** and **Box Collaborations**, plus **Box Folders** or **Box Files** for collaborations on that item type |
| `box_collaboration` **ASSIGNED** `box_group` | **Box Groups** and **Box Collaborations**, plus **Box Folders** or **Box Files** for collaborations on that item type |

Notes on relationships:

-   Each user's root folder (**All Files**, folder ID `0`) is not ingested, so top-level folders and files have no parent `CONTAINS` relationship.
-   `OWNS` is created only when the owner is an ingested `box_user`. Items owned by users outside the enterprise have no owner relationship.
-   `ASSIGNED` is created only when the collaborating user or group was ingested. An external collaborator has a `box_collaboration` entity, with `isExternal = true` and the collaborator's login in `accessibleByLogin`, but no `ASSIGNED` relationship.

#### How folders and files are read

Box has no endpoint that lists all of an enterprise's content, so the integration walks the folder tree one folder at a time with `GET /folders/{id}/items`, up to 1,000 items per page:

1.  It lists the enterprise users with `GET /users`. If that call fails, the data source fails, because a walk of the Service Account alone would look complete while missing most content.
2.  It walks the Service Account's tree, then each user's tree as that user (`As-User`).
3.  A folder that several users can see, such as a shared folder, is read once, by the first user who reaches it. Each folder and file becomes one entity, however many users can see it.
4.  A user whose tree cannot be read (Box answers `400`, `403` or `404`) is skipped and logged. If the first 25 users are all denied before any succeeds, the run fails with an error that points at the **App + Enterprise Access** and As-User settings.
5.  A folder that was deleted or unshared during the walk (`403` or `404`) is skipped.

Content that only a skipped user can reach is not ingested on that run. Web links (bookmarks) are listed by Box but are not ingested.

**Box Collaborations** makes one request per ingested folder or file that Box reports as having collaborations. Items Box reports as having none are skipped without a request. The request is made as the item's owner when the owner is an enterprise user, otherwise as the user whose tree the item was found in. `isExternal` is `true` when the collaborating user's login, or the invite email, is not the login of an enterprise user. It is empty for group collaborations and when the user list cannot be read.

#### Example queries

Files and folders that anyone with the link can open:

```j1ql
FIND (box_file | box_folder) WITH isPublic = true
```

Folders shared with collaborators outside the enterprise, with the role each one was given:

```j1ql
FIND box_folder AS f
  THAT ALLOWS box_collaboration WITH isExternal = true AS c
RETURN f.displayName, c.accessibleByLogin, c.inviteEmail, c.role, c.collaborationStatus
```

Public files and the users who own them:

```j1ql
FIND box_user AS u
  THAT OWNS box_file WITH isPublic = true AS f
RETURN u.email, f.displayName, f.sharedLinkAccess
```

#### What the integration does not collect

-   File contents, file versions, comments, tasks, and metadata or classification labels.
-   Shared-link URLs and download URLs. Only the access level (`open`, `company` or `collaborators`) is stored, as `sharedLinkAccess`, `isPublic` and `isSharedLinkConfigured`. Shared-link password settings are not collected.
-   Group memberships. Users and groups are ingested, but which users belong to which group is not.
-   User phone numbers and addresses.
-   Web links (bookmarks) and each user's **All Files** root folder.
-   Box events and activity, such as downloads, previews, moves and logins.

#### Request volume and rate limits

Box allows about 1,000 API requests per minute per user. All steps of a run share one API client that sends at most 15 requests per second. When Box answers `429 Too Many Requests`, the integration waits for the time in the `Retry-After` header before retrying. Access tokens last 60 minutes and are renewed during the run.

Request volume grows with the size of your content:

-   **Box Folders** and **Box Files** each walk the whole tree on their own, one request per folder for each page of up to 1,000 items. With both enabled, the tree is walked twice.
-   **Box Collaborations** adds one request per folder or file that has collaborations.

On a large enterprise, a full run can take a long time. Use **Maximum folder depth**, or turn off **Ingest files**, to reduce it.

`GET /groups` cannot page past an offset of 10,000. On an enterprise with more than about 11,000 groups, the remaining groups are not ingested and a warning is logged.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Client Credentials Grant](https://developer.box.com/guides/authentication/client-credentials/): Service Account and user subjects, token lifetime
-   [Set up an app with Client Credentials Grant](https://developer.box.com/guides/authentication/client-credentials/client-credentials-setup/): creating the app, access level, scopes and the client secret
-   [Platform app approval](https://developer.box.com/guides/authorization/platform-app-approval/): authorizing and re-authorizing the app in the Admin Console
-   [Scopes](https://developer.box.com/guides/api-calls/permissions-and-errors/scopes/)
-   [As-User header](https://developer.box.com/guides/authentication/jwt/as-user/)
-   [Security and application access](https://developer.box.com/guides/security/): App Access Only and App + Enterprise Access
-   [Locating common values](https://developer.box.com/platform/appendix/locating-values/): finding the Enterprise ID
-   [Rate limits](https://developer.box.com/guides/api-calls/permissions-and-errors/rate-limits/)
-   [List items in folder](https://developer.box.com/reference/get-folders-id-items/)
-   [List enterprise users](https://developer.box.com/reference/get-users/)
-   [List groups for enterprise](https://developer.box.com/reference/get-groups/)

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (3)

-   `manage_groups`
-   `manage_managed_users`
-   `root_readonly`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (6)

-   `https://api.box.com/2.0/files/{fileId}/collaborations`
-   `https://api.box.com/2.0/folders/{folderId}/collaborations`
-   `https://api.box.com/2.0/folders/{folderId}/items`
-   `https://api.box.com/2.0/groups`
-   `https://api.box.com/2.0/users`
-   `https://api.box.com/2.0/users/me`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (8)

-   [https://developer.box.com/guides/authentication/client-credentials/](https://developer.box.com/guides/authentication/client-credentials/)
-   [https://developer.box.com/guides/authentication/jwt/as-user/](https://developer.box.com/guides/authentication/jwt/as-user/)
-   [https://developer.box.com/reference/get-files-id-collaborations/](https://developer.box.com/reference/get-files-id-collaborations/)
-   [https://developer.box.com/reference/get-folders-id-collaborations/](https://developer.box.com/reference/get-folders-id-collaborations/)
-   [https://developer.box.com/reference/get-folders-id-items/](https://developer.box.com/reference/get-folders-id-items/)
-   [https://developer.box.com/reference/get-groups/](https://developer.box.com/reference/get-groups/)
-   [https://developer.box.com/reference/get-users-me/](https://developer.box.com/reference/get-users-me/)
-   [https://developer.box.com/reference/get-users/](https://developer.box.com/reference/get-users/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Fetch File Collaborations | `root_readonly`, `manage_managed_users` | `https://api.box.com/2.0/files/{fileId}/collaborations`, `https://api.box.com/2.0/users` |
| Fetch Folder Collaborations | `root_readonly`, `manage_managed_users` | `https://api.box.com/2.0/folders/{folderId}/collaborations`, `https://api.box.com/2.0/users` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `box_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Collaboration | `box_collaboration` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| File | `box_file` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| Folder | `box_folder` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Group | `box_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Service | `box_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `box_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `box_account` | **PROVIDES** | `box_service` |
| `box_account` | **HAS** | `box_user` |
| `box_account` | **HAS** | `box_group` |
| `box_collaboration` | **ASSIGNED** | `box_user` |
| `box_collaboration` | **ASSIGNED** | `box_group` |
| `box_file` | **ALLOWS** | `box_collaboration` |
| `box_folder` | **ALLOWS** | `box_collaboration` |
| `box_folder` | **CONTAINS** | `box_folder` |
| `box_folder` | **CONTAINS** | `box_file` |
| `box_user` | **OWNS** | `box_folder` |
| `box_user` | **OWNS** | `box_file` |

### Box Account

`box_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`enterpriseId` \*

 | `string` | The Box Enterprise ID this account represents. |  |

---

### Box Collaboration

`box_collaboration` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessibleByLogin` | `string` **|** `null` | The login (email) of the collaborating user, used to compute isExternal. |  |
| `accessibleByType` | `string` **|** `null` | The type of the collaborator ("user" or "group"). |  |
| `collaborationStatus` | `string` **|** `null` | The collaboration status: "accepted", "pending" or "rejected". |  |
| `expiresOn` | `number` **|** `null` | When the collaboration expires, in milliseconds since epoch. |  |
| `inviteEmail` | `string` **|** `null` | The email the collaboration was invited to, when the collaborator is not yet a Box user. |  |
| `isAccessOnly` | `boolean` **|** `null` | Whether the collaboration grants access-only (not visible in the collaborator's items list). |  |
| `isExternal` | `boolean` **|** `null` | Computed when collaborations are fetched: true when the collaborating user's login (or invite email) is not an enterprise user login from GET /users; null when the collaborator is a group or absent, or the user list could not be read (unknown). |  |
| `itemType` | `string` **|** `null` | The type of the collaborated item ("file" or "folder"). |  |
| `role` | `string` **|** `null` | The access level granted, e.g. "editor", "viewer" or "co-owner". |  |

---

### Box File

`box_file` inherits from [DataObject](/data-model/schemas/DataObject.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `extension` | `string` **|** `null` | The file extension. |  |
| `isExternallyOwned` | `boolean` **|** `null` | Whether the file is owned by a user outside the enterprise. |  |
| `isPublic` | `boolean` **|** `null` | Computed: true when shared\_link.access is "open"; null when the file has no shared link (unknown, not false). |  |
| `isSharedLinkConfigured` | `boolean` **|** `null` | Computed: true when the file has a shared link configured. The link URL itself is a secret and is not ingested. |  |
| `itemStatus` | `string` **|** `null` | The file status, e.g. "active", "trashed" or "deleted". |  |
| `sha1` | `string` **|** `null` | The SHA-1 hash of the file. |  |
| `sharedLinkAccess` | `string` **|** `null` | The shared-link access level ("open", "company" or "collaborators"); null when the file has no shared link. |  |
| `sizeInBytes` | `number` **|** `null` | The file size in bytes. |  |

---

### Box Folder

`box_folder` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isPublic` | `boolean` **|** `null` | Computed: true when shared\_link.access is "open"; null when the folder has no shared link (unknown, not false). |  |
| `isSharedLinkConfigured` | `boolean` **|** `null` | Computed: true when the folder has a shared link configured. The link URL itself is a secret and is not ingested. |  |
| `itemStatus` | `string` **|** `null` | The folder status, e.g. "active", "trashed" or "deleted". |  |
| `sharedLinkAccess` | `string` **|** `null` | The shared-link access level ("open", "company" or "collaborators"); null when the folder has no shared link. |  |

---

### Box Group

`box_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `groupType` | `string` **|** `null` | The group type, e.g. "managed\_group" or "all\_users\_group". |  |

---

### Box Service

`box_service` inherits from [Service](/data-model/schemas/Service.md)

---

### Box User

`box_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `jobTitle` | `string` **|** `null` | The user's job title. |  |
| `language` | `string` **|** `null` | The user's configured language. |  |
| `timezone` | `string` **|** `null` | The user's configured timezone. |  |

---

## Release Notes

-   **2026-10-05** — New Box integration: ingests enterprise accounts, users, groups, folders, files, and collaboration access roles with ownership and sharing relationships.

---

Source: /integrations/directory/braintrust

# Braintrust

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `Owner`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://www.braintrust.dev/docs/reference/api](https://www.braintrust.dev/docs/reference/api)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (10)

| Step | Roles |
| --- | --- |
| Fetch AI Secrets | \- |
| Fetch API Keys | `Owner` |
| Fetch Datasets | \- |
| Fetch Groups | \- |
| Fetch Project Providers | \- |
| Fetch Projects | \- |
| Fetch Prompts | \- |
| Fetch Roles | \- |
| Fetch Service Tokens | \- |
| Fetch Users | \- |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Access Key | `braintrust_api_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Access Role | `braintrust_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Account | `braintrust_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AI Secret | `braintrust_ai_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Dataset | `braintrust_dataset` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Environment Variable | `braintrust_env_var` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Model | `braintrust_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| Project | `braintrust_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Prompt | `braintrust_prompt` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Service Token | `braintrust_service_token` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| User | `braintrust_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `braintrust_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `braintrust_account` | **HAS** | `braintrust_user` |
| `braintrust_account` | **HAS** | `braintrust_group` |
| `braintrust_account` | **HAS** | `braintrust_role` |
| `braintrust_account` | **HAS** | `braintrust_project` |
| `braintrust_account` | **HAS** | `braintrust_api_key` |
| `braintrust_account` | **HAS** | `braintrust_ai_secret` |
| `braintrust_account` | **HAS** | `braintrust_service_token` |
| `braintrust_group` | **HAS** | `braintrust_user` |
| `braintrust_group` | **ASSIGNED** | `braintrust_role` |
| `braintrust_project` | **HAS** | `braintrust_prompt` |
| `braintrust_project` | **HAS** | `braintrust_dataset` |
| `braintrust_project` | **HAS** | `braintrust_env_var` |
| `braintrust_prompt` | **USES** | `braintrust_model` |
| `braintrust_user` | **CREATED** | `braintrust_project` |
| `braintrust_user` | **CREATED** | `braintrust_api_key` |
| `braintrust_user` | **ASSIGNED** | `braintrust_role` |

### Braintrust Account

`braintrust_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` | The Braintrust organization ID |  |

---

### Braintrust Ai Secret

`braintrust_ai_secret` inherits from [Secret](/data-model/schemas/Secret.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `previewSecret` | `string` | Masked preview of the secret value |  |
| `providerType` | `string` | The AI provider type (e.g. anthropic, bedrock, openai) |  |
| `updatedOn` | `number` | Timestamp of the last update |  |

---

### Braintrust Api Key

`braintrust_api_key` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `previewName` | `string` | Preview hint of the API key value |  |
| `userEmail` | `string` | Email of the user who owns this key |  |

---

### Braintrust Dataset

`braintrust_dataset` inherits from [DataStore](/data-model/schemas/DataStore.md)

---

### Braintrust Env Var

`braintrust_env_var` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `lastUsedOn` | `number` | Timestamp of last usage |  |
| `objectId` | `string` | ID of the scoped object |  |
| `objectType` | `string` | Scope type: organization, project, or function |  |
| `secretCategory` | `string` | Category: env\_var, ai\_provider, or sandbox\_provider |  |
| `secretType` | `string` | The AI provider type name |  |

---

### Braintrust Group

`braintrust_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `memberGroupCount` | `number` | Number of sub-groups in this group |  |
| `memberUserCount` | `number` | Number of users in this group |  |

---

### Braintrust Model

`braintrust_model` inherits from [Model](/data-model/schemas/Model.md)

---

### Braintrust Project

`braintrust_project` inherits from [Project](/data-model/schemas/Project.md)

---

### Braintrust Prompt

`braintrust_prompt` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `model` | `string` | AI model used by this prompt |  |
| `slug` | `string` | URL-safe identifier for the prompt |  |

---

### Braintrust Role

`braintrust_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `global` | `boolean` | Whether this is a global role (not org-specific) |  |
| `permissionCount` | `number` | Number of permissions granted by this role |  |

---

### Braintrust Service Token

`braintrust_service_token` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `previewName` | `string` | Preview hint of the token value |  |
| `serviceAccountEmail` | `string` | Email identifier of the service account |  |
| `serviceAccountId` | `string` | ID of the service account this token belongs to |  |
| `serviceAccountName` | `string` | Name of the service account |  |

---

### Braintrust User

`braintrust_user` inherits from [User](/data-model/schemas/User.md)

---

## Release Notes

-   **2026-04-10** — Added initial Braintrust integration, ingesting users, user groups, and access roles with their assignments.

---

Source: /integrations/directory/bugcrowd

# Bugcrowd

Visualize Bugcrowd bounty programs and submitted findings, and monitor changes through queries and alerts.

## Installation

### Configuration in JupiterOne

To install the Bugcrowd integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Bugcrowd. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Bugcrowd account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Bugcrowd **API Token** configured for read access. To generate an API token, log into your Bugcrowd account, navigate to the **API Credentials** page, specify a descriptive name, and click **Create credentials**. API tokens are automatically pinned to major version v1. If you have an existing token that is not pinned to v1.0.0, you must manually update the API version in your Bugcrowd account settings. If updating is not possible, you will need to generate a new token. See [Bugcrowd's API documentation](https://docs.bugcrowd.com/api/1.0.0/) for more information.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `bugcrowd_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Program | `bugcrowd_program` | [Program](https://docs.jupiterone.io/data-model/schemas/Program), [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Service | `bugcrowd_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service), [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Submission | `bugcrowd_submission` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `bugcrowd_account` | **PROVIDES** | `bugcrowd_service` |
| `bugcrowd_account` | **HAS** | `bugcrowd_program` |
| `bugcrowd_program` | **HAS** | `bugcrowd_submission` |
| `bugcrowd_service` | **MANAGES** | `bugcrowd_program` |

### Bugcrowd Account

`bugcrowd_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` |  |  |
| `displayName` | `string` |  |  |
| `name` | `string` |  |  |

---

### Bugcrowd Program

`bugcrowd_program` inherits from [Program](/data-model/schemas/Program.md), [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `code` | `string` |  |  |
| `createdAt` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `customFields` | `array` of `undefined`s |  |  |
| `demo` | `boolean` |  |  |
| `description` | `string` |  |  |
| `displayName` | `string` |  |  |
| `function` | `string` |  |  |
| `internal` | `boolean` |  |  |
| `maxReward` | `number` |  |  |
| `minReward` | `number` |  |  |
| `name` | `string` |  |  |
| `overview` | `string` |  |  |
| `participation` | `string` |  |  |
| `pointsOnly` | `boolean` |  |  |
| `programType` | `string` |  |  |
| `remainingPrizePool` | `number` |  |  |
| `serviceLevel` | `string` |  |  |
| `startedOn` | `number` |  |  |
| `status` | `string` |  |  |
| `stoppedOn` | `number` |  |  |
| `tagline` | `string` |  |  |
| `targetsOverview` | `string` |  |  |
| `totalPrizePool` | `number` |  |  |
| `trial` | `boolean` |  |  |
| `type` | `string` |  |  |
| `updatedAt` | `string` |  |  |
| `webLink` | `string` |  |  |

---

### Bugcrowd Service

`bugcrowd_service` inherits from [Service](/data-model/schemas/Service.md), [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `array` of `string`s |  |  |
| `description` | `string` |  |  |
| `displayName` | `string` |  |  |
| `function` | `array` of `string`s |  |  |
| `name` | `string` |  |  |

---

### Bugcrowd Submission

`bugcrowd_submission` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `bugUrl` | `string` |  |  |
| `category` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `description` | `string` |  |  |
| `details` | `string` |  |  |
| `displayName` | `string` |  |  |
| `extraInfo` | `string` |  |  |
| `name` | `string` |  |  |
| `numericSeverity` | `number` |  |  |
| `open` | `boolean` |  |  |
| 
`references` \*

 | `array` **|** `null` |  |  |
| 

`rewards` \*

 | `array` **|** `null` |  |  |
| `severity` | `string` |  |  |
| `state` | `string` |  |  |
| `submissionPriority` | `number` |  |  |
| `targetName` | `string` |  |  |
| 

`targets` \*

 | `array` **|** `null` |  |  |
| `title` | `string` |  |  |
| 

`totalAmountAwarded` \*

 | `number` **|** `null` |  |  |
| `vulnerabilityReferences` | `string` |  |  |
| `webLink` | `string` |  |  |

---

---

Source: /integrations/directory/cato-networks

# Cato Networks

Visualize your Cato Networks SASE account, administrators and their roles, sites and Socket appliances, and SDP users in JupiterOne. Find admins without MFA, keep an inventory of your sites and remote users, and monitor changes through queries and alerts.

## Installation

This integration connects to the **Cato API** (`https://<API Host>/api/v1/graphql2`) and ingests your Cato account, its administrators and roles, its sites and Sockets, and its SDP users. It authenticates with a Cato API key, sent in the `x-api-key` header, and every request is a read-only GraphQL query. The integration is managed by JupiterOne and runs in the JupiterOne cloud, so no collector is needed.

### Prerequisites

-   A **Cato Networks** account and access to the Cato Management Application (CMA).
-   A CMA administrator who can create Service Principals and service API keys.
-   Access to **JupiterOne** with permission to configure integrations.

### Configuration in Cato Networks

The integration uses a **service API key**. Service keys belong to a Service Principal rather than to an individual admin, so they keep working when people change roles or leave, and they cannot be used to sign in to the CMA. A service key inherits the permissions of its Service Principal.

#### Create a Service Principal

If you do not have a Service Principal for JupiterOne yet:

1.  In the CMA, open **Account** > **Administrators** and click **New**.
2.  Select **Create New** and **Create as Service Principal**.
3.  Enter the **General** settings, for example the name `JupiterOne`.
4.  Select the **Role** for the Service Principal. A role with view (read-only) access to the account is enough, because the integration never changes your configuration.
5.  Click **Apply**.

#### Create the service API key

1.  In the CMA, open **Resources** > **Service API Keys** and click **New**.
2.  Select the **Service Principal** you created.
3.  Enter a **Key Name**, such as `JupiterOne`.
4.  Select **Downgrade to View**. This limits the key to query (read-only) API calls, whatever role the Service Principal has.
5.  In **Allow access from IPs**, leave **Any IP**, or select **Specific IP list** to restrict the key to known addresses. See **IP allowlisting** below.
6.  Optionally, select an **Expires at** date. When the key expires, the integration stops ingesting until you add a new key to the instance.
7.  Click **Apply**, copy the key from the pop-up and store it somewhere safe. Cato shows the key value only once.
8.  Click **OK**.

#### Find your Account ID

The integration needs your numeric Cato Account ID. In the CMA, open **Account** > **Account Info** and copy the **Account ID**. In older versions of the CMA, the same value is under **Administration** > **General Info**.

#### Find your API host

The API host depends on where your CMA is hosted. Look at the address you use to sign in to the CMA:

-   `cc.catonetworks.com` (no prefix): the API host is `api.catonetworks.com`, which is the default.
-   A regional prefix, such as `cc.us1.catonetworks.com`: use the same prefix for the API host, for example `api.us1.catonetworks.com`.

#### IP allowlisting

If you restrict the API key with **Specific IP list**, Cato rejects requests from addresses that are not on the list. Contact JupiterOne support to get the egress IP addresses the integration uses, and add them to the key before you create the instance.

### Configuration in JupiterOne

To install the Cato Networks integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Cato Networks**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Cato Networks account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Authentication** fields below.
    

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **API Key** | Yes | The Cato service API key created above. It is masked in JupiterOne and sent in the `x-api-key` header. |
| **Account ID** | Yes | The numeric Cato Account ID, from **Account** > **Account Info** in the CMA. |
| **API Host** | No | The Cato API host for your CMA region. Defaults to `api.catonetworks.com`. Accounts on a regional CMA set the regional host, for example `api.us1.catonetworks.com`. |

When you save the instance, JupiterOne checks that **API Key** and **Account ID** are set and sends a test query to the Cato API for that account. A wrong key, a key for a different account, a wrong API host or a blocked IP address fails the check.

Click **Create** once all values are provided to finalize the integration.

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default**, so a new instance ingests only the `cato_account` and `cato_service` entities until you enable the ones you want. To enable them, open the instance, turn on the data sources under **Data Sources**, and save. They are ingested on the next run.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Access Governance (Admins & Roles)** | Account administrators, with their status, admin type (person or Service Principal) and whether MFA is enabled; the access roles defined in the account, predefined or custom; and which admin holds which role. | `cato_admin`, `cato_role` |
| **Sites & Sockets** | Sites configured in the account, with their connectivity, operational and high-availability status, and the Socket appliances behind each site, with their version, connection state and whether they are the primary Socket of an HA pair. | `cato_site`, `cato_socket` |
| **SDP Users** | SDP (remote) users who connect through Cato, with their connectivity status and the device they connect from. | `cato_vpn_user` |

To ingest everything the integration supports, enable all three data sources.

Relationships are built only when the data source they need is enabled:

| Relationship | Requires |
| --- | --- |
| `cato_account` **PROVIDES** `cato_service` | Always created |
| `cato_account` **HAS** `cato_admin` | **Access Governance (Admins & Roles)** |
| `cato_account` **HAS** `cato_role` | **Access Governance (Admins & Roles)** |
| `cato_admin` **ASSIGNED** `cato_role` | **Access Governance (Admins & Roles)** |
| `cato_account` **HAS** `cato_site` | **Sites & Sockets** |
| `cato_site` **HAS** `cato_socket` | **Sites & Sockets** |

SDP users are not linked to the account by a relationship, because an account can have a very large number of them. Each `cato_vpn_user` carries the Cato account ID in `accountId` instead.

#### Required permissions

The API key only needs to read your account. A key created with **Downgrade to View**, or a Service Principal with a view-only role, is enough: Cato limits view permissions to query API calls, and the integration only sends queries.

#### Notes

-   **Connectivity status is a point-in-time value.** Site, Socket and SDP user status comes from the Cato account snapshot taken during the run. Cato reports SDP users in the snapshot only while they are connected, so `connectivityStatus` and `deviceName` are set only for SDP users who were connected when the integration ran. Users who were not connected are still ingested, without those values.
-   **Events and audit trail are not ingested.** The integration does not read Cato events, the audit trail or network metrics.
-   **Every run is a full sync.** Admins, roles, sites, Sockets and SDP users that Cato no longer reports are removed from the graph on the next run.

#### Rate limits

Cato applies rate limits per query and per account, and every API key that calls the same query on your account shares one counter. If another tool, such as a SIEM or log forwarder, uses the Cato API on the same account, it shares those limits with JupiterOne. Most queries allow 120 calls per minute, `accountSnapshot` allows 30 per minute, and `entityLookup`, which the integration uses to list sites and SDP users, allows 30 per minute and 1,500 per 5 hours. The integration reads up to 1,000 entities per `entityLookup` call. When Cato reports a rate limit, the integration waits and retries. If runs hit rate limits often, lower the polling frequency or schedule them away from other tools that use the Cato API.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Generating API Keys for the Cato API](https://support.catonetworks.com/hc/en-us/articles/4413280536081)
-   [What is the Cato API](https://support.catonetworks.com/hc/en-us/articles/20564679978397) — API endpoints by CMA region and the `x-api-key` header
-   [Understanding Cato API Rate Limiting](https://support.catonetworks.com/hc/en-us/articles/5119033786653)
-   [Viewing the Account Info](https://support.catonetworks.com/hc/en-us/articles/16231671459997)
-   [Cato API reference](https://api.catonetworks.com/documentation/)

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (8)

-   `Accounts`
-   `Administrators`
-   `Authentication`
-   `Network Dashboard`
-   `SDP Users Overview`
-   `Sites Overview`
-   `Topology`
-   `Users & User Groups`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (1)

-   `POST /api/v1/graphql2`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (5)

-   [https://api.catonetworks.com/documentation/#query-account](https://api.catonetworks.com/documentation/#query-account)
-   [https://api.catonetworks.com/documentation/#query-accountRoles](https://api.catonetworks.com/documentation/#query-accountRoles)
-   [https://api.catonetworks.com/documentation/#query-accountSnapshot](https://api.catonetworks.com/documentation/#query-accountSnapshot)
-   [https://api.catonetworks.com/documentation/#query-admins](https://api.catonetworks.com/documentation/#query-admins)
-   [https://api.catonetworks.com/documentation/#query-entityLookup](https://api.catonetworks.com/documentation/#query-entityLookup)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (1)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Fetch Admins | `Administrators`, `Authentication` | `POST /api/v1/graphql2` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cato_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Admin | `cato_admin` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Role | `cato_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| SDP User | `cato_vpn_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Service | `cato_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Site | `cato_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| Socket | `cato_socket` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cato_account` | **PROVIDES** | `cato_service` |
| `cato_account` | **HAS** | `cato_role` |
| `cato_account` | **HAS** | `cato_admin` |
| `cato_account` | **HAS** | `cato_site` |
| `cato_admin` | **ASSIGNED** | `cato_role` |
| `cato_site` | **HAS** | `cato_socket` |

### Cato Account

`cato_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountType` | `string` **|** `null` | Cato account type (e.g. CUSTOMER, RESELLER). |  |
| 
`apiHost` \*

 | `string` | Cato API host (CMA region) this account was ingested through, e.g. api.catonetworks.com. |  |
| `tenancy` | `string` **|** `null` | Account tenancy model reported by Cato (e.g. SINGLE\_TENANT). |  |
| `timeZone` | `string` **|** `null` | IANA time zone configured for the account. |  |

---

### Cato Admin

`cato_admin` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `adminStatus` | `string` **|** `null` | Cato operational status of the admin (active, disabled, locked, new, pending\_\*). |  |
| `adminType` | `string` **|** `null` | Cato admin type: LOGIN (a person) or SERVICE\_PRINCIPLE (a service principal). |  |

---

### Cato Role

`cato_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isPredefined` | `boolean` **|** `null` | Whether the role is a Cato-predefined role (true) or custom (false). |  |

---

### Cato Service

`cato_service` inherits from [Service](/data-model/schemas/Service.md)

---

### Cato Site

`cato_site` inherits from [Site](/data-model/schemas/Site.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `connectivityStatus` | `string` **|** `null` | Point-in-time connectivity status of the site (e.g. 'connected', 'disconnected'). |  |
| `haReadiness` | `string` **|** `null` | High-availability readiness status reported by Cato. |  |
| `operationalStatus` | `string` **|** `null` | Point-in-time operational status of the site (e.g. 'active'). |  |

---

### Cato Socket

`cato_socket` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isConnected` | `boolean` **|** `null` | Whether the Socket is currently connected to Cato Cloud. |  |
| `isPrimary` | `boolean` **|** `null` | For HA sites, whether this Socket is the primary one. |  |

---

### Cato Vpn User

`cato_vpn_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | ID of the Cato account the SDP user belongs to. |  |
| `connectivityStatus` | `string` **|** `null` | Point-in-time connectivity status of the SDP user. |  |
| `deviceName` | `string` **|** `null` | Name of the device the SDP user is currently connecting from. |  |
| `isConnectedInOffice` | `boolean` **|** `null` | Whether the SDP user is connected from inside an office site. |  |

---

---

Source: /integrations/directory/cbdefense

# Carbon Black PSC

Visualize Carbon Black endpoint agents and findings on devices, map the agents to devices and their owners, and monitor findings and changes to endpoints through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within Carbon Black and on JupiterOne. Before enabling in JupiterOne, ensure that you have completed the setup within your Carbon Black.

### Carbon Black configuration

The Carbon Black integration connects directly to Carbon Black APIs to obtain details about device sensors/agents and active alerts. To authorize access, you will need to create a **Connector** and an **API Key** in your target PSC account. These credentials will need to be provided in JupiterOne.

In Carbon Black, you will first need to set up an Access Level and API Key in the Carbon Black Cloud Console to allow access to the Devices and Alerts APIs.

This can be done by:

1.  In Carbon Black, go to **Settings > API Access > Access Levels: Add Access Level** and provide the following details:

-   Name "JupiterOne Read Only" (or match your naming patterns)
-   Permissions: `device: READ`, `org.alerts: READ`, `org.retention: READ`

2.  Next, go to **Settings > API Access > API Keys : Add API Key** and create the access key with the following details:

-   Name "JupiterOne" (or match your naming patterns),
    
-   Access Level Type "Custom", "JupiterOne Read Only".
    
    > **NOTE**
    > 
    > Capture the **API Secret Key** and **API ID** for input in JupiterOne.
    

With the Access Level and API Key now configured, you'll need to provide the parameters below for the integration instance in JupiterOne:

-   **Org Key** (`orgKey`): In **Settings > API Access**, capture the **Org Key**.
-   **API ID** (`connectorId`): Captured during API Key creation.
-   **API Key** (`apiKey`): Captured during API Key creation.

_Optional_

-   **Deployment Site/Environment** (`site`): The part immediately following defense- in your Carbon Black Cloud account URL. For example, if you access your account at `https://defense-prod05.conferdeploy.net/`, the site is prod05. See more details [here](https://developer.carbonblack.com/reference/carbon-black-cloud/authentication/#building-your-base-urls).

Once you've collected the above information, head to JupiterOne to create the integration instance.

### Configuration in JupiterOne

To install the Carbon Black integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Carbon Black Cloud. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Carbon Black account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Carbon Black **Deployment Site** and **Org Key** from the Carbon Black Console.
    
-   Lastly, the **API ID** and **API Key** generated for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `carbonblack_psc_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `cbdefense_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| CarbonBlack Host | `cbdefense_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Device Sensor Agent | `cbdefense_sensor` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Service | `cb_endpoint_protection` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `carbonblack_psc_account` | **HAS** | `cb_endpoint_protection` |
| `carbonblack_psc_account` | **HAS** | `cbdefense_sensor` |
| `cbdefense_sensor` | **PROTECTS** | `cbdefense_host` |
| `cbdefense_sensor` | **IDENTIFIED** | `cbdefense_alert` |

### Cbdefense Host

`cbdefense_host` inherits from [Host](/data-model/schemas/Host.md)

---

---

Source: /integrations/directory/checkmarx

# Checkmarx

Visualize Checkmarx scan assessments, findings, and teams, and monitor changes through queries and alerts.

## Installation

The integration connects directly to Checkmarx SAST API. You will need Checkmarx service account user credentials and the associated Checkmarx Hostname to enable this integration.

### Required Permissions in Checkmarx

The service account must have **read-only access** with the following scope:

-   **OAuth Scope**: `sast_rest_api` (required for authentication)

The integration requires read access to:

-   **Projects** (`/cxrestapi/projects`) - to retrieve project configurations
-   **Teams** (`/cxrestapi/auth/teams`) - to retrieve team information
-   **Scans** (`/cxrestapi/sast/scans`) - to retrieve scan results
-   **Reports** (`/cxrestapi/reports/sastScan`) - to generate and download scan reports

The service account should be configured with **Viewer** or **Scanner** role permissions to access these resources without modification capabilities.

### Configuration in JupiterOne

To install the Checkmarx integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Checkmarx. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Checkmarx account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Checkmarx user's **Client username**, and **Client password** for the Checkmarx.
    
-   The **Client Hostname** for your Checkmarx instance. For example, `https://{hostname.checkmarx.net`.
    
    > If you are using a custom host, please make sure to include `.checkmarx.net` with the subdomain and omit the `https://` protocol.
    

Click **Create** once all values are provided to finalize the integration.

> **INFO**
> 
> The Checkmarx integration retrieves the latest project scan. If it has failed, then the integration will use the last successful scan instead.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `checkmarx_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Assessment | `checkmarx_scan` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Finding | `checkmarx_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Project | `checkmarx_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Service | `checkmarx_dast_scanner` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Team | `checkmarx_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `checkmarx_account` | **HAS** | `checkmarx_dast_scanner` |
| `checkmarx_account` | **HAS** | `checkmarx_team` |
| `checkmarx_dast_scanner` | **PERFORMED** | `checkmarx_scan` |
| `checkmarx_project` | **HAS** | `checkmarx_scan` |
| `checkmarx_scan` | **IDENTIFIED** | `checkmarx_finding` |
| `checkmarx_team` | **HAS** | `checkmarx_project` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `checkmarx_project` | **SCANS** | `CodeRepo` | FORWARD |

---

Source: /integrations/directory/checkpoint-harmony

# Checkpoint Harmony

Visualize Checkpoint Harmony Mobile devices, device groups and alerts through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create API Key with Read-only permissions as mentioned below.
> 
> -   Using a web browser, go to your Checkpoint Harmony Mobile tenant (e.g. `https://<REGION>.portal.checkpoint.com`) and log in with your credentials.
>     
> -   Hover over to the Gear Icon, and click on `API Keys` as shown in the image
>     
>     ![Api Token](/assets/images/select-api-token-page-0e691e77021db8c44706a19b1d68a987.png)
>     
> -   On the API Keys page, click on `New`
>     
> -   On the Create New API Key pop up, select the `Service` as `Harmony Mobile`. Select an `Expiration Date` for the API Key. Be Mindful that once the token is expired the Integration will fail. Lastly the select the `Roles` as `Read Only` and click on `CREATE`
>     
>     ![Api Key](/assets/images/create-api-key-924ba438770ed972eb6409ad637e571c.png)
>     
> -   Save the Credentials created an the next screen somewhere as they are required when configuring the integration in JupiterOne.**Note**: the Authentication Url inputted into the integration configuration should end in `.com` (remove `/auth/external` if present).
>     
>     ![Credentials Screen](/assets/images/credentials-screen-18f9b2b7607e24cc568a3375b5c41e2d.png)
>     

To install the Checkpoint Harmony Mobile integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Checkpoint Harmony Mobile. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Checkpoint Harmony Mobile account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Checkpoint Harmony Mobile **Tenant URL**, **API client ID** and **API client secret** to authenticate with the APIs.
    

Click **Create** once all values are provided to finalize the integration.

:::

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `checkpoint_harmony_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `user_endpoint` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device | `checkpoint_harmony_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Device | `checkpoint_harmony_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Service | `checkpoint_harmony_mobile_protection` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `checkpoint_harmony_account` | **HAS** | `user_endpoint` |
| `checkpoint_harmony_account` | **HAS** | `checkpoint_harmony_device_group` |
| `checkpoint_harmony_account` | **HAS** | `checkpoint_harmony_mobile_protection` |
| `checkpoint_harmony_device_group` | **HAS** | `user_endpoint` |
| `user_endpoint` | **HAS** | `checkpoint_harmony_alert` |

---

Source: /integrations/directory/chef-automate

# Chef Automate

Visualize your Chef-managed infrastructure in JupiterOne — the nodes that check in to Chef Automate, the Chef organizations, environments, and Chef Infra Servers that organize them, and each node's latest Chef Infra Client converge run with the versioned cookbooks it applied — map nodes to the Chef Infra Servers that manage them and the environments they belong to, and track failed runs, Chef Infra Client versions, and cookbook versions in use through queries and alerts.

## Installation

This integration connects to your Chef Automate instance using the Chef Automate REST API and ingests the nodes that have checked in to Automate, the Chef organizations, environments, and Chef Infra Servers they report through, and their Chef Infra Client converge runs together with the cookbooks those runs applied. It reads the infrastructure (config-mgmt) endpoints under `/api/v0/cfgmgmt/` and authenticates with a Chef Automate API token. It does not use the Chef Infra Server API or its signed-request authentication, so it sees only the nodes that report to Chef Automate.

Chef Automate is usually self-hosted. If your instance is not reachable from the internet, run the integration on a [JupiterOne Collector](/integrations/development/collector.md) that can reach the Automate URL over HTTPS.

### Configuration in Chef Automate

Before you configure the integration in JupiterOne, prepare the following in Chef Automate:

-   The **URL** of your Chef Automate instance, for example `https://automate.example.com`. JupiterOne, or the JupiterOne Collector, must be able to reach it.
    
-   An **API token** for the integration. API tokens are the only way to authenticate against the Chef Automate API. In the Chef Automate UI, go to the **Settings** tab, open **API Tokens**, and select **Create Token**. Give the token a name and, optionally, assign it to a policy in the same dialog. After you create the token, open the menu at the end of its row and select **Copy Token** to get its value. You need the `iam:tokens` permission to manage tokens. Members of the admins team or the Administrator policy have it.
    
-   **Permissions** for the token. A token that isn't assigned to a policy has no permissions. The integration needs only these two read-only IAM actions:
    
    | IAM action | Needed for |
    | --- | --- |
    | `infra:nodes:list` | Credential validation (always required), and the **Organizations**, **Chef Infra Servers**, **Nodes**, and **Environments** data sources. It's also used to list run history for **Node Runs** |
    | `infra:nodes:get` | **Node Runs**: reading each converge run report |
    
    Do one of the following:
    
    -   Add the token to the Chef-managed **Viewers** policy. This policy grants read-only access to everything in Chef Automate except IAM, including both actions above.
    -   Create a custom policy that grants only `infra:nodes:list` and `infra:nodes:get`, and add the token to it. You can only create custom policies with the Chef Automate Policies API (`POST /apis/iam/v2/policies`).
    
    To add the token to an existing policy, go to **Settings**, open **Policies**, open the policy, select **Add Members**, then **Add Member Expression**, and enter `token:<token-id>`. The token ID is shown on the **API Tokens** page.
    
    If the policy only covers some Chef Automate projects, the token only sees the nodes assigned to those projects. Scope the policy to every project (`"projects": ["*"]`) to ingest your whole estate.
    
-   If Chef Automate presents a self-signed or internal-CA TLS certificate, get the **CA certificate** in PEM format so the integration can verify the connection.
    

Once you have obtained the information above, proceed to JupiterOne to finalize the integration.

### Configuration in JupiterOne

To install the Chef Automate integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Chef Automate**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Chef Automate account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Authentication** and **Options** fields below.
    

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **Chef Automate URL** | Yes | Base URL of your Chef Automate instance, for example `https://automate.example.com`. Any trailing slash is removed. |
| **API Token** | Yes | The Chef Automate API token created above. It's sent in the `api-token` request header. The token must belong to a policy that grants the `infra:nodes:list` and `infra:nodes:get` actions. |

When you save the instance, the integration checks the credentials by calling `GET /api/v0/cfgmgmt/organizations`.

#### Options fields

| Field | Required | Default | Description |
| --- | --- | --- | --- |
| **Disable TLS Verification** | No | Off | Skips TLS certificate verification. Not recommended. Use it only for a self-signed, on-premises Chef Automate instance, and use **CA Certificate** instead where you can. |
| **CA Certificate** | No | Empty | CA certificate (PEM) used to verify a Chef Automate instance that presents a self-signed or internal-CA-signed TLS certificate. |
| **Include Run History** | No | Off | When off, only the latest converge run of each node is ingested. When on, every run Chef Automate still holds for each node is ingested. Only applies when the **Node Runs** data source is enabled. |
| **Organizations** | No | Empty (all) | Ingest only nodes in these Chef organizations. Leave empty to ingest all. |
| **Environments** | No | Empty (all) | Ingest only nodes in these Chef environments. Leave empty to ingest all. |

**Organizations** and **Environments** are sent to Chef Automate as node filters. Values in the same list are combined with OR, and the two lists are combined with AND. They restrict the nodes, and so also the environments, runs, and cookbooks derived from those nodes. They don't restrict the **Organizations** and **Chef Infra Servers** data sources, which always list every organization and Chef Infra Server known to Chef Automate.

Click **Create** once all values are provided to finalize the integration.

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default**, so enable the ones you want to ingest. The `chef_account` entity (the Chef Automate instance) and the `chef_service` entity are always created.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Organizations** | Chef organizations associated with checked-in nodes | `chef_organization` |
| **Chef Infra Servers** | Chef Infra Servers that managed nodes report through, identified by FQDN | `chef_infra_server` |
| **Environments** | Chef environments of the ingested nodes. Requires **Nodes** | `chef_environment` |
| **Nodes** | Chef-managed infrastructure nodes checked in to Chef Automate, with hostname, FQDN, IP and MAC addresses, platform, Chef Infra Client version, policy, and check-in status | `chef_node` |
| **Node Runs** | Chef Infra Client converge runs and the versioned cookbooks they applied. Requires **Nodes** | `chef_run`, `chef_cookbook` |

Some relationships, and two data sources, need more than one data source to be enabled:

-   Organization to node (`HAS`) requires **Organizations** and **Nodes**.
-   Chef Infra Server to node (`MANAGES`) requires **Chef Infra Servers** and **Nodes**.
-   **Environments** requires **Nodes**. Chef Automate has no complete environment list, so environments are built from the nodes that were ingested. It also creates the environment to node (`HAS`) relationship.
-   **Node Runs** requires **Nodes**. It creates the node to run (`HAS`) and run to cookbook (`USES`) relationships.

The integration doesn't create mapped relationships to entities from other integrations.

#### Limits and behavior

-   **10,000-result limit.** Chef Automate serves the node list and each node's run history from its search backend (Elasticsearch or OpenSearch). That backend returns at most 10,000 results for a single query by default (`index.max_result_window`). If more than 10,000 nodes match your filters, Chef Automate returns an error for the pages past that point and the **Nodes** step fails. If you have more than 10,000 nodes, split them across several integration instances with the **Organizations** or **Environments** filters, or ask your Chef Automate administrator to raise `index.max_result_window`. The same limit applies to each node's run history when **Include Run History** is enabled.
-   **Run volume.** By default, one run (the latest) is ingested per node. With **Include Run History** enabled, the integration makes one extra API request for every run. Run data is kept in Chef Automate only as long as its data lifecycle settings allow (30 days by default).
-   **Nodes without runs.** A node appears in Chef Automate after a Chef Infra Client run completes, but a node can be listed with no run history. Such nodes are ingested as `chef_node` entities and skipped by **Node Runs**.
-   **Missing nodes.** Chef Automate labels nodes that stop checking in as missing, and later deletes them, based on its data lifecycle settings. A deleted node disappears from JupiterOne on the next run.
-   **Environment identity.** Environments are scoped to a Chef Infra Server and an organization, so environments with the same name (for example `production`) in different organizations or servers become separate `chef_environment` entities.
-   **Chef Infra Servers.** Chef Automate only exposes each server's FQDN, so `chef_infra_server` entities carry the FQDN and no other host details.
-   **Not collected.** Node attributes, per-resource run details (including resource diffs), compliance reports, and the event feed aren't collected.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Chef Automate API reference](https://docs.chef.io/automate/api/): the config-mgmt endpoints this integration calls
-   [Chef Automate API tokens](https://docs.chef.io/automate/api_tokens/): creating a token and assigning it to a policy
-   [Chef Automate policies](https://docs.chef.io/automate/policies/) and [IAM guide](https://docs.chef.io/automate/iam_v2_guide/): policy membership and member expressions
-   [Chef Automate roles](https://docs.chef.io/automate/roles/): the actions included in the Viewer role
-   [Chef Automate client runs](https://docs.chef.io/automate/client_runs/) and [data lifecycle](https://docs.chef.io/automate/data_lifecycle/): how nodes and run history are kept
-   [Chef Automate troubleshooting](https://docs.chef.io/automate/troubleshooting/): the OpenSearch 10,000-record limit and `max_result_window`

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (2)

-   `infra:nodes:get`
-   `infra:nodes:list`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (5)

-   `https://<automate-host>/api/v0/cfgmgmt/nodes`
-   `https://<automate-host>/api/v0/cfgmgmt/nodes/{node_id}/runs`
-   `https://<automate-host>/api/v0/cfgmgmt/nodes/{node_id}/runs/{run_id}`
-   `https://<automate-host>/api/v0/cfgmgmt/organizations`
-   `https://<automate-host>/api/v0/cfgmgmt/source_fqdns`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (2)

-   [https://docs.chef.io/automate/api/](https://docs.chef.io/automate/api/)
-   [https://docs.chef.io/automate/api\_tokens/](https://docs.chef.io/automate/api_tokens/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Fetch Environments | `infra:nodes:list` | `https://<automate-host>/api/v0/cfgmgmt/nodes` |
| Fetch Node Runs | `infra:nodes:list`, `infra:nodes:get` | `https://<automate-host>/api/v0/cfgmgmt/nodes/{node_id}/runs`, `https://<automate-host>/api/v0/cfgmgmt/nodes/{node_id}/runs/{run_id}` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `chef_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Chef Infra Server | `chef_infra_server` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cookbook | `chef_cookbook` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Environment | `chef_environment` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Node | `chef_node` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Organization | `chef_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Run | `chef_run` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Service | `chef_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `chef_account` | **PROVIDES** | `chef_service` |
| `chef_account` | **HAS** | `chef_organization` |
| `chef_account` | **HAS** | `chef_infra_server` |
| `chef_account` | **HAS** | `chef_environment` |
| `chef_environment` | **HAS** | `chef_node` |
| `chef_infra_server` | **MANAGES** | `chef_node` |
| `chef_node` | **HAS** | `chef_run` |
| `chef_organization` | **HAS** | `chef_node` |
| `chef_run` | **USES** | `chef_cookbook` |

### Chef Account

`chef_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`automateUrl` \*

 | `string` | Base URL of the Chef Automate instance. |  |

---

### Chef Cookbook

`chef_cookbook` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`version` \*

 | `string` | The version of the cookbook. |  |

---

### Chef Environment

`chef_environment` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`organization` \*

 | `string` **|** `null` | The Chef organization the environment belongs to. |  |
| 

`sourceFqdn` \*

 | `string` **|** `null` | FQDN of the Chef Infra Server the environment belongs to (null for nodes that report no server). |  |

---

### Chef Infra Server

`chef_infra_server` inherits from [Host](/data-model/schemas/Host.md)

---

### Chef Node

`chef_node` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`checkInStatus` \*

 | `string` **|** `null` | Status on the latest infra report for the node (e.g. success, failure, missing). Churns per Chef run. |  |
| 

`chefVersion` \*

 | `string` **|** `null` | Chef Infra Client version running on the node. |  |
| 

`cloudProvider` \*

 | `string` **|** `null` | Cloud provider the node runs on, if any. |  |
| 

`environment` \*

 | `string` **|** `null` | The Chef environment the node is in. |  |
| 

`manufacturer` \*

 | `string` **|** `null` | DMI system manufacturer reported for the node. |  |
| 

`organization` \*

 | `string` **|** `null` | The Chef organization the node is associated with. |  |
| 

`platformFamily` \*

 | `string` **|** `null` | Platform family of the node (e.g. debian, rhel, windows). |  |
| 

`policyGroup` \*

 | `string` **|** `null` | Policyfile policy group associated with the node. |  |
| 

`policyName` \*

 | `string` **|** `null` | Policyfile policy name associated with the node. |  |
| 

`policyRevision` \*

 | `string` **|** `null` | Policyfile policy revision associated with the node. |  |
| 

`sourceFqdn` \*

 | `string` **|** `null` | FQDN of the Chef Infra Server the node reports through. |  |
| 

`uptimeSeconds` \*

 | `number` **|** `null` | Count in seconds that the node has been active. Churns per Chef run. |  |

---

### Chef Organization

`chef_organization` inherits from [Organization](/data-model/schemas/Organization.md)

---

### Chef Run

`chef_run` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`chefVersion` \*

 | `string` **|** `null` | Chef Infra Client version that performed the run. |  |
| 

`completedOn` \*

 | `number` **|** `null` | End time of the run, in milliseconds since epoch. |  |
| 

`error` \*

 | `string` **|** `null` | Error message reported on a failed run, if any. |  |
| 

`policyGroup` \*

 | `string` **|** `null` | Policyfile policy group applied during the run. |  |
| 

`policyName` \*

 | `string` **|** `null` | Policyfile policy name applied during the run. |  |
| 

`policyRevision` \*

 | `string` **|** `null` | Policyfile policy revision applied during the run. |  |
| 

`recipes` \*

 | `array` **|** `null` | Recipes the node called during the run. |  |
| 

`roles` \*

 | `array` **|** `null` | Roles associated with the node during the run. |  |
| 

`runList` \*

 | `array` **|** `null` | Run list applied during the converge. |  |
| 

`startedOn` \*

 | `number` **|** `null` | Start time of the run, in milliseconds since epoch. |  |
| 

`totalResourceCount` \*

 | `number` **|** `null` | Total number of resources reported on the run. |  |
| 

`updatedResourceCount` \*

 | `number` **|** `null` | Number of resources updated during the run. |  |

---

### Chef Service

`chef_service` inherits from [Service](/data-model/schemas/Service.md)

---

---

Source: /integrations/directory/circleci

# CircleCI

Visualize CircleCI users, user groups, pipelines, and projects, map CircleCI users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need your CircleCI **User ID**, **VCS username**, and a **Personal API Token** to configure this integration. Find your User ID and create a token in CircleCI under **User Settings > Account Integrations** and **User Settings > Personal API Tokens**. See [Managing API Tokens](https://circleci.com/docs/managing-api-tokens/) for details.

### Required Permissions in CircleCI

The API Key must have **read-only access** to the following resources:

-   **User Information** (`/api/v2/me`) - to retrieve user and collaboration details
-   **Pipelines** (`/api/v2/pipeline`) - to retrieve pipeline configurations and executions
-   **Workflows** (`/api/v2/pipeline/{id}/workflow`) - to retrieve workflow details
-   **Jobs** (`/api/v2/workflow/{id}/job`) - to retrieve job executions
-   **Projects** (`/api/v2/project/{project_slug}`) - to retrieve project configurations
-   **Environment Variables** (`/api/v2/project/{project_slug}/envvar`) - to list project environment variable names (values are not exposed)
-   **Contexts** (`/api/v2/context`) - to retrieve context configurations
-   **Context Environment Variables** (`/api/v2/context/{id}/environment-variable`) - to list context variable names
-   **Context Restrictions** (`/api/v2/context/{id}/restrictions`) - to retrieve context access restrictions

The integration uses the CircleCI v2 API with token-based authentication and requires no write or modification permissions.

### Configuration in JupiterOne

To install the CircleCI integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select CircleCI. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Account Name** used to identify the CircleCI account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **User ID** — your CircleCI user ID. Find this under **User Settings > Account Integrations** in the CircleCI web app.
    
-   **VCS username** — your version control system username (for example, your GitHub or Bitbucket username).
    
-   **API Key** — a CircleCI Personal API Token. Generate one in the CircleCI web app under **User Settings > Personal API Tokens**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `circleci_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Context | `circleci_context` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Context Environment Variable | `circleci_context_environment_variable` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Pipeline | `circleci_pipeline` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Pipeline Workflow | `circleci_workflow` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Project | `circleci_project` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Project Environment Variable | `circleci_project_environment_variable` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| User | `circleci_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| UserGroup | `circleci_user_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Workflow Job | `circleci_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `circleci_account` | **HAS** | `circleci_user_group` |
| `circleci_account` | **HAS** | `circleci_user` |
| `circleci_context` | **HAS** | `circleci_context_environment_variable` |
| `circleci_pipeline` | **HAS** | `circleci_workflow` |
| `circleci_project` | **HAS** | `circleci_pipeline` |
| `circleci_project` | **HAS** | `circleci_project_environment_variable` |
| `circleci_project` | **USES** | `circleci_context_environment_variable` |
| `circleci_user_group` | **HAS** | `circleci_project` |
| `circleci_user_group` | **HAS** | `circleci_user` |
| `circleci_workflow` | **HAS** | `circleci_job` |

---

Source: /integrations/directory/cisco-aci

# Cisco ACI

Cisco Application Centric Infrastructure (ACI) is a software-defined networking solution that provides centralized automation and policy-driven application profiles for data center environments. This integration enables visibility into your ACI fabric topology, tenants, networking constructs (VRFs, Bridge Domains), application profiles, endpoint groups, and discovered endpoints with their IP and MAC addresses.

## Installation

### Prerequisites in Cisco ACI

The JupiterOne Cisco ACI integration requires read-only access to the APIC (Application Policy Infrastructure Controller) REST API. You will need to create a local user account with the appropriate role.

#### Creating a Local User Account

1.  Log in to the APIC GUI with administrator credentials.
    
2.  Navigate to **Admin > AAA > Users**.
    
3.  Select the **Local Users** tab.
    
4.  Click **Create Local User** and configure the following:
    
    -   **Login ID**: A unique username for the integration (for example, `jupiterone-readonly`).
    -   **Password**: A strong password meeting APIC requirements (minimum 8 characters, including at least three character types: lowercase, uppercase, digits, or symbols).
5.  In the **Security** section:
    
    -   **Security Domain**: Select `all` to allow access to every tenant, or select specific tenant domains to limit the integration's scope.
6.  In the **Roles** section, assign the following role:
    
    -   **Role**: `read-all`
    -   **Privilege Type**: `Read`
    
    > **NOTE**
    > 
    > The `read-all` role with the `Read` privilege provides read-only access to tenant configurations, fabric topology, and endpoint information without the ability to modify any settings.
    
7.  Click **Submit** to create the user.
    

#### Network Requirements

-   The JupiterOne integration must be able to reach the APIC controller over HTTPS (port 443).
-   If the APIC uses a self-signed certificate, ensure your JupiterOne Collector is deployed in an environment that trusts the APIC's certificate.
-   For on-premises deployments, ensure the JupiterOne Collector has network access to the APIC URL.

### Configuration in JupiterOne

To install the Cisco ACI integration in JupiterOne, navigate to the **Integrations** tab and select **Cisco ACI**. Click **New Instance** to begin configuring your integration.

#### Authentication Settings

-   **APIC URL**: The URL of your Cisco ACI APIC controller (for example, `https://apic.example.com`). This should be the management IP or hostname of your primary APIC.
    
-   **Username**: The username of the read-only APIC user created for JupiterOne.
    
-   **Password**: The password for the APIC user.
    

#### General Settings

-   **Account Name**: Used to identify the Cisco ACI account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **Account Name** toggle is enabled.
    
-   **Description**: Optional description to help identify the integration instance.
    
-   **Polling Interval**: Select the frequency for data synchronization. You may leave this set to `DISABLED` and run the integration manually.
    

#### Data Sources

The integration provides granular control over what data is ingested. You can enable or disable specific ingestion sources:

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Fabric & Controllers** | ACI fabric topology, APIC controllers, and network switches | `cisco_aci_fabric`, `cisco_aci_controller`, `cisco_aci_switch` |
| **Tenants** | ACI tenants (logical containers for policies) and the L4-L7 firewall service devices attached to them | `cisco_aci_tenant`, `cisco_aci_firewall` |
| **Networking** | VRFs (Virtual Routing and Forwarding contexts) and Bridge Domains | `cisco_aci_vrf`, `cisco_aci_bridge_domain` |
| **Applications** | Application Profiles and Endpoint Groups (EPGs) | `cisco_aci_application_profile`, `cisco_aci_epg` |
| **Endpoints** | Discovered client endpoints with IP and MAC addresses, and DNS records | `cisco_aci_endpoint`, `cisco_aci_dns_record` |

Click **Create** once all values are provided to finalize the integration.

### Using a JupiterOne Collector

For on-premises Cisco ACI deployments that are not accessible from the internet, you can use a [JupiterOne Collector](/integrations/development/collector.md) to run the integration within your network:

1.  Deploy a JupiterOne Collector in your network with access to the APIC controller.
2.  When configuring the integration instance, select the appropriate Collector.
3.  The Collector will execute the integration locally and securely upload the data to JupiterOne.

### Next Steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional Resources

-   [Cisco APIC Basic Configuration Guide - User Access and Authentication](https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/6x/basic-configuration/cisco-apic-basic-configuration-guide-60x/user-access-authentication-and-accounting-60x.html)
-   [Cisco APIC REST API Configuration Guide](https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/all/apic-rest-api-configuration-guide/cisco-apic-rest-api-configuration-guide/m_using_the_rest_api.html)

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `read-all`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (10)

-   `GET /api/node/class/eqptCh.json`
-   `GET /api/node/class/fabricNode.json`
-   `GET /api/node/class/fvAEPg.json?rsp-subtree=children&rsp-subtree-class=fvRsBd,fvRsPathAtt`
-   `GET /api/node/class/fvAp.json`
-   `GET /api/node/class/fvBD.json?rsp-subtree=children&rsp-subtree-class=fvRsCtx,fvSubnet`
-   `GET /api/node/class/fvCEp.json?rsp-subtree=children&rsp-subtree-class=fvIp`
-   `GET /api/node/class/fvCtx.json`
-   `GET /api/node/class/fvTenant.json`
-   `GET /api/node/class/topSystem.json`
-   `GET /api/node/class/vnsLDevVip.json?rsp-subtree=children&rsp-subtree-class=vnsCDev,vnsCMgmt,vnsRsMDevAtt`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://developer.cisco.com/docs/apic-rest-api-configuration-guide/](https://developer.cisco.com/docs/apic-rest-api-configuration-guide/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (6)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Fetch Application Profiles | `read-all` | `GET /api/node/class/fvAp.json` |
| Fetch Bridge Domains | `read-all` | `GET /api/node/class/fvBD.json?rsp-subtree=children&rsp-subtree-class=fvRsCtx,fvSubnet` |
| Fetch Endpoint Groups | `read-all` | `GET /api/node/class/fvAEPg.json?rsp-subtree=children&rsp-subtree-class=fvRsBd,fvRsPathAtt` |
| Fetch Endpoints | `read-all` | `GET /api/node/class/fvCEp.json?rsp-subtree=children&rsp-subtree-class=fvIp` |
| Fetch L4-L7 Devices (Firewalls) | `read-all` | `GET /api/node/class/vnsLDevVip.json?rsp-subtree=children&rsp-subtree-class=vnsCDev,vnsCMgmt,vnsRsMDevAtt` |
| Fetch VRFs | `read-all` | `GET /api/node/class/fvCtx.json` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Cisco ACI Account | `cisco_aci_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cisco ACI Application Profile | `cisco_aci_application_profile` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Cisco ACI Bridge Domain | `cisco_aci_bridge_domain` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cisco ACI Controller | `cisco_aci_controller` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Cisco ACI DNS Record | `cisco_aci_dns_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| Cisco ACI Endpoint | `cisco_aci_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| Cisco ACI Endpoint Group | `cisco_aci_epg` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Cisco ACI Fabric | `cisco_aci_fabric` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| Cisco ACI Firewall | `cisco_aci_firewall` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Cisco ACI Switch | `cisco_aci_switch` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Cisco ACI Tenant | `cisco_aci_tenant` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cisco ACI VRF | `cisco_aci_vrf` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cisco_aci_account` | **HAS** | `cisco_aci_fabric` |
| `cisco_aci_account` | **HAS** | `cisco_aci_tenant` |
| `cisco_aci_application_profile` | **HAS** | `cisco_aci_epg` |
| `cisco_aci_bridge_domain` | **USES** | `cisco_aci_vrf` |
| `cisco_aci_endpoint` | **ASSIGNED** | `cisco_aci_epg` |
| `cisco_aci_endpoint` | **HAS** | `cisco_aci_dns_record` |
| `cisco_aci_epg` | **USES** | `cisco_aci_bridge_domain` |
| `cisco_aci_fabric` | **HAS** | `cisco_aci_controller` |
| `cisco_aci_fabric` | **HAS** | `cisco_aci_switch` |
| `cisco_aci_tenant` | **HAS** | `cisco_aci_vrf` |
| `cisco_aci_tenant` | **HAS** | `cisco_aci_bridge_domain` |
| `cisco_aci_tenant` | **HAS** | `cisco_aci_application_profile` |
| `cisco_aci_tenant` | **HAS** | `cisco_aci_firewall` |

### Cisco Aci Account

`cisco_aci_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Cisco Aci Application Profile

`cisco_aci_application_profile` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `qosPriority` | `string` |  |  |
| `tenantName` | `string` |  |  |

---

### Cisco Aci Bridge Domain

`cisco_aci_bridge_domain` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arpFlood` | `boolean` |  |  |
| `limitIpLearnToSubnets` | `boolean` |  |  |
| `multiDestinationPacketAction` | `string` |  |  |
| `subnets` | `array` of `string`s |  |  |
| `tenantName` | `string` |  |  |
| `unicastRoute` | `boolean` |  |  |
| `unknownMacUnicastAction` | `string` |  |  |
| `unknownMulticastAction` | `string` |  |  |
| `vrfName` | `string` |  |  |

---

### Cisco Aci Controller

`cisco_aci_controller` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agreementId` | `string` |  |  |
| `assetType` | `string` |  |  |
| `endOfLife` | `string` |  |  |
| `endOfSale` | `string` |  |  |
| `endOfSupport` | `string` |  |  |
| `manufacturingDate` | `string` |  |  |
| `operationalState` | `string` |  |  |
| `podId` | `string` |  |  |
| `role` | `string` |  |  |
| `serviceLevel` | `string` |  |  |
| `systemUpTime` | `string` |  |  |

---

### Cisco Aci Dns Record

`cisco_aci_dns_record` inherits from [DomainRecord](/data-model/schemas/DomainRecord.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `value` | `string` |  |  |

---

### Cisco Aci Endpoint

`cisco_aci_endpoint` inherits from [NetworkEndpoint](/data-model/schemas/NetworkEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `applicationProfileName` | `string` |  |  |
| `encapsulation` | `string` |  |  |
| `endpointGroupName` | `string` |  |  |
| `ipAddresses` | `array` of `string`s |  |  |
| `lifecycleClass` | `string` |  |  |
| `macAddress` | `string` |  |  |
| `tenantName` | `string` |  |  |

---

### Cisco Aci Epg

`cisco_aci_epg` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `applicationProfileName` | `string` |  |  |
| `bridgeDomainName` | `string` |  |  |
| `encapsulations` | `array` of `string`s |  |  |
| `floodOnEncapsulation` | `string` |  |  |
| `policyEnforcementPreference` | `string` |  |  |
| `preferredGroupMembership` | `string` |  |  |
| `qosPriority` | `string` |  |  |
| `tenantName` | `string` |  |  |

---

### Cisco Aci Fabric

`cisco_aci_fabric` inherits from [Site](/data-model/schemas/Site.md)

---

### Cisco Aci Firewall

`cisco_aci_firewall` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agreementId` | `string` |  |  |
| `assetType` | `string` |  |  |
| `configState` | `string` |  |  |
| `contextAware` | `string` |  |  |
| `deviceType` | `string` |  |  |
| `endOfLife` | `string` |  |  |
| `endOfSale` | `string` |  |  |
| `endOfSupport` | `string` |  |  |
| `isManaged` | `boolean` |  |  |
| `serviceLevel` | `string` |  |  |
| `tenantName` | `string` |  |  |

---

### Cisco Aci Switch

`cisco_aci_switch` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agreementId` | `string` |  |  |
| `assetType` | `string` |  |  |
| `endOfLife` | `string` |  |  |
| `endOfSale` | `string` |  |  |
| `endOfSupport` | `string` |  |  |
| `manufacturingDate` | `string` |  |  |
| `operationalState` | `string` |  |  |
| `podId` | `string` |  |  |
| `role` | `string` |  |  |
| `serviceLevel` | `string` |  |  |
| `systemUpTime` | `string` |  |  |

---

### Cisco Aci Tenant

`cisco_aci_tenant` inherits from [Account](/data-model/schemas/Account.md)

---

### Cisco Aci Vrf

`cisco_aci_vrf` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dataPlaneLearning` | `string` |  |  |
| `policyEnforcementDirection` | `string` |  |  |
| `policyEnforcementPreference` | `string` |  |  |
| `tenantName` | `string` |  |  |

---

## Release Notes

-   **2026-03-06** — Added switches and firewalls as new entity types to the Cisco ACI integration.
-   **2026-01-27** — New Cisco ACI integration: ingests tenants, VRFs, bridge domains, application profiles, endpoint groups, endpoints, and DNS records with full fabric topology.

---

Source: /integrations/directory/cisco-amp

# Cisco Secure Endpoint

Visualize Cisco Secure Endpoint protected devices, map agents to devices and their respective owners, and monitor changes through queries and alerts.

## Installation

This integration connects directly to [Cisco Secure Endpoint REST API](https://api-docs.amp.cisco.com/) to obtain endpoint protection and configuration information.

Valid API Endpoints include:

-   `api.amp.cisco.com`
-   `api.apjc.amp.cisco.com`
-   `api.eu.amp.cisco.com`

> **INFO**
> 
> You will need to create a new Client ID and API Key with _read access_ in Cisco Secure Endpoint for this integration. See [their documentation](https://developer.cisco.com/docs/secure-endpoint/#!overview) for more information.

To install the Cisco Secure Endpoint integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Cisco Secure Endpoint. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Cisco Secure Endpoint account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **API Endpoint Hostname** associated with your Cisco Secure Endpoint account.
    
-   Your Cisco Secure Endpoint **Client ID** and **API Key** (configured for read access).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cisco_amp_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Computer | `cisco_amp_endpoint` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Vulnerability | `cisco_amp_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cisco_amp_account` | **HAS** | `cisco_amp_endpoint` |
| `cisco_amp_endpoint` | **HAS** | `cisco_amp_vulnerability` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `cisco_amp_endpoint` | **PROTECTS** | `user_endpoint` | FORWARD |

### Cisco Amp Endpoint

`cisco_amp_endpoint` inherits from [Host](/data-model/schemas/Host.md)

---

### Cisco Amp Vulnerability

`cisco_amp_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cvssScore` \*

 | `number` **|** `null` |  |  |

---

## Release Notes

-   **2025-06-03** — New Cisco Secure Endpoint integration: ingests endpoints, malware findings, and CVE vulnerabilities with device protection relationships.

---

Source: /integrations/directory/cisco-cyber-vision

# Cisco Cyber Vision

Visualize your Cisco Cyber Vision OT environment in JupiterOne — the Cyber Vision Center, the industrial assets it discovers (PLCs, controllers, switches, and other devices, with their IP and MAC addresses, VLANs, and networks), and the CVE-backed vulnerabilities detected on them with their CVSS and Cisco Security Risk Scores — map each device to the vulnerabilities that affect it, and monitor OT exposure through queries and alerts.

## Installation

This integration connects to your on-premises Cisco Cyber Vision Center using the Cisco Cyber Vision New UI API (`https://<center>/cvapi/v1/`, Cyber Vision 5.4 and later) and ingests OT assets and the vulnerabilities detected on them. The Center is usually on your own network, so the integration normally runs on a [JupiterOne Collector](/integrations/development/collector.md) that can reach the Center over HTTPS (port `443` unless you include a different port in the hostname).

### Configuration in Cisco Cyber Vision

Before you configure the integration in JupiterOne, prepare the following in your Cisco Cyber Vision Center:

-   The **hostname or IP address** of the Center, for example `192.168.1.100`. The JupiterOne Collector must be able to reach it over HTTPS.
    
-   An **API token**. In the Center, go to **Admin** > **API** > **Token**, click **New Token** (or **Create your first token**), enter a name such as `JupiterOne`, leave the **Status** toggle enabled, optionally set an expiration date, and save. Click **Show** to see and copy the token. Cisco recommends one token per application so you can expire or remove access separately. The menu location can differ between Center releases; see [Cisco's authentication guide](https://developer.cisco.com/docs/cyber-vision/authentication/).
    
    The integration only sends `GET` requests to two endpoints, `/cvapi/v1/assets` and `/cvapi/v1/assets/vulnerabilities`, and never modifies data on the Center.
    
-   If the Center presents a self-signed or internal-CA TLS certificate, get the **CA certificate** in PEM format so the collector can verify the connection.
    

Once you have obtained the information above, proceed to JupiterOne to finalize the integration.

### Configuration in JupiterOne

To install the Cisco Cyber Vision integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Cisco Cyber Vision**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Cisco Cyber Vision account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Center Hostname or IP** of your Cyber Vision Center, for example `192.168.1.100`. You can also enter `host:port` or a full `https://` URL; the integration builds the `https://<host>/cvapi/v1/` base URL from it.
    
-   The **API Token** created above. It is sent in the `x-token-id` request header.
    
-   Optionally, a **CA Certificate** to trust a self-signed or internal-CA certificate, or enable **Disable TLS Verification** to skip certificate validation (not recommended).
    
-   Optionally, set **Minimum CVSS Score** to limit the vulnerabilities that are ingested. Options: **All vulnerabilities** (default, no filter), **4.0 (medium and above)**, **7.0 (high and above)**, **9.0 (critical only)**. The value is sent to the Center as the `cvss` filter on `/assets/vulnerabilities`.
    
-   Optionally, set **Minimum Cisco Security Risk Score** to limit the vulnerabilities that are ingested. Options: **All vulnerabilities** (default, no filter), **25 and above**, **50 and above**, **75 and above**. The value is sent to the Center as the `csrs` filter on `/assets/vulnerabilities`.
    
-   Optionally, set **Last Active Within** to ingest only assets that were last active within the selected window. Options: **All assets** (default, no filter), **7 days**, **30 days**, **90 days**, **180 days**, **365 days**.
    

Raising either score threshold or narrowing **Last Active Within** removes the vulnerabilities or devices that fall outside the new filter from JupiterOne on the next run.

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default**, so enable the ones you want to ingest. The Center account (`cisco_cyber_vision_account`) and the Cyber Vision service (`cisco_cyber_vision_service`) entities are always created.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Devices** | OT assets (PLCs, controllers, switches, etc.) discovered by Cisco Cyber Vision, with asset type, vendor, IP and MAC addresses, VLANs, network names, vulnerability and active alert counts, and first and last active times | `cisco_cyber_vision_device` |
| **Vulnerabilities** | CVE-backed vulnerabilities detected on Cisco Cyber Vision OT assets, with title, CVSS score, and Cisco Security Risk Score | `cisco_cyber_vision_vulnerability` |

One vulnerability entity is created per CVE and shared by every device it affects. Its `severity` is derived from the CVSS score.

The relationships are built as follows:

-   Account to device (`HAS`) requires **Devices**.
-   Service to vulnerability (`IDENTIFIED`) requires **Vulnerabilities**.
-   Device to vulnerability (`HAS`) requires both **Devices** and **Vulnerabilities**.

The integration collects only assets and their vulnerabilities. Other Cyber Vision data, such as activities, flows, events, components, and baselines, is not retrieved.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Cisco Cyber Vision API authentication (creating an API token)](https://developer.cisco.com/docs/cyber-vision/authentication/)
-   [Cisco Cyber Vision New UI API: Get Asset List](https://developer.cisco.com/docs/cyber-vision/new-ui/get-asset-list/)
-   [Cisco Cyber Vision New UI API: Get Asset Vulnerabilities](https://developer.cisco.com/docs/cyber-vision/new-ui/get-asset-vulnerabilities/)

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (2)

-   `/cvapi/v1/assets`
-   `/cvapi/v1/assets/vulnerabilities`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (2)

-   [https://developer.cisco.com/docs/cyber-vision/new-ui/get-asset-list/](https://developer.cisco.com/docs/cyber-vision/new-ui/get-asset-list/)
-   [https://developer.cisco.com/docs/cyber-vision/new-ui/get-asset-vulnerabilities/](https://developer.cisco.com/docs/cyber-vision/new-ui/get-asset-vulnerabilities/)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Asset | `cisco_cyber_vision_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Center | `cisco_cyber_vision_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Service | `cisco_cyber_vision_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Vulnerability | `cisco_cyber_vision_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cisco_cyber_vision_account` | **PROVIDES** | `cisco_cyber_vision_service` |
| `cisco_cyber_vision_account` | **HAS** | `cisco_cyber_vision_device` |
| `cisco_cyber_vision_device` | **HAS** | `cisco_cyber_vision_vulnerability` |
| `cisco_cyber_vision_service` | **IDENTIFIED** | `cisco_cyber_vision_vulnerability` |

### Cisco Cyber Vision Account

`cisco_cyber_vision_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`centerHost` \*

 | `string` | The configured hostname or IP of the Cyber Vision Center |  |
| 

`centerId` \*

 | `string` **|** `null` | The Center identifier reported by the Cyber Vision New UI API |  |

---

### Cisco Cyber Vision Device

`cisco_cyber_vision_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`activeAlertCount` \*

 | `number` **|** `null` | Count of active alerts currently raised on the asset (rolling count, informational) |  |
| 

`assetType` \*

 | `string` **|** `null` | The Cyber Vision OT asset type verbatim (e.g. PLC, Controller, Switch) |  |
| 

`firstActiveOn` \*

 | `number` **|** `null` | Epoch milliseconds when the asset was first seen active |  |
| 

`networkNames` \*

 | `array` **|** `null` | Network names observed across the asset network interfaces |  |
| 

`vlans` \*

 | `array` **|** `null` | VLAN identifiers observed across the asset network interfaces |  |
| 

`vulnerabilityCount` \*

 | `number` **|** `null` | Count of vulnerabilities currently detected on the asset (rolling count, informational) |  |

---

### Cisco Cyber Vision Service

`cisco_cyber_vision_service` inherits from [Service](/data-model/schemas/Service.md)

---

### Cisco Cyber Vision Vulnerability

`cisco_cyber_vision_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`ciscoSecurityRiskScore` \*

 | `number` **|** `null` | The Cisco Security Risk Score (CSRS) for the CVE (0 - 100) |  |
| 

`cvssScore` \*

 | `number` **|** `null` | The CVSS score assigned to the CVE (0.0 - 10.0) |  |
| 

`title` \*

 | `string` **|** `null` | The human-readable vulnerability title |  |

---

## Release Notes

-   **2026-10-06** — New Cisco Cyber Vision integration: ingests OT network assets and devices, services, and CVE-backed vulnerability findings with device-vulnerability relationships.

---

Source: /integrations/directory/cisco-fmc

# Cisco FMC

Visualize your Cisco Secure Firewall Management Center (FMC) deployment in JupiterOne — the FTD firewalls it manages, the access control and NAT policies assigned to each device and the rules inside them, and the hosts and network vulnerabilities discovered by FMC network discovery — so you can see which rules apply to which firewall, find exposed services and vulnerable hosts, and monitor changes through queries and alerts.

## Installation

This integration connects to your on-premises Cisco Secure Firewall Management Center (FMC) using the FMC REST API and ingests managed FTD devices, access control policies and their access rules, FTD NAT policies and their NAT rules, and the hosts and vulnerabilities discovered by FMC network discovery. The FMC is usually on your own network, so the integration normally runs on a [JupiterOne Collector](/integrations/development/collector.md) that can reach the FMC over HTTPS.

Cloud-delivered FMC (cdFMC) is not supported. The integration only works with an on-premises or virtual FMC appliance.

### Configuration in Cisco FMC

Before you configure the integration in JupiterOne, prepare the following in your FMC:

-   The **base URL** of your FMC, for example `https://fmc.example.com`. The JupiterOne Collector must be able to reach it.
    
-   The **REST API enabled**. It is enabled by default; to confirm, choose **System > Configuration > REST API Preferences** and check that **Enable REST API** is selected.
    
-   A **dedicated FMC user** for the integration, with a read-only role that can use the REST API and view devices, access control policies, NAT policies, and network discovery hosts and vulnerabilities. The integration only makes read (`GET`) requests, plus the `POST` that generates its access token.
    
    Do not reuse an account that people sign in to the FMC web interface with. FMC does not allow the same credentials to be used for the web interface and the REST API at the same time, and logs the other session out without warning. Cisco also recommends keeping UI users and API users separate and not using an admin account for the API.
    
-   The **username** and **password** of that user. The integration sends them as HTTP Basic authentication to `POST /api/fmc_platform/v1/auth/generatetoken` and then uses the returned `X-auth-access-token` for every other request. Access tokens are valid for 30 minutes; the integration requests a new one automatically when a token expires during a run.
    
-   If the FMC presents a self-signed or internal-CA TLS certificate, get the **CA certificate** in PEM format so the collector can verify the connection.
    

Once you have obtained the information above, proceed to JupiterOne to finalize the integration.

### Configuration in JupiterOne

To install the Cisco FMC integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Cisco FMC**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Cisco FMC account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **FMC Base URL** of your on-premises FMC, for example `https://fmc.example.com` (required).
    
-   The **API Username** and **API Password** of the dedicated read-only FMC user created above (required).
    
-   Optionally, a **CA Certificate** to trust a self-signed or internal-CA certificate, or enable **Disable TLS Verification** to skip certificate validation (not recommended).
    

When you save the instance, JupiterOne validates the credentials by requesting an access token from the FMC.

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default**, so enable the ones you want to ingest. The account (`cisco_fmc_account`) and service (`cisco_fmc_service`) entities are always created.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Managed Devices** | FTD devices managed by the FMC, with hostname, model, software version, FTD mode, health status, and deployment status | `cisco_fmc_device` |
| **Access Control Policies** | Access control policies with their default action, and the access rules inside each policy (action, enabled state, logging, source and destination networks and ports, and applications) | `cisco_fmc_access_policy`, `cisco_fmc_access_rule` |
| **NAT Policies** | FTD NAT policies and their auto and manual NAT rules (NAT type, section, original and translated source, and source and destination interfaces) | `cisco_fmc_nat_policy`, `cisco_fmc_nat_rule` |
| **Discovered Hosts** | Hosts discovered by FMC network discovery, with IP and MAC addresses, hostname, operating system, exposed services, and detected applications | `cisco_fmc_host` |
| **Host Findings** | Network vulnerabilities (CVEs) that FMC network discovery detected on hosts, one finding per CVE, host IP address, and port | `cisco_fmc_host_finding` |

The relationships between data sources are built only when both sides are enabled:

-   Device to access control policy (`ASSIGNED`) requires **Managed Devices** and **Access Control Policies**.
-   Device to NAT policy (`ASSIGNED`) requires **Managed Devices** and **NAT Policies**. Only policies assigned directly to a device are linked; NAT policies assigned to a high-availability pair or a cluster are not linked to the member devices.
-   Discovered host to host finding (`HAS`) requires **Discovered Hosts** and **Host Findings**. Findings are matched to hosts by IP address.

The integration does not create relationships to entities from other integrations.

Keep the following in mind:

-   **Only one FMC domain is ingested.** The integration collects the domain that the FMC returns for the API user when it signs in (the `DOMAIN_UUID` of the token response) and does not enumerate or query any other domain.
-   **"Access lists" means access control policies and their rules.** Extended ACL objects are not ingested.
-   **Host findings carry no severity or CVSS score.** The FMC network map does not return one, so every finding is ingested with `severity: informational` and `numericSeverity: 0`, along with its `cveId` and an NVD reference link.
-   **Large deployments take a while.** Cisco documents a REST API limit of 120 `GET` requests per minute from a single IP address. The integration paces all of its requests just below that (about 114 per minute) on every FMC release, requests up to 1000 objects per page, and fetches access and NAT rules one policy at a time, so a run against a FMC with many policies, rules, or discovered hosts can take a long time.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Secure Firewall Management Center REST API Quick Start Guide, Version 7.4.1](https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/REST/secure_firewall_management_center_rest_api_quick_start_guide_741.html)
-   [About the Management Center REST API](https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/REST/secure_firewall_management_center_rest_api_quick_start_guide_741/About_The_Firepower_Management_Center_REST_API.html) — enabling the REST API and API user best practices
-   [Connecting with a Client](https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/REST/secure_firewall_management_center_rest_api_quick_start_guide_741/Connecting_With_A_Client.html) — token generation and session behavior
-   [Objects in the REST API](https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/REST/secure_firewall_management_center_rest_api_quick_start_guide_741/Objects_In_The_REST_API.html) — rate limits, paging, and the endpoints this integration reads

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (9)

-   `/api/fmc_config/v1/domain/{domainUUID}/assignment/policyassignments`
-   `/api/fmc_config/v1/domain/{domainUUID}/devices/devicerecords`
-   `/api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies`
-   `/api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies/{containerUUID}/accessrules`
-   `/api/fmc_config/v1/domain/{domainUUID}/policy/ftdnatpolicies`
-   `/api/fmc_config/v1/domain/{domainUUID}/policy/ftdnatpolicies/{containerUUID}/natrules`
-   `/api/fmc_netmap/v1/domain/{domainUUID}/hosts`
-   `/api/fmc_netmap/v1/domain/{domainUUID}/vulns`
-   `/api/fmc_platform/v1/auth/generatetoken`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (2)

-   [https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/REST/secure\_firewall\_management\_center\_rest\_api\_quick\_start\_guide\_741/Connecting\_with\_a\_Client.html](https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/REST/secure_firewall_management_center_rest_api_quick_start_guide_741/Connecting_with_a_Client.html)
-   [https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/REST/secure\_firewall\_management\_center\_rest\_api\_quick\_start\_guide\_741/Objects\_In\_The\_REST\_API.html](https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/REST/secure_firewall_management_center_rest_api_quick_start_guide_741/Objects_In_The_REST_API.html)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (3)

| Step | Endpoints |
| --- | --- |
| Build Device Assigned NAT Policy Relationships | `/api/fmc_config/v1/domain/{domainUUID}/assignment/policyassignments` |
| Fetch Access Rules | `/api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies/{containerUUID}/accessrules` |
| Fetch NAT Rules | `/api/fmc_config/v1/domain/{domainUUID}/policy/ftdnatpolicies/{containerUUID}/natrules` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Access Control Policy | `cisco_fmc_access_policy` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| Access Rule | `cisco_fmc_access_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Account | `cisco_fmc_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Discovered Host | `cisco_fmc_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Host Finding | `cisco_fmc_host_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Managed Device | `cisco_fmc_device` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| NAT Policy | `cisco_fmc_nat_policy` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| NAT Rule | `cisco_fmc_nat_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Service | `cisco_fmc_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cisco_fmc_access_policy` | **HAS** | `cisco_fmc_access_rule` |
| `cisco_fmc_account` | **PROVIDES** | `cisco_fmc_service` |
| `cisco_fmc_account` | **HAS** | `cisco_fmc_device` |
| `cisco_fmc_account` | **HAS** | `cisco_fmc_access_policy` |
| `cisco_fmc_account` | **HAS** | `cisco_fmc_nat_policy` |
| `cisco_fmc_device` | **ASSIGNED** | `cisco_fmc_access_policy` |
| `cisco_fmc_device` | **ASSIGNED** | `cisco_fmc_nat_policy` |
| `cisco_fmc_host` | **HAS** | `cisco_fmc_host_finding` |
| `cisco_fmc_nat_policy` | **HAS** | `cisco_fmc_nat_rule` |

### Cisco Fmc Access Policy

`cisco_fmc_access_policy` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `defaultAction` | `string` **|** `null` | The policy default action (BLOCK, TRUST, PERMIT, NETWORK\_DISCOVERY, INHERIT\_FROM\_PARENT). |  |

---

### Cisco Fmc Access Rule

`cisco_fmc_access_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `action` | `string` **|** `null` | The rule action (ALLOW, TRUST, BLOCK, MONITOR, BLOCK\_RESET, ...). |  |
| `applications` | `array` **|** `null` | Summarized application names matched by the rule. |  |
| `destinationNetworks` | `array` **|** `null` | Summarized destination network object names and inline literal values. |  |
| `destinationPorts` | `array` **|** `null` | Summarized destination port object names and literal values. |  |
| `isEnabled` | `boolean` **|** `null` | Whether the rule is enabled. |  |
| `isLogBeginEnabled` | `boolean` **|** `null` | Whether logging at the start of the connection is on. |  |
| `isLogEndEnabled` | `boolean` **|** `null` | Whether logging at the end of the connection is on. |  |
| `section` | `string` **|** `null` | The rule section (mandatory, default), when reported. |  |
| `sourceNetworks` | `array` **|** `null` | Summarized source network object names and inline literal values. |  |
| `sourcePorts` | `array` **|** `null` | Summarized source port object names and literal values. |  |

---

### Cisco Fmc Account

`cisco_fmc_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainUuid` \*

 | `string` | The FMC domain UUID this account represents. |  |
| `fmcHost` | `string` **|** `null` | The on-prem FMC host, or null for a cloud-delivered FMC (cdFMC) tenant. |  |

---

### Cisco Fmc Device

`cisco_fmc_device` inherits from [Firewall](/data-model/schemas/Firewall.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deploymentStatus` | `string` **|** `null` | The device policy deployment status reported by FMC. |  |
| `ftdMode` | `string` **|** `null` | The FTD deployment mode (e.g. ROUTED, TRANSPARENT), when reported. |  |
| `healthStatus` | `string` **|** `null` | The device health status reported by FMC. |  |
| `hostName` | `string` **|** `null` | The device hostname reported by FMC. |  |
| `ipv4Addresses` | `array` **|** `null` | IPv4 addresses of the device, when the name/hostName is an address. |  |
| `model` | `string` **|** `null` | The device hardware model reported by FMC. |  |
| `osVersion` | `string` **|** `null` | The device software version (sw\_version) reported by FMC. |  |

---

### Cisco Fmc Host

`cisco_fmc_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `applications` | `array` **|** `null` | Applications detected on the host, name and version (R6). |  |
| `criticalityLevel` | `string` **|** `null` | The host criticality level reported by FMC RNA (e.g. High, Medium, Low). Named criticalityLevel to avoid the base Entity numeric `criticality` property (ADR-012). |  |
| `services` | `array` **|** `null` | Exposed services as "{protocol}/{port}" strings (R4). |  |

---

### Cisco Fmc Host Finding

`cisco_fmc_host_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `port` | `number` **|** `null` | The port the vulnerability was detected on, when reported. |  |
| `protocol` | `string` **|** `null` | The protocol the vulnerability was detected on, when reported. |  |
| `source` | `string` **|** `null` | The detection source reported by FMC (e.g. RNA for passive detection). |  |

---

### Cisco Fmc Nat Policy

`cisco_fmc_nat_policy` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

---

### Cisco Fmc Nat Rule

`cisco_fmc_nat_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `destinationInterface` | `string` **|** `null` | The destination interface/zone object name. |  |
| `isEnabled` | `boolean` **|** `null` | Whether the rule is enabled. |  |
| `natType` | `string` **|** `null` | The NAT type (DYNAMIC, STATIC). |  |
| `originalSource` | `string` **|** `null` | The original (pre-translation) source object name: originalSource for manual NAT, originalNetwork for auto NAT. |  |
| `ruleType` | `string` **|** `null` | The rule object type (FTDAutoNatRule or FTDManualNatRule). |  |
| `section` | `string` **|** `null` | The NAT section (BEFORE\_AUTO, AUTO, AFTER\_AUTO). |  |
| `sourceInterface` | `string` **|** `null` | The source interface/zone object name. |  |
| `translatedSource` | `string` **|** `null` | The translated source object name: translatedSource for manual NAT, translatedNetwork for auto NAT. |  |

---

### Cisco Fmc Service

`cisco_fmc_service` inherits from [Service](/data-model/schemas/Service.md)

---

## Release Notes

-   **2026-10-07** — Added new Cisco Firepower Management Center integration, ingesting managed devices, access control policies and rules, NAT policies and rules, discovered network hosts, and host vulnerability findings.

---

Source: /integrations/directory/cisco-ise

# Cisco ISE

Cisco Identity Services Engine (ISE) is a security policy management and control platform that enables enterprises to automate and enforce security policies across their wired, wireless, and VPN networks. It's designed to provide comprehensive, identity-based access control and security compliance for devices and users on a network.

## Installation

### Configuration in Cisco ISE Platform

1.  Navigate to the Cisco ISE Dashboard
    
2.  Click on menú icon located in the top left corner.
    
3.  Under "System", click on "Settings".
    
4.  In the left bar, search for API settings.
    
5.  Under API Settings -> API Service Settings -> API Service Settings for Primary Administration Node, you should enable "Open API (Read/Write)".
    

### Required Permissions in Cisco ISE

The user account must have **read-only access** to the ERS (External RESTful Services) API:

-   **API Access**: Open API must be enabled on the Primary Administration Node
-   **User Role**: The account should be assigned an **Admin** role with at least **Read-Only** permissions
-   **Required API Access**:
    -   **Network Devices** (`/ers/config/networkdevice`) - to retrieve network device configurations
    -   **Network Device Groups** (`/ers/config/networkdevicegroup`) - to retrieve device groupings

The integration uses HTTP Basic authentication over HTTPS and accesses the ERS API endpoints. No write or modification permissions are required.

### Configuration in JupiterOne

To install the Cisco ISE integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Cisco ISE. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **PAN URL**: your PAN URL of the Primary Administration Node's address in a Cisco ISE deployment. Please do not include the http protocol (Ex: devnetsandbox.cisco.com). If you are using an non-standard port you can include it at the end of the url (Ex: devnetsandbox.cisco.com:9060)
    
-   **Username**: the username used for authentication.
    
-   **Password**: the password used for authentication.
    
-   The **Account Name** used to identify the Cisco ISE account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Data Source Settigns**: here you will be able to customize the steps to be ingested. If desired, specific steps can be enabled/disabled from here.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cisco_ise_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Network Device | `cisco_ise_network_device` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| Network Device Group | `cisco_ise_network_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cisco_ise_network_device_group` | **HAS** | `cisco_ise_network_device` |

---

Source: /integrations/directory/cisco-meraki

# Cisco Meraki

Visualize Cisco Meraki administrators, SAML roles, and devices within network sites, map Cisco Meraki users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need a Cisco Meraki API key with read access to your organization. The API key inherits the permissions of the administrator account that generates it, so a **read-only** organization administrator is sufficient.

### Generate a Meraki API key

1.  Log in to the [Meraki Dashboard](https://account.meraki.com/secure/login/dashboard_login) as an organization administrator.
2.  Go to **Organization** > **API & Webhooks**.
3.  Under **API access**, click **Generate new API key**.
4.  Copy the key and store it securely — it is shown only once.

> **NOTE**
> 
> The **API & Webhooks** page is visible only to organization administrators. If you do not see it, you will need to request organization admin access or have an existing admin generate the key.

For more information, see the [Cisco Meraki Dashboard API documentation](https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Operate_and_Maintain/How-Tos/How_to_Use_the_Cisco_Meraki_Dashboard_API).

### Configuration in JupiterOne

To install the Cisco Meraki integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Cisco Meraki. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Cisco Meraki account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Cisco Meraki **API Key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cisco_meraki_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Admin | `meraki_admin` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Device | `meraki_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Network | `meraki_network` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| Organization | `meraki_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| SAML Role | `meraki_saml_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| SSID | `meraki_wifi` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| VLAN | `meraki_vlan` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cisco_meraki_account` | **HAS** | `meraki_organization` |
| `meraki_network` | **HAS** | `meraki_device` |
| `meraki_network` | **HAS** | `meraki_vlan` |
| `meraki_network` | **HAS** | `meraki_wifi` |
| `meraki_organization` | **HAS** | `meraki_network` |
| `meraki_organization` | **HAS** | `meraki_admin` |
| `meraki_organization` | **HAS** | `meraki_saml_role` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `meraki_device` | **CONNECTS** | `internet` | FORWARD |
| `meraki_network` | **HAS** | `host` | FORWARD |
| `meraki_vlan` | **HAS** | `host` | FORWARD |

---

Source: /integrations/directory/cisco-secure-workload

# Cisco Secure Workload

Visualize Cisco Secure Workload user roles and scopes, and monitor changes through queries and alerts.

## Installation

To use the Cisco Secure Workload integration, you need an API Key and API Secret with the specific capabilities the integration requires. The integration authenticates using HMAC-SHA256 request signing — every request is signed with the API Secret, so no write access is granted.

### Prerequisites

1.  Log in to your Cisco Secure Workload dashboard.
2.  Click your account name in the upper right corner and choose **API Keys**.
3.  Click **Create API Key** and enter an optional description.
4.  Under **Capabilities**, select all three of the following:
    -   `user_role_scope_management` — read users, roles, and application scopes
    -   `flow_inventory_query` — query workload inventory, packages, and vulnerabilities
    -   `app_policy_management` — read application workspaces and security policies
5.  Click **Create**. Copy the API Key and API Secret and store them securely — the secret is shown only once.
6.  Note the URL of your Cisco Secure Workload dashboard (for example, `https://<tenant>.tetrationpreview.com`).

See [Cisco Secure Workload OpenAPIs](https://www.cisco.com/c/en/us/td/docs/security/workload_security/secure_workload/user-guide/3_10/cisco-secure-workload-user-guide-on-prem-v310/secure-workload-openapis.html) for full details on API key capabilities and authentication.

### Configuration in JupiterOne

Navigate to **Integrations** in JupiterOne, select **Cisco Secure Workload**, and click **New Instance**.

Creating an instance requires the following:

-   **API Key** — The API Key generated in Cisco Secure Workload.
-   **API Secret** — The API Secret generated alongside the API Key.
-   **API URI** — The base URL of your Cisco Secure Workload dashboard (for example, `https://<tenant>.tetrationpreview.com`).

Click **Create** to finish. The integration will begin running on the polling interval you selected, or you can trigger it manually at any time.

### Next steps

Once configured, your Cisco Secure Workload data will populate in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) to learn how to edit, disable, or re-run your integration instance.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `csw_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Interface | `csw_interface` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Package | `csw_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Policy | `csw_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Role | `csw_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Scope | `csw_scope` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `csw_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Workload | `csw_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Workload Finding | `csw_workload_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Workload Vulnerability | `csw_workload_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `csw_account` | **HAS** | `csw_user` |
| `csw_account` | **HAS** | `csw_role` |
| `csw_account` | **HAS** | `csw_policy` |
| `csw_interface` | **HAS** | `csw_scope` |
| `csw_package` | **HAS** | `csw_workload_finding` |
| `csw_policy` | **HAS** | `csw_scope` |
| `csw_project` | **HAS** | `csw_interface` |
| `csw_project` | **HAS** | `csw_package` |
| `csw_project` | **HAS** | `csw_workload_finding` |
| `csw_role` | **USES** | `csw_scope` |
| `csw_scope` | **HAS** | `csw_scope` |
| `csw_user` | **HAS** | `csw_role` |
| `csw_user` | **ASSIGNED** | `csw_scope` |

### Csw Workload Finding

`csw_workload_finding` inherits from [Finding](/data-model/schemas/Finding.md)

---

### Csw Workload Vulnerability

`csw_workload_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

---

## Release Notes

-   **2025-06-05** — Promoted Cisco Secure Workload vulnerability findings to carry both the Vulnerability and Finding entity classes, enabling cross-integration vulnerability queries.

---

Source: /integrations/directory/cisco-umbrella

# Cisco Umbrella

Visualize Cisco Umbrella networks, domains, destinations, users, and discovered applications in the JupiterOne graph. Use this integration to also map Cisco Umbrella users to employees in your JupiterOne account and to monitor changes to Cisco Umbrella entities using JupiterOne alerts.

## Installation

> **INFO**
> 
> Cisco Umbrella uses OAuth 2.0 client credentials (API Key and Key Secret) to authenticate API requests. You must have an Umbrella user account with the **Full Admin** role to create the API key. You must also have permission in JupiterOne to install new integrations.

### Configuration in Cisco Umbrella

1.  Sign in to [Cisco Umbrella](https://dashboard.umbrella.com) and navigate to **Admin** > **API Keys**. In a Multi-org, MSP, or MSSP console, go to **Console Settings** > **API Keys** instead.
2.  Click **API Keys**, then click **Add**.
3.  Enter a name for the key, and an optional description.
4.  Grant the following scopes, selecting **Read-Only** for each. Expand a scope to view its categories, then check each category to grant access:
    -   **Admin** — Roles, Users
    -   **Deployments** — Internal Domains, Internal Networks, Network Devices, Policies, Sites, Network Tunnels, Virtual Appliances
    -   **Policies** — Destination Lists, Destinations
    -   **Reports** — App Discovery
5.  Set an **Expiry Date** for the key, or choose for it to never expire. Optionally add network restrictions.
6.  Click **Create Key**, then copy and save the **API Key** and **Key Secret**. You have only one opportunity to copy the Key Secret.
7.  Click **Accept And Close**.

> **NOTE**
> 
> Network tunnel data requires a Cisco Umbrella SIG (Secure Internet Gateway) license. If the API returns 403 for network tunnels, the integration skips network tunnel ingestion and shows a warning. All other data types are still collected.

### Configuration in JupiterOne

To install the Cisco Umbrella integration in JupiterOne, navigate to the **Integrations** tab, select Cisco Umbrella, and click **New Instance**.

Creating an instance requires the following:

-   **API Key** — The Cisco Umbrella API key used for authentication.
-   **Key Secret** — The secret associated with the API key.

You can also set an optional **Description** and choose a **Polling Interval** for how often the integration runs. Leave the polling interval as `DISABLED` to trigger runs manually.

Click **Create** to save and activate the integration.

### Next steps

After creating the instance, the integration will run on the polling interval you configured and populate data in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) for more on managing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (12)

-   `admin.roles:read`
-   `admin.users:read`
-   `deployments.internaldomains:read`
-   `deployments.internalnetworks:read`
-   `deployments.networkdevices:read`
-   `deployments.policies:read`
-   `deployments.sites:read`
-   `deployments.tunnels:read`
-   `deployments.virtualappliances:read`
-   `policies.destinationLists:read`
-   `policies.destinations:read`
-   `reports.appDiscovery:read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (13)

-   `https://api.umbrella.com/admin/v2/roles`
-   `https://api.umbrella.com/admin/v2/users`
-   `https://api.umbrella.com/deployments/v2/internaldomains`
-   `https://api.umbrella.com/deployments/v2/internalnetworks`
-   `https://api.umbrella.com/deployments/v2/networkdevices`
-   `https://api.umbrella.com/deployments/v2/policies`
-   `https://api.umbrella.com/deployments/v2/sites`
-   `https://api.umbrella.com/deployments/v2/tunnels`
-   `https://api.umbrella.com/deployments/v2/virtualappliances`
-   `https://api.umbrella.com/policies/v2/destinationlists`
-   `https://api.umbrella.com/policies/v2/destinationlists/{destinationListId}/destinations`
-   `https://api.umbrella.com/reports/v2/appDiscovery/applicationCategories`
-   `https://api.umbrella.com/reports/v2/appDiscovery/applications`

### Licenses

Product licenses or SKUs required in the target environment.

Show Licenses (1)

-   `Cisco Umbrella SIG (Secure Internet Gateway)`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://developer.cisco.com/docs/cloud-security/umbrella-api-oauth-scopes/](https://developer.cisco.com/docs/cloud-security/umbrella-api-oauth-scopes/)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cisco_umbrella_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `cisco_umbrella_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Application Category | `cisco_umbrella_application_category` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Destination | `cisco_umbrella_destination` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Destination List | `cisco_umbrella_destination_list` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Domain | `cisco_umbrella_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| Network | `cisco_umbrella_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Network Device | `cisco_umbrella_network_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Network Tunnel | `cisco_umbrella_network_tunnel` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| Policy | `cisco_umbrella_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Site | `cisco_umbrella_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| System Role | `cisco_umbrella_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| System User | `cisco_umbrella_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Virtual Appliance | `cisco_umbrella_virtual_appliance` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_application` |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_destination_list` |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_network_device` |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_domain` |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_network` |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_policy` |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_site` |
| `cisco_umbrella_account` | **HAS** | `cisco_umbrella_user` |
| `cisco_umbrella_application` | **HAS** | `cisco_umbrella_application_category` |
| `cisco_umbrella_destination_list` | **HAS** | `cisco_umbrella_destination` |
| `cisco_umbrella_site` | **HAS** | `cisco_umbrella_network_tunnel` |
| `cisco_umbrella_site` | **HAS** | `cisco_umbrella_virtual_appliance` |
| `cisco_umbrella_user` | **ASSIGNED** | `cisco_umbrella_role` |
| `cisco_umbrella_virtual_appliance` | **USES** | `cisco_umbrella_domain` |

---

Source: /integrations/directory/cloudbees

# Cloudbees

Visualize Cloudbees CI users, groups, roles, and accounts, map Cloudbees CI users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> For this integration, you will need to have a deployed Cloudbees CI Operations Center and user credentials for a user with administrator-level permissions.

To install the Cloudbees integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Cloudbees. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Cloudbees account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Cloudbees **User ID**, **API Key**, and **Hostname**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cloudbees_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Role | `cloudbees_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| User | `cloudbees_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| UserGroup | `cloudbees_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cloudbees_account` | **HAS** | `cloudbees_user` |
| `cloudbees_account` | **HAS** | `cloudbees_group` |
| `cloudbees_account` | **HAS** | `cloudbees_role` |
| `cloudbees_group` | **HAS** | `cloudbees_user` |
| `cloudbees_group` | **ASSIGNED** | `cloudbees_role` |

---

Source: /integrations/directory/cloudflare

# Cloudflare

Visualize Cloudflare users, access roles, domain zones, and domain records, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to create a [Cloudflare API Token](https://dash.cloudflare.com/profile/api-tokens) configured for read access with the following:

-   `Account` → `Access: Organizations, Identity Providers, and Groups` → `Read` to list identity provider information.
-   `Account` → `Account Settings` → `Read` to list accounts, members, and roles.
-   `Account` → `Zero Trust` → `Read` to list Zero Trust entities.
-   `Account` → `Access: Audit Logs` → `Read` to list Zero Trust (Access) users.
-   `Account` → `Load Balancing: Monitors and Pools` → `Read` to list load balancer pools.
-   `Account` → `Account Rulesets` → `Read` to list account-level rulesets and their rules.
-   `Zone` → `Zone` → `Read` to get information about the zone
-   `Zone` → `DNS` → `Read` to list records in a zone.
-   `Zone` → `Load Balancers` → `Read` to list load balancers in a zone.
-   `Zone` → `Zone WAF` → `Read` to list zone-level rulesets and their rules.
-   `Zone` → `Logs` → `Read` to read the log retention flag of a zone. Only required when the **Ingest Log Retention Flag** configuration option is enabled.

![Token Creation](/assets/images/token-d5b36bbe4969e4be131e78397ee0868f.png)

Once created, obtain an API token from the bottom of the [**API Tokens** page](https://dash.cloudflare.com/profile/api-tokens) in your Cloudflare account. With the token, head to JupiterOne to complete the integration installation.

### Configuration in JupiterOne

To install the Cloudflare integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Cloudflare. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Cloudflare account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Cloudflare (read access) **API Token**.
    

Click **Create** once all values are provided to finalize the integration.

## Data Volume Configuration

Control how much data is ingested from Cloudflare to manage additional API requests.

### Data Filtering Options

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Ingest Log Retention Flag** | When enabled, ingests the log retention flag for each zone. | Disabled | Enabled, Disabled |

**How it affects data volume:** When enabled, the integration makes one additional request per zone to the Cloudflare API to retrieve the log retention flag. This option requires the `Zone` → `Logs` → `Read` permission on the API token.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (11)

-   `Access: Audit Logs Read`
-   `Access: Organizations, Identity Providers, and Groups Read`
-   `Account Rulesets Read`
-   `Account Settings Read`
-   `DNS Read`
-   `Load Balancers Read`
-   `Load Balancing: Monitors and Pools Read`
-   `Logs Read`
-   `Zero Trust Read`
-   `Zone Read`
-   `Zone WAF Read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (15)

-   `GET https://api.cloudflare.com/client/v4/accounts`
-   `GET https://api.cloudflare.com/client/v4/accounts/{account_id}/access/identity_providers`
-   `GET https://api.cloudflare.com/client/v4/accounts/{account_id}/access/users`
-   `GET https://api.cloudflare.com/client/v4/accounts/{account_id}/devices/physical-devices`
-   `GET https://api.cloudflare.com/client/v4/accounts/{account_id}/load_balancers/pools`
-   `GET https://api.cloudflare.com/client/v4/accounts/{account_id}/members`
-   `GET https://api.cloudflare.com/client/v4/accounts/{account_id}/roles`
-   `GET https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets`
-   `GET https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets/{ruleset_id}`
-   `GET https://api.cloudflare.com/client/v4/zones`
-   `GET https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records`
-   `GET https://api.cloudflare.com/client/v4/zones/{zone_id}/load_balancers`
-   `GET https://api.cloudflare.com/client/v4/zones/{zone_id}/logs/control/retention/flag`
-   `GET https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets`
-   `GET https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (16)

-   [https://developers.cloudflare.com/api/resources/accounts/methods/list/](https://developers.cloudflare.com/api/resources/accounts/methods/list/)
-   [https://developers.cloudflare.com/api/resources/accounts/subresources/members/methods/list/](https://developers.cloudflare.com/api/resources/accounts/subresources/members/methods/list/)
-   [https://developers.cloudflare.com/api/resources/accounts/subresources/roles/methods/list/](https://developers.cloudflare.com/api/resources/accounts/subresources/roles/methods/list/)
-   [https://developers.cloudflare.com/api/resources/dns/subresources/records/methods/list/](https://developers.cloudflare.com/api/resources/dns/subresources/records/methods/list/)
-   [https://developers.cloudflare.com/api/resources/load\_balancers/](https://developers.cloudflare.com/api/resources/load_balancers/)
-   [https://developers.cloudflare.com/api/resources/load\_balancers/methods/list/](https://developers.cloudflare.com/api/resources/load_balancers/methods/list/)
-   [https://developers.cloudflare.com/api/resources/load\_balancers/subresources/pools/methods/list/](https://developers.cloudflare.com/api/resources/load_balancers/subresources/pools/methods/list/)
-   [https://developers.cloudflare.com/api/resources/logs/subresources/control/subresources/retention/methods/get/](https://developers.cloudflare.com/api/resources/logs/subresources/control/subresources/retention/methods/get/)
-   [https://developers.cloudflare.com/api/resources/rulesets/methods/get/](https://developers.cloudflare.com/api/resources/rulesets/methods/get/)
-   [https://developers.cloudflare.com/api/resources/rulesets/methods/list/](https://developers.cloudflare.com/api/resources/rulesets/methods/list/)
-   [https://developers.cloudflare.com/api/resources/zero\_trust/subresources/access/subresources/users/methods/list/](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/users/methods/list/)
-   [https://developers.cloudflare.com/api/resources/zero\_trust/subresources/devices/subresources/devices/methods/list/](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/devices/methods/list/)
-   [https://developers.cloudflare.com/api/resources/zero\_trust/subresources/identity\_providers/methods/list/](https://developers.cloudflare.com/api/resources/zero_trust/subresources/identity_providers/methods/list/)
-   [https://developers.cloudflare.com/api/resources/zones/methods/list/](https://developers.cloudflare.com/api/resources/zones/methods/list/)
-   [https://developers.cloudflare.com/fundamentals/api/reference/permissions/](https://developers.cloudflare.com/fundamentals/api/reference/permissions/)
-   [https://developers.cloudflare.com/ruleset-engine/basic-operations/view-rulesets/](https://developers.cloudflare.com/ruleset-engine/basic-operations/view-rulesets/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (5)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Fetch Cloudflare Load Balancer Pool Relationships | \- | \- |
| Fetch Cloudflare Load Balancers | `Load Balancers Read` | `GET https://api.cloudflare.com/client/v4/zones/{zone_id}/load_balancers` |
| Fetch Ruleset Rules | `Account Rulesets Read`, `Zone WAF Read` | `GET https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets/{ruleset_id}`, `GET https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}` |
| Fetch Rulesets | `Account Rulesets Read`, `Zone WAF Read` | `GET https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets`, `GET https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets` |
| Fetch Zero Trust Devices | `Zero Trust Read` | `GET https://api.cloudflare.com/client/v4/accounts/{account_id}/devices/physical-devices` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cloudflare_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Account Member | `cloudflare_account_member` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Account Role | `cloudflare_account_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| DNS Record | `cloudflare_dns_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| DNS Zone | `cloudflare_dns_zone` | [DomainZone](https://docs.jupiterone.io/data-model/schemas/DomainZone) |
| Load Balancer | `cloudflare_load_balancer` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Load Balancer Pool | `cloudflare_load_balancer_pool` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Ruleset | `cloudflare_ruleset` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| Ruleset Rule | `cloudflare_ruleset_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Zero Trust | `cloudflare_zero_trust_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Zero Trust Device | `cloudflare_zero_trust_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cloudflare_account` | **HAS** | `cloudflare_account_member` |
| `cloudflare_account` | **HAS** | `cloudflare_account_role` |
| `cloudflare_account` | **HAS** | `cloudflare_dns_zone` |
| `cloudflare_account` | **HAS** | `cloudflare_ruleset` |
| `cloudflare_account_member` | **ASSIGNED** | `cloudflare_account_role` |
| `cloudflare_dns_zone` | **HAS** | `cloudflare_dns_record` |
| `cloudflare_dns_zone` | **HAS** | `cloudflare_load_balancer` |
| `cloudflare_dns_zone` | **HAS** | `cloudflare_ruleset` |
| `cloudflare_load_balancer` | **USES** | `cloudflare_load_balancer_pool` |
| `cloudflare_ruleset` | **CONTAINS** | `cloudflare_ruleset_rule` |
| `cloudflare_zero_trust_user` | **OWNS** | `cloudflare_zero_trust_device` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `cloudflare_account` | **CONNECTS** | `cloudflare_account` | REVERSE |
| `cloudflare_dns_record` | **CONNECTS** | `cloudflare_load_balancer` | FORWARD |
| `cloudflare_dns_record` | **CONNECTS** | `aws_alb` | FORWARD |
| `cloudflare_load_balancer_pool` | **USES** | `cloudflare_dns_record` | FORWARD |

### Cloudflare Load Balancer

`cloudflare_load_balancer` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `adaptiveRoutingFailoverAcrossPools` | `boolean` |  |  |
| `countryPools` | `array` of `string`s |  |  |
| `createdOn` | `number` |  |  |
| `defaultPoolCount` | `number` |  |  |
| `defaultPoolIds` | `array` of `string`s |  |  |
| `description` | `string` |  |  |
| `displayName` | `string` |  |  |
| `enabled` | `boolean` |  |  |
| `fallbackPoolId` | `string` |  |  |
| `id` | `string` |  |  |
| `locationStrategyMode` | `string` |  |  |
| `locationStrategyPreferEcs` | `string` |  |  |
| `modifiedOn` | `number` |  |  |
| `popPools` | `array` of `string`s |  |  |
| `proxied` | `boolean` |  |  |
| `randomSteeringDefaultWeight` | `number` |  |  |
| `randomSteeringPoolWeights` | `array` of `string`s |  |  |
| `regionPools` | `array` of `string`s |  |  |
| `rules` | `array` of `string`s |  |  |
| `sessionAffinity` | `string` |  |  |
| `sessionAffinityDrainDuration` | `number` |  |  |
| `sessionAffinityHeaders` | `array` of `string`s |  |  |
| `sessionAffinityRequireAllHeaders` | `boolean` |  |  |
| `sessionAffinitySamesite` | `string` |  |  |
| `sessionAffinitySecure` | `string` |  |  |
| `sessionAffinityTTL` | `number` |  |  |
| `sessionAffinityZeroDowntimeFailover` | `string` |  |  |
| `steeringPolicy` | `string` |  |  |
| `ttl` | `number` |  |  |
| `zoneName` | `string` |  |  |

---

### Cloudflare Load Balancer Pool

`cloudflare_load_balancer_pool` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `checkRegions` | `array` of `string`s |  |  |
| `createdOn` | `number` |  |  |
| `description` | `string` |  |  |
| `id` | `string` |  |  |
| `latitude` | `number` |  |  |
| `loadSheddingDefaultPercent` | `number` |  |  |
| `loadSheddingDefaultPolicy` | `string` |  |  |
| `loadSheddingSessionPercent` | `number` |  |  |
| `loadSheddingSessionPolicy` | `string` |  |  |
| `longitude` | `number` |  |  |
| `minimumOrigins` | `number` |  |  |
| `modifiedOn` | `number` |  |  |
| `monitor` | `string` |  |  |
| `networks` | `array` of `string`s |  |  |
| `originAddresses` | `array` of `string`s |  |  |

---

### Cloudflare Ruleset

`cloudflare_ruleset` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`phase` \*

 | `string` **|** `null` |  |  |
| 

`source` \*

 | `string` **|** `null` |  |  |
| 

`version` \*

 | `string` **|** `null` |  |  |
| 

`zoneId` \*

 | `string` **|** `null` |  |  |

---

### Cloudflare Ruleset Rule

`cloudflare_ruleset_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `string` **|** `null` |  |  |
| 

`actionParametersId` \*

 | `string` **|** `null` |  |  |
| 

`actionParametersOverridesAction` \*

 | `string` **|** `null` |  |  |
| 

`actionParametersVersion` \*

 | `string` **|** `null` |  |  |
| 

`expression` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isActionParametersOverridesEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`position` \*

 | `number` **|** `null` |  |  |
| 

`ref` \*

 | `string` **|** `null` |  |  |
| 

`rulesetId` \*

 | `string` **|** `null` |  |  |
| 

`version` \*

 | `string` **|** `null` |  |  |

---

### Cloudflare Zero Trust Device

`cloudflare_zero_trust_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `deleted` | `boolean` |  |  |
| `deviceType` | `string` |  |  |
| `id` | `string` |  |  |
| `ip` | `string` |  |  |
| `key` | `string` |  |  |
| `macAddress` | `string` |  |  |
| `manufacturer` | `string` |  |  |
| `name` | `string` |  |  |
| `osDistroName` | `string` |  |  |
| `osDistroRevision` | `string` |  |  |
| `osVersionExtra` | `string` |  |  |
| `revokedOn` | `number` |  |  |
| `serialNumber` | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `userEmail` | `string` |  |  |
| `userName` | `string` |  |  |
| `version` | `string` |  |  |

---

### Cloudflare Zero Trust User

`cloudflare_zero_trust_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessSeat` | `boolean` |  |  |
| `activeDeviceCount` | `number` |  |  |
| `gatewaySeat` | `boolean` |  |  |
| `lastSuccessfulLoginOn` | `number` |  |  |
| `seatUid` | `string` |  |  |
| `uid` | `string` |  |  |

---

## Release Notes

-   **2025-10-24** — Improved accuracy of Zero Trust device properties including public IP, OS version, hardware ID, and last-seen timestamps.
-   **2025-09-05** — Added Cloudflare ruleset ingestion at both the account and zone scopes, including ruleset rules as queryable entities.
-   **2025-05-21** — Added mapped relationships from DNS CNAME records to AWS Application Load Balancers, and from load balancer pools to their DNS records.
-   **2025-04-28** — Added Cloudflare Load Balancer ingestion, including load balancers and their pools, with relationships to DNS zones.

---

Source: /integrations/directory/cobalt

# Cobalt

Visualize Cobalt pentests and findings, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> For this integration, you will need to create and copy an API Token in Cobalt. See [their documentation](https://developer.cobalt.io/platform-deep-dive/cobalt-account/account-settings/#create-and-manage-api-tokens) for more information.

### Configuration in JupiterOne

To install the Cobalt integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Cobalt. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Cobalt account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Cobalt **API Key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Cobalt | `cobalt_vendor` | [Vendor](https://docs.jupiterone.io/data-model/schemas/Vendor) |
| Cobalt Account | `cobalt_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cobalt Asset | `cobalt_asset` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Cobalt Asset | `cobalt_asset` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| Cobalt Asset | `cobalt_asset` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cobalt Asset | `cobalt_asset` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cobalt Finding | `cobalt_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Cobalt Pentest | `cobalt_pentest` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Cobalt pentest service | `cobalt_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cobalt_account` | **HAS** | `cobalt_service` |
| `cobalt_account` | **HAS** | `cobalt_asset` |
| `cobalt_asset` | **HAS** | `cobalt_finding` |
| `cobalt_pentest` | **IDENTIFIED** | `cobalt_finding` |
| `cobalt_service` | **PERFORMED** | `cobalt_pentest` |
| `cobalt_vendor` | **PROVIDES** | `cobalt_service` |
| `cobalt_vendor` | **PERFORMED** | `cobalt_pentest` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `cobalt_finding` | **IS** | `cve` | FORWARD |
| `cobalt_finding` | **IS** | `cwe` | FORWARD |

### Cobalt Finding

`cobalt_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetId` \*

 | `string` **|** `null` |  |  |
| 

`category` \*

 | `string` **|** `null` |  |  |
| 

`cobaltHashtag` \*

 | `string` **|** `null` |  |  |
| 

`impact` \*

 | `number` **|** `null` |  |  |
| 

`likelihood` \*

 | `number` **|** `null` |  |  |
| 

`pentestId` \*

 | `string` **|** `null` |  |  |
| 

`prerequisites` \*

 | `string` **|** `null` |  |  |
| 

`proofOfConcept` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`suggestedFix` \*

 | `string` **|** `null` |  |  |
| 

`targets` \*

 | `array` **|** `null` |  |  |

---

## Release Notes

-   **2025-06-06** — Promoted Cobalt finding entities to carry both the Vulnerability and Finding entity classes, enabling broader query compatibility.

---

Source: /integrations/directory/confluence

# Confluence

Visualize Confluence Cloud spaces, pages, labels and page authors as evidence for GRC and continuous controls monitoring. Find policies that have not been updated in the last year, see who last changed each one, and monitor changes through queries and alerts.

## Installation

This integration connects to **Confluence Cloud** using the Confluence Cloud REST API v2 (`https://<your-site>.atlassian.net/wiki/api/v2/...`) and ingests spaces, pages, page labels, and the users who authored them. It is built for GRC and continuous controls monitoring use cases where your policies and procedures live in Confluence. The integration is managed by JupiterOne and runs in the JupiterOne cloud, so no collector is needed. Confluence Data Center and Server are not supported.

### Prerequisites

-   A **Confluence Cloud** site, for example `your-company.atlassian.net`.
-   An **Atlassian account** that can read the spaces and pages you want to ingest, and an **API token** for that account.
-   Access to **JupiterOne** with permission to configure integrations.

### Configuration in Confluence

The integration authenticates with **Basic authentication**: the Atlassian account email and an API token, sent as `Authorization: Basic <base64(email:api_token)>`. Every request is read-only.

#### Choose the account

The API token can see exactly what its Atlassian account can see. Pages and spaces the account cannot view are not returned by the API and are not ingested. We recommend a dedicated account that has:

-   Access to the Confluence site (the **Can use** global permission).
-   View permission on every space you want to ingest.
-   Permission to view user profiles, which the **Confluence Users** data source needs.

The integration never writes to Confluence, so the account does not need edit or admin permissions.

#### Create the API token

1.  Sign in to [id.atlassian.com/manage-profile/security/api-tokens](https://id.atlassian.com/manage-profile/security/api-tokens) as the account above.
2.  Select **Create API token**, give it a name, and choose an expiration date.
3.  Select **Create**, then copy the token. Store it somewhere safe; you will paste it into JupiterOne.

Create a regular API token, **not an API token with scopes**. Atlassian requires scoped tokens to call the API through `api.atlassian.com`, while this integration calls your site host directly.

Atlassian API tokens expire. New tokens default to one year, and one year is the longest you can choose. Note the expiration date: when the token expires, the integration stops ingesting until you add a new token to the instance.

### Configuration in JupiterOne

To install the Confluence integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Confluence**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Confluence account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Authentication** fields below.
    

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **Site Host** | Yes | Your Confluence Cloud site host, for example `your-company.atlassian.net`. A full URL such as `https://your-company.atlassian.net/wiki` is also accepted and is reduced to the host. |
| **Account Email** | Yes | The email address of the Atlassian account that owns the API token. |
| **API Token** | Yes | The API token created above. |

When you save the instance, JupiterOne checks the credentials by requesting one space from the site.

#### Filters

All filters are optional. Leave them empty to ingest everything the account can read.

| Field | Default | Description |
| --- | --- | --- |
| **Space Keys** | Empty (all spaces the account can read) | Ingest only these spaces, by space key. Applies to both spaces and pages. If none of the keys match a space, no pages are ingested. |
| **Policy Labels** | Empty (all pages) | Ingest only pages that carry at least one of these labels. Labels are matched case-insensitively. |
| **Page Statuses** | **Current** and **Archived** | Which page statuses to ingest. Options are **Current** and **Archived**. |

Click **Create** once all values are provided to finalize the integration.

##### Narrowing ingestion to your policies

A Confluence site usually holds much more than policies. Use **Space Keys** and **Policy Labels** together to ingest only your policy documents. For example, set **Space Keys** to the space where your policies live and **Policy Labels** to the label your team puts on approved policies, such as `policy`.

Each filter has a different cost:

-   **Space Keys** is applied by the Confluence API, so it costs no extra requests and reduces the number of pages read.
-   **Policy Labels** cannot be applied by the API. The integration lists every page in scope and makes **one extra request per page** to read its labels before deciding whether to keep it. Combine it with **Space Keys** on a large site so fewer pages have to be checked.

**Policy Labels** works on its own and does not need the **Confluence Page Labels** data source. That data source is what creates `confluence_label` entities in the graph.

> **CAUTION**
> 
> Narrowing a filter later removes pages from JupiterOne. Pages that no longer match **Space Keys**, **Policy Labels** or **Page Statuses** on the next run are deleted from the graph.

##### Page statuses and drafts

By default the integration ingests **current** (published) and **archived** pages. **Unpublished drafts cannot be ingested**, because the Confluence pages API does not list them. A published page with unpublished edits is still ingested, with the status **current**.

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default**, so enable the ones you want to ingest. The `confluence_account` entity for the site is always created.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Confluence Spaces** | Spaces in the Confluence site, limited by **Space Keys** when set. | `confluence_space` |
| **Confluence Pages** | Pages in the Confluence site, limited by the filters above, with their status, version number, version message, and created and last-updated dates. | `confluence_page` |
| **Confluence Page Labels** | Labels on the ingested pages, used to tell policies from general wiki content. Makes one API request per ingested page. Requires **Confluence Pages**. | `confluence_label` |
| **Confluence Users** | Users referenced as creators, owners or last editors of the ingested pages, and creators of the ingested spaces. Requires **Confluence Spaces** and **Confluence Pages**. | `confluence_user` |

To ingest everything the integration supports, enable **Confluence Spaces**, **Confluence Pages** and **Confluence Users**, and add **Confluence Page Labels** if you want labels in the graph.

> **CAUTION**
> 
> **Confluence Users must be enabled together with Confluence Spaces and Confluence Pages.** Users are not read from a directory: they are looked up from the creator, owner and last-editor account IDs on the ingested pages and spaces. If either **Confluence Spaces** or **Confluence Pages** is disabled, the **Confluence Users** data source does not run at all and no users are ingested.

Relationships are built only when every data source they need is enabled:

| Relationship | Requires |
| --- | --- |
| `confluence_account` **HAS** `confluence_space` | **Confluence Spaces** |
| `confluence_space` **HAS** `confluence_page` | **Confluence Spaces** and **Confluence Pages** |
| `confluence_page` **HAS** `confluence_page` (parent page to child page) | **Confluence Pages** |
| `confluence_page` **HAS** `confluence_label` | **Confluence Pages** and **Confluence Page Labels** |
| `confluence_account` **HAS** `confluence_user` | **Confluence Users** (with Spaces and Pages) |
| `confluence_user` **CREATED** `confluence_page` | **Confluence Users** (with Spaces and Pages) |
| `confluence_user` **UPDATED** `confluence_page` (author of the current version) | **Confluence Users** (with Spaces and Pages) |

A parent-to-child page relationship is created only when the parent page was also ingested. With **Policy Labels** set, a policy whose parent page has no matching label has no parent relationship.

Each user is looked up in Confluence. The user's email is included only when the user's Atlassian profile privacy settings allow it.

#### Example queries

Policy pages that have not been updated in the last 12 months. On an instance where **Space Keys** and **Policy Labels** already limit ingestion to your policies:

```j1ql
FIND confluence_page WITH status = 'current' AND updatedOn < date.now - 12 months
```

With the **Confluence Page Labels** data source enabled, the same check for pages labeled `policy`, with a link to each page:

```j1ql
FIND confluence_page AS p
  THAT HAS confluence_label AS l
  WHERE l.name = 'policy' AND p.updatedOn < date.now - 12 months
RETURN p.displayName, p.updatedOn, p.webLink
```

#### What the integration does not collect

-   Page body content, comments, attachments, and content properties (neither keys nor values).
-   Unpublished drafts, blog posts, whiteboards, databases and folders. Only pages are ingested.
-   Page and space permissions or restrictions.
-   Policy acceptance or acknowledgment records. Confluence does not provide them, so evidence that employees have read and accepted a policy has to come from another system.

#### Rate limits

Confluence Cloud enforces rate limits. The integration paces its own requests and, when Confluence answers with `429 Too Many Requests`, waits for the time given in the `Retry-After` header before retrying. **Policy Labels** and the **Confluence Page Labels** data source each add one request per page, so on large sites they make each run take longer.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Manage API tokens for your Atlassian account](https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/) — creating, expiring and revoking API tokens
-   [Basic auth for Confluence Cloud REST APIs](https://developer.atlassian.com/cloud/confluence/basic-auth-for-rest-apis/) — email and API token authentication
-   [Confluence Cloud REST API v2](https://developer.atlassian.com/cloud/confluence/rest/v2/intro/) — overview and pagination
-   [Pages API](https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-page/) — page fields and supported statuses
-   [Spaces API](https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-space/)
-   [Labels API](https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-label/)
-   [Users API](https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-user/)
-   [Confluence Cloud rate limiting](https://developer.atlassian.com/cloud/confluence/rate-limiting/)

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (3)

-   `read:page:confluence`
-   `read:space:confluence`
-   `read:user:confluence`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (4)

-   `https://your-domain.atlassian.net/wiki/api/v2/pages`
-   `https://your-domain.atlassian.net/wiki/api/v2/pages/{id}/labels`
-   `https://your-domain.atlassian.net/wiki/api/v2/spaces`
-   `https://your-domain.atlassian.net/wiki/api/v2/users-bulk`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (4)

-   [https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-label/#api-pages-id-labels-get](https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-label/#api-pages-id-labels-get)
-   [https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-page/#api-pages-get](https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-page/#api-pages-get)
-   [https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-space/#api-spaces-get](https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-space/#api-spaces-get)
-   [https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-user/#api-users-bulk-post](https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-user/#api-users-bulk-post)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Fetch Labels | `read:page:confluence` | `https://your-domain.atlassian.net/wiki/api/v2/pages/{id}/labels` |
| Fetch Users | `read:user:confluence` | `https://your-domain.atlassian.net/wiki/api/v2/users-bulk` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `confluence_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Label | `confluence_label` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Page | `confluence_page` | [Document](https://docs.jupiterone.io/data-model/schemas/Document) |
| Space | `confluence_space` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| User | `confluence_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `confluence_account` | **HAS** | `confluence_space` |
| `confluence_account` | **HAS** | `confluence_user` |
| `confluence_page` | **HAS** | `confluence_label` |
| `confluence_page` | **HAS** | `confluence_page` |
| `confluence_space` | **HAS** | `confluence_page` |
| `confluence_user` | **CREATED** | `confluence_page` |
| `confluence_user` | **UPDATED** | `confluence_page` |

### Confluence Account

`confluence_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`siteHost` \*

 | `string` | The Confluence Cloud site host this account represents, e.g. your-company.atlassian.net. |  |

---

### Confluence Label

`confluence_label` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`labelId` \*

 | `string` | The Confluence label id (Label.id). |  |
| `prefix` | `string` **|** `null` | The label prefix (Label.prefix), e.g. "global" or "my". |  |

---

### Confluence Page

`confluence_page` inherits from [Document](/data-model/schemas/Document.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authorId` | `string` **|** `null` | Account id of the page creator (PageBulk.authorId); source of the CREATED relationship. |  |
| `labels` | `array` **|** `null` | Names of the labels attached to this page, collected by the labels step. Empty when the page has no labels; null when labels were not fetched. |  |
| `ownerId` | `string` **|** `null` | Account id of the current page owner (PageBulk.ownerId). |  |
| `parentId` | `string` **|** `null` | Id of the parent content for the page hierarchy (PageBulk.parentId); null for a top-level page. |  |
| `parentType` | `string` **|** `null` | Type of the parent content (PageBulk.parentType): page, whiteboard, database, embed or folder. |  |
| `spaceId` | `string` **|** `null` | Id of the space containing this page (PageBulk.spaceId). |  |
| `versionAuthorId` | `string` **|** `null` | Account id of the author of the current version (PageBulk.version.authorId); source of the UPDATED relationship. |  |
| `versionMessage` | `string` **|** `null` | The change message on the current version (PageBulk.version.message). |  |
| `versionMinorEdit` | `boolean` **|** `null` | Whether the current version was flagged a minor edit (PageBulk.version.minorEdit). |  |
| `versionNumber` | `number` **|** `null` | The current version number of the page (PageBulk.version.number); the review-cycle counter. |  |

---

### Confluence Space

`confluence_space` inherits from [Project](/data-model/schemas/Project.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authorId` | `string` **|** `null` | Account id of the space creator (SpaceBulk.authorId). |  |
| `homepageId` | `string` **|** `null` | Id of the space homepage (SpaceBulk.homepageId). |  |
| `spaceType` | `string` **|** `null` | The space type (SpaceBulk.type): global, collaboration, knowledge\_base, personal, system, onboarding or xflow\_sample\_space. |  |

---

### Confluence User

`confluence_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountStatus` | `string` **|** `null` | The account status (User.accountStatus), e.g. "active". |  |
| `accountType` | `string` **|** `null` | The account type (User.accountType): atlassian, app, customer or unknown. |  |
| `isExternalCollaborator` | `boolean` **|** `null` | Whether the user is an external collaborator (User.isExternalCollaborator). |  |

---

## Release Notes

-   **2026-10-14** — The option to fetch Confluence page content property values has been removed; the integration no longer ingests custom content property data from pages.
-   **2026-10-07** — Added ingestion of Confluence spaces, pages, page labels, and users with authorship and hierarchy relationships.

---

Source: /integrations/directory/confluent-cloud

# Confluent Cloud

Visualize Confluent Cloud Organization, Environments, Clusters, and monitor changes through queries and alerts.

## Installation

### Requirements

-   JupiterOne requires API Key Id & API Key Secret. You need permission to create a service account in Confluent Cloud that will be used to obtain the API Key Id & Secret. The Service Account should have the `MetricsViewer` permission to allow the ability to pull data.
-   You must have permission in JupiterOne to install new integrations.

### Configuration in Confluent Cloud

#### Create a Service Account and Grant Required Permissions

1.  Visit the [Accounts Page](https://confluent.cloud/settings/org/accounts).
2.  Toggle to the "Service Accounts" tab.
3.  Click the "+ Add Service Account" button.
4.  Enter a meaningful name and description for the service account.
5.  Click the "+ Add Role Assignment" button.
6.  Select "Organization" and choose the role "MetricsViewer".
7.  Click "Next" and then "Create Service Account."

#### Generate an API Key

1.  Visit the [API Key Page](https://confluent.cloud/settings/api-keys).
2.  Click the "Add API Key" button.
3.  Select "Service Account".
4.  Choose the service account you created earlier with the "MetricsViewer" role and click "Next".
5.  Select "Cloud Resource Management" as the scope for the API key and click "Next."
6.  Enter a meaningful name and description for the API key and create it.
7.  Copy or download the API Key & API Secret. It will disappear once you close the page.

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**
2.  Scroll to the **Confluent Cloud** integration tile and click it.
3.  Click the **Add Configuration** button and configure the following settings:

-   Enter the **Account Name** by which you'd like to identify this Confluent Cloud instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
-   Enter a **Description** that will further assist your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
-   Enter the **Confluent Cloud API Key** generated for use by JupiterOne.
-   Enter the **Confluent Cloud API Secret** generated for use by JupiterOne.

4.  Click **Create Configuration** once all values are provided.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Confluent Cloud Environment | `confluent_cloud_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Confluent Cloud Kafka Cluster | `confluent_cloud_kafka_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Confluent Cloud KSQL DB Cluster | `confluent_cloud_ksql_db_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Confluent Cloud Organization | `confluent_cloud_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `confluent_cloud_environment` | **CONTAINS** | `confluent_cloud_kafka_cluster` |
| `confluent_cloud_kafka_cluster` | **CONTAINS** | `confluent_cloud_ksql_db_cluster` |
| `confluent_cloud_organization` | **CONTAINS** | `confluent_cloud_environment` |

---

Source: /integrations/directory/controlup

# Controlup

Visualize Hosts, users, and Host Agents in Controlup while monitoring changes through advanced queries and automated alerts.

## Installation

### Requirements

-   User must have the **Manage Users** role to access User details in ControlUp account.
-   User must have permission in JupiterOne to install new integrations.

### Configuration in ControlUp

#### Generate API Key and collect Organization ID from ControlUp

1.  Log in to your ControlUp account at [https://app.controlup.com](https://app.controlup.com).
2.  Click on **Profile Icon** in the top-right corner.
3.  Go to **API Key Management > Create new**
4.  Provide **Name** and **Duration** for the API key and click on **Create**.
5.  Copy the **API key** and store it securely for further use.
6.  Go to **API Key Management** or **AccountSettings**
7.  Copy the **Organization ID**.

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**
2.  Search for the **ControlUp** and select it.
3.  Click on the **Add Instance** button and configure the following settings:

-   Enter the **ControlUp API Key** generated for use by JupiterOne.
-   Enter the **ControlUp Organization ID** generated for use by JupiterOne.
-   Enter the **Account Name** by which you'd like to identify this ControlUp Cloud instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
-   Enter a **Description** that will further assist your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.

4.  Click **Create Instance** once all values are provided.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Host | `controlup_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Host Agent | `controlup_hostagent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| User | `controlup_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `controlup_hostAgent` | **MONITORS** | `controlup_host` |

### Controlup Host

`controlup_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeUsernames` | `array` of `string`s |  |  |
| `agentConfigGroup` | `string` |  |  |
| `bssids` | `array` of `string`s |  |  |
| `cpuPCoreCount` | `number` | Count of Physical CPU cores in a processor |  |
| `cpuVCoreCount` | `number` | Count of Virtual CPU cores in a processor |  |
| `displayCount` | `number` |  |  |
| `dnsFriendlyName` | `string` |  |  |
| `dsGroups` | `array` of `string`s |  |  |
| `firewallStatus` | `string` |  |  |
| `gpuMemory` | `number` | Memory of Graphical Processing Unit |  |
| `gpuName` | `string` | Name of Graphical Processing Unit |  |
| `gpuVersion` | `string` | Version of Graphical Processing Unit |  |
| `group` | `array` of `string`s |  |  |
| `hasWiredMacAddress` | `boolean` |  |  |
| `hasWirelessMacAddress` | `boolean` |  |  |
| `interfaceTypes` | `array` of `string`s |  |  |
| `lastCommunicatedOn` | `number` |  |  |
| `memory` | `number` |  |  |
| `networkData` | `string` |  |  |
| `osDiskConfigurationFreespace` | `number` |  |  |
| `osDiskConfigurationUsedspace` | `number` |  |  |
| `osDomainSite` | `string` |  |  |
| `osPatch` | `string` |  |  |
| `platformFriendlyName` | `string` |  |  |
| `publicIPCity` | `string` |  |  |
| `publicIPCountry` | `string` |  |  |
| `publicIPState` | `string` |  |  |
| `remoteAddress` | `string` |  |  |
| `remoteAddressGeo` | `string` |  |  |
| `remoteAddressISP` | `string` |  |  |
| `serialNumber` | `string` |  |  |
| `ssids` | `array` of `string`s |  |  |
| `wifiMACAddresses` | `array` of `string`s |  |  |
| `wifiNames` | `array` of `string`s |  |  |
| `wiredMacAddresses` | `array` of `string`s |  |  |
| `wirelessMacAddresses` | `array` of `string`s |  |  |

---

### Controlup Hostagent

`controlup_hostagent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentVersion` | `string` |  |  |
| `autoUpdateMode` | `string` |  |  |
| `build` | `string` |  |  |
| `configUpdateInterval` | `number` |  |  |
| `debugLevel` | `number` |  |  |
| `deviceGroup` | `string` |  |  |
| `geoLocation` | `string` |  |  |
| `isAgentAutoUpdateEnabled` | `boolean` |  |  |
| `refreshInterval` | `number` |  |  |
| `statusInterval` | `number` |  |  |
| `triggerIntervalShort` | `number` |  |  |

---

### Controlup User

`controlup_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `eulaVersion` | `string` |  |  |
| `loginMethods` | `array` of `string`s |  |  |
| `phone` | `string` |  |  |
| `region` | `string` |  |  |
| `roleNames` | `array` of `string`s |  |  |
| `vdiDaasLdapLogin` | `boolean` |  |  |

---

---

Source: /integrations/directory/cribl-edge

# Cribl Edge

Visualize your Cribl Edge deployment in JupiterOne — the Fleets you organize your telemetry agents into and the Edge Nodes reporting to your Leader, with the host, OS, and version each Node reports. Edge Nodes running on EC2 instances or Azure VMs are correlated to those hosts in the graph, so you can see which of your compute is covered by telemetry collection and monitor Fleet membership and agent versions through queries and alerts.

## Installation

This integration reads your Cribl Edge deployment through the [Cribl Control Plane REST API](https://docs.cribl.io/cribl-as-code/api-reference/control-plane/cribl-edge) — the Edge Fleets configured on your Leader and the Edge Nodes reporting into them, including each Node's hostname, operating system, architecture, Cribl version, and connection state. It is read-only: it issues only `GET` requests against the Fleets and Nodes collections and never modifies your Cribl configuration.

Nodes that report AWS or Azure metadata are mapped to the matching `aws_instance` or `azure_vm` entity already in your graph. Those relationships are only created when the target host is present — the integration never creates placeholder cloud instances.

### Prerequisites

-   A **Cribl Edge** deployment, either on Cribl.Cloud (including Hybrid) or a customer-managed (on-premises) Leader.
-   The base URL of that deployment:
    -   **Cribl.Cloud** — your workspace URL, in the form `https://${workspaceName}-${organizationId}.cribl.cloud`.
    -   **On-premises** — your Leader URL, including the port, for example `https://leader.example.com:9000`.
-   Credentials with read access to Worker Groups and Fleets — see below.
-   Access to JupiterOne with permission to configure integrations.

> **NOTE**
> 
> Customer-managed Leaders are commonly deployed inside a private network and are not reachable from the internet. In that case, run this integration through a [JupiterOne Collector](/integrations/development/collector.md) inside your network.

### Configuration in Cribl

This integration supports two authentication methods. Choose the one that matches your deployment when you create the instance in JupiterOne; each presents its own set of fields.

#### Cribl.Cloud / Hybrid (OAuth2)

An Organization Owner or Admin creates an API Credential in the Cribl.Cloud UI, which yields a **Client ID** and a **Client Secret**. The integration exchanges those for a bearer token against `https://login.cribl.cloud/oauth/token`.

The credential needs the `user:read:workergroups` scope, which grants read access to Worker Groups and Edge Fleets. This scope is part of the default set granted to API Credentials.

> **CAUTION**
> 
> The Client Secret is shown only when the credential is created. Record it before leaving the page — if you lose it, you must create a new credential.

See the Cribl [API authentication guide](https://docs.cribl.io/cribl-as-code/api-auth) for the current steps.

#### On-premises (Username/Password)

The integration posts a username and password to `/api/v1/auth/login` on your Leader and uses the returned bearer token. Create a dedicated Cribl user for it rather than reusing an operator account.

Grant that user read access to your Edge Fleets. In the Roles and Policies model this is the built-in **`reader_all`** role, which carries the **`GroupRead`** policy across all Worker Groups and Fleets; in the Members and Permissions model, grant Read Only at the Worker Group level.

> **NOTE**
> 
> Role- and permission-based access control requires a Cribl Enterprise license. On deployments without one, any authenticated user has full access and no explicit grant is needed.

See the Cribl [Roles documentation](https://docs.cribl.io/stream/roles/) for details.

### Configuration in JupiterOne

To install the Cribl Edge integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Cribl Edge**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Cribl Edge account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The authentication method matching your deployment, and its fields:
    
    **Cribl.Cloud / Hybrid (OAuth2)**
    
    -   Your **Workspace URL** — for example `https://main-acmecorp-abcd1234.cribl.cloud`.
    -   The **Client ID** and **Client Secret** of the API Credential you created.
    
    **On-Premises (Username/Password)**
    
    -   Your **Leader URL** — for example `https://leader.example.com:9000`.
    -   The **Username** and **Password** of the Cribl user you created.
-   Optionally, **Ingest Disconnected Nodes**. Enabled by default, meaning Edge Nodes the Leader currently reports as disconnected are still ingested. Disable it to ingest only Nodes actively connected to the Leader.
    

Click **Create** once all values are provided to finalize the integration.

> **NOTE**
> 
> The `/api/v1` suffix is appended to your URL automatically. A trailing slash, or a URL you paste with `/api/v1` already on it, is handled for you.

#### Data sources

You can narrow what the integration collects from the instance's ingestion source settings. **Fetch Edge Fleets** underpins **Fetch Edge Nodes** — Nodes are attached to the graph through their Fleet, so disabling Fleets also disables Node collection.

| Ingestion source | Data collected |
| --- | --- |
| **Fetch Edge Fleets** | Edge Fleets on the Leader, their deployed configuration version and Node count, and Subfleet nesting. |
| **Fetch Edge Nodes** | Edge Nodes, with hostname, OS and architecture, Cribl version, connection state, and cloud metadata. |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Authenticate with the Cribl API](https://docs.cribl.io/cribl-as-code/api-auth) — token endpoints and lifetimes for both deployment types
-   [Cribl Edge API reference](https://docs.cribl.io/cribl-as-code/api-reference/control-plane/cribl-edge)
-   [Roles](https://docs.cribl.io/stream/roles/) — on-premises roles and policies
-   [Manage Edge Fleets](https://docs.cribl.io/edge/fleets/)

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (1)

-   `GroupRead`

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `reader_all`

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (1)

-   `user:read:workergroups`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (2)

-   `GET /api/v1/products/edge/groups`
-   `GET /api/v1/products/edge/workers`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://docs.cribl.io/cribl-as-code/api-auth](https://docs.cribl.io/cribl-as-code/api-auth)
-   [https://docs.cribl.io/cribl-as-code/api-reference/control-plane/cribl-edge](https://docs.cribl.io/cribl-as-code/api-reference/control-plane/cribl-edge)
-   [https://docs.cribl.io/stream/roles/](https://docs.cribl.io/stream/roles/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (1)

| Step | Permissions | Roles | OAuth Scopes | Endpoints |
| --- | --- | --- | --- | --- |
| Fetch Edge Nodes | `GroupRead` | `reader_all` | `user:read:workergroups` | `GET /api/v1/products/edge/workers` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cribl_edge_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Edge Fleet | `cribl_edge_fleet` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Edge Node | `cribl_edge_node` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Service | `cribl_edge_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cribl_edge_account` | **PROVIDES** | `cribl_edge_service` |
| `cribl_edge_account` | **HAS** | `cribl_edge_fleet` |
| `cribl_edge_fleet` | **HAS** | `cribl_edge_fleet` |
| `cribl_edge_fleet` | **HAS** | `cribl_edge_node` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `cribl_edge_node` | **MONITORS** | `aws_instance` | FORWARD |
| `cribl_edge_node` | **MONITORS** | `azure_vm` | FORWARD |
| `cribl_edge_node` | **MONITORS** | `host` | FORWARD |
| `cribl_edge_node` | **MONITORS** | `device` | FORWARD |

### Cribl Edge Account

`cribl_edge_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`deploymentType` \*

 | `string` **|** `null` | The deployment mode of the Cribl account: 'cloud' (Cribl.Cloud) or 'on-prem'. |  |
| 

`hostname` \*

 | `string` **|** `null` | The configured Cribl Leader hostname or Cribl.Cloud workspace URL. |  |

---

### Cribl Edge Fleet

`cribl_edge_fleet` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`configVersion` \*

 | `string` **|** `null` | Commit hash of the deployed configuration version for the Fleet. |  |
| 

`fleetId` \*

 | `string` | The Cribl Fleet id (unique within the deployment). |  |
| 

`fleetType` \*

 | `string` **|** `null` | Explicit Cribl group type (always 'edge' for Fleets). |  |
| 

`isOnPrem` \*

 | `boolean` **|** `null` | Whether the Fleet uses customer-hosted (on-prem) Nodes rather than Cribl.Cloud. |  |
| 

`nodeCount` \*

 | `number` **|** `null` | Number of Nodes currently in the Fleet (workerCount). |  |

---

### Cribl Edge Node

`cribl_edge_node` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`architecture` \*

 | `string` **|** `null` | CPU architecture reported by the Node (e.g. 'x64', 'arm64'). |  |
| 

`awsInstanceId` \*

 | `string` **|** `null` | AWS EC2 instance id, when the AWS metadata collector is enabled. |  |
| 

`awsRegion` \*

 | `string` **|** `null` | AWS region, when the AWS metadata collector is enabled. |  |
| 

`azureVmId` \*

 | `string` **|** `null` | Azure VM id, when the Azure metadata collector is enabled. |  |
| 

`connectionProtocol` \*

 | `string` **|** `null` | Node-to-Leader connection protocol ('tcp', 'tls', or 'http2'). |  |
| 

`firstSeenOn` \*

 | `number` **|** `null` | Epoch milliseconds when the Leader first received a message from the Node. |  |
| 

`guid` \*

 | `string` **|** `null` | The unique Cribl instance identifier (guid) for the Node. |  |
| 

`hostname` \*

 | `string` **|** `null` | Hostname reported by the Node. |  |
| 

`installType` \*

 | `string` **|** `null` | The Cribl install type reported by the Node (CRIBL\_INSTALL\_TYPE). |  |
| 

`ipAddresses` \*

 | `array` **|** `null` | Network addresses reported by the host operating system. |  |
| 

`isConnected` \*

 | `boolean` **|** `null` | Whether the Node is currently connected to the Leader. |  |
| 

`nodeId` \*

 | `string` | The Cribl Node id (unique within the deployment). |  |
| 

`osName` \*

 | `string` **|** `null` | Host operating system distribution name reported by the Node. |  |
| 

`osRelease` \*

 | `string` **|** `null` | OS release string reported by the Node. |  |
| 

`osVersion` \*

 | `string` **|** `null` | Host operating system version reported by the Node. |  |
| 

`platform` \*

 | `string` **|** `null` | OS platform reported by the Node (e.g. 'linux', 'win32', 'darwin'). |  |
| 

`version` \*

 | `string` **|** `null` | Cribl software version running on the Node. |  |

---

### Cribl Edge Service

`cribl_edge_service` inherits from [Service](/data-model/schemas/Service.md)

---

---

Source: /integrations/directory/crowdstrike

# CrowdStrike

Visualize Crowdstrike endpoint agents and protected devices, map agents to devices and their respective owners, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an API client in the CrowdStrike Falcon console, which requires the Falcon Administrator role. In the console, go to **Support > API Clients and Keys** and click **Add new API client**. Give the client a name, select the API scopes listed below, and copy the client ID and secret. The secret is only shown when the client is created or its secret is reset. CrowdStrike's [API Credentials](https://developer.crowdstrike.com/falcon-mcp/getting-started/credentials/#creating-api-credentials) guide walks through the same console steps. It is written for the Falcon MCP server, so use the scopes listed on this page rather than the ones it suggests.

When creating the API client, grant (at minimum) read access to the following scopes:

-   **Hosts**
-   **Prevention Policies**

Additional scopes are required to enable optional ingestion steps:

-   **Alerts**
-   **Apps** (Falcon Discover applications)
-   **Cloud Security API Assets** (Compliance Controls)
-   **Cloud Security API Detections** (IOM Findings)
-   **Cloud Security AWS Registration** (CSPM)
-   **Cloud Security Azure Registration** (CSPM)
-   **Device control policies**
-   **External Assets** (EASM Findings)
-   **Falcon Container Image** (Container Security, Serverless Vulnerabilities)
-   **Firewall management**
-   **Kubernetes Protection** (Container–host relationships)
-   **SaaS Security (Falcon Shield)**
-   **Spotlight Vulnerabilities** (Vulnerabilities, Remediations, EASM Findings)
-   **User management**
-   **Zero Trust Assessment**

To install the CrowdStrike integration in JupiterOne, navigate to the **Integrations** tab and select **CrowdStrike**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the CrowdStrike account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   An optional **Description** to help identify the integration instance.
    
-   A **Polling Interval** for how frequently data is refreshed. Leave this as `DISABLED` to trigger runs manually.
    
-   Your CrowdStrike **API client ID** and **API client secret** to authenticate with the Falcon API.
    
-   An optional **Availability Zone** for API calls. Leave blank to use the main endpoint (`api.crowdstrike.com`). For example, entering `us-2` routes requests to `api.us-2.crowdstrike.com`.
    

Click **Create** once all values are provided to start the integration.

> **NOTE**
> 
> The CrowdStrike integration only ingests applications that have vulnerabilities. Applications without vulnerabilities will not appear in JupiterOne.

## Data Volume Configuration

### Ingestion Windows

Define how far back in time data is collected during each ingestion run. Each data type has its own configurable window.

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Device Ingestion Window** | Days to look back for devices by last-seen date. | 50 | 7, 15, 30, 50, 60, 90, 180, 275, 365 |
| **Vulnerabilities Ingestion Window** | Days to look back for updated vulnerabilities. | 90 | 90, 180, 275, 365 |
| **Alerts Ingestion Window** | Days to look back for updated alerts. | 90 | 90, 180, 275, 365 |
| **Applications Ingestion Window** | Days to look back for last-used applications. | 90 | 90, 180, 275, 365 |
| **Containers Ingestion Window** | Days to look back for containers by first-seen date. | 50 | 7, 15, 30, 50, 60, 90, 180, 275, 365 |
| **Container Image Vulnerabilities Ingestion Window** | Days to look back for container image vulnerabilities by first-seen date. | 365 | 90, 180, 275, 365 |
| **EASM Findings Ingestion Window** | Days to look back for EASM findings by created date. | 90 | 7, 15, 30, 50, 60, 90, 180, 275, 365 |
| **Serverless Vulnerabilities Ingestion Window** | Days to look back for serverless vulnerabilities. | 90 | 90, 180, 275, 365 |
| **Serverless Vulnerabilities Page Size** | Maximum number of serverless vulnerabilities fetched per API request. Must be a whole number between 1 and 500. | _(not set)_ | — |

### Data Filtering Options

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Included Vulnerability Severities** | Vulnerability severity levels to ingest. Configure this field **or** **Included Vulnerability Exprt Ratings** — not both simultaneously. | Critical, High, Medium, Unknown | Critical, High, Medium, Low, None, Unknown |
| **Included Vulnerability Exprt Ratings** | ExPRT ratings to use as a vulnerability filter instead of severity levels. When set, severity-based filters are ignored. | _(not set)_ | Critical, High, Medium, Low, Unknown |
| **Include Closed Vulnerabilities** | When enabled, ingests vulnerabilities that are marked as closed in CrowdStrike. | Disabled | — |
| **Included Alerts Severities** | Alert severity levels to ingest. | Critical, High, Medium | Critical, High, Medium, Low, Informational |
| **Ingest suspicious applications only** | When enabled, only applications flagged as suspicious in CrowdStrike are ingested. | Disabled | — |
| **CSPM Cloud Providers** | Cloud providers to monitor for CSPM findings, cloud accounts, and IOM findings. If nothing is selected, CSPM data is not ingested. | _(not set)_ | AWS, Azure |
| **IOM Severity Filter** | IOM finding severity levels to ingest. | Critical | Critical, High, Medium, Informational |
| **Compliance Control Severities** | Compliance control severity levels to ingest. | Critical, High | Critical, High, Medium, Informational, Unknown |
| **Included EASM Finding Severities** | EASM finding severity levels to ingest. | Critical, High | Critical, High, Medium, Low, Unknown |
| **Included Image Vulnerability Severities** | Container image vulnerability severity levels to ingest. | Critical, High | Critical, High, Medium, Low, Unknown |
| **Serverless Cloud Providers** | Cloud providers to ingest serverless vulnerabilities for. | AWS | AWS, GCP, Azure |
| **Included Serverless Vulnerability Severities** | Serverless vulnerability severity levels to ingest. | Critical, High | Critical, High, Medium, Low, None, Unknown |

## Multi-Tenant (MSSP) Configuration

CrowdStrike Flight Control allows a parent account to manage multiple child CIDs. To enable multi-tenant ingestion:

1.  Enable **Configure Child CIDs**.
2.  Enter the **Parent CID** — the CID of the parent CrowdStrike account.

When configured, JupiterOne automatically creates a separate integration instance for each child CID discovered under the parent account.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (15)

-   `alerts:read`
-   `assets:read`
-   `cloud-security-assets:read`
-   `cspm-registration:read`
-   `device-control-policies:read`
-   `discover:read`
-   `falcon-container-image:read`
-   `firewall-policies:read`
-   `hosts:read`
-   `kubernetes-protection:read`
-   `prevention-policies:read`
-   `saas-security:read`
-   `spotlight-vulnerabilities:read`
-   `user-management:read`
-   `zero-trust-assessment:read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (33)

-   `/alerts/combined/alerts/v1`
-   `/cloud-connect-cspm-aws/entities/account/v1`
-   `/cloud-connect-cspm-azure/entities/account/v1`
-   `/cloud-security-assets/combined/compliance-controls/by-account-region-and-resource-type/v1`
-   `/container-security/combined/containers/v1`
-   `/container-security/combined/image-assessment/images/v1`
-   `/container-security/combined/images/export/v1`
-   `/container-security/combined/vulnerabilities/v1`
-   `/detects/entities/iom/v2`
-   `/detects/queries/iom/v2`
-   `/devices/entities/devices/v2`
-   `/devices/queries/devices-hidden/v1`
-   `/devices/queries/devices-scroll/v1`
-   `/discover/combined/applications/v1`
-   `/fem/entities/external-assets/v1`
-   `/fem/queries/external-assets/v1`
-   `/lambdas/combined/vulnerabilities/sarif/v1`
-   `/policy/combined/device-control/v1`
-   `/policy/combined/firewall/v1`
-   `/policy/combined/prevention/v1`
-   `/policy/queries/device-control-members/v1`
-   `/policy/queries/firewall-members/v1`
-   `/policy/queries/prevention-members/v1`
-   `/saas-security/entities/alerts/v3`
-   `/saas-security/entities/apps/v3`
-   `/saas-security/entities/integrations/v3`
-   `/settings/entities/policy/v1`
-   `/spotlight/combined/vulnerabilities/v1`
-   `/spotlight/entities/remediations/v2`
-   `/user-management/entities/users/GET/v1`
-   `/user-management/queries/users/v1`
-   `/zero-trust-assessment/entities/assessments/v1`
-   `/zero-trust-assessment/queries/assessments/v1`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (2)

-   [https://developer.crowdstrike.com/api-reference/collections/cspm-registration/](https://developer.crowdstrike.com/api-reference/collections/cspm-registration/)
-   [https://developer.crowdstrike.com/api-reference/collections/oauth2/](https://developer.crowdstrike.com/api-reference/collections/oauth2/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (16)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Build Host to Container Image Relationships | `kubernetes-protection:read` | `/container-security/combined/containers/v1` |
| Compliance Controls | `cloud-security-assets:read` | `/cloud-security-assets/combined/compliance-controls/by-account-region-and-resource-type/v1` |
| Fetch Alerts | `alerts:read` | `/alerts/combined/alerts/v1` |
| Fetch Applications | `discover:read` | `/discover/combined/applications/v1` |
| Fetch Cloud Entities | \- | \- |
| Fetch Container Images Vulnerabilities | `falcon-container-image:read` | `/container-security/combined/vulnerabilities/v1` |
| Fetch Device Control Policy Relationships | `device-control-policies:read` | `/policy/combined/device-control/v1`, `/policy/queries/device-control-members/v1` |
| Fetch Device Policies | `prevention-policies:read` | `/policy/queries/prevention-members/v1` |
| Fetch EASM Findings | `spotlight-vulnerabilities:read`, `assets:read` | `/spotlight/combined/vulnerabilities/v1` |
| Fetch Falcon Shield Alerts | `saas-security:read` | `/saas-security/entities/alerts/v3` |
| Fetch Falcon Shield Apps | `saas-security:read` | `/saas-security/entities/apps/v3` |
| Fetch Firewall Policy Relationships | `firewall-policies:read` | `/policy/combined/firewall/v1`, `/policy/queries/firewall-members/v1` |
| Fetch Remediations | `spotlight-vulnerabilities:read` | `/spotlight/entities/remediations/v2` |
| Fetch Vulnerabilities | `spotlight-vulnerabilities:read` | `/spotlight/combined/vulnerabilities/v1` |
| IOM Findings | `cspm-registration:read` | `/detects/queries/iom/v2`, `/detects/entities/iom/v2` |
| IOM Rules | `cspm-registration:read` | `/settings/entities/policy/v1` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `crowdstrike_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `crowdstrike_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Application | `crowdstrike_detected_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS API Gateway Resource | `crowdstrike_aws_api_gateway_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS API Gateway REST API | `crowdstrike_aws_api_gateway_rest_api` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Athena Work Group | `crowdstrike_aws_athena_work_group` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Auto Scaling Launch Configuration | `crowdstrike_aws_autoscaling_launch_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS CloudFormation Stack | `crowdstrike_aws_cloudformation_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS CloudFront Domain | `crowdstrike_aws_cloudfront_domain` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudTrail | `crowdstrike_aws_cloudtrail` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudTrail Account | `crowdstrike_aws_cloudtrail_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AWS CloudTrail Bucket | `crowdstrike_aws_cloudtrail_bucket` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS CodeBuild Project | `crowdstrike_aws_codebuild_project` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cognito User Pool | `crowdstrike_aws_cognito_user_pool` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Config Account | `crowdstrike_aws_config_account` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS DynamoDB Table | `crowdstrike_aws_dynamodb_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| AWS EBS Snapshot | `crowdstrike_aws_ebs_snapshot` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| AWS EBS Volume | `crowdstrike_aws_ebs_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS EC2 Instance | `crowdstrike_aws_ec2_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS EC2 Network Acl | `crowdstrike_aws_ec2_network_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS EC2 Security Group | `crowdstrike_aws_ec2_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS ECR Repository | `crowdstrike_aws_ecr_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| AWS ECS Task Definition | `crowdstrike_aws_ecs_task_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EFS File System | `crowdstrike_aws_efs_file_system` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS EKS Cluster | `crowdstrike_aws_eks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS ElastiCache Cluster | `crowdstrike_aws_elasticache_cluster` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| AWS ELB Azure Tenant | `crowdstrike_aws_elb_azure_tenant` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS ELB Load Balancer | `crowdstrike_aws_elb_load_balancer` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Event Bridge Event Bus | `crowdstrike_aws_eventbridge_event_bus` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS IAM Account | `crowdstrike_aws_iam_account` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS IAM Group | `crowdstrike_aws_iam_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| AWS IAM Policy | `crowdstrike_aws_iam_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS IAM Role | `crowdstrike_aws_iam_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| AWS IAM S3 Policy | `crowdstrike_aws_iam_s3_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS IAM User | `crowdstrike_aws_iam_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS Kinesis Stream | `crowdstrike_aws_kinesis_stream` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS KMS Key | `crowdstrike_aws_kms_key` | [CryptoKey](https://docs.jupiterone.io/data-model/schemas/CryptoKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| AWS Lambda Disk | `crowdstrike_aws_lambda_disk` | [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| AWS Lambda Function | `crowdstrike_aws_lambda_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS NLB/ALB Load Balancer | `crowdstrike_aws_nlb_alb_load_balancer` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS RDS Database | `crowdstrike_aws_rds_database` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| AWS Route 53 Domain | `crowdstrike_aws_route53_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| AWS S3 Bucket | `crowdstrike_aws_s3_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS SageMaker Workbench Instance | `crowdstrike_aws_sagemaker_notebook_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Secrets Manager Secret | `crowdstrike_aws_secrets_manager_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| AWS SES | `crowdstrike_aws_ses` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SNS Topic | `crowdstrike_aws_sns_topic` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS SQS Queue | `crowdstrike_aws_sqs_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS SSM Parameter | `crowdstrike_aws_ssm_parameter` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS VPC | `crowdstrike_aws_vpc` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC Bucket | `crowdstrike_aws_vpc_bucket` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC Endpoint | `crowdstrike_aws_vpc_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS VPC Route Table | `crowdstrike_aws_vpc_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS VPC Subnet | `crowdstrike_aws_vpc_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS WAF VPC Endpoint | `crowdstrike_aws_waf_vpc_endpoint` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Azure AD Domain Service | `crowdstrike_azure_ad_domain_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Azure App Service | `crowdstrike_azure_app_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Azure App Service | `crowdstrike_azure_web_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Azure CDN Profile | `crowdstrike_azure_cdn_profile` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Azure Container Apps | `crowdstrike_azure_container_app` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Azure Cosmos DB | `crowdstrike_azure_cosmosdb_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account), [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Azure Event Hub | `crowdstrike_azure_event_hub` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Azure Firewall | `crowdstrike_azure_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Azure Key Vault | `crowdstrike_azure_key_vault` | KeyStore |
| Azure Kubernetes Cluster | `crowdstrike_azure_kubernetes_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Azure Managed Disk | `crowdstrike_azure_managed_disk` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| Azure MySQL Server | `crowdstrike_azure_mysql_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Azure Security Group | `crowdstrike_azure_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Azure Storage Account | `crowdstrike_azure_storage_account` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Azure Subscription | `crowdstrike_azure_subscription` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Azure Virtual Machine | `crowdstrike_azure_vm` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Azure Virtual Network | `crowdstrike_azure_vnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cloud Account | `crowdstrike_cloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cloud Entity | `crowdstrike_cloud_entity` | [Entity](https://docs.jupiterone.io/data-model/schemas/Entity) |
| Compliance Control | `crowdstrike_compliance_control` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Container Image | `crowdstrike_container_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Device | `crowdstrike_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Device Control Policy | `crowdstrike_device_control_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Device Sensor Agent | `crowdstrike_sensor` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Discover Application | `crowdstrike_discover_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| EASM Finding | `crowdstrike_easm_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| External Asset | `crowdstrike_external_asset` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Falcon Shield Alert | `crowdstrike_falcon_shield_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Falcon Shield App | `crowdstrike_falcon_shield_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Falcon Shield Integration | `crowdstrike_falcon_shield_integration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Firewall Policy | `crowdstrike_firewall_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Image Vulnerability | `crowdstrike_image_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Image Vulnerability | `crowdstrike_image_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| IOM Finding | `crowdstrike_iom_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| IOM Rule | `crowdstrike_iom_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Prevention Policy | `crowdstrike_prevention_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Prevention Policy Setting | `crowdstrike_prevention_policy_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Remediation | `crowdstrike_remediation` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Serverless Vulnerability | `crowdstrike_serverless_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Service | `crowdstrike_endpoint_protection` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `crowdstrike_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `crowdstrike_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Vulnerability | `crowdstrike_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Zero Trust Assessment | `crowdstrike_zero_trust_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `crowdstrike_account` | **HAS** | `crowdstrike_endpoint_protection` |
| `crowdstrike_account` | **HAS** | `crowdstrike_sensor` |
| `crowdstrike_account` | **HAS** | `crowdstrike_container_image` |
| `crowdstrike_account` | **HAS** | `crowdstrike_user` |
| `crowdstrike_account` | **HAS** | `crowdstrike_remediation` |
| `crowdstrike_account` | **HAS** | `crowdstrike_cloud_account` |
| `crowdstrike_account` | **HAS** | `crowdstrike_external_asset` |
| `crowdstrike_account` | **HAS** | `crowdstrike_serverless_vulnerability` |
| `crowdstrike_account` | **HAS** | `crowdstrike_falcon_shield_integration` |
| `crowdstrike_cloud_account` | **HAS** | `crowdstrike_compliance_control` |
| `crowdstrike_cloud_account` | **HAS** | `crowdstrike_cloud_entity` |
| `crowdstrike_cloud_entity` | **HAS** | `crowdstrike_iom_finding` |
| `crowdstrike_compliance_control` | **HAS** | `crowdstrike_iom_rule` |
| `crowdstrike_container_image` | **EXPLOITS** | `crowdstrike_vulnerability` |
| `crowdstrike_detected_application` | **HAS** | `crowdstrike_vulnerability` |
| `crowdstrike_external_asset` | **HAS** | `crowdstrike_easm_finding` |
| `crowdstrike_falcon_shield_integration` | **HAS** | `crowdstrike_falcon_shield_app` |
| `crowdstrike_falcon_shield_integration` | **HAS** | `crowdstrike_falcon_shield_alert` |
| `crowdstrike_host` | **HAS** | `crowdstrike_vulnerability` |
| `crowdstrike_host` | **USES** | `crowdstrike_container_image` |
| `crowdstrike_iom_rule` | **IDENTIFIED** | `crowdstrike_iom_finding` |
| `crowdstrike_prevention_policy` | **ENFORCES** | `crowdstrike_endpoint_protection` |
| `crowdstrike_prevention_policy` | **HAS** | `crowdstrike_prevention_policy_setting` |
| `crowdstrike_sensor` | **PROTECTS** | `crowdstrike_host` |
| `crowdstrike_sensor` | **ASSIGNED** | `crowdstrike_prevention_policy` |
| `crowdstrike_sensor` | **IDENTIFIED** | `crowdstrike_vulnerability` |
| `crowdstrike_sensor` | **HAS** | `crowdstrike_zero_trust_assessment` |
| `crowdstrike_sensor` | **ASSIGNED** | `crowdstrike_device_control_policy` |
| `crowdstrike_sensor` | **ASSIGNED** | `crowdstrike_firewall_policy` |
| `crowdstrike_sensor` | **INSTALLED** | `crowdstrike_discover_application` |
| `crowdstrike_sensor` | **HAS** | `crowdstrike_alert` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `crowdstrike_sensor` | **ASSIGNED** | `crowdstrike_device_control_policy` | FORWARD |
| `crowdstrike_sensor` | **ASSIGNED** | `crowdstrike_firewall_policy` | FORWARD |
| `crowdstrike_serverless_vulnerability` | **HAS** | `aws_lambda_function` | REVERSE |
| `crowdstrike_serverless_vulnerability` | **HAS** | `google_cloud_function` | REVERSE |
| `crowdstrike_serverless_vulnerability` | **HAS** | `azure_function_app` | REVERSE |
| `crowdstrike_vulnerability` | **IS** | `cve` | FORWARD |

### Crowdstrike Account

`crowdstrike_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cid` | `string` |  |  |

---

### Crowdstrike Alert

`crowdstrike_alert` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aggregateId` | `string` |  |  |
| `childProcessIds` | `array` of `string`s |  |  |
| `cid` | `string` |  |  |
| `cmdline` | `string` |  |  |
| `compositeId` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `dataDomains` | `array` of `string`s |  |  |
| `description` | `string` |  |  |
| `detectedOn` | `number` |  |  |
| `deviceExternalIp` | `string` |  |  |
| `deviceHostname` | `string` |  |  |
| `deviceId` | `string` |  |  |
| `deviceLocalIp` | `string` |  |  |
| `deviceMacAddress` | `string` |  |  |
| `deviceOsVersion` | `string` |  |  |
| `devicePlatformName` | `string` |  |  |
| `deviceStatus` | `string` |  |  |
| `falconHostLink` | `string` |  |  |
| `filename` | `string` |  |  |
| `filepath` | `string` |  |  |
| `filesAccessed` | `array` of `string`s |  |  |
| `id` | `string` |  |  |
| `mitreAttack` | `array` of `string`s |  |  |
| `objective` | `string` |  |  |
| `parentCmdline` | `string` |  |  |
| `parentFilename` | `string` |  |  |
| `product` | `string` |  |  |
| `scenario` | `string` |  |  |
| `severityName` | `string` |  |  |
| `sourceProducts` | `array` of `string`s |  |  |
| `sourceVendors` | `array` of `string`s |  |  |
| `status` | `string` |  |  |
| `tactic` | `string` |  |  |
| `tacticId` | `string` |  |  |
| `technique` | `string` |  |  |
| `techniqueId` | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `userId` | `string` |  |  |
| `userName` | `string` |  |  |
| `userPrincipal` | `string` |  |  |

---

### Crowdstrike Cloud Account

`crowdstrike_cloud_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountAlias` \*

 | `string` **|** `null` |  |  |
| 

`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`accountType` \*

 | `string` **|** `null` |  |  |
| 

`availableRegions` \*

 | `array` **|** `null` |  |  |
| 

`azureTenantId` \*

 | `string` **|** `null` |  |  |
| 

`cid` \*

 | `string` **|** `null` |  |  |
| 

`cloudformationUpdateUrl` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`cloudtrailBucketName` \*

 | `string` **|** `null` |  |  |
| 

`cloudtrailRegion` \*

 | `string` **|** `null` |  |  |
| 

`dsprmRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`enabledServices` \*

 | `array` **|** `null` |  |  |
| 

`endedOn` \*

 | `number` **|** `null` |  |  |
| 

`eventbusArn` \*

 | `string` **|** `null` |  |  |
| 

`eventbusName` \*

 | `string` **|** `null` |  |  |
| 

`externalId` \*

 | `string` **|** `null` |  |  |
| 

`falconClientId` \*

 | `string` **|** `null` |  |  |
| 

`healthyConditionsCount` \*

 | `number` **|** `null` |  |  |
| 

`iamRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`intermediateRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isBehaviorAssessmentEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCloudRegistration` \*

 | `boolean` **|** `null` |  |  |
| 

`isCSPMEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCSPMLite` \*

 | `boolean` **|** `null` |  |  |
| 

`isCustomRolename` \*

 | `boolean` **|** `null` |  |  |
| 

`isD4CMigrated` \*

 | `boolean` **|** `null` |  |  |
| 

`isDSPMEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isManaged` \*

 | `boolean` **|** `null` |  |  |
| 

`isMaster` \*

 | `boolean` **|** `null` |  |  |
| 

`isSensorManagementEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isUsingExistingCloudtrail` \*

 | `boolean` **|** `null` |  |  |
| 

`isValid` \*

 | `boolean` **|** `null` |  |  |
| 

`lastScanOn` \*

 | `number` **|** `null` |  |  |
| 

`onboardedOn` \*

 | `number` **|** `null` |  |  |
| 

`operationalServicesCount` \*

 | `number` **|** `null` |  |  |
| 

`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`remediationCloudformationUrl` \*

 | `string` **|** `null` |  |  |
| 

`s3Url` \*

 | `string` **|** `null` |  |  |
| 

`startedOn` \*

 | `number` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`totalConditionsCount` \*

 | `number` **|** `null` |  |  |
| 

`totalServicesCount` \*

 | `number` **|** `null` |  |  |
| 

`vendor` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |

---

### Crowdstrike Compliance Control

`crowdstrike_compliance_control` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`assessmentId` \*

 | `string` |  |  |
| 

`benchmarkId` \*

 | `string` **|** `null` |  |  |
| 

`benchmarkName` \*

 | `string` **|** `null` |  |  |
| 

`benchmarkVersion` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`compliantResources` \*

 | `number` **|** `null` |  |  |
| 

`controlFramework` \*

 | `string` **|** `null` |  |  |
| 

`controlName` \*

 | `string` **|** `null` |  |  |
| 

`controlType` \*

 | `string` **|** `null` |  |  |
| 

`controlVersion` \*

 | `string` **|** `null` |  |  |
| 

`criticalNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`highNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`informationalNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`lastEvaluatedOn` \*

 | `number` **|** `null` |  |  |
| 

`mediumNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`nonCompliantResources` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceProvider` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`ruleIds` \*

 | `array` **|** `null` |  |  |
| 

`ruleNames` \*

 | `array` **|** `null` |  |  |
| 

`ruleOrigins` \*

 | `array` **|** `null` |  |  |
| 

`rulePolicyIds` \*

 | `array` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |
| 

`severities` \*

 | `array` **|** `null` |  |  |
| 

`totalResources` \*

 | `number` **|** `null` |  |  |

---

### Crowdstrike Container Image

`crowdstrike_container_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cid` | `string` |  |  |
| `digest` | `string` |  |  |
| `imageId` | `string` |  |  |
| `lastSeen` | `number` |  |  |
| `registry` | `string` |  |  |
| `repository` | `string` |  |  |
| `tag` | `string` |  |  |

---

### Crowdstrike Detected Application

`crowdstrike_detected_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dataProvider` | `string` | Source that produced the detection, e.g. "Falcon sensor" or "Falcon EASM". |  |
| 
`evaluationLogicId` \*

 | `string` | ID of the Spotlight evaluation logic that matched the application on the host. |  |
| `installPath` | `string` | Filesystem path where the application was detected on the host, when available. |  |
| 

`open` \*

 | `boolean` | Whether the application still has an open vulnerability sub-status. |  |
| `productName` | `string` | Normalized product name without version (e.g. "Firefox"). |  |
| `remediationIds` | `array` of `string`s |  |  |
| `vendor` | `string` | Normalized vendor of the application (e.g. "Mozilla"). |  |
| `version` | `string` | Installed version of the application. For macOS software this is parsed from the Spotlight evaluation logic; for other platforms it is taken from the affected product name. |  |

---

### Crowdstrike Device Control Policy

`crowdstrike_device_control_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cid` \*

 | `string` |  |  |
| 

`createdBy` \*

 | `string` |  |  |
| 

`description` \*

 | `string` |  |  |
| 

`enabled` \*

 | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`modifiedBy` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`platformName` \*

 | `string` |  |  |
| 

`settingsClasses` \*

 | `array` of `string`s |  |  |
| 

`settingsEndUserNotification` \*

 | `string` |  |  |
| 

`settingsEnforcementMode` \*

 | `string` |  |  |

---

### Crowdstrike Discover Application

`crowdstrike_discover_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `architectures` | `array` of `string`s |  |  |
| `category` | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| `installedOn` | `number` |  |  |
| `isNormalized` | `boolean` |  |  |
| `isSuspicious` | `boolean` |  |  |
| `lastUpdatedOn` | `number` |  |  |
| `lastUsedOn` | `number` |  |  |
| `vendor` | `string` |  |  |
| `version` | `string` |  |  |
| `versioningScheme` | `string` |  |  |

---

### Crowdstrike Easm Finding

`crowdstrike_easm_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`actors` \*

 | `array` **|** `null` |  |  |
| 

`aid` \*

 | `string` |  |  |
| 

`assetCriticality` \*

 | `string` **|** `null` |  |  |
| 

`baseScore` \*

 | `number` **|** `null` |  |  |
| 

`cid` \*

 | `string` |  |  |
| 

`cisaDueDate` \*

 | `string` **|** `null` |  |  |
| 

`closedOn` \*

 | `number` **|** `null` |  |  |
| 

`exploitabilityScore` \*

 | `number` **|** `null` |  |  |
| 

`exploitStatus` \*

 | `number` **|** `null` |  |  |
| 

`exprtRating` \*

 | `string` **|** `null` |  |  |
| 

`hostname` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`impactScore` \*

 | `number` **|** `null` |  |  |
| 

`instanceId` \*

 | `string` **|** `null` |  |  |
| 

`isCisaKev` \*

 | `boolean` **|** `null` |  |  |
| 

`isInternetExposed` \*

 | `boolean` **|** `null` |  |  |
| 

`isSuppressed` \*

 | `boolean` **|** `null` |  |  |
| 

`localIp` \*

 | `string` **|** `null` |  |  |
| 

`osVersion` \*

 | `string` **|** `null` |  |  |
| 

`platform` \*

 | `string` **|** `null` |  |  |
| 

`productName` \*

 | `string` **|** `null` |  |  |
| 

`productVersion` \*

 | `string` **|** `null` |  |  |
| 

`publishedOn` \*

 | `number` **|** `null` |  |  |
| 

`remediationLevel` \*

 | `string` **|** `null` |  |  |
| 

`servicePorts` \*

 | `array` **|** `null` |  |  |
| 

`serviceProvider` \*

 | `string` **|** `null` |  |  |
| 

`suppressionReason` \*

 | `string` **|** `null` |  |  |
| 

`vendor` \*

 | `string` **|** `null` |  |  |
| 

`vendorAdvisory` \*

 | `array` **|** `null` |  |  |
| 

`vulnerabilityId` \*

 | `string` |  |  |

---

### Crowdstrike Endpoint Protection

`crowdstrike_endpoint_protection` inherits from [Service](/data-model/schemas/Service.md)

---

### Crowdstrike External Asset

`crowdstrike_external_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicableActions` \*

 | `array` **|** `null` |  |  |
| 

`asn` \*

 | `number` **|** `null` |  |  |
| 

`assetType` \*

 | `string` |  |  |
| 

`awsRegion` \*

 | `string` **|** `null` |  |  |
| 

`cid` \*

 | `string` |  |  |
| 

`cloudProvider` \*

 | `string` **|** `null` |  |  |
| 

`confidence` \*

 | `number` **|** `null` |  |  |
| 

`countryCode` \*

 | `string` **|** `null` |  |  |
| 

`countryName` \*

 | `string` **|** `null` |  |  |
| 

`criticalityDescription` \*

 | `string` **|** `null` |  |  |
| 

`dataProviders` \*

 | `array` **|** `null` |  |  |
| 

`discoveredBy` \*

 | `string` **|** `null` |  |  |
| 

`dnsType` \*

 | `string` **|** `null` |  |  |
| 

`domainName` \*

 | `string` **|** `null` |  |  |
| 

`entityType` \*

 | `string` **|** `null` |  |  |
| 

`firstSeenOn` \*

 | `number` **|** `null` |  |  |
| 

`fqdn` \*

 | `string` **|** `null` |  |  |
| 

`hostingProviders` \*

 | `array` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`ipAddress` \*

 | `string` **|** `null` |  |  |
| 

`isAwsHosted` \*

 | `boolean` **|** `null` |  |  |
| 

`isAzureHosted` \*

 | `boolean` **|** `null` |  |  |
| 

`isGcpHosted` \*

 | `boolean` **|** `null` |  |  |
| 

`isInternetExposed` \*

 | `boolean` **|** `null` |  |  |
| 

`isp` \*

 | `string` **|** `null` |  |  |
| 

`isps` \*

 | `array` **|** `null` |  |  |
| 

`lastSeenOn` \*

 | `number` **|** `null` |  |  |
| 

`manual` \*

 | `boolean` **|** `null` |  |  |
| 

`parentDomain` \*

 | `string` **|** `null` |  |  |
| 

`perimeter` \*

 | `string` **|** `null` |  |  |
| 

`ptr` \*

 | `string` **|** `null` |  |  |
| 

`resolvedIps` \*

 | `array` **|** `null` |  |  |
| 

`serviceCount` \*

 | `number` **|** `null` |  |  |
| 

`servicePorts` \*

 | `array` **|** `null` |  |  |
| 

`serviceProtocols` \*

 | `array` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`subsidiaryIds` \*

 | `array` **|** `null` |  |  |
| 

`subsidiaryNames` \*

 | `array` **|** `null` |  |  |
| 

`timezone` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Falcon Shield Alert

`crowdstrike_falcon_shield_alert` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| `alertSource` | `string` |  |  |
| `alertType` | `string` |  |  |
| `detectedOn` | `number` |  |  |
| `integrationId` | `string` |  |  |
| `integrationName` | `string` |  |  |
| `isArchived` | `boolean` |  |  |
| `newAffectedCount` | `number` |  |  |
| `securityCheckApiLink` | `string` |  |  |
| `sourceId` | `string` |  |  |
| `threatApiLink` | `string` |  |  |

---

### Crowdstrike Falcon Shield App

`crowdstrike_falcon_shield_app` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessLevel` | `string` |  |  |
| `accountId` | `string` |  |  |
| `appDisplayName` | `string` |  |  |
| `appId` | `string` |  |  |
| `appStatus` | `string` |  |  |
| `appStatusReason` | `string` |  |  |
| `appType` | `string` |  |  |
| `clientId` | `string` |  |  |
| `integrationAlias` | `string` |  |  |
| `integrationId` | `string` |  |  |
| `integrationName` | `string` |  |  |
| `lastActivityOn` | `number` |  |  |
| `scopes` | `array` of `string`s |  |  |

---

### Crowdstrike Falcon Shield Integration

`crowdstrike_falcon_shield_integration` inherits from [Configuration](/data-model/schemas/Configuration.md), [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| `alias` | `string` |  |  |
| `enabled` | `boolean` |  |  |
| `integrationStatus` | `string` |  |  |
| `lastRunOn` | `number` |  |  |
| `saasId` | `string` |  |  |
| `saasName` | `string` |  |  |

---

### Crowdstrike Firewall Policy

`crowdstrike_firewall_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`channelVersion` \*

 | `number` |  |  |
| 

`cid` \*

 | `string` |  |  |
| 

`createdBy` \*

 | `string` |  |  |
| 

`description` \*

 | `string` |  |  |
| 

`enabled` \*

 | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`modifiedBy` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`platformName` \*

 | `string` |  |  |
| 

`ruleSetId` \*

 | `string` |  |  |

---

### Crowdstrike Host

`crowdstrike_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentVersion` | `string` |  |  |
| 
`appliedPolicyCount` \*

 | `number` **|** `null` |  |  |
| 

`biosManufacturer` \*

 | `string` **|** `null` |  |  |
| 

`biosVersion` \*

 | `string` **|** `null` |  |  |
| `chassisTypeDescription` | `string` |  |  |
| 

`cid` \*

 | `string` |  |  |
| 

`cloudProvider` \*

 | `string` **|** `null` | Canonical, lowercased cloud provider ('aws', 'azure', 'gcp', 'oci') derived from the raw serviceProvider so it matches the cloudProvider on CrowdStrike findings/CSPM entities. Null for non-cloud devices. |  |
| 

`defaultGatewayIp` \*

 | `string` **|** `null` |  |  |
| 

`deploymentType` \*

 | `string` **|** `null` |  |  |
| `ec2InstanceArn` | `string` |  |  |
| 

`emails` \*

 | `array` **|** `null` | Email addresses associated with the host. email and associated\_email\_addresses are referenced. |  |
| 

`externalIp` \*

 | `string` **|** `null` |  |  |
| `filesystemContainmentStatus` | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| `groupHash` | `string` |  |  |
| 

`groupIds` \*

 | `array` **|** `null` |  |  |
| 

`instanceId` \*

 | `string` **|** `null` | CrowdStrike's ID of the cloud VM. Per provider: AWS EC2 id (`i-...`), Azure VM `vmId` GUID, GCP numeric instance id, or OCI OCID. |  |
| 

`isContentUpdatePolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| 

`isExposureManagementPolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| 

`isGlobalConfigPolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| 

`isHostRetentionPolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| 

`isPreventionPolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| 

`isReducedFunctionalityMode` \*

 | `boolean` **|** `null` |  |  |
| 

`isRemoteResponsePolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| 

`isScaPolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| 

`isSensorUpdatePolicyApplied` \*

 | `boolean` **|** `null` |  |  |
| `kernelVersion` | `string` |  |  |
| `lastLoginUser` | `string` |  |  |
| `lastLoginUserSid` | `string` |  |  |
| 

`linuxSensorMode` \*

 | `string` **|** `null` |  |  |
| 

`majorVersion` \*

 | `string` **|** `null` |  |  |
| 

`minorVersion` \*

 | `string` **|** `null` |  |  |
| `osKernel` | `string` |  |  |
| `ou` | `array` of `string`s |  |  |
| 

`platformId` \*

 | `string` **|** `null` |  |  |
| 

`podAnnotations` \*

 | `array` **|** `null` |  |  |
| 

`podLabels` \*

 | `array` **|** `null` |  |  |
| 

`policyIds` \*

 | `array` **|** `null` |  |  |
| 

`policyTypes` \*

 | `array` **|** `null` |  |  |
| `provisionStatus` | `string` |  |  |
| 

`serviceProvider` \*

 | `string` **|** `null` | Raw CrowdStrike service provider of the asset, e.g. 'AWS\_EC2\_V2' or 'AZURE'. Use `cloudProvider` for the normalized value. |  |
| 

`serviceProviderAccountId` \*

 | `string` **|** `null` |  |  |
| 

`zoneGroup` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Image Vulnerability

`crowdstrike_image_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cpsCurrentRating` | `string` |  |  |
| `cvssScore` | `number` |  |  |
| `exploitedStatus` | `number` |  |  |
| `remediationAvailable` | `boolean` |  |  |

---

### Crowdstrike Image Vulnerability

`crowdstrike_image_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cpsCurrentRating` | `string` |  |  |
| `cvssScore` | `number` |  |  |
| `exploitedStatus` | `number` |  |  |
| `remediationAvailable` | `boolean` |  |  |

---

### Crowdstrike Iom Finding

`crowdstrike_iom_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`azureTenantId` \*

 | `string` **|** `null` |  |  |
| 

`cid` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`numericSeverity` \*

 | `number` **|** `null` |  |  |
| 

`policyId` \*

 | `number` |  |  |
| 

`policyStatement` \*

 | `string` |  |  |
| 

`policyType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`reportedOn` \*

 | `number` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`resourceUuid` \*

 | `string` **|** `null` |  |  |
| 

`scannedOn` \*

 | `number` **|** `null` |  |  |
| 

`service` \*

 | `string` |  |  |
| 

`severity` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |

---

### Crowdstrike Iom Rule

`crowdstrike_iom_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountScope` \*

 | `string` **|** `null` |  |  |
| 

`attackTypes` \*

 | `array` **|** `null` |  |  |
| 

`cid` \*

 | `string` **|** `null` |  |  |
| 

`cloudAssetType` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` **|** `null` |  |  |
| 

`cloudService` \*

 | `string` **|** `null` |  |  |
| 

`cloudServiceFriendly` \*

 | `string` **|** `null` |  |  |
| 

`cloudServiceSubtype` \*

 | `string` **|** `null` |  |  |
| 

`defaultSeverity` \*

 | `string` **|** `null` |  |  |
| 

`fqlPolicy` \*

 | `string` **|** `null` |  |  |
| 

`isGlobal` \*

 | `boolean` **|** `null` |  |  |
| 

`isRemediable` \*

 | `boolean` **|** `null` |  |  |
| 

`policyId` \*

 | `number` |  |  |
| 

`policyTimestampOn` \*

 | `number` **|** `null` |  |  |
| 

`policyType` \*

 | `string` **|** `null` |  |  |
| 

`remediationSummary` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Prevention Policy

`crowdstrike_prevention_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cid` \*

 | `string` |  |  |

---

### Crowdstrike Prevention Policy Setting

`crowdstrike_prevention_policy_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`categoryName` \*

 | `string` |  |  |
| `configured` | `boolean` |  |  |
| 

`description` \*

 | `string` |  |  |
| `enabled` | `boolean` |  |  |
| 

`type` \*

 | `string` |  |  |

---

### Crowdstrike Remediation

`crowdstrike_remediation` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `string` **|** `null` |  |  |
| 

`link` \*

 | `string` **|** `null` |  |  |
| 

`patchPublishedOn` \*

 | `number` **|** `null` |  |  |
| 

`recommendationType` \*

 | `string` **|** `null` |  |  |
| 

`reference` \*

 | `string` **|** `null` |  |  |
| 

`vendorUrl` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Sensor

`crowdstrike_sensor` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cloudProvider` \*

 | `string` **|** `null` | Canonical, lowercased cloud provider ('aws', 'azure', 'gcp', 'oci') derived from the raw serviceProvider so it matches the cloudProvider on CrowdStrike findings/CSPM entities. Null for non-cloud devices. |  |
| `ec2InstanceArn` | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| `macAddress` | `string` | A normalized MAC address for the device's network interface |  |
| 

`originalMacAddress` \*

 |  | The original MAC address for the device's network interface |  |

---

### Crowdstrike Serverless Vulnerability

`crowdstrike_serverless_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`exploitStatus` \*

 | `string` **|** `null` |  |  |
| 

`exprtRating` \*

 | `string` **|** `null` |  |  |
| 

`exprtRatingHighest` \*

 | `string` **|** `null` |  |  |
| 

`firstSeenOn` \*

 | `number` **|** `null` |  |  |
| 

`remediations` \*

 | `array` **|** `null` |  |  |
| 

`runtime` \*

 | `string` **|** `null` |  |  |
| 

`scannerVersion` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike User

`crowdstrike_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cid` | `string` |  |  |
| `lastLoginOn` | `number` |  |  |
| `uid` | `string` |  |  |

---

### Crowdstrike Vulnerability

`crowdstrike_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aid` | `string` |  |  |
| 
`cid` \*

 | `string` |  |  |
| `closedOn` | `number` |  |  |
| 

`confidenceLabel` \*

 | `string` **|** `null` | CrowdStrike's confidence that the detection is a true positive (e.g. 'Low', 'Medium', 'High'). The Spotlight console hides 'Low' by default; filter on this to reconcile J1 counts with the dashboard. |  |
| `exploitStatus` | `number` |  |  |
| `exprtRating` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isSuppressed` \*

 | `boolean` **|** `null` | Whether the detection is hidden by a Spotlight suppression rule. Suppressed detections are excluded from the console by default. |  |
| `productNameVersion` | `string` |  |  |
| `publishedOn` | `number` |  |  |
| `remediationIds` | `array` of `string`s |  |  |
| 

`suppressionReason` \*

 | `string` **|** `null` | Reason the detection was suppressed, when suppressed. |  |
| `vendorAdvisory` | `array` of `string`s |  |  |

---

### Crowdstrike Vulnerability

`crowdstrike_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aid` | `string` |  |  |
| 
`cid` \*

 | `string` |  |  |
| `closedOn` | `number` |  |  |
| 

`confidenceLabel` \*

 | `string` **|** `null` | CrowdStrike's confidence that the detection is a true positive (e.g. 'Low', 'Medium', 'High'). The Spotlight console hides 'Low' by default; filter on this to reconcile J1 counts with the dashboard. |  |
| `exploitStatus` | `number` |  |  |
| `exprtRating` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isSuppressed` \*

 | `boolean` **|** `null` | Whether the detection is hidden by a Spotlight suppression rule. Suppressed detections are excluded from the console by default. |  |
| `productNameVersion` | `string` |  |  |
| `publishedOn` | `number` |  |  |
| `remediationIds` | `array` of `string`s |  |  |
| 

`suppressionReason` \*

 | `string` **|** `null` | Reason the detection was suppressed, when suppressed. |  |
| `vendorAdvisory` | `array` of `string`s |  |  |

---

### Crowdstrike Zero Trust Assessment

`crowdstrike_zero_trust_assessment` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aid` | `string` |  |  |
| 
`cid` \*

 | `string` |  |  |
| 

`eventPlatform` \*

 | `string` |  |  |
| 

`metOsSignals` \*

 | `array` of `string`s |  |  |
| 

`metSensorSignals` \*

 | `array` of `string`s |  |  |
| 

`osScore` \*

 | `number` |  |  |
| 

`overallScore` \*

 | `number` |  |  |
| 

`productTypeDescription` \*

 | `string` |  |  |
| 

`sensorConfigScore` \*

 | `number` |  |  |
| 

`sensorFileStatus` \*

 | `string` |  |  |
| 

`systemSerialNumber` \*

 | `string` |  |  |
| 

`unmetOsSignals` \*

 | `array` of `string`s |  |  |
| 

`unmetSensorSignals` \*

 | `array` of `string`s |  |  |
| 

`version` \*

 | `string` |  |  |

---

## Release Notes

-   **2026-09-18** — Newly registered devices are now ingested during micro-ingestion runs, reducing the window between device registration and visibility in JupiterOne.
-   **2026-09-17** — CrowdStrike vulnerabilities are now updated during micro-ingestion runs, keeping Spotlight findings in sync with near-real-time detection data.
-   **2026-09-11** — Added a configurable API origin override for CrowdStrike environments using regional or alternate API endpoints.
-   **2026-07-14** — Vulnerability findings now include a confidence label and suppression status, indicating whether a detection is a confirmed true positive and whether it is hidden in the Spotlight console.
-   **2026-03-31** — Promoted OS kernel version property to CrowdStrike host entities, exposing the operating system kernel version.
-   **2026-02-20** — Added container image vulnerability assessments via the Image Assessments API, available behind a configuration flag.
-   **2026-01-06** — Added CrowdStrike External Attack Surface Management (EASM) vulnerabilities ingestion as new findable entity types.
-   **2025-12-10** — Added filtering of CrowdStrike compliance controls by severity.
-   **2025-11-05** — Added remediation actions property to CrowdStrike vulnerability entities.
-   **2025-10-08** — Added CrowdStrike container vulnerability ingestion, relating containers to their image vulnerabilities.
-   **2025-10-03** — Added CrowdStrike Alerts ingestion as alert entities.
-   **2025-09-30** — Added Device Unification support for CrowdStrike CSPM resources.
-   **2025-09-10** — Added CrowdStrike Azure CSPM ingestion, covering Azure resource findings alongside existing AWS coverage.
-   **2025-08-27** — Added host to container image relationships linking CrowdStrike hosts to their running container images.
-   **2025-08-22** — Added CrowdStrike compliance controls ingestion as compliance finding entities with policy framework relationships.
-   **2025-08-12** — Added CrowdStrike CSPM Phase 2, expanding cloud security posture findings coverage with additional ARN types.
-   **2025-08-08** — Added CrowdStrike CSPM Phase 1, ingesting cloud security posture management findings for AWS resources.
-   **2025-07-08** — Added image digest property to CrowdStrike container image entities for content-addressable image identification.
-   **2025-06-16** — Added CrowdStrike application ingestion using the combined apps endpoint with configurable date filtering.
-   **2025-06-02** — Added device remediation actions as device remediation entities.
-   **2025-04-22** — Added CrowdStrike Users and device-user relationships ingestion.
-   **2025-04-10** — Added CrowdStrike Firewall Policy and Device Control Policy ingestion.

---

Source: /integrations/directory/crowdstrike-fcs

# CrowdStrike Falcon Cloud Security

Visualize your cloud security posture across AWS, Azure, and GCP with CrowdStrike Falcon Cloud Security. Ingest cloud accounts and resources, map Indicators of Misconfiguration (IOM) findings to the rules that detect them, and monitor compliance controls through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an API client ID and an API client secret in CrowdStrike, which requires the Falcon Administrator role. In the Falcon console, go to **Support > API Clients and Keys** and click **Add new API client**. The secret is only shown when the client is created or its secret is reset. CrowdStrike's [API Credentials](https://developer.crowdstrike.com/falcon-mcp/getting-started/credentials/#creating-api-credentials) guide walks through the same console steps. It is written for the Falcon MCP server, so use the scopes listed on this page rather than the ones it suggests.

CrowdStrike Falcon Cloud Security ingests cloud security posture data. When creating the API client ID and API client secret, grant read access to the following API Scopes:

-   CSPM registration (`cspm-registration:read`)
-   Cloud security assets (`cloud-security-assets:read`)

🎯 2. Data Filtering Options

These options control which findings and controls are ingested. Leave defaults for a focused, high-signal first run.

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **CSPM Cloud Providers** | MultiSelect | Cloud providers to monitor for CSPM findings. | AWS, Azure |
| **IOM Severity Filter** | MultiSelect | Severity levels to include for Indicator of Misconfiguration (IOM) findings. | Critical |
| **Compliance Control Severities** | MultiSelect | Severity levels to include for compliance controls. | Critical, High |

To install the CrowdStrike Falcon Cloud Security integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select CrowdStrike Falcon Cloud Security. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the CrowdStrike account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your CrowdStrike **API client ID** and **API client secret** to authenticate with the CrowdStrike Falcon API.
    
-   Enter the **Availability Zone** you'd like to use for API calls. Leave blank to use the main API endpoint. For example, entering `us-2` as the availability zone will result in the use of a CrowdStrike API endpoint of `api.us-2.crowdstrike.com`.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (4)

-   `cloud-google-cloud-registration:read`
-   `cloud-security-assets:read`
-   `cloud-security-detections:read`
-   `cspm-registration:read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (9)

-   `/cloud-connect-cspm-aws/entities/account/v1`
-   `/cloud-connect-cspm-azure/entities/account/v1`
-   `/cloud-security-assets/combined/compliance-controls/by-account-region-and-resource-type/v1`
-   `/cloud-security-assets/entities/resources/v1`
-   `/cloud-security-assets/queries/resources/v1`
-   `/cloud-security-evaluations/entities/ioms/v1`
-   `/cloud-security-evaluations/queries/ioms/v1`
-   `/cloud-security-registration-google-cloud/entities/accounts/v1`
-   `/settings/entities/policy/v1`

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Compliance Controls | `cloud-security-assets:read` | `/cloud-security-assets/combined/compliance-controls/by-account-region-and-resource-type/v1` |
| Fetch Cloud Entities | `cloud-security-assets:read` | `/cloud-security-assets/queries/resources/v1`, `/cloud-security-assets/entities/resources/v1` |
| IOM Findings | `cloud-security-detections:read` | `/cloud-security-evaluations/queries/ioms/v1`, `/cloud-security-evaluations/entities/ioms/v1` |
| IOM Rules | `cspm-registration:read` | `/settings/entities/policy/v1` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `crowdstrike_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cloud Account | `crowdstrike_cloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cloud Entity | `crowdstrike_cloud_entity` | [Entity](https://docs.jupiterone.io/data-model/schemas/Entity) |
| Cloud Entity | `crowdstrike_aws_iam_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Cloud Entity | `crowdstrike_aws_iam_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Cloud Entity | `crowdstrike_aws_iam_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Cloud Entity | `crowdstrike_aws_iam_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Cloud Entity | `crowdstrike_aws_ec2_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cloud Entity | `crowdstrike_aws_ec2_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Cloud Entity | `crowdstrike_aws_ec2_network_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Cloud Entity | `crowdstrike_aws_vpc` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cloud Entity | `crowdstrike_aws_vpc_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cloud Entity | `crowdstrike_aws_vpc_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Entity | `crowdstrike_aws_vpc_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Cloud Entity | `crowdstrike_aws_ebs_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Cloud Entity | `crowdstrike_aws_ebs_snapshot` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Cloud Entity | `crowdstrike_aws_s3_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Cloud Entity | `crowdstrike_aws_dynamodb_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Cloud Entity | `crowdstrike_aws_rds_database` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Cloud Entity | `crowdstrike_aws_efs_file_system` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Cloud Entity | `crowdstrike_aws_elasticache_cluster` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Cloud Entity | `crowdstrike_aws_kinesis_stream` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Cloud Entity | `crowdstrike_aws_ecr_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Cloud Entity | `crowdstrike_aws_eks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Cloud Entity | `crowdstrike_aws_ecs_task_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Entity | `crowdstrike_aws_lambda_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| Cloud Entity | `crowdstrike_aws_sns_topic` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| Cloud Entity | `crowdstrike_aws_sqs_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| Cloud Entity | `crowdstrike_aws_kms_key` | [CryptoKey](https://docs.jupiterone.io/data-model/schemas/CryptoKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| Cloud Entity | `crowdstrike_aws_secrets_manager_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Cloud Entity | `crowdstrike_aws_ssm_parameter` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Entity | `crowdstrike_aws_route53_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| Cloud Entity | `crowdstrike_aws_api_gateway_rest_api` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_aws_cloudformation_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Entity | `crowdstrike_aws_cloudtrail` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_aws_athena_work_group` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_aws_cognito_user_pool` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_aws_sagemaker_notebook_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cloud Entity | `crowdstrike_azure_vm` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cloud Entity | `crowdstrike_azure_managed_disk` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| Cloud Entity | `crowdstrike_azure_storage_account` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_azure_vnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cloud Entity | `crowdstrike_azure_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Cloud Entity | `crowdstrike_azure_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Cloud Entity | `crowdstrike_azure_key_vault` | KeyStore |
| Cloud Entity | `crowdstrike_azure_kubernetes_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Cloud Entity | `crowdstrike_azure_cosmosdb_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account), [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_azure_container_app` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_azure_web_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Cloud Entity | `crowdstrike_azure_cdn_profile` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_azure_event_hub` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_azure_subscription` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cloud Entity | `crowdstrike_azure_mysql_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cloud Entity | `crowdstrike_azure_ad_domain_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_azure_role_definition` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Cloud Entity | `crowdstrike_azure_role_assignment` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Cloud Entity | `crowdstrike_azure_deny_assignment` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Cloud Entity | `crowdstrike_azure_policy_definition` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Cloud Entity | `crowdstrike_azure_policy_assignment` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Cloud Entity | `crowdstrike_azure_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Cloud Entity | `crowdstrike_azure_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Cloud Entity | `crowdstrike_azure_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Cloud Entity | `crowdstrike_azure_service_principal` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Cloud Entity | `crowdstrike_azure_directory_role_definition` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Cloud Entity | `crowdstrike_gcp_compute_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cloud Entity | `crowdstrike_gcp_storage_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Cloud Entity | `crowdstrike_gcp_iam_service_account` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Cloud Entity | `crowdstrike_gcp_iam_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Cloud Entity | `crowdstrike_gcp_iam_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Cloud Entity | `crowdstrike_gcp_bigquery_dataset` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Cloud Entity | `crowdstrike_gcp_bigquery_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Cloud Entity | `crowdstrike_gcp_kubernetes_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Cloud Entity | `crowdstrike_gcp_kms_key` | [CryptoKey](https://docs.jupiterone.io/data-model/schemas/CryptoKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| Cloud Entity | `crowdstrike_gcp_sql_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cloud Entity | `crowdstrike_gcp_cloud_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| Cloud Entity | `crowdstrike_gcp_cloud_run_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Entity | `crowdstrike_gcp_compute_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cloud Entity | `crowdstrike_gcp_compute_subnetwork` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Cloud Entity | `crowdstrike_gcp_compute_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Cloud Entity | `crowdstrike_gcp_compute_route` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Entity | `crowdstrike_gcp_compute_disk` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| Cloud Entity | `crowdstrike_gcp_iam_service_account_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Cloud Entity | `crowdstrike_gcp_secret_manager_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Cloud Entity | `crowdstrike_gcp_secret_manager_secret_version` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Cloud Entity | `crowdstrike_gcp_pubsub_topic` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| Cloud Entity | `crowdstrike_gcp_pubsub_subscription` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| Cloud Entity | `crowdstrike_gcp_logging_sink` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Entity | `crowdstrike_gcp_logging_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Compliance Control | `crowdstrike_compliance_control` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| IOM Finding | `crowdstrike_iom_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| IOM Rule | `crowdstrike_iom_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Service | `crowdstrike_endpoint_protection` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `crowdstrike_account` | **HAS** | `crowdstrike_endpoint_protection` |
| `crowdstrike_account` | **HAS** | `crowdstrike_cloud_account` |
| `crowdstrike_cloud_account` | **HAS** | `crowdstrike_cloud_entity` |
| `crowdstrike_cloud_entity` | **HAS** | `crowdstrike_iom_finding` |
| `crowdstrike_compliance_control` | **HAS** | `crowdstrike_iom_rule` |

### Crowdstrike Account

`crowdstrike_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cid` | `string` |  |  |

---

### Crowdstrike Cloud Account

`crowdstrike_cloud_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountAlias` \*

 | `string` **|** `null` |  |  |
| 

`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`accountType` \*

 | `string` **|** `null` |  |  |
| 

`availableRegions` \*

 | `array` **|** `null` |  |  |
| 

`azureTenantId` \*

 | `string` **|** `null` |  |  |
| 

`cid` \*

 | `string` **|** `null` |  |  |
| 

`cloudformationUpdateUrl` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`cloudtrailBucketName` \*

 | `string` **|** `null` |  |  |
| 

`cloudtrailRegion` \*

 | `string` **|** `null` |  |  |
| 

`dsprmRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`enabledServices` \*

 | `array` **|** `null` |  |  |
| 

`endedOn` \*

 | `number` **|** `null` |  |  |
| 

`eventbusArn` \*

 | `string` **|** `null` |  |  |
| 

`eventbusName` \*

 | `string` **|** `null` |  |  |
| 

`externalId` \*

 | `string` **|** `null` |  |  |
| 

`falconClientId` \*

 | `string` **|** `null` |  |  |
| 

`healthyConditionsCount` \*

 | `number` **|** `null` |  |  |
| 

`iamRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`intermediateRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isBehaviorAssessmentEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCloudRegistration` \*

 | `boolean` **|** `null` |  |  |
| 

`isCSPMEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCSPMLite` \*

 | `boolean` **|** `null` |  |  |
| 

`isCustomRolename` \*

 | `boolean` **|** `null` |  |  |
| 

`isD4CMigrated` \*

 | `boolean` **|** `null` |  |  |
| 

`isDSPMEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isManaged` \*

 | `boolean` **|** `null` |  |  |
| 

`isMaster` \*

 | `boolean` **|** `null` |  |  |
| 

`isSensorManagementEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isUsingExistingCloudtrail` \*

 | `boolean` **|** `null` |  |  |
| 

`isValid` \*

 | `boolean` **|** `null` |  |  |
| 

`lastScanOn` \*

 | `number` **|** `null` |  |  |
| 

`onboardedOn` \*

 | `number` **|** `null` |  |  |
| 

`operationalServicesCount` \*

 | `number` **|** `null` |  |  |
| 

`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`remediationCloudformationUrl` \*

 | `string` **|** `null` |  |  |
| 

`s3Url` \*

 | `string` **|** `null` |  |  |
| 

`startedOn` \*

 | `number` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`totalConditionsCount` \*

 | `number` **|** `null` |  |  |
| 

`totalServicesCount` \*

 | `number` **|** `null` |  |  |
| 

`vendor` \*

 | `string` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Cloud Entity

`crowdstrike_cloud_entity` inherits from [Entity](/data-model/schemas/Entity.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceIdType` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`resourceUrl` \*

 | `string` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Compliance Control

`crowdstrike_compliance_control` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`assessmentId` \*

 | `string` |  |  |
| 

`benchmarkId` \*

 | `string` **|** `null` |  |  |
| 

`benchmarkName` \*

 | `string` **|** `null` |  |  |
| 

`benchmarkVersion` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`compliantResources` \*

 | `number` **|** `null` |  |  |
| 

`controlFramework` \*

 | `string` **|** `null` |  |  |
| 

`controlName` \*

 | `string` **|** `null` |  |  |
| 

`controlType` \*

 | `string` **|** `null` |  |  |
| 

`controlVersion` \*

 | `string` **|** `null` |  |  |
| 

`criticalNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`highNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`informationalNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`lastEvaluatedOn` \*

 | `number` **|** `null` |  |  |
| 

`mediumNonCompliant` \*

 | `number` **|** `null` |  |  |
| 

`nonCompliantResources` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceProvider` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`ruleIds` \*

 | `array` **|** `null` |  |  |
| 

`ruleNames` \*

 | `array` **|** `null` |  |  |
| 

`ruleOrigins` \*

 | `array` **|** `null` |  |  |
| 

`rulePolicyIds` \*

 | `array` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |
| 

`severities` \*

 | `array` **|** `null` |  |  |
| 

`totalResources` \*

 | `number` **|** `null` |  |  |

---

### Crowdstrike Endpoint Protection

`crowdstrike_endpoint_protection` inherits from [Service](/data-model/schemas/Service.md)

---

### Crowdstrike Iom Finding

`crowdstrike_iom_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountName` \*

 | `string` **|** `null` |  |  |
| 

`attackTypes` \*

 | `array` **|** `null` |  |  |
| 

`cid` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` |  |  |
| 

`evaluationStatus` \*

 | `string` **|** `null` |  |  |
| 

`extensionStatus` \*

 | `string` **|** `null` |  |  |
| 

`firstDetectedOn` \*

 | `number` **|** `null` |  |  |
| 

`frameworks` \*

 | `array` **|** `null` |  |  |
| 

`gcrn` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastDetectedOn` \*

 | `number` **|** `null` |  |  |
| 

`policyId` \*

 | `number` |  |  |
| 

`policyName` \*

 | `string` **|** `null` |  |  |
| 

`policyStatement` \*

 | `string` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceName` \*

 | `string` **|** `null` |  |  |
| 

`resourceStatus` \*

 | `string` **|** `null` |  |  |
| 

`resourceType` \*

 | `string` **|** `null` |  |  |
| 

`resourceTypeName` \*

 | `string` **|** `null` |  |  |
| 

`ruleDescription` \*

 | `string` **|** `null` |  |  |
| 

`ruleId` \*

 | `string` **|** `null` |  |  |
| 

`ruleName` \*

 | `string` **|** `null` |  |  |
| 

`ruleOrigin` \*

 | `string` **|** `null` |  |  |
| 

`ruleRemediation` \*

 | `string` **|** `null` |  |  |
| 

`scannedOn` \*

 | `number` **|** `null` |  |  |
| 

`service` \*

 | `string` **|** `null` |  |  |
| 

`serviceCategory` \*

 | `string` **|** `null` |  |  |

---

### Crowdstrike Iom Rule

`crowdstrike_iom_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountScope` \*

 | `string` **|** `null` |  |  |
| 

`attackTypes` \*

 | `array` **|** `null` |  |  |
| 

`cid` \*

 | `string` **|** `null` |  |  |
| 

`cloudAssetType` \*

 | `string` **|** `null` |  |  |
| 

`cloudProvider` \*

 | `string` **|** `null` |  |  |
| 

`cloudService` \*

 | `string` **|** `null` |  |  |
| 

`cloudServiceFriendly` \*

 | `string` **|** `null` |  |  |
| 

`cloudServiceSubtype` \*

 | `string` **|** `null` |  |  |
| 

`defaultSeverity` \*

 | `string` **|** `null` |  |  |
| 

`fqlPolicy` \*

 | `string` **|** `null` |  |  |
| 

`isGlobal` \*

 | `boolean` **|** `null` |  |  |
| 

`isRemediable` \*

 | `boolean` **|** `null` |  |  |
| 

`policyId` \*

 | `number` |  |  |
| 

`policyTimestampOn` \*

 | `number` **|** `null` |  |  |
| 

`policyType` \*

 | `string` **|** `null` |  |  |
| 

`remediationSummary` \*

 | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-09-24** — Added configuration options to filter cloud asset ingestion by cloud provider and by specific asset types within each provider.
-   **2026-09-18** — Added support for MSSP parent accounts to automatically configure child integration instances for each managed customer CID.
-   **2026-06-29** — CrowdStrike Falcon Cloud Security IOM findings are now ingested through the Cloud Security evaluation API for improved coverage and reliability.
-   **2026-06-26** — Added ingestion of additional Google Cloud resource types including networks, subnets, firewalls, disks, IAM service account keys, secrets, and Pub/Sub topics.
-   **2026-06-25** — Initial release of the CrowdStrike Falcon Cloud Security integration, ingesting cloud accounts and resources, Indicators of Misconfiguration (IOM) findings and rules, and compliance controls across AWS, Azure, and GCP.

---

Source: /integrations/directory/cyberark-epm

# CyberArk EPM

Visualize CyberArk EPM account, policies, devices, application groups and monitor changes through queries and alerts.

## Installation

The CyberArk EPM integration supports two authentication methods, which you choose when you create the instance in JupiterOne:

-   **Session Token** — a CyberArk EPM user that signs in directly to EPM.
-   **CyberArk Identity Service User** — an OAuth service user managed in CyberArk Identity, authenticating through your Identity tenant.

Both methods only read data, so the user you create should have read-only access. The EPM web services documentation recommends a dedicated user with read-only permissions for API integrations. For set-level data (sets, endpoints, and policies), read-only access is granted by assigning the user an EPM **role** that combines the predefined **View only** permission group with the relevant sets. Only an account administrator can create users and assign roles.

> **INFO**
> 
> See the CyberArk documentation on [EPM web services](https://docs.cyberark.com/epm/latest/en/content/webservices/webservicesintro.htm) and [role-based access control](https://docs.cyberark.com/epm/latest/en/content/admin/role-based-access-control.htm) for more detail on users, roles, and permissions.

### Create a Session Token user

Use this method for a user defined directly in EPM. Users who sign in through CyberArk Identity or SAML SSO cannot use this method; use the CyberArk Identity Service User method instead.

1.  Log in to your CyberArk EPM console. ![Login](/assets/images/cyberarkepm-login-f344ad6663daf781cd52f7880b739c9d.png)
2.  Click the **Administration** tile. ![Administration](/assets/images/cybereark-administration-c2cf7ddb24cb4c8fd43b75a39c7b6407.png)
3.  Navigate to **Users** and add a user, completing the credential and permission details. ![Create User](/assets/images/cybereark-create-user-f953f136cac23fe6062206853a93a9aa.png) ![Permissions](/assets/images/cybereark-permissions-4a08284db3af64ae5a172d73bbd35f15.png)
4.  Assign the user a role that combines the **View only** permission group with the sets you want to ingest.

You will use this user's username and password, together with your regional dispatcher server, to configure the integration.

### Create a CyberArk Identity Service User

Use this method to authenticate through CyberArk Identity with an OAuth service user.

1.  In Identity Administration, navigate to **Manage > Inventory > Users** and add a user. Set a login in the form `<user>@<tenant-domain>` and a password, and select **Is OAuth confidential client**, **Is Service User**, and **Password never expires**.
2.  Add that service user as a member of the EPM role that carries the required view-only EPM permissions for the sets, policies, and endpoints you want to ingest.
3.  In Identity Administration, navigate to **Manage > Inventory > Targets > Applications** and add an application. Search for `EPM`, add the **EPM API Client** web app, and save its settings.
4.  In the web app, open the **Tokens** tab and set a token lifetime. Then open the **Permissions** tab and add the service user. Confirm the app status is **Deployed**.
5.  Find your tenant sub-domain and the app alias (Application ID) in Identity Administration under your user name > **About**.

> **INFO**
> 
> See [Set up API authentication for EPM REST APIs using ISPSS](https://docs.cyberark.com/epm/latest/en/content/webservices/authenticate-with-tenant-url.htm) for the full procedure.

### Configuration in JupiterOne

To install the CyberArk EPM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select CyberArk EPM. Click **New Instance** to begin configuring your integration, then choose the authentication method you set up above.

#### Session Token

Creating an instance with the **Session Token** method requires the following:

-   **CyberArk EPM Dispatcher Server URL** — the dispatcher server for your region, for example `login.epm.cyberark.com` (US) or `eu.epm.cyberark.com` (Germany). You can paste the URL you use to open the EPM console and JupiterOne will use its host.
-   **CyberArk EPM Username** — the username of the EPM user you created.
-   **CyberArk EPM Password** — the password of that EPM user.

#### CyberArk Identity Service User

Creating an instance with the **CyberArk Identity Service User** method requires the following:

-   **CyberArk EPM Server** — your EPM server: the host of the URL you use to open the EPM console, for example `na101.epm.cyberark.com`. This is not the regional dispatcher server (`login.epm.cyberark.com`).
-   **CyberArk Identity Tenant URL** — your CyberArk Identity tenant, for example `abc1234.id.cyberark.cloud`. Identity Administration shows it under your user name
    
    > **About**.
    
-   **EPM API Client Application ID** — the Application ID of the custom EPM API Client web app you added in Identity Administration (**Manage > Inventory > Targets > Applications**).
-   **Service User** — the Identity service user's login, `<user>@<tenant-domain>`. It must be marked **Is OAuth confidential client** and **Is Service User**, be a member of an EPM role with view access to sets, policies, and endpoints, and be listed on the web app's **Permissions** tab.
-   **Service User Password** — the password of that service user.

Click **Create** once all values are provided to finalize the integration.

### Advanced Configuration

| Field | Description | Default |
| --- | --- | --- |
| Disable TLS Verification | When enabled, skips TLS certificate verification when connecting to the EPM server. Not recommended; install valid TLS certificates instead. | Disabled |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cyberark_epm_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| ApplicationGroup | `cyberark_epm_applicationgroup` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Device | `cyberark_epm_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| HostAgent | `cyberark_epm_hostagent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Policy | `cyberark_epm_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Service | `cyberark_epm_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cyberark_epm_account` | **HAS** | `cyberark_epm_service` |
| `cyberark_epm_account` | **HAS** | `cyberark_epm_hostagent` |
| `cyberark_epm_hostagent` | **PROTECTS** | `cyberark_epm_device` |
| `cyberark_epm_policy` | **ENFORCES** | `cyberark_epm_service` |
| `cyberark_epm_policy` | **ENFORCES** | `cyberark_epm_applicationgroup` |

### Cyberark Epm Account

`cyberark_epm_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isNpvdi` | `boolean` **|** `null` | Whether the set is a non-persistent VDI (NPVDI) set. |  |

---

### Cyberark Epm Applicationgroup

`cyberark_epm_applicationgroup` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `string` | The EPM policy type of the application group. |  |

---

### Cyberark Epm Device

`cyberark_epm_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentVersion` | `string` **|** `null` | The version of the EPM agent on the endpoint. |  |
| `connectionStatus` | `string` **|** `null` | The agent connection status EPM reports: Alive, Disconnected, Initializing, Support or Upgrading from Get computers; Connected, Disconnected or NeverConnected from Get endpoints. |  |
| `endpointId` | `string` **|** `null` | The endpoint id from the EPM endpoint management service. Present only for endpoints read from the Get endpoints API. |  |
| `installedOn` | `number` **|** `null` | When the EPM agent was first installed on the endpoint. |  |
| `setid` | `string` | The id of the EPM set the endpoint belongs to. |  |

---

### Cyberark Epm Hostagent

`cyberark_epm_hostagent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentVersion` | `string` **|** `null` | The version of the EPM agent. |  |

---

### Cyberark Epm Policy

`cyberark_epm_policy` inherits from [Policy](/data-model/schemas/Policy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`id` \*

 | `string` | The EPM policy id. |  |
| `isActive` | `boolean` **|** `null` | Whether the policy is active. |  |
| `referencedApplicationGroupsIds` | `array` of `string`s | Ids of the application groups the policy references. Each one that was ingested is also related to the policy with ENFORCES. |  |
| `setId` | `string` | The id of the EPM set the policy belongs to. |  |

---

### Cyberark Epm Service

`cyberark_epm_service` inherits from [Service](/data-model/schemas/Service.md)

---

## Release Notes

-   **2026-04-08** — Improved OS type accuracy for CyberArk EPM device entities.

---

Source: /integrations/directory/cyberark-idaptive

# CyberArk Idaptive

Visualize CyberArk Idaptive Devices, Users, Applications, Roles, Accounts and monitor changes through queries and alerts.

This integration ingests devices, users, accounts, applications, and roles from the CyberArk Idaptive REST API. Setup involves two parts: creating a service account and an OAuth2 client application in your CyberArk Idaptive tenant, then configuring the integration in JupiterOne using the credentials you generate.

## Installation

To complete setup you need:

-   A CyberArk Idaptive tenant (e.g., `https://my-tenant.id.cyberark.cloud`). You log in with a tenant admin account to create the service user and the OAuth2 application.
-   The CyberArk Idaptive [Identity APIs reference](https://api-docs.cyberark.com/identity-docs-api/docs/identity-apis).

### Step 1: Create a service account

1.  Log in to your CyberArk Idaptive tenant and navigate to the **Admin portal**.
    
    ![Admin Portal](/assets/images/select-admin-portal-9254bd1e1cebdf5be92024a8799ec080.png)
    
2.  Go to **Core Services** > **Users**. Fill in all required fields. Check **Password never expires**, **Is service user**, and **Is OAuth Credential Client** in the status section, then click **Create user**.
    
    ![Create User](/assets/images/create-service-user-0077d5373e76f923f214cbd86124baef.png)
    

### Step 2: Create an OAuth2 client application

3.  In the Admin portal, click **Apps & Widgets** > **Web Apps**, then click **Add Web Apps**.
    
    ![Web Apps page](/assets/images/select-web-apps-38bb8390e7698539153ab36f42d2b089.png)
    
4.  Select **Custom** and choose **OAuth2 Client** from the list.
    
    ![Select client web app](/assets/images/select-oauth-client-94e65c7e60398cc51026db84fde41ecc.png)
    
5.  Select the **Organization** from the dropdown and click **Add**.
    
    ![Select organization](/assets/images/select-org-7224be474e10ba7b5ac9b39d3e50619d.png)
    
6.  On the **Settings** page, enter an ID for the application. Save this ID — you will need it as the **CyberArk Idaptive Client Application Id** when configuring the JupiterOne integration.
    
    ![Application page](/assets/images/application-id-9fa46d3bce19b61db5d4d42cde22a811.png)
    
7.  Click **General Usage** in the sidebar. Select **Confidential** and check **Must be OAuth Client**.
    
    ![OAuth client](/assets/images/select-oauth-confidential-04661aac9b33531c5c52440f2db77d63.png)
    
8.  Go to **Tokens** in the sidebar, select **Client credentials**, and set a token validity period greater than 10 minutes. Enable refresh tokens.
    
    ![Client credentials](/assets/images/select-client-creds-f7c3f869b9237a48bc6414f9b14cf997.png)
    
9.  Go to **Scope** in the sidebar and click **Add**. Name the scope `all` and set the regex to:
    
    ```text
    CDirectoryService/GetUsers|redrock/query|Roles/GetRoleMembers|SysInfo/About|UPRest/GetResultantAppsForUser|Acl/GetRowAces
    ```
    
    ![Scopes](/assets/images/select-scopes-c0e574f9a9b11f53345440ebd2518c7c.png)
    
10.  Go to **Permissions** in the sidebar, search for the service account you created in step 2, and click **Add**. Grant the **Run** permission to the service account, then click **Save**.
     
     ![Add service account](/assets/images/add-permission-91118d9f8ada8a22db3f1f4206f92d05.png)
     

### Step 3: Grant the System Administrator role

11.  In the Admin portal, navigate to **Roles** > **System Administrator**.
     
     ![Admin role](/assets/images/add-role-5fe197c818352158871f954569a3e2f1.png)
     
12.  Go to **Members** and add the service account as a member.
     
     ![Assign role](/assets/images/add-service-account-74549de992010477572f655ea12d12d1.png)
     

### Configuration in JupiterOne

To install the CyberArk Idaptive integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select CyberArk Idaptive. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the CyberArk Idaptive account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **CyberArk Idaptive instance URL** — The URL of your CyberArk Idaptive tenant, for example `https://my-tenant.id.cyberark.cloud`.
    
-   **CyberArk Idaptive Client Application Id** — The application ID you assigned when creating the OAuth2 client app (step 6 above).
    
-   **CyberArk Idaptive Service Account Username** — The username of the service account you created in step 2.
    
-   **CyberArk Idaptive Service Account Password** — The password for the service account.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cyberark_idaptive_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `cyberark_idaptive_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device | `cyberark_idaptive_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Role | `cyberark_idaptive_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Service | `cyberark_idaptive` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `cyberark_idaptive_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cyberark_idaptive_account` | **HAS** | `cyberark_idaptive_user` |
| `cyberark_idaptive_account` | **HAS** | `cyberark_idaptive_application` |
| `cyberark_idaptive_account` | **PROVIDES** | `cyberark_idaptive` |
| `cyberark_idaptive_role` | **ASSIGNED** | `cyberark_idaptive_application` |
| `cyberark_idaptive_user` | **OWNS** | `cyberark_idaptive_device` |
| `cyberark_idaptive_user` | **ASSIGNED** | `cyberark_idaptive_role` |
| `cyberark_idaptive_user` | **ASSIGNED** | `cyberark_idaptive_application` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `cyberark_idaptive_user` | **IS** | `Person` | FORWARD |

### Cyberark Idaptive

`cyberark_idaptive` inherits from [Service](/data-model/schemas/Service.md)

---

### Cyberark Idaptive Account

`cyberark_idaptive_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessURL` | `string` |  |  |
| `podFqdn` | `string` |  |  |
| `podName` | `string` |  |  |
| `podRegion` | `string` |  |  |
| `version` | `string` |  |  |

---

### Cyberark Idaptive Application

`cyberark_idaptive_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `adminTag` | `string` |  |  |
| `appType` | `string` |  |  |
| `appTypeDisplayName` | `string` |  |  |
| `authChallengeDefinitionFlowId` | `string` |  |  |
| `authChallengeDefinitionId` | `string` |  |  |
| `brand` | `string` |  |  |
| `bypassLoginMFA` | `boolean` |  |  |
| `catalogVisibility` | `string` |  |  |
| `category` | `string` |  |  |
| `certBasedAuthEnabled` | `boolean` |  |  |
| `childLinkedApps` | `string` |  |  |
| `corpIdentifier` | `string` |  |  |
| `deepLinkUrl` | `string` |  |  |
| `derivedCredsSupported` | `boolean` |  |  |
| `directoryId` | `string` |  |  |
| `entityKeys` | `array` of `string`s |  |  |
| `featured` | `boolean` |  |  |
| `generic` | `boolean` |  |  |
| `handler` | `string` |  |  |
| `icon` | `string` |  |  |
| `id` | `string` |  |  |
| `isGatewayed` | `boolean` |  |  |
| `isMarketplaceApp` | `boolean` |  |  |
| `isScaEnabled` | `boolean` |  |  |
| `isSwsEnabled` | `boolean` |  |  |
| `isTestApp` | `boolean` |  |  |
| `isThirdPartyIdpEnabled` | `boolean` |  |  |
| `lastUsedCentrifyUrl` | `string` |  |  |
| `lastUsedPodUrl` | `string` |  |  |
| `mobileAppSource` | `string` |  |  |
| `mobileAppType` | `string` |  |  |
| `munkiMetadata` | `string` |  |  |
| `notSelfService` | `boolean` |  |  |
| `onPrem` | `boolean` |  |  |
| `orgId` | `string` |  |  |
| `orgPath` | `string` |  |  |
| `parentApp` | `string` |  |  |
| `parentAppTemplateName` | `string` |  |  |
| `policyScript` | `string` |  |  |
| `popular` | `boolean` |  |  |
| `portalApp` | `boolean` |  |  |
| `provCapable` | `boolean` |  |  |
| `provConfigured` | `boolean` |  |  |
| `provSettingEnabled` | `boolean` |  |  |
| `provSettingPreview` | `boolean` |  |  |
| `provSettingsIsEnterpriseScimUser` | `string` |  |  |
| `provSettingsValidateEmailAttribute` | `string` |  |  |
| `serviceName` | `string` |  |  |
| `shadowAppLink` | `string` |  |  |
| `skipSwsForAwsCli` | `boolean` |  |  |
| `state` | `string` |  |  |
| `tableName` | `string` |  |  |
| `templateName` | `string` |  |  |
| `version` | `string` |  |  |
| `versionName` | `string` |  |  |
| `webAppLoginType` | `string` |  |  |
| `webAppType` | `string` |  |  |
| `webAppTypeDisplayName` | `string` |  |  |
| `webUPAppType` | `string` |  |  |
| `workflowEnabled` | `boolean` |  |  |

---

### Cyberark Idaptive Device

`cyberark_idaptive_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `afwDeviceId` | `string` **|** `null` |  |  |
| `agentAccount` | `string` **|** `null` |  |  |
| `amsPolicyEnforced` | `boolean` **|** `null` |  |  |
| `androidAppReleaseVersion` | `string` |  |  |
| `apps` | `string` **|** `null` |  |  |
| `availableDeviceCapacity` | `string` **|** `null` |  |  |
| `availableDeviceCapacityDisplay` | `string` **|** `null` |  |  |
| `batteryLevel` | `string` **|** `null` |  |  |
| `bytesReceivedNetwork` | `string` **|** `null` |  |  |
| `bytesReceivedWIFI` | `string` **|** `null` |  |  |
| `bytesSentNetwork` | `string` **|** `null` |  |  |
| `bytesSentWIFI` | `string` **|** `null` |  |  |
| `capabilities` | `string` |  |  |
| `carrier` | `string` **|** `null` |  |  |
| `cellularTechnology` | `string` **|** `null` |  |  |
| `clientPackageId` | `string` **|** `null` |  |  |
| `commandCountThisWeek` | `number` |  |  |
| `commandCountToday` | `number` |  |  |
| `complianceState` | `string` **|** `null` |  |  |
| `corporateOwned` | `boolean` |  |  |
| `customerID` | `string` |  |  |
| `deviceCapacity` | `string` **|** `null` |  |  |
| `deviceCapacityDisplay` | `string` **|** `null` |  |  |
| `deviceDetails` | `string` |  |  |
| `displayModelName` | `string` **|** `null` |  |  |
| `displayOsVersion` | `string` |  |  |
| `displayOwner` | `string` |  |  |
| `displayState` | `string` |  |  |
| `displayStateString` | `string` |  |  |
| `enrollmentType` | `string` |  |  |
| `entityKeys` | `array` of `string`s |  |  |
| `fileVaultStatus` | `string` **|** `null` |  |  |
| `hasNonExportableKeychainData` | `boolean` |  |  |
| `id` | `string` |  |  |
| `imei` | `string` **|** `null` |  |  |
| `internalDeviceType` | `string` |  |  |
| `ipAddress` | `string` **|** `null` |  |  |
| `isAdminLocationTrackingEnabled` | `boolean` **|** `null` |  |  |
| `jailbroken` | `number` |  |  |
| `knoxApiLevel` | `string` **|** `null` |  |  |
| `knoxContainerStatus` | `string` **|** `null` |  |  |
| `knoxLicenseActivated` | `boolean` **|** `null` |  |  |
| `knoxSdkVersion` | `string` **|** `null` |  |  |
| `knoxVersionDisplay` | `string` **|** `null` |  |  |
| `lastAttestationState` | `string` **|** `null` |  |  |
| `lastAttestationSucceeded` | `boolean` **|** `null` |  |  |
| `lastDeviceOwnerLogin` | `string` **|** `null` |  |  |
| `lastInfoReceived` | `string` |  |  |
| `lastNotify` | `string` |  |  |
| `lastUsedCentrifyUrl` | `string` **|** `null` |  |  |
| `lastUsedPodUrl` | `string` **|** `null` |  |  |
| `latitude` | `string` **|** `null` |  |  |
| `latitudeDisplay` | `string` **|** `null` |  |  |
| `locationAccuracy` | `string` **|** `null` |  |  |
| `locationTime` | `string` **|** `null` |  |  |
| `loggingCallInfo` | `string` **|** `null` |  |  |
| `loggingCarrierDataUsage` | `boolean` **|** `null` |  |  |
| `loggingSMS` | `boolean` **|** `null` |  |  |
| `longitude` | `string` **|** `null` |  |  |
| `longitudeDisplay` | `string` **|** `null` |  |  |
| `missedCallsCount` | `string` **|** `null` |  |  |
| `mobileManagerVersion` | `string` |  |  |
| `modelName` | `string` **|** `null` |  |  |
| `orgId` | `string` **|** `null` |  |  |
| `osBuild` | `string` **|** `null` |  |  |
| `osPlatform` | `string` **|** `null` |  |  |
| `ownerID` | `string` |  |  |
| `phoneNumber` | `string` **|** `null` |  |  |
| `primaryEnrolledTenant` | `string` **|** `null` |  |  |
| `primaryEnrolledUser` | `string` **|** `null` |  |  |
| `product` | `string` **|** `null` |  |  |
| `safeKeyVersion` | `string` **|** `null` |  |  |
| `safeSdkVersion` | `string` **|** `null` |  |  |
| `ssoEnabled` | `boolean` |  |  |
| `state` | `number` |  |  |
| `statusFlags` | `string` |  |  |
| `successCallsCount` | `string` **|** `null` |  |  |
| `tableName` | `string` |  |  |

---

### Cyberark Idaptive Role

`cyberark_idaptive_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `category` | `string` **|** `null` |  |  |
| `directoryServiceUuid` | `string` |  |  |
| `entityKeys` | `array` of `string`s |  |  |
| `id` | `string` |  |  |
| `isHidden` | `boolean` **|** `null` |  |  |
| `orgId` | `string` |  |  |
| `orgPath` | `string` **|** `null` |  |  |
| `readOnly` | `boolean` **|** `null` |  |  |

---

### Cyberark Idaptive User

`cyberark_idaptive_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `endDate` | `string` **|** `null` |  |  |
| `entityKeys` | `array` of `string`s |  |  |
| `homeNumber` | `string` **|** `null` |  |  |
| `id` | `string` |  |  |
| `mail` | `string` **|** `null` |  |  |
| `mobileNumber` | `string` **|** `null` |  |  |
| `officeNumber` | `string` **|** `null` |  |  |
| `pictureUri` | `string` **|** `null` |  |  |
| `preferredCulture` | `string` **|** `null` |  |  |
| `reportsTo` | `string` **|** `null` |  |  |
| `startDate` | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name accuracy for CyberArk Idaptive device entities, using human-readable names for iOS, iPadOS, tvOS, macOS, Android, and Windows devices.

---

Source: /integrations/directory/cyberark-pam

# CyberArk PAM

Visualize CyberArk PAM users, groups, safes, privileged accounts, platforms, and applications in JupiterOne. Map CyberArk users to employees, monitor safe access assignments, and track privileged account management through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within CyberArk PAM and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your CyberArk PAM environment.

### Configuration on CyberArk PAM

> **NOTE**
> 
> A CyberArk PAM user's `Base URL`, `Username`, and `Password` are required for the JupiterOne integration to interact with CyberArk PAM.

The integration authenticates using the CyberArk PAM REST API (v14.6+). An administrator of the CyberArk PAM vault will need to create or designate a user account for JupiterOne with the appropriate permissions.

To configure a CyberArk PAM user for use with JupiterOne:

1.  Log in to the CyberArk PrivateArk Client or PVWA (Password Vault Web Access).
2.  Create a new CyberArk user or designate an existing user for JupiterOne.
3.  Assign the user the following minimum vault-level authorizations:
    -   `List Accounts` — required to enumerate users and groups.
    -   `Audit Users` — required to retrieve user details.
4.  For each safe you want JupiterOne to ingest, add the JupiterOne user as a safe member with the following permission:
    -   `View Safe Members` — required to list members of a safe.
5.  Note the **Base URL** of your CyberArk PVWA instance (e.g., `https://cyberark.example.com`).

> **INFO**
> 
> The integration supports CyberArk, LDAP, RADIUS, and Windows authentication methods. The default authentication type is `Cyberark`. If your environment uses a different authentication method, you can specify it in the JupiterOne configuration.

> **NOTE**
> 
> The integration automatically appends `/PasswordVault` to the base URL if it is not already present. Do not include a trailing slash.

### Permissions

The API user requires the following permissions to ingest all supported resources:

| Resource | Required Permission |
| --- | --- |
| Users | Vault-level `List Accounts` and `Audit Users` |
| Groups | Vault-level `List Accounts` |
| Safes | Vault-level `List Accounts` |
| Safe Members | Safe-level `View Safe Members` on each target safe |
| Privileged Accounts | Safe-level `List Accounts` on each target safe |
| Platforms | Vault-level `List Accounts` |
| Applications | Vault-level `List Accounts` |

> **NOTE**
> 
> If the API user lacks permissions for a specific resource, the integration will log a warning and continue ingesting other resources rather than failing entirely.

### Configuration in JupiterOne

To install the CyberArk PAM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select CyberArk PAM. Click **New Instance** to begin configuring the integration.

Creating a CyberArk PAM instance requires the following:

-   The **Account Name** used to identify the CyberArk PAM account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the **Base URL** for your CyberArk PVWA instance (e.g., `https://cyberark.example.com`). Do not include `/PasswordVault` — it is appended automatically.
    
-   Enter the **Username** of the CyberArk user designated for JupiterOne.
    
-   Enter the **Password** for the CyberArk user designated for JupiterOne.
    
-   Optionally, enter the **Authentication Type** if your environment uses a method other than the default CyberArk authentication (e.g., `LDAP`, `RADIUS`, or `Windows`).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cyberark_pam_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `cyberark_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Group | `cyberark_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Platform | `cyberark_platform` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Privileged Account | `cyberark_privileged_account` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Safe | `cyberark_safe` | [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| User | `cyberark_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cyberark_group` | **HAS** | `cyberark_user` |
| `cyberark_group` | **ASSIGNED** | `cyberark_safe` |
| `cyberark_pam_account` | **HAS** | `cyberark_user` |
| `cyberark_pam_account` | **HAS** | `cyberark_group` |
| `cyberark_pam_account` | **HAS** | `cyberark_safe` |
| `cyberark_pam_account` | **HAS** | `cyberark_platform` |
| `cyberark_pam_account` | **HAS** | `cyberark_application` |
| `cyberark_safe` | **CONTAINS** | `cyberark_privileged_account` |
| `cyberark_user` | **ASSIGNED** | `cyberark_safe` |

## Release Notes

-   **2026-03-18** — Renamed the CyberArk PAM account entity type for consistency, aligning it with other CyberArk integration entity naming conventions.
-   **2026-03-04** — New CyberArk PAM integration: ingests users, groups, safes, privileged accounts, platforms, and applications with full access and ownership relationships.

---

Source: /integrations/directory/cyberhaven

# Cyberhaven

Visualize Cyberhaven Endpoints and monitor changes through queries and alerts.

## Installation

### Requirements

-   A Cyberhaven role carrying the `endpoint__read` permission, and an API key assigned to that role.
-   Appropriate permissions in JupiterOne to setup new integration.

---

### Configuration in Cyberhaven

#### Authentication

Cyberhaven uses token-based authentication to secure its API endpoints. To authenticate, you must first create an API key in the Cyberhaven Console and use it to generate a temporary bearer token. JupiterOne performs this exchange for you; you only supply the API key.

> **Note:** Create the role before generating the key. The role attached to the key must carry the `endpoint__read` permission, otherwise Cyberhaven rejects the request.

Refer to the Cyberhaven documentation for guidance on creating an API role: [Creating an API Role](https://docs.cyberhaven.io/24-09/docs/roles-and-scopes#creating-an-api-role)

##### Generate an API Key

1.  Navigate to **Preferences > Users and API keys**, then open the **API Keys** tab.
2.  Click **New API Key**.
3.  Provide a name to identify the API key.
4.  Select a role from the list. The role must include the `endpoint__read` permission.
5.  Specify a validity period (up to one year).
6.  Click **Save**.
7.  Copy and securely store the generated API key.

---

### Configuration in JupiterOne

1.  From the JupiterOne Search homepage, navigate to **Integrations** from the top menu.
2.  Search for **Cyberhaven**, then select it.
3.  Click **Add Instance**, then provide the following information:

-   **Cyberhaven API Key**: Use the key generated in the _Generate an API Key_ section.
-   **Cyberhaven Tenant Name**: Your tenant's subdomain only — not the full console URL. If you sign in at `https://acme.cyberhaven.io`, enter `acme`.
-   **Account Name**: A label for identifying this Cyberhaven instance in JupiterOne. If **Tag with Account Name** is enabled, this value is stored in `tag.AccountName` for all ingested entities.
-   **Description**: (Optional) A brief description to help your team identify this integration.
-   **Polling Interval**: Choose an appropriate interval for your monitoring needs. You can also select `DISABLED` to manually execute the integration.

4.  Once all values are entered, click **Create Instance**.

---

### Next Steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cyberhaven_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Endpoint | `cyberhaven_endpoint` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cyberhaven_account` | **HAS** | `cyberhaven_endpoint` |

### Cyberhaven Account

`cyberhaven_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Cyberhaven Endpoint

`cyberhaven_endpoint` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deploymentGroup` | `string` |  |  |
| `lastActiveUserId` | `string` |  |  |
| `lastActiveUsername` | `string` |  |  |
| `sensorVersion` | `string` |  |  |

---

## Release Notes

-   **2025-04-22** — New Cyberhaven integration: ingests endpoint devices and account information with host entity types.

---

Source: /integrations/directory/cycognito

# CyCognito

Visualize CyCognito assets and issues, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> For this integration, you will need to request an Access Token from an Admin on Cycognito.

To install the CyCongnito integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select CyCongnito. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the CyCongnito account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your CyCognito **Access Token**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `cycognito_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Certificate | `cycognito_asset_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Domain | `cycognito_asset_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| IP | `cycognito_asset_ip` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| Issue | `cycognito_issue` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Web App | `cycognito_asset_web_app` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `cycognito_account` | **HAS** | `cycognito_issue` |
| `cycognito_account` | **HAS** | `cycognito_asset_ip` |
| `cycognito_account` | **HAS** | `cycognito_asset_domain` |
| `cycognito_account` | **HAS** | `cycognito_asset_certificate` |
| `cycognito_account` | **HAS** | `cycognito_asset_web_app` |
| `cycognito_asset_certificate` | **HAS** | `cycognito_issue` |
| `cycognito_asset_certificate` | **HAS** | `cycognito_asset_ip` |
| `cycognito_asset_certificate` | **HAS** | `cycognito_asset_domain` |
| `cycognito_asset_domain` | **HAS** | `cycognito_issue` |
| `cycognito_asset_domain` | **HAS** | `cycognito_asset_ip` |
| `cycognito_asset_domain` | **CONTAINS** | `cycognito_asset_domain` |
| `cycognito_asset_ip` | **HAS** | `cycognito_issue` |
| `cycognito_asset_ip` | **HAS** | `cycognito_asset_domain` |
| `cycognito_asset_web_app` | **HAS** | `cycognito_issue` |
| `cycognito_issue` | **IS** | `cve` |
| `cycognito_issue` | **IS** | `cyc` |

---

Source: /integrations/directory/databricks

# Databricks

Visualize Databricks workspace groups, users, and clusters, map Databrick users to employees, and monitor changes through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within Databricks and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your Databricks account.

### Configuration in Databricks

The integration authenticates against a single Databricks workspace with a personal access token. Follow the steps for the cloud your workspace runs on to find the workspace URL, then generate the token.

#### Databricks on AWS

1.  Go to the [Databricks AWS account console](https://accounts.cloud.databricks.com/login) and log in.
2.  In the **Workspaces** section, choose the workspace you want to ingest.
3.  The workspace URL has the format `https://[deployment-name].cloud.databricks.com`, for example `https://dbc-c50dbe80-ed72.cloud.databricks.com`. Take note of it and supply it on the integration configuration page.

#### Databricks on GCP

1.  Go to the [Databricks GCP dashboard](https://accounts.gcp.databricks.com/login) and log in.
2.  In the [Workspaces section](https://accounts.gcp.databricks.com/workspaces), choose the workspace.
3.  You will be able to see the URL on the following page that has the following format: `https://[numbers].[number].gcp.databricks.com`
4.  Take note of it and supply it on the integration configuration page. For example, `https://1122334455.6.gcp.databricks.com`

#### Generating the access token

1.  Click the workspace URL to go to the workspace dashboard. Once there, click on the settings icon (bottom part of left side menu) and choose **User settings**.
2.  Click **Generate New Token**, add comment/description, and press **Generate**. Retain this for use in JupiterOne.

> **INFO**
> 
> For additional assistance generating an API Token on Databricks, see [their documentation](https://docs.databricks.com/dev-tools/auth.html#databricks-personal-access-tokens) for more information.

### Required Permissions in Databricks

The Personal Access Token must have appropriate permissions to access the following resources:

-   **Groups** (`/api/2.0/groups/list`) - to retrieve group information
-   **Group Members** (`/api/2.0/groups/list-members`) - to retrieve user memberships in groups
-   **Clusters** (`/api/2.0/clusters/list`) - to retrieve cluster configurations

**Important**: The token user must have **CAN\_ATTACH\_TO** permission on clusters to successfully retrieve cluster information. Without this permission, the cluster list will return empty results. This permission can be granted through cluster access control lists (ACLs) in the Databricks workspace settings.

### Optional: AWS configuration of a Databricks on AWS workspace

The AWS resources backing a workspace — its region, VPC, subnets, security groups, root S3 bucket, KMS keys and PrivateLink settings — are only exposed through the Databricks **account-level** API, which a personal access token cannot call: ["You can't use personal access tokens to automate Databricks account-level functionality."](https://docs.databricks.com/aws/en/dev-tools/auth/pat)

To ingest them, additionally configure an account-level service principal with an OAuth secret:

1.  Go to the [Databricks AWS account console](https://accounts.cloud.databricks.com/login) and log in as an account admin.
2.  Copy your **Account ID** from the user menu in the top right corner.
3.  Go to **User management > Service principals** and either select an existing service principal or click **Add service principal**.
4.  On the service principal's **Roles** tab, enable **Account admin**. Account-level APIs [require the service principal to be an account admin](https://docs.databricks.com/aws/en/dev-tools/auth/oauth-m2m).
5.  On the **Secrets** tab, click **Generate secret**. Retain the **Client ID** and the **Secret** — the secret is only shown once.

The service principal reads the following account-level endpoints:

-   `GET /api/2.0/accounts/{account_id}/workspaces` - to find the account record of the configured workspace
-   `GET /api/2.0/accounts/{account_id}/networks/{network_id}` - to retrieve the VPC, subnets and security groups
-   `GET /api/2.0/accounts/{account_id}/storage-configurations/{storage_configuration_id}` - to retrieve the root S3 bucket
-   `GET /api/2.0/accounts/{account_id}/credentials/{credentials_id}` - to retrieve the cross-account IAM role, which identifies the AWS account
-   `GET /api/2.0/accounts/{account_id}/customer-managed-keys/{customer_managed_key_id}` - to retrieve the KMS keys
-   `GET /api/2.0/accounts/{account_id}/private-access-settings/{private_access_settings_id}` - to retrieve the PrivateLink settings

> **NOTE**
> 
> These fields are optional. When they are left empty, the integration ingests the workspace, its groups, users and clusters exactly as before. They have no effect on workspaces hosted on GCP or Azure.

### Configuration in JupiterOne

To install the Databricks integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Databricks. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Databricks account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Databricks **Host** and **Access token**.
    
-   Optionally, for a Databricks on AWS workspace, your **Databricks Account ID**, the **Service Principal Client ID** and the **Service Principal OAuth Secret** of the account-level service principal described above.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Cluster | `databricks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Group | `databricks_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| User | `databricks_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Workspace | `databricks_workspace` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `databricks_group` | **HAS** | `databricks_user` |
| `databricks_user` | **CREATED** | `databricks_cluster` |
| `databricks_workspace` | **HAS** | `databricks_group` |
| `databricks_workspace` | **HAS** | `databricks_cluster` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `databricks_cluster` | **IS** | `aws_instance` | FORWARD |
| `databricks_workspace` | **USES** | `aws_vpc` | FORWARD |
| `databricks_workspace` | **USES** | `aws_subnet` | FORWARD |
| `databricks_workspace` | **USES** | `aws_s3_bucket` | FORWARD |
| `databricks_workspace` | **USES** | `aws_kms_key` | FORWARD |
| `databricks_workspace` | **USES** | `aws_cloudwatch` | FORWARD |
| `databricks_workspace` | **USES** | `aws_config` | FORWARD |

### Databricks Cluster

`databricks_cluster` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `autoTerminationMinutes` | `number` | The idle time in minutes after which the cluster is terminated automatically. Zero disables automatic termination. |  |
| `availabilityZone` | `string` | The AWS availability zone the cluster nodes run in, e.g. us-east-1a. Only set on clusters in a Databricks on AWS workspace. |  |
| `awsAvailability` | `string` | The AWS instance purchasing strategy of the cluster: SPOT, ON\_DEMAND or SPOT\_WITH\_FALLBACK. |  |
| `awsFirstOnDemand` | `number` | The number of cluster nodes, starting with the driver, placed on on-demand instances before spot instances are used. |  |
| `awsSpotBidPricePercent` | `number` | The maximum price for AWS spot instances, as a percentage of the on-demand price of the instance type. |  |
| `clusterCores` | `number` | The total number of CPU cores across all the nodes of the cluster. |  |
| `clusterMemoryMb` | `number` | The total memory in megabytes across all the nodes of the cluster. |  |
| `clusterSource` | `string` | What created the cluster, e.g. UI, API, JOB, PIPELINE or SQL. |  |
| `creator` | `string` | The user name of the principal that created the cluster. |  |
| `dockerImageUrl` | `string` | The URL of the custom container image the cluster runs, when Databricks Container Services is used. |  |
| `dockerRegistryUsername` | `string` | The user name the cluster authenticates to the container registry with. |  |
| `driverNodeTypeId` | `string` | The instance type of the cluster driver node. |  |
| `ebsVolumeCount` | `number` | The number of EBS volumes attached to each of the cluster nodes. |  |
| `ebsVolumeSize` | `number` | The size in GiB of each EBS volume attached to the cluster nodes. |  |
| `ebsVolumeType` | `string` | The type of the EBS volumes attached to the cluster nodes: GENERAL\_PURPOSE\_SSD or THROUGHPUT\_OPTIMIZED\_HDD. |  |
| `enableElasticDisk` | `boolean` | Whether the cluster acquires additional disk space when its workers run low on it. |  |
| `enableLocalDiskEncryption` | `boolean` | Whether the local disks attached to the cluster nodes are encrypted. |  |
| `gcpAvailability` | `string` | The GCP instance purchasing strategy of the cluster, e.g. ON\_DEMAND\_GCP or PREEMPTIBLE\_WITH\_FALLBACK\_GCP. Only set on clusters in a Databricks on GCP workspace. |  |
| `gcpZoneId` | `string` | The GCP zone the cluster nodes run in, e.g. us-central1-a, or HA/AUTO for Databricks-selected zones. Only set on clusters in a Databricks on GCP workspace. |  |
| `initScriptsSafeMode` | `boolean` | Whether the cluster runs its init scripts in safe mode, i.e. from workspace-approved locations only. |  |
| `instanceProfileArn` | `string` | The ARN of the AWS instance profile the cluster nodes assume. |  |
| `isUsePreemptibleExecutors` | `boolean` | Whether the cluster uses preemptible GCP instances for its executors. Only set on clusters in a Databricks on GCP workspace. |  |
| `maxWorkers` | `number` | The maximum number of worker nodes the cluster autoscales up to. Only set on autoscaling clusters. |  |
| `minWorkers` | `number` | The minimum number of worker nodes the cluster autoscales down to. Only set on autoscaling clusters. |  |
| `nodeTypeId` | `string` | The instance type of the cluster worker nodes, e.g. m5d.large. |  |
| `numWorkers` | `number` | The number of worker nodes of the cluster. |  |
| `sparkVersion` | `string` | The Databricks Runtime version of the cluster, e.g. 13.3.x-scala2.12. |  |
| `state` | `string` | The current state of the cluster, e.g. PENDING, RUNNING, TERMINATED. |  |
| `stateMessage` | `string` | A message describing the most recent state transition of the cluster. |  |
| `terminatedOn` | `number` | The timestamp in milliseconds since epoch when the cluster was last terminated. |  |
| `terminationReasonCode` | `string` | The code of the reason the cluster was last terminated, e.g. INACTIVITY or USER\_REQUEST. |  |
| `terminationReasonType` | `string` | The category of the reason the cluster was last terminated: SUCCESS, CLIENT\_ERROR, SERVICE\_FAULT or CLOUD\_FAILURE. |  |

---

### Databricks Workspace

`databricks_workspace` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowedVpcEndpointIds` | `array` **|** `null` | The Databricks VPC endpoint identifiers allowed to connect to the workspace over AWS PrivateLink. |  |
| `awsAccountId` | `string` **|** `null` | The AWS account hosting the workspace data plane, taken from the cross-account IAM role Databricks assumes. |  |
| `awsRegion` | `string` **|** `null` | The AWS region the workspace data plane is deployed in, e.g. us-east-1. |  |
| `cloud` | `string` | The cloud the workspace data plane runs on: aws, azure or gcp. |  |
| `computeMode` | `string` | The compute mode of the workspace: HYBRID or SERVERLESS. |  |
| `crossAccountRoleArn` | `string` **|** `null` | The ARN of the cross-account IAM role Databricks assumes to manage the workspace data plane. |  |
| `databricksAccountId` | `string` | The identifier of the Databricks account the workspace belongs to. |  |
| `deploymentName` | `string` | The subdomain component of the workspace URL, e.g. dbc-c50dbe80-ed72. |  |
| `encryptionKeyRef` | `string` **|** `null` | The ARN of the AWS KMS key encrypting the workspace root storage, falling back to the managed services key. |  |
| `isEncrypted` | `boolean` | Whether the workspace is configured with a customer-managed key for either its storage or its managed services. |  |
| `isManagedServicesEncrypted` | `boolean` | Whether the workspace managed services (notebooks, secrets) are encrypted with a customer-managed key. |  |
| `isPrivateEndpointEnabled` | `boolean` **|** `null` | Whether the workspace is only reachable over AWS PrivateLink, i.e. public access is explicitly disabled in its private access settings. |  |
| `isStorageEncrypted` | `boolean` | Whether the workspace root storage is encrypted with a customer-managed key. |  |
| `pricingTier` | `string` | The pricing tier (SKU) of the workspace: COMMUNITY\_EDITION, STANDARD, PREMIUM, ENTERPRISE or DEDICATED. |  |
| `privateAccessLevel` | `string` **|** `null` | Which VPC endpoints may connect to the workspace: ACCOUNT or ENDPOINT. |  |
| `s3BucketName` | `string` **|** `null` | The name of the S3 bucket backing the workspace root storage. |  |
| `securityGroupIds` | `array` **|** `null` | The identifiers of the AWS security groups attached to the workspace data plane. |  |
| `storageMode` | `string` | The storage mode of the workspace: CUSTOMER\_HOSTED or DEFAULT\_STORAGE. |  |
| `subnetIds` | `array` **|** `null` | The identifiers of the AWS subnets the workspace data plane runs in. |  |
| `vpcEndpointIds` | `array` **|** `null` | The Databricks VPC endpoint configuration identifiers registered for the workspace network, covering both the REST API and the data plane relay. |  |
| `vpcId` | `string` **|** `null` | The identifier of the AWS VPC hosting the workspace data plane. |  |
| `vpcStatus` | `string` **|** `null` | The status of the workspace network configuration: VALID, BROKEN, UNATTACHED or WARNED. |  |
| `workspaceId` | `string` **|** `null` | The Databricks-assigned identifier of the workspace, e.g. 6280049833385130. |  |

---

## Release Notes

-   **2022-02-09** — New Databricks integration: ingests workspaces, users, groups, and clusters, providing visibility into Databricks compute environments and access configurations.

---

Source: /integrations/directory/datadog

# Datadog

Visualize Datadog services and users, and monitor changes to Datadog users through queries and alerts.

## Installation

Before setting up the integration within JupiterOne, you will need to create an API key and Application key in Datadog.

1.  **To create your API key**: navigate to your [Datadog organization's API keys](https://app.datadoghq.com/organization-settings/api-keys) and select **New Key**.

> **NOTE**
> 
> Your account must have the Datadog Admin Role to generate an API key.

2.  **To create an application key**: navigate to your [Datadog organization's application keys](https://app.datadoghq.com/organization-settings/application-keys) and select **New Key**. Required scopes:

-   `user_access_read`
-   `hosts_read`
-   `org_management`

### Configuration in JupiterOne

To install the Datadog integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Datadog. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Datadog account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Datadog **API Key**, **Application Key**, and your **Datadog email** (the email associated with your Datadog account).
    
-   Optionally, enter the Datadog **Host** and **Datadog Organization ID** for your organization. You can find this by sending a GET request to the endpoint listed at [https://docs.datadoghq.com/api/latest/organizations/#list-your-managed-organizations](https://docs.datadoghq.com/api/latest/organizations/#list-your-managed-organizations).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `datadog_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Host | `datadog_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Role | `datadog_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| User | `datadog_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `datadog_account` | **HAS** | `datadog_user` |
| `datadog_account` | **HAS** | `datadog_role` |
| `datadog_account` | **HAS** | `datadog_host` |
| `datadog_user` | **ASSIGNED** | `datadog_role` |

### Datadog Account

`datadog_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Datadog Host

`datadog_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentVersion` | `string` |  |  |
| `aliases` | `array` of `string`s |  |  |
| `apps` | `array` of `string`s |  |  |
| `awsName` | `string` |  |  |
| `hostCpuCores` | `number` |  |  |
| 
`id` \*

 | `string` |  |  |
| `isMuted` | `boolean` |  |  |
| `machine` | `string` |  |  |
| `name` | `string` |  |  |
| `platform` | `string` |  |  |
| `processor` | `string` |  |  |
| `pythonVersion` | `string` |  |  |
| `reportedOn` | `number` |  |  |
| `socketFqdn` | `string` |  |  |
| `socketHostname` | `string` |  |  |
| `sources` | `array` of `string`s |  |  |
| `state` | `string` |  |  |

---

### Datadog Role

`datadog_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` |  |  |
| `modifiedAt` | `number` |  |  |
| `userCount` | `number` |  |  |

---

### Datadog User

`datadog_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `disabled` | `boolean` |  |  |
| `icon` | `string` |  |  |
| `verified` | `boolean` |  |  |

---

## Release Notes

-   **2022-11-17** — Added host entity ingestion to the Datadog integration, enabling visibility into monitored infrastructure hosts and their properties.
-   **2021-11-17** — New Datadog integration: ingests account information, users, and roles, enabling identity and access visibility for Datadog organizations.

---

Source: /integrations/directory/datastax

# DataStax

Visualize DataStax Astra organizations, users, roles, databases, and access, map DataStax Astra users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to create a custom role in DataStax and a TOKEN key.

### Configuration DataStax

From within the DataStax dashboard, you will fist need to create a custom role. To do so:

1.  Navigate to **Current Organization > Organization Settings > Role Management** and select **Add Custom Role**.
2.  Provide a name for the custom role and check the following roles:

-   `View DB`
-   `Read IP Access List`
-   `Read User`
-   `Read Organization`
-   `Read Custom Role`

3.  Enable **Apply permissions to all databases in this organization**
4.  Click **Create Role** and navigate to **Token Management**.
5.  Under **Select Role**, choose the role you just created, and press **Save**.

> **INFO**
> 
> For additional information regarding DataStax user permissions, token generation, and custom roles, [see DataStax's documentation](https://docs.datastax.com/en/astra-serverless/docs/getting-started/gs-grant-user-access.html).

### Configuration in JupiterOne

To install the DataStax integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select DataStax. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the DataStax account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your DataStax **Organization name** and **Token**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Access List | `datastax_access_list` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Access List Address | `datastax_access_list_address` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Access Role | `datastax_access_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Database | `datastax_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Organization | `datastax_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| User | `datastax_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `datastax_access_list` | **HAS** | `datastax_access_list_address` |
| `datastax_database` | **ASSIGNED** | `datastax_access_list` |
| `datastax_organization` | **HAS** | `datastax_database` |
| `datastax_organization` | **HAS** | `datastax_access_list` |
| `datastax_organization` | **HAS** | `datastax_user` |
| `datastax_user` | **ASSIGNED** | `datastax_access_role` |

### Datastax User

`datastax_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |

---

---

Source: /integrations/directory/defender-endpoint

# Microsoft Defender for Endpoint

Visualize Microsoft Defender for Endpoint resources, map Defender users to employees, and monitor changes through queries and alerts.

## Installation

To use this integration, you must have:

-   An Azure account with an App Registration that provides credentials for JupiterOne to authenticate with Microsoft Graph and Microsoft Defender for Endpoint APIs.
-   An Active Directory tenant to target for data ingestion. The tenant can be the same one that hosts the App Registration or a separate one.
-   A Microsoft Defender for Endpoint subscription that includes the devices and vulnerability data you want to ingest.

### Configuration in Microsoft Defender for Endpoint

**In the Azure Portal — create the App Registration**

1.  Navigate to **App Registrations**.
2.  Click **New registration**.
3.  Enter a name for the app (for example, `JupiterOne`).
4.  Select the supported account type for your organization.
5.  Click **Register**.

#### Add API permissions

In your new app registration, go to **API permissions** under **Manage** in the left panel.

1.  If the app already has the `User.Read` permission, remove it — it is not needed for this integration.
2.  Click **Add a permission** > **Microsoft Graph**.
3.  Select **Application permissions** and add:
    -   `Organization.Read.All`
    -   `Directory.Read.All`
4.  Click **Add permissions**.
5.  Click **Add a permission** again.
6.  Under **APIs my organization uses**, search for `WindowsDefenderATP` and click the result.
7.  Select **Application permissions** and add:
    -   `Machine.Read.All`
    -   `User.Read.All`
    -   `Vulnerability.Read.All`
8.  Click **Add permissions**.
9.  Click **Grant admin consent** and confirm.

**Create a client secret**

1.  In your app registration, click **Certificates & secrets**.
2.  Under **Client secrets**, click **New client secret**.
3.  Add a description and choose an expiration that fits your secret-rotation policy.
4.  Click **Add**.
5.  Copy the **Value** immediately using the copy icon — the full value is not shown again after you navigate away.

##### API permissions reference

**Microsoft Graph**

| Permission | Purpose |
| --- | --- |
| `Organization.Read.All` | Read organization information; required to create the Account entity |
| `Directory.Read.All` | Read directory data; required to create User entities |

**WindowsDefenderATP**

| Permission | Purpose |
| --- | --- |
| `Machine.Read.All` | Read device information; required to create Device and Endpoint entities |
| `User.Read.All` | Read user profiles; required to create logon-user entities |
| `Vulnerability.Read.All` | Read Threat and Vulnerability Management data; required to create Vulnerability and Finding entities |

## Configuration in JupiterOne

Navigate to the **Integrations** tab, select **Microsoft Defender for Endpoint**, and click **New Instance**.

Creating an instance requires the following credentials from your Azure App Registration:

-   **Application (client) ID** — The application client ID created for JupiterOne, used to authenticate with Azure. Find this on your App Registration's **Overview** tab.
    
-   **Directory (tenant) ID** — The tenant ID of the Active Directory to target in Azure API requests. Also found on your App Registration's **Overview** tab.
    
-   **Application (client) Secret** — The client secret value you copied in the previous step. This field is masked after entry; paste the value before closing the Azure Portal tab.
    

Click **Create** to finish.

### Next steps

Once configured, the integration will run on the polling interval you set, populating data in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) for more on managing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (5)

-   `AdvancedQuery.Read.All`
-   `Machine.Read.All`
-   `Organization.Read.All`
-   `User.Read.All`
-   `Vulnerability.Read.All`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (6)

-   `https://api.securitycenter.microsoft.com/api/advancedqueries/run`
-   `https://api.securitycenter.microsoft.com/api/machines`
-   `https://api.securitycenter.microsoft.com/api/machines/{machineId}/logonusers`
-   `https://api.securitycenter.microsoft.com/api/machines/{machineId}/vulnerabilities`
-   `https://graph.microsoft.com/v1.0/organization`
-   `https://graph.microsoft.com/v1.0/users`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (10)

-   [https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-create-app-webapp](https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-create-app-webapp)
-   [https://learn.microsoft.com/en-us/defender-endpoint/api/get-discovered-vulnerabilities](https://learn.microsoft.com/en-us/defender-endpoint/api/get-discovered-vulnerabilities)
-   [https://learn.microsoft.com/en-us/defender-endpoint/api/get-machine-log-on-users](https://learn.microsoft.com/en-us/defender-endpoint/api/get-machine-log-on-users)
-   [https://learn.microsoft.com/en-us/defender-endpoint/api/get-machines](https://learn.microsoft.com/en-us/defender-endpoint/api/get-machines)
-   [https://learn.microsoft.com/en-us/defender-endpoint/api/run-advanced-query-api](https://learn.microsoft.com/en-us/defender-endpoint/api/run-advanced-query-api)
-   [https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table](https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table)
-   [https://learn.microsoft.com/en-us/graph/api/organization-get](https://learn.microsoft.com/en-us/graph/api/organization-get)
-   [https://learn.microsoft.com/en-us/graph/api/user-list](https://learn.microsoft.com/en-us/graph/api/user-list)
-   [https://learn.microsoft.com/en-us/graph/permissions-reference#organizationreadall](https://learn.microsoft.com/en-us/graph/permissions-reference#organizationreadall)
-   [https://learn.microsoft.com/en-us/graph/permissions-reference#userreadall](https://learn.microsoft.com/en-us/graph/permissions-reference#userreadall)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Build Endpoint Has Vulnerability Relationships | \- | \- |
| Fetch Endpoints | `AdvancedQuery.Read.All` | `https://api.securitycenter.microsoft.com/api/advancedqueries/run` |
| Fetch Logon Users | `Machine.Read.All`, `AdvancedQuery.Read.All` | `https://api.securitycenter.microsoft.com/api/machines/{machineId}/logonusers`, `https://api.securitycenter.microsoft.com/api/advancedqueries/run` |
| Fetch Vulnerabilities | `Vulnerability.Read.All`, `AdvancedQuery.Read.All` | `https://api.securitycenter.microsoft.com/api/machines/{machineId}/vulnerabilities`, `https://api.securitycenter.microsoft.com/api/advancedqueries/run` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `microsoft_defender_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device/Machine/Host | `microsoft_defender_user_endpoint` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Logon User | `microsoft_defender_logon_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Machine | `microsoft_defender_machine` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| User | `microsoft_defender_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `microsoft_defender_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Vulnerability | `microsoft_defender_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `microsoft_defender_account` | **HAS** | `microsoft_defender_user` |
| `microsoft_defender_account` | **HAS** | `microsoft_defender_machine` |
| `microsoft_defender_machine` | **PROTECTS** | `microsoft_defender_user_endpoint` |
| `microsoft_defender_machine` | **IDENTIFIED** | `microsoft_defender_vulnerability` |
| `microsoft_defender_machine` | **HAS** | `microsoft_defender_logon_user` |
| `microsoft_defender_user_endpoint` | **HAS** | `microsoft_defender_vulnerability` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `microsoft_defender_user_endpoint` | **IS** | `aws_instance` | FORWARD |

### Microsoft Defender Account

`microsoft_defender_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `defaultDomain` | `string` |  |  |
| `organizationName` | `string` **|** `null` |  |  |
| `verifiedDomains` | `array` of `string`s |  |  |

---

### Microsoft Defender Logon User

`microsoft_defender_logon_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `domain` | `string` **|** `null` |  |  |
| `firstSeenOn` | `number` |  |  |
| `lastSeenOn` | `number` |  |  |
| 
`logonTypes` \*

 | `string` |  |  |

---

### Microsoft Defender Machine

`microsoft_defender_machine` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`aadDeviceId` \*

 | `string` **|** `null` |  |  |
| 

`agentVersion` \*

 | `string` |  |  |
| 

`computerDnsName` \*

 | `string` |  |  |
| 

`defenderAvStatus` \*

 | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| 

`ipAddress` \*

 | `array` of `string`s |  |  |
| 

`macAddress` \*

 | `array` of `string`s |  |  |
| 

`machineTags` \*

 | `array` of `string`s |  |  |
| 

`managedBy` \*

 | `string` |  |  |
| 

`managedByStatus` \*

 | `string` |  |  |
| 

`onboardingStatus` \*

 | `string` |  |  |
| 

`rbacGroupId` \*

 | `number` |  |  |
| 

`rbacGroupName` \*

 | `string` **|** `null` |  |  |
| 

`riskScore` \*

 | `string` |  |  |

---

### Microsoft Defender User

`microsoft_defender_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `businessPhones` | `array` of `string`s |  |  |
| `givenName` | `string` **|** `null` |  |  |
| `jobTitle` | `string` **|** `null` |  |  |
| `mail` | `string` **|** `null` |  |  |
| `mobilePhone` | `string` **|** `null` |  |  |
| `officeLocation` | `string` **|** `null` |  |  |
| `preferredLanguage` | `string` **|** `null` |  |  |
| `surname` | `string` **|** `null` |  |  |
| `userPrincipalName` | `string` **|** `null` |  |  |

---

### Microsoft Defender User Endpoint

`microsoft_defender_user_endpoint` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`aadDeviceId` \*

 | `string` **|** `null` |  |  |
| 

`agentVersion` \*

 | `string` |  |  |
| `cloudProvider` | `string` |  |  |
| 

`computerDnsName` \*

 | `string` |  |  |
| 

`defenderAvStatus` \*

 | `string` |  |  |
| 

`deviceValue` \*

 | `string` |  |  |
| 

`exposureLevel` \*

 | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| 

`healthStatus` \*

 | `string` |  |  |
| 

`ipAddress` \*

 | `array` of `string`s |  |  |
| 

`ipAddresses` \*

 | `array` of `string`s |  |  |
| 

`isAadJoined` \*

 | `boolean` **|** `null` |  |  |
| 

`lastExternalIpAddress` \*

 | `string` |  |  |
| 

`lastIpAddress` \*

 | `string` |  |  |
| 

`macAddress` \*

 | `array` of `string`s |  |  |
| 

`machineTags` \*

 | `array` of `string`s |  |  |
| 

`managedBy` \*

 | `string` |  |  |
| 

`managedByStatus` \*

 | `string` |  |  |
| 

`onboardingStatus` \*

 | `string` |  |  |
| 

`osArchitecture` \*

 | `string` |  |  |
| 

`osBuild` \*

 | `number` **|** `null` |  |  |
| 

`osPlatform` \*

 | `string` |  |  |
| `osProcessor` | `string` |  |  |
| 

`rbacGroupId` \*

 | `number` |  |  |
| 

`rbacGroupName` \*

 | `string` **|** `null` |  |  |
| `resourceId` | `string` |  |  |
| 

`riskScore` \*

 | `string` |  |  |
| `status` | `string` |  |  |
| `subscriptionId` | `string` |  |  |
| `vmId` | `string` |  |  |

---

### Microsoft Defender Vulnerability

`microsoft_defender_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cveSupportability` | `string` | Whether Defender Vulnerability Management supports the CVE (Supported, Not Supported, SupportedInPremium). |  |
| `cvssVector` | `string` | CVSS vector string used to derive the score. |  |
| 
`exposedMachines` \*

 | `number` | Number of devices exposed to the vulnerability. On the Advanced Hunting path this counts only devices ingested into JupiterOne. |  |
| 

`id` \*

 | `string` | Defender vulnerability id (the CVE id). |  |
| `publishedOn` | `number` | Date the vulnerability was published. |  |

---

### Microsoft Defender Vulnerability

`microsoft_defender_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`blocking` \*

 | `boolean` | Whether the finding should block a production deploy. Always false. |  |
| `cveSupportability` | `string` | Whether Defender Vulnerability Management supports the CVE (Supported, Not Supported, SupportedInPremium). |  |
| `cvssVector` | `string` | CVSS vector string used to derive the score. |  |
| 

`exposedMachines` \*

 | `number` | Number of devices exposed to the vulnerability. |  |
| 

`id` \*

 | `string` | Defender vulnerability id. |  |
| `publishedOn` | `number` | Date the vulnerability was published. |  |

---

## Release Notes

-   **2026-04-08** — Improved OS data model accuracy for Microsoft Defender endpoint entities.
-   **2026-04-01** — Added mapped relationships from Microsoft Defender endpoints to AWS EC2 instances, enabling cross-cloud device correlation.
-   **2026-03-05** — Added optional Advanced Hunting API enrichment to link Microsoft Defender endpoints with cloud resource identifiers from AWS and GCP.
-   **2025-12-02** — Added CVSS vector string and CVE supportability properties to Microsoft Defender vulnerability and finding entities.
-   **2025-09-11** — Added relationships linking Azure virtual machines to their corresponding Microsoft Defender endpoint data.
-   **2025-06-04** — Microsoft Defender endpoint vulnerability entities now support both the Vulnerability and Finding entity classes for improved data model compatibility.

---

Source: /integrations/directory/defense-storm

# DefenseStorm

Visualize DefenseStorm GRID network assets and users, map devices to their owners, and monitor changes through queries and alerts.

## Installation

To set up this integration, you will need to generate an API token from your DefenseStorm GRID console and provide the resulting credentials to JupiterOne.

### Configuration in DefenseStorm

DefenseStorm GRID authenticates API requests using an **API Key** and an **API Secret** obtained from an _Input Token_. These credentials must belong to a user account with sufficient permissions to read assets and users.

**To generate an API token:**

1.  Log in to your [DefenseStorm GRID console](https://console.defensestorm.com).
2.  Navigate to **Settings** in the left-hand menu.
3.  Select **Input Tokens** at the top of the Settings page.
4.  Click **Get API Token** in the top-right corner of the Input Tokens page.
5.  Record the **Key** and **Secret** values that are displayed — you will need both to configure the JupiterOne integration.

> **WARNING**
> 
> The API Secret is only shown once. Store it securely before closing the dialog.

> **INFO**
> 
> The API token must be associated with a user account that has read access to the resources you intend to ingest (assets and/or users). Tokens tied to restricted accounts may result in empty or partial data ingestion.

### Configuration in JupiterOne

To install the DefenseStorm integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select DefenseStorm. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the DefenseStorm account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your DefenseStorm **API Key** and **API Secret** obtained from the Input Tokens page in GRID Settings.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `defense_storm_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `defense_storm_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| User | `defense_storm_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `defense_storm_account` | **HAS** | `defense_storm_device` |
| `defense_storm_account` | **HAS** | `defense_storm_user` |

### Defense Storm Account

`defense_storm_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Defense Storm Device

`defense_storm_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`dataLastSentOn` \*

 | `number` **|** `null` |  |  |
| `importance` | `string` |  |  |
| `labels` | `array` of `string`s |  |  |
| `observedHostnames` | `array` of `string`s |  |  |
| `owner` | `string` |  |  |
| `softwareNames` | `array` of `string`s |  |  |
| `tag` | `string` |  |  |
| 

`tracked` \*

 | `boolean` |  |  |

---

### Defense Storm User

`defense_storm_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authorizedOrgIds` | `array` of `string`s |  |  |
| `dataRestrictionId` | `string` |  |  |
| 
`google2faEnabled` \*

 | `boolean` |  |  |
| `orgId` | `string` |  |  |
| `phoneNumber` | `string` |  |  |
| `roleId` | `string` |  |  |
| `shortName` | `string` |  |  |
| 

`u2fEnabled` \*

 | `boolean` |  |  |

---

## Release Notes

-   **2026-02-25** — New DefenseStorm integration: ingests devices and users, linking them to the DefenseStorm account for security monitoring visibility.

---

Source: /integrations/directory/dell-asset-management

# Dell Asset Management

JupiterOne's integration with Dell Asset Management collects hardware inventory and warranty entitlement data from the Dell TechDirect API, providing visibility into your Dell device fleet and the support coverage attached to each asset.

## Installation

For this integration, you will need:

-   A set of Dell **TechDirect API** OAuth credentials — a **Client ID** and **Client Secret** for the TechDirect Asset/Entitlement API. Register at [tdm.dell.com](https://tdm.dell.com) to obtain them. See the [Dell developer portal](https://developer.dell.com/apis) for API documentation.
-   A **CSV file containing the Dell service tags** you want to enrich. The integration looks up warranty and entitlement data for each tag against the TechDirect `/PROD/sbil/eapi/v5/asset-entitlements` endpoint.

> **INFO**
> 
> The integration enriches a customer-supplied list of service tags — it does not auto-discover newly purchased hardware. Re-upload the CSV when new devices ship to bring them into JupiterOne.

### Service tags CSV format

The **Service Tags (CSV)** field accepts either of the following formats:

-   **One service tag per line**, with no header row:
    
    ```text
    ABC1234
    DEF5678
    GHI9012
    ```
    
-   **A CSV with a header row** containing a `serviceTag` column. The header match is case-insensitive, and `service_tag` and `Service Tag` are also accepted. Any extra columns are ignored:
    
    ```csv
    serviceTag,owner,location
    ABC1234,Alice,Boston
    DEF5678,Bob,New York
    ```
    

Tags are automatically trimmed, uppercased, and deduplicated. Blank rows are skipped. A multi-column file that does not contain a recognized service-tag header column is rejected with a configuration error, to avoid silently treating the header row as data.

### Configuration in JupiterOne

To install the Dell Asset Management integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Dell Asset Management. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Dell account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **TechDirect Client ID**: the OAuth client ID for the Dell TechDirect Asset/Entitlement API.
    
-   **TechDirect Client Secret**: the OAuth client secret for the Dell TechDirect API.
    
-   **Service Tags (CSV)**: upload the CSV file containing the Dell service tags to enrich.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (1)

-   `/PROD/sbil/eapi/v5/asset-entitlements`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (2)

-   [https://developer.dell.com/apis](https://developer.dell.com/apis)
-   [https://tdm.dell.com](https://tdm.dell.com)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `dell_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `dell_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Entitlement | `dell_entitlement` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `dell_account` | **HAS** | `dell_device` |
| `dell_device` | **HAS** | `dell_entitlement` |

### Dell Account

`dell_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`clientId` \*

 | `string` | The Dell TechDirect OAuth client ID used as the stable identifier for this customer account. |  |

---

### Dell Device

`dell_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`countryCode` \*

 | `string` **|** `null` | The ISO 3166-1 alpha-2 country code recorded for the device shipment. |  |
| 

`productCode` \*

 | `string` **|** `null` | The internal Dell product/SKU code describing the device configuration. |  |
| 

`productFamily` \*

 | `string` **|** `null` | The product family grouping reported by TechDirect (e.g. Latitude, PowerEdge). |  |
| 

`productLineDescription` \*

 | `string` **|** `null` | The human-readable product line description (e.g. Latitude 5440, OptiPlex 7010). |  |
| 

`serviceTag` \*

 | `string` | The Dell service tag — the unique hardware identifier printed on the device chassis. |  |
| 

`shippedOn` \*

 | `number` **|** `null` | The date the device shipped from Dell, as a Unix timestamp in milliseconds. |  |

---

### Dell Entitlement

`dell_entitlement` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`endsOn` \*

 | `number` **|** `null` | The date this entitlement expires, as a Unix timestamp in milliseconds. |  |
| 

`entitlementType` \*

 | `string` **|** `null` | The category of entitlement (e.g. INITIAL, EXTENDED, UPGRADE) as reported by TechDirect. |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the entitlement is currently active (derived: endsOn is in the future). Null when end date is unknown. |  |
| 

`itemNumber` \*

 | `string` | The TechDirect-assigned item number identifying this entitlement record within the device. |  |
| 

`serviceLevelCode` \*

 | `string` **|** `null` | The Dell service level code identifying the support plan (e.g. ND, PR, KD). |  |
| 

`serviceLevelDescription` \*

 | `string` **|** `null` | The human-readable description of the service level (e.g. ProSupport Next Business Day). |  |
| 

`serviceLevelGroup` \*

 | `number` **|** `null` | The numeric grouping that Dell uses internally to bucket related service levels. |  |
| 

`serviceTag` \*

 | `string` | The service tag of the device this entitlement covers. |  |
| 

`startsOn` \*

 | `number` **|** `null` | The date this entitlement becomes effective, as a Unix timestamp in milliseconds. |  |

---

## Release Notes

-   **2026-05-18** — Added initial Dell Asset Management integration, ingesting device assets and their service entitlements.

---

Source: /integrations/directory/detectify

# Detectify

Visualize Detectify scan reports and monitor changes through queries and alerts.

## Installation

The integration connects directly to [Detectify REST API](https://developer.detectify.com/) to obtain application scan assets, reports, and findings. By default, it only ingests finding from the past 30 days. If you have an Enterprise Plan with Detectify, the configuration can be changed to ingest finding from the latest scan reports.

> **INFO**
> 
> For this integration, you will need to create an API Key key on Detectify. See [their documentation](https://support.detectify.com/support/solutions/articles/48001061878-how-to-set-up-the-detectify-api) for more information.

## Configuration in JupiterOne

To install the Detectify integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Detectify. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Detectify account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Detectify **API Key**, configured for read access.
    

Click **Create** once all values are provided to finalize the integration.

## Data Volume Configuration

The Detectify integration provides configuration options to control the volume of data ingested into JupiterOne:

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| Get findings from the latest scans | This option requires Enterprise Plan from Detectify. When enabled, the integration will pull findings only from the latest scan reports. When disabled, the integration will pull all findings within the last 30 days. | Disabled (pulls findings from last 30 days) | Enable to pull only latest scan findings (requires Enterprise Plan) |

### Configuration in JupiterOne

The JupiterOne vulnerability management and scanner integration is built on this high level data model:

```text

Vendor   - HOSTS    ->       Account
Account  - PROVIDES ->       Service (*)
Service  - SCANS or TESTS -> <Entity> (*)
<Entity> - HAS      ->       Finding
```

> (\*) Examples:
> 
> -   `Service` (E.g., SAST, DAST, IAST, MAST, PenTest, etc.)
> -   `<Entity>` (E.g., Application, Host, or Device)

Optionally, the following is added when each scan/assessment/report is also tracked by the integration:

```text

Service    - PERFORMS   -> Assessment
Assessment - IDENTIFIED -> Finding
```

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `detectify_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Asset (Domain) | `web_app_domain` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Asset (Subdomain) | `web_app_endpoint` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| Finding | `detectify_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Scan Profile | `detectify_scan_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Service | `detectify_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `detectify_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `detectify_account` | **PROVIDES** | `detectify_service` |
| `detectify_account` | **HAS** | `web_app_domain` |
| `detectify_account` | **HAS** | `detectify_user` |
| `detectify_service` | **SCANS** | `web_app_domain` |
| `web_app_domain` | **HAS** | `web_app_endpoint` |
| `web_app_domain` | **HAS** | `detectify_scan_profile` |
| `web_app_endpoint` | **HAS** | `detectify_finding` |

### Detectify Finding

`detectify_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` |  |  |
| 

`cvss2Score` \*

 | `number` **|** `null` |  |  |
| 

`cvss2Vector` \*

 | `string` **|** `null` |  |  |
| 

`cvss31Score` \*

 | `number` **|** `null` |  |  |
| 

`cvss31Vector` \*

 | `string` **|** `null` |  |  |
| 

`cvss3Score` \*

 | `number` **|** `null` |  |  |
| 

`cvss3Vector` \*

 | `string` **|** `null` |  |  |
| 

`details` \*

 | `array` **|** `null` |  |  |
| 

`endpoint` \*

 | `string` **|** `null` |  |  |
| 

`references` \*

 | `array` **|** `null` |  |  |
| 

`score` \*

 | `number` **|** `null` |  |  |
| 

`vector` \*

 | `string` **|** `null` |  |  |

---

### Detectify User

`detectify_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authentication` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `lastLoginOn` | `number` |  |  |
| `role` | `string` |  |  |
| `userToken` | `string` |  |  |

---

## Release Notes

-   **2025-06-06** — Added CVSS v2, v3, and v3.1 score and vector properties to Detectify finding entities for vulnerability severity assessment.

---

Source: /integrations/directory/device42

# Device42

Visualize Device42 users and devices and monitor changes through queries and alerts.

## Installation

For this integration, you will need to create a new user in Device42.

### Configuration in Device42

1.  In the Device42 Console, navigate to **Tools > Administrators**.
2.  Click **Add Local Admin** in the top right corner.
3.  Create a username and password for the new user. Save these for use in the integration configuration in JupiterOne.
4.  Click **Save** in the bottom right corner.
5.  On the next screen under **Permissions**, make sure the user is Active. We recommend disabling **Staff status** and **Superuser status** to ensure the user can only access the API.
6.  Under Groups add **System Generated Read Only**.
7.  Click the **Save** button in the bottom right corner.

### Required Permissions in Device42

The user must be assigned to the **System Generated Read Only** group to provide read-only access to the following API endpoints:

-   **End Users** (`/api/1.0/endusers/`) - to retrieve end user information
-   **Devices** (`/api/1.0/devices/all/`) - to retrieve device inventory and configurations

The integration uses HTTP Basic authentication or Bearer token authentication. No write or modification permissions are required.

> **INFO**
> 
> Refer to [Device42's documentation](https://docs.device42.com/tools/add-an-active-directory-user-as-a-device42-administrator/) for additional assistance creating a user.

### Configuration in JupiterOne

To install the Device42 integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Device42. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Device42 account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the **username** and **password** for the Device42 account and the **hostname** for your Device42 instance.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `device42_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `device42_device` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| End User | `device42_enduser` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `device42_account` | **HAS** | `device42_enduser` |
| `device42_account` | **HAS** | `device42_device` |

### Device42 Account

`device42_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Device42 Device

`device42_device` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `customer` | `string` |  |  |
| `inService` | `boolean` |  |  |
| `ipAddress` | `array` of `string`s |  |  |
| `macAddress` | `array` of `string`s |  |  |
| `serviceLevel` | `string` |  |  |
| `switch` | `string` |  |  |
| `type` | `string` |  |  |
| `uuid` | `string` |  |  |

---

### Device42 Enduser

`device42_enduser` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeDirectoryUsername` | `string` |  |  |
| `contact` | `string` |  |  |
| `domain` | `string` |  |  |
| `notes` | `string` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name, type, and version details for Device42 device entities.
-   **2026-02-27** — Added support for custom CA certificates in the Device42 integration configuration, enabling secure connections to instances with internal or self-signed certificates.

---

Source: /integrations/directory/digicert

# DigiCert

Visualize DigiCert users and certificates, map certificates to domains, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> For this integration, you will need to create an API key on DigiCert. See [their documentation](https://www.digicert.com/rest-api/) for more information.

### Configuration in JupiterOne

To install the DigiCert integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select DigiCert. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the DigiCert account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your DigiCert **API URL** (optional), with `/services/v2` at the end. This defaults to the US-based DigiCert instance if left blank. For regional instances (such as Europe), enter the appropriate regional API URL. You can identify the Europe instance if your CertCentral console displays "CertCentral Europe" in the top left corner.
    
-   Your DigiCert **API Key**, configured for read access.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `digicert_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| CertificateNote | `digicert_certificate_note` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| User | `digicert_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User | `digicert_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `digicert_account` | **HAS** | `digicert_user` |
| `digicert_account` | **HAS** | `digicert_certificate` |
| `digicert_certificate` | **HAS** | `digicert_certificate_note` |

### Digicert Certificate Note

`digicert_certificate_note` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authorEmail` \*

 | `string` **|** `null` |  |  |
| 

`authorName` \*

 | `string` **|** `null` |  |  |
| 

`authorUserId` \*

 | `number` **|** `null` |  |  |
| 

`noteId` \*

 | `number` |  |  |
| 

`orderId` \*

 | `string` |  |  |

---

### Digicert User

`digicert_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| `active` | `boolean` |  |  |
| `admin` | `boolean` |  |  |
| `jobTitle` | `string` |  |  |
| `phone` | `string` |  |  |
| `roles` | `array` of `string`s |  |  |
| `status` | `string` |  |  |
| `type` | `string` |  |  |
| `userId` | `number` |  |  |

---

## Release Notes

-   **2026-10-08** — Added certificate serial number to DigiCert certificate entities.
    
-   **2026-04-08** — Added ingestion of DigiCert certificate order notes as new entity types, capturing note content, author, and creation timestamp.

---

Source: /integrations/directory/duo

# Duo

Visualize Duo users and access management, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an API Key (`Integration Key` + `Secret Key`) key on Duo. See [their documentation](https://duo.com/docs/adminapi) for more information.

The Duo integration requires (at minimum) the following API permissions enabled:

-   `Grant administrators`
-   `Grant settings`
-   `Grant read resource`

### Configuration in JupiterOne

To install the Duo integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Duo. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Duo account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Duo **API Hostname**.
    
-   The Duo `Integration Key` and `Secret Key` (both configured for read access).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `duo_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Admin | `duo_admin` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Device | `duo_phone` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Group | `duo_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Integration | `duo_integration` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| MFA Token | `mfa_device` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| User | `duo_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `duo_account` | **HAS** | `duo_group` |
| `duo_account` | **HAS** | `duo_admin` |
| `duo_account` | **HAS** | `duo_user` |
| `duo_account` | **HAS** | `duo_integration` |
| `duo_group` | **HAS** | `duo_user` |
| `duo_user` | **ASSIGNED** | `mfa_device` |
| `duo_user` | **USES** | `duo_phone` |

### Duo Account

`duo_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `siteId` | `string` |  |  |
| `webLink` | `string` |  |  |

---

### Duo Phone

`duo_phone` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activated` | `boolean` |  |  |
| `email` | `string` |  |  |
| `encrypted` | `boolean` |  |  |
| `phoneNumber` | `string` |  |  |
| `platform` | `string` |  |  |
| `tampered` | `boolean` |  |  |
| `userId` | `string` |  |  |
| `username` | `string` |  |  |

---

### Duo User

`duo_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `lastLogin` | `number` |  |  |
| `notes` | `array` of `string`s |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name, type, and version accuracy for Duo phone and device entities.

---

Source: /integrations/directory/dx

# DX

Visualize DX teams, users, and software catalog entities, map team ownership of services and domains, and monitor your developer experience platform through queries and alerts.

## Installation

> **INFO**
> 
> You will need a DX API key to configure this integration. API keys are generated in the DX admin area.
> 
> Required API scopes:
> 
> -   `snapshots:read` — Access to snapshots, teams, and users
> -   `catalog:read` — Access to software catalog entities
> 
> See [DX API documentation](https://docs.getdx.com/webapi/overview/) for more information.

To install the DX integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select DX. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the DX account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your DX **API Key** generated from the DX admin area.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (2)

-   `catalog:read`
-   `snapshots:read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `https://api.getdx.com/catalog.entities.info`
-   `https://api.getdx.com/catalog.entities.list`
-   `https://api.getdx.com/catalog.relationEdges.list`
-   `https://api.getdx.com/catalog.relations.list`
-   `https://api.getdx.com/snapshots.list`
-   `https://api.getdx.com/teams.info`
-   `https://api.getdx.com/teams.list`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (7)

-   [https://docs.getdx.com/webapi/methods/catalog.entities.info/](https://docs.getdx.com/webapi/methods/catalog.entities.info/)
-   [https://docs.getdx.com/webapi/methods/catalog.entities.list/](https://docs.getdx.com/webapi/methods/catalog.entities.list/)
-   [https://docs.getdx.com/webapi/methods/catalog.relationedges.list/](https://docs.getdx.com/webapi/methods/catalog.relationedges.list/)
-   [https://docs.getdx.com/webapi/methods/catalog.relations.list/](https://docs.getdx.com/webapi/methods/catalog.relations.list/)
-   [https://docs.getdx.com/webapi/methods/snapshots.list/](https://docs.getdx.com/webapi/methods/snapshots.list/)
-   [https://docs.getdx.com/webapi/methods/teams.info/](https://docs.getdx.com/webapi/methods/teams.info/)
-   [https://docs.getdx.com/webapi/methods/teams.list/](https://docs.getdx.com/webapi/methods/teams.list/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Fetch Catalog Entities | `catalog:read` | `https://api.getdx.com/catalog.entities.list`, `https://api.getdx.com/catalog.entities.info` |
| Fetch Catalog Relations | `catalog:read` | `https://api.getdx.com/catalog.relations.list`, `https://api.getdx.com/catalog.relationEdges.list` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `dx_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| CatalogDomain | `dx_catalog_domain` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| CatalogEntity | `dx_catalog_entity` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| CatalogService | `dx_catalog_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Team | `dx_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `dx_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `dx_account` | **HAS** | `dx_team` |
| `dx_account` | **HAS** | `dx_user` |
| `dx_catalog_entity` | **HAS** | `dx_catalog_service` |
| `dx_catalog_service` | **USES** | `dx_catalog_service` |
| `dx_catalog_service` | **USES** | `dx_catalog_entity` |
| `dx_team` | **HAS** | `dx_team` |
| `dx_team` | **HAS** | `dx_user` |
| `dx_team` | **OWNS** | `dx_catalog_entity` |
| `dx_team` | **OWNS** | `dx_catalog_service` |
| `dx_team` | **OWNS** | `dx_catalog_domain` |
| `dx_user` | **MANAGES** | `dx_team` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `dx_catalog_domain` | **HAS** | `github_repo` | FORWARD |
| `dx_catalog_entity` | **HAS** | `github_repo` | FORWARD |
| `dx_catalog_service` | **HAS** | `github_repo` | FORWARD |
| `dx_catalog_service` | **USES** | `google_storage_bucket` | FORWARD |

### Dx Account

`dx_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Dx Catalog Domain

`dx_catalog_domain` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`catalogEntityType` \*

 | `string` **|** `null` | The type of catalog entity (e.g. service, domain) |  |
| 

`githubRepoIds` \*

 | `array` **|** `null` | Identifiers of the GitHub repositories linked to this catalog entity |  |
| 

`githubRepoNames` \*

 | `array` **|** `null` | Full names of the GitHub repositories linked to this catalog entity |  |
| 

`ownerTeamIds` \*

 | `array` **|** `null` | IDs of the teams that own this catalog entity |  |
| 

`ownerTeamNames` \*

 | `array` **|** `null` | Names of the teams that own this catalog entity |  |

---

### Dx Catalog Entity

`dx_catalog_entity` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`catalogEntityType` \*

 | `string` **|** `null` | The type of catalog entity (e.g. service, domain) |  |
| 

`githubRepoIds` \*

 | `array` **|** `null` | Identifiers of the GitHub repositories linked to this catalog entity |  |
| 

`githubRepoNames` \*

 | `array` **|** `null` | Full names of the GitHub repositories linked to this catalog entity |  |
| 

`ownerTeamIds` \*

 | `array` **|** `null` | IDs of the teams that own this catalog entity |  |
| 

`ownerTeamNames` \*

 | `array` **|** `null` | Names of the teams that own this catalog entity |  |

---

### Dx Catalog Service

`dx_catalog_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`catalogEntityType` \*

 | `string` **|** `null` | The type of catalog entity (e.g. service, domain) |  |
| 

`githubRepoIds` \*

 | `array` **|** `null` | Identifiers of the GitHub repositories linked to this catalog entity |  |
| 

`githubRepoNames` \*

 | `array` **|** `null` | Full names of the GitHub repositories linked to this catalog entity |  |
| 

`ownerTeamIds` \*

 | `array` **|** `null` | IDs of the teams that own this catalog entity |  |
| 

`ownerTeamNames` \*

 | `array` **|** `null` | Names of the teams that own this catalog entity |  |

---

### Dx Team

`dx_team` inherits from [Team](/data-model/schemas/Team.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`ancestors` \*

 | `array` **|** `null` |  |  |
| `contributorCount` | `number` |  |  |
| `isParent` | `boolean` |  |  |
| 

`managerId` \*

 | `string` **|** `null` |  |  |
| 

`parentId` \*

 | `string` **|** `null` |  |  |
| 

`referenceId` \*

 | `string` **|** `null` |  |  |

---

### Dx User

`dx_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`githubUsername` \*

 | `string` **|** `null` |  |  |
| 

`isDeveloper` \*

 | `boolean` **|** `null` |  |  |
| 

`timezone` \*

 | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-04-09** — New DX integration: ingests teams, users, and catalog entities including services and domains, with team ownership relationships.

---

Source: /integrations/directory/elastic-cloud

# Elastic Cloud

Visualize Elastic Cloud Search Account, Users, Clusters, Nodes, Backup, Roles and Service Accounts changes through queries and alerts.

## Installation

The Elastic Cloud integration collects data from Elasticsearch deployments hosted on Elastic Cloud using the Elasticsearch REST API. It ingests cluster statistics, nodes, users, roles, service accounts, and snapshots. Before configuring the integration in JupiterOne, create an Elasticsearch API key with the required cluster privileges.

### Prerequisites

One instance is required per Elasticsearch deployment. The integration connects directly to the Elasticsearch endpoint using an API key.

The API key must have the following cluster privileges:

| Privilege | Required for |
| --- | --- |
| `monitor` | Cluster statistics (`/_cluster/stats`) and node info (`/_nodes`) |
| `read_security` | Users (`/_security/user`) and roles (`/_security/role`) |
| `manage_service_account` | Service accounts (`/_security/service`) |
| `monitor_snapshot` | Snapshots (`/_snapshot/_all/_all`) |

See [Cluster privileges](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html) in the Elasticsearch documentation for details.

### Finding your Elasticsearch endpoint

1.  Log in to the [Elastic Cloud console](https://cloud.elastic.co).
2.  On the **Hosted deployments** page, select your deployment.
3.  Under **Applications**, locate the **Elasticsearch** entry and note the endpoint URL. It has the form `https://<deployment-id>.<region>.<provider>.elastic-cloud.com:443`.

Keep this URL — you will need it as the **Elastic Search Endpoint** when configuring JupiterOne.

### Finding your Elastic Cloud Account ID

1.  In the [Elastic Cloud console](https://cloud.elastic.co), click your profile icon and select **Organization**.
2.  Copy the **Organization ID**.

### Creating an Elasticsearch API key

1.  From the Elastic Cloud console, open Kibana for your deployment (select **Kibana** under **Applications** on the deployment page).
2.  In Kibana, go to **Stack Management > Security > API Keys** (or search for "API Keys" in the global search bar).
3.  Click **Create API key**.
4.  Enter a descriptive name, such as `JupiterOne`.
5.  Optionally, set an expiration date.
6.  Under **Control security privileges**, set the following cluster privileges: `monitor`, `read_security`, `manage_service_account`, `monitor_snapshot`.
7.  Click **Create API key**.
8.  Copy the generated key — it is shown only once.

See [Elasticsearch API keys](https://www.elastic.co/docs/deploy-manage/api-keys/elasticsearch-api-keys) in the Elastic documentation for additional guidance.

### Configuration in JupiterOne

To install the Elastic Cloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Elastic Cloud. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Elastic Cloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Elastic Cloud Account ID**: Your Elastic Cloud organization ID, copied from the Organization page in the Elastic Cloud console.
    
-   **Elastic Search API Key**: The API key created in the previous step. This field is required.
    
-   **Elastic Search Endpoint**: The Elasticsearch endpoint URL for your deployment (for example, `https://<deployment-id>.asia-south1.gcp.elastic-cloud.com:443`). This field is required.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (4)

-   `manage_service_account`
-   `monitor`
-   `monitor_snapshot`
-   `read_security`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (6)

-   `{elasticSearchEndpoint}/_cluster/stats`
-   `{elasticSearchEndpoint}/_nodes`
-   `{elasticSearchEndpoint}/_security/role`
-   `{elasticSearchEndpoint}/_security/service`
-   `{elasticSearchEndpoint}/_security/user`
-   `{elasticSearchEndpoint}/_snapshot/_all/_all`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (7)

-   [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-stats](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-stats)
-   [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-nodes-info](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-nodes-info)
-   [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-get-role](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-get-role)
-   [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-get-service-accounts](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-get-service-accounts)
-   [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-get-user](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-get-user)
-   [https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-snapshot-get](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-snapshot-get)
-   [https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Fetch Elastic Search Backups | `monitor_snapshot` | `{elasticSearchEndpoint}/_snapshot/_all/_all` |
| Fetch Elastic Search Cluster Nodes | `monitor` | `{elasticSearchEndpoint}/_nodes` |
| Fetch Roles | `read_security` | `{elasticSearchEndpoint}/_security/role` |
| Fetch Users | `read_security` | `{elasticSearchEndpoint}/_security/user` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `ec_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Backup | `ec_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Cluster | `ec_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Cluster Node | `ec_cluster_node` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Role | `ec_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Service Account | `ec_service_account` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User | `ec_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `ec_account` | **HAS** | `ec_cluster` |
| `ec_account` | **HAS** | `ec_user` |
| `ec_account` | **HAS** | `ec_role` |
| `ec_cluster` | **CONTAINS** | `ec_cluster_node` |
| `ec_cluster` | **HAS** | `ec_backup` |
| `ec_cluster` | **USES** | `ec_role` |
| `ec_user` | **ASSIGNED** | `ec_role` |

### Ec Account

`ec_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Ec Backup

`ec_backup` inherits from [Backup](/data-model/schemas/Backup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `completedOn` | `number` |  |  |
| `dataStreams` | `array` of `string`s |  |  |
| `duration` | `number` |  |  |
| `failedShards` | `number` |  |  |
| `featureStates` | `array` of `string`s |  |  |
| `includeGlobalState` | `boolean` |  |  |
| `indices` | `array` of `string`s |  |  |
| `repository` | `string` |  |  |
| `startedOn` | `number` |  |  |
| `status` | `string` |  |  |
| `successfulShards` | `number` |  |  |
| `totalShards` | `number` |  |  |
| `version` | `string` |  |  |
| `versionId` | `number` |  |  |

---

### Ec Cluster

`ec_cluster` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availableDiskSpace` | `string` |  |  |
| 
`docsCount` \*

 | `number` |  |  |
| 

`failedNodeCount` \*

 | `number` |  |  |
| 

`indicesCount` \*

 | `number` |  |  |
| 

`ingestPipelines` \*

 | `number` |  |  |
| 

`jvmThreads` \*

 | `number` |  |  |
| 

`nodeCount` \*

 | `number` |  |  |
| 

`primaryShards` \*

 | `number` |  |  |
| `storeSize` | `string` |  |  |
| 

`successfulNodeCount` \*

 | `number` |  |  |
| `totalDiskSpace` | `string` |  |  |
| 

`totalShards` \*

 | `number` |  |  |

---

### Ec Cluster Node

`ec_cluster_node` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availabilityZone` | `string` |  |  |
| `clusterName` | `string` |  |  |
| `dataPath` | `string` |  |  |
| `dataTier` | `string` |  |  |
| `diskReadSpeed` | `string` |  |  |
| `diskWriteSpeed` | `string` |  |  |
| `homePath` | `string` |  |  |
| `httpPort` | `string` |  |  |
| `httpSslEnabled` | `boolean` |  |  |
| `initialMasterNodes` | `string` |  |  |
| `instanceConfiguration` | `string` |  |  |
| `isxPackInstalled` | `boolean` | X-Pack is an Elastic Stack plugin providing advanced features like security, monitoring, and machine learning. |  |
| `logsPath` | `string` |  |  |
| `machineLearningEnabled` | `boolean` |  |  |
| `managedPolicies` | `array` of `string`s |  |  |
| `monitoringEnabled` | `boolean` |  |  |
| `networkBandwidth` | `string` |  |  |
| `processors` | `string` |  |  |
| `region` | `string` |  |  |
| 
`roles` \*

 | `array` of `string`s |  |  |
| `serverName` | `string` |  |  |
| `transportSslEnabled` | `boolean` |  |  |

---

### Ec Role

`ec_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `clusterPrivilegeNames` | `array` of `string`s |  |  |

---

### Ec Service Account

`ec_service_account` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `clusterPrivilege` | `array` of `string`s |  |  |

---

### Ec User

`ec_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `fullName` | `string` |  |  |
| `roles` | `array` of `string`s |  |  |

---

---

Source: /integrations/directory/esper

# Esper

Visualize Esper enterprises, applications, devices, and device groups, map Esper users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an API key on Esper for this integration. See [their documentation](https://help.esper.io/hc/en-us/articles/12656963209361-Generate-an-API-Key) for more information.

To install the Esper integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Esper. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Esper account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Esper API **Access Token**, **Esper Enterprise ID**, and **Esper Domain**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `esper_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `esper_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device | `esper_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device Group | `esper_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `esper_account` | **HAS** | `esper_application` |
| `esper_account` | **HAS** | `esper_device_group` |
| `esper_account` | **HAS** | `esper_device` |
| `esper_device_group` | **HAS** | `esper_device` |

## Release Notes

-   **2026-03-31** — Added OS kernel version property to Esper device entities.

---

Source: /integrations/directory/fastly

# Fastly

Visualize Fastly data, map Fastly users to employees, and monitor changes through queries and alerts.

## Installation

You will need to create an API Token key on Fastly for this integration. See [their documentation](https://docs.fastly.com/en/guides/using-api-tokens#creating-api-tokens) for more information.

> **NOTE**
> 
> The API token should be generated by a superuser so it is associated with the organization, not the user, with global read permissions.

### Configuration in Fastly

-   Obtain your Fastly Customer ID [here](https://manage.fastly.com/account/company).
-   Create the API Token on Fastly [here](https://manage.fastly.com/account/personal/tokens).

### Configuration in Jupiterone

To install the Fastly integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Fastly. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Fastly account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Fastly **Customer ID** and **API Token**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `fastly_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| API Token | `fastly_api_token` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Service | `fastly_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Service Backend | `fastly_service_backend` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| User | `fastly_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `fastly_account` | **HAS** | `fastly_user` |
| `fastly_account` | **HAS** | `fastly_api_token` |
| `fastly_account` | **HAS** | `fastly_service` |
| `fastly_service` | **HAS** | `fastly_service_backend` |
| `fastly_user` | **HAS** | `fastly_api_token` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `fastly_service` | **CONNECTS** | `DomainRecord` | FORWARD |
| `fastly_service_backend` | **CONNECTS** | `Host or Gateway` | FORWARD |

---

Source: /integrations/directory/feroot

# Feroot

Visualize Feroot users, groups, project folders, projects, alerts, and domains, map Feroot users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> This integration requires an API key with `Admin Read-only` permissions on Feroot.

### Configuration in Feroot

To create an API Key on Feroot:

1.  Navigate to **Settings > Account > Developer** and click **Create new API key**.
2.  Select the `Admin Read-only` role for the new key.
3.  Once the key is created, access it from the **List of API keys**, and copy the key.

## Data Volume Configuration

Control how much data is ingested from Feroot to manage storage and processing.

### Data Filtering Options

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **Ingest Resolved Alerts** | Boolean | Indicates whether to preserve entities for resolved alerts or to remove all resolved alerts from the graph. | `false` |

**How it affects data volume:** When disabled (default), resolved alerts are removed from the graph, keeping only active alerts. Enabling this setting preserves all alerts including resolved ones, increasing the total number of alert entities stored.

### In JupiterOne

To install the Feroot integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Feroot. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Feroot account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Lastly, your Feroot **API Key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Alert | `feroot_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Inspector Project | `feroot_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| PageGuard Project | `feroot_pageguard_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Project Folder | `feroot_project_folder` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Target Domain | `web_app_domain` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| User | `feroot_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `feroot_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `feroot_project` | **MONITORS** | `web_app_domain` |
| `feroot_project` | **CONTAINS** | `feroot_pageguard_project` |
| `feroot_project` | **GENERATED** | `feroot_alert` |
| `feroot_project_folder` | **HAS** | `feroot_project` |
| `feroot_user_group` | **HAS** | `feroot_user` |
| `feroot_user_group` | **HAS** | `feroot_project_folder` |

### Feroot User

`feroot_user` inherits from [User](/data-model/schemas/User.md)

---

---

Source: /integrations/directory/fleetdm

# FleetDM

Visualize your FleetDM policies, hosts, users, and installed software in the JupiterOne graph and detect policy violations with JupterOne Alerts.

## Installation

To use this integration, JupiterOne requires an API-only global admin user's credentials.

### Configuration in FleetDM

Using the `fleetctl` command line tool ([installation instructions here](https://fleetdm.com/docs/using-fleet/fleetctl-cli)), create an [API-only user](https://fleetdm.com/docs/using-fleet/fleetctl-cli#using-fleetctl-with-an-api-only-user) with global admin privileges:

```sh
fleetctl user create --name "API User" --email api@example.com --password temp#pass --api-only --global-role admin
```

NOTE: If you're using FleetDM to manage cloud hosts in addition to user endpoints, create a custom label that includes the user endpoints you want to ingest as `Device` entities. Each of those labeled hosts will be ingested as `Device` entities, and any hosts that are not labeled will be ingested as `Host` entities. If you're not using FleetDM to manage any cloud hosts, and the only hosts are user endpoints, you do not need to specify a custom label, and all hosts will be ingested as `Device` entities.

### Configuration in JupiterOne

To install the FleetDM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select FleetDM. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the FleetDM account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **FleetDM User Email**, **FleetDM User Password**, and **FleetDM Hostname**.
    
-   Optionally, **User Endpoint Labels** (separate multiple labels with commas).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data about your FleetDM environment within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Host | `fleetdm_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Host | `user_endpoint` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Instance | `fleetdm_instance` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Policy | `fleetdm_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| User | `fleetdm_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `fleetdm_host` | **VIOLATES** | `fleetdm_policy` |
| `fleetdm_instance` | **HAS** | `fleetdm_user` |
| `fleetdm_instance` | **HAS** | `fleetdm_host` |
| `fleetdm_instance` | **HAS** | `user_endpoint` |
| `fleetdm_instance` | **HAS** | `fleetdm_policy` |
| `fleetdm_policy` | **ASSIGNED** | `fleetdm_host` |
| `fleetdm_policy` | **ASSIGNED** | `user_endpoint` |
| `user_endpoint` | **VIOLATES** | `fleetdm_policy` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `fleetdm_host` | **INSTALLED** | `fleetdm_software` | FORWARD |
| `user_endpoint` | **INSTALLED** | `fleetdm_software` | FORWARD |

### Fleetdm User

`fleetdm_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `picture` | `string` |  |  |
| `ssoEnabled` | `boolean` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS type accuracy for FleetDM host entities.

---

Source: /integrations/directory/forescout-eyesight

# Forescout Eyesight

Visualize Forescout Eyesight hosts, policies, users and vulnerabilities, map Forescout hosts to its matching policies, assigned user and identified vulnerabilities, and monitor changes through queries and alerts.

## Installation

To set up this integration in JupiterOne, you first create a Web API user in Forescout and, optionally, an Admin API user if you want to ingest IP ranges.

### Prerequisites

-   The **Web API Plugin** is installed and started on your Enterprise Manager or standalone Appliance. JupiterOne authenticates every Web API request with a Web API user you create below.
-   To ingest IP ranges, the **Admin API Plugin** (Core Extensions Module) is installed and started. This is required only for the IP Ranges data.

### Configuration in Forescout Eyesight

#### Create a Web API user

1.  In the Forescout Console, select **Options** from the **Tools** menu, then select **Web API**.
2.  On the **User Settings** tab, click **Add**.
3.  Enter a user name and password, then click **OK**.
4.  Save the user name and password. You enter these later in the **Web API Username** and **Web API Password** fields in JupiterOne.
5.  Go to **Options > Access > Web**, select the **Client IPs** tab, and click **Add**. Add the IP range or subnet JupiterOne connects from (your collector host if you run one, otherwise contact [JupiterOne Support](https://info.jupiterone.com/contact-us) for JupiterOne's egress addresses), then click **OK**. Forescout rejects Web API logins from addresses outside this list, even with valid credentials.

> **NOTE**
> 
> The Web API Authentication Security Settings control account lockout and token expiration.

#### Create an Admin API user (optional, for IP Ranges)

1.  In the Forescout Console, select **Options** from the **Tools** menu, then select **CounterACT User Profiles** and click **Add**.
2.  In the **General** pane, set **User Type** to **Single-Password** and enter a user name and password.
3.  In the **Permissions** pane, select **Group Management** and **Policy Management** with view-only access. JupiterOne only reads network segments, so update access is not needed.
4.  In the **Scope** pane, select **View All Hosts**.
5.  Save the user name and password. You enter these later in the **Admin API Username** and **Admin API Password** fields in JupiterOne.

> **NOTE**
> 
> The Admin API user is required only to ingest IP ranges. Forescout recommends a dedicated user for Admin API access with no permissions beyond Group Management and Policy Management, and advises against using the built-in `admin` user.

### Configuration in JupiterOne

To install the Forescout Eyesight integration in JupiterOne, navigate to the **Integrations** tab and select **Forescout Eyesight**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Forescout Eyesight account in JupiterOne. Ingested entities store this value in `tag.AccountName` when the **AccountName** toggle is enabled.
-   A **Description** to help identify the integration instance, if desired.
-   A **Polling Interval** sufficient for your monitoring needs. You can leave this as `DISABLED` and run the integration manually.
-   Your **Hostname** — the host of your Forescout Eyesight instance, for example `https://eyesight.example.com`.
-   The **Web API Username** and **Web API Password** for the Web Service user you created.
-   The **Admin API Username** and **Admin API Password**, only if you want to ingest IP ranges.

Click **Create** once all values are provided to finalize the integration.

### Advanced Configuration

These TLS transport options are optional and only needed when your Enterprise Manager or appliance presents a certificate that JupiterOne cannot verify against a public certificate authority.

| Field | Description | Default |
| --- | --- | --- |
| **CA Certificate** | A PEM file with the CA certificate (and any intermediates) that issued the Enterprise Manager or appliance TLS certificate. Use it when that certificate is self-signed or issued by an internal CA. | None |
| **Disable TLS Verification** | When enabled, JupiterOne skips TLS certificate verification. | Disabled |

> **CAUTION**
> 
> Disabling TLS verification is not recommended. Use it only for appliances with self-signed certificates, and prefer uploading a **CA Certificate** instead.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (3)

-   `Group Management (view)`
-   `Policy Management (view)`
-   `Scope: View All Hosts`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `GET adminapi/segments`
-   `GET api/hosts`
-   `GET api/hosts/{hostId}`
-   `GET api/hosts?matchRuleId={ruleId}`
-   `GET api/policies`
-   `POST /fsum/oauth2.0/token`
-   `POST api/login`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (4)

-   [https://docs.forescout.com/eyeextend/eyeextend-web-api-plugin/eyeextend-web-api-plugin/configure-webapi.htm](https://docs.forescout.com/eyeextend/eyeextend-web-api-plugin/eyeextend-web-api-plugin/configure-webapi.htm)
-   [https://docs.forescout.com/eyeextend/eyeextend-web-api-plugin/eyeextend-web-api-plugin/endpoints.htm](https://docs.forescout.com/eyeextend/eyeextend-web-api-plugin/eyeextend-web-api-plugin/endpoints.htm)
-   [https://docs.forescout.com/modules-plugins/core-extensions/admin-api-plugin/admin-api-plugin/command-reference-link.html](https://docs.forescout.com/modules-plugins/core-extensions/admin-api-plugin/admin-api-plugin/command-reference-link.html)
-   [https://docs.forescout.com/modules-plugins/core-extensions/admin-api-plugin/admin-api-plugin/set-up-admin-api-user-profiles.htm](https://docs.forescout.com/modules-plugins/core-extensions/admin-api-plugin/admin-api-plugin/set-up-admin-api-user-profiles.htm)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Fetch IP Ranges | `Group Management (view)`, `Policy Management (view)`, `Scope: View All Hosts` | `POST /fsum/oauth2.0/token`, `GET adminapi/segments` |
| Fetch Policies | \- | `POST api/login`, `GET api/policies`, `GET api/hosts?matchRuleId={ruleId}` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `forescout_eyesight_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Host | `forescout_eyesight_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Ip Range | `forescout_eyesight_ip_range` | [IpRange](https://docs.jupiterone.io/data-model/schemas/IpRange) |
| Policy | `forescout_eyesight_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Policy Rule | `forescout_eyesight_policy_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Scanner | `forescout_eyesight_scanner` | [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| User | `forescout_eyesight_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `forescout_eyesight_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Vulnerability | `forescout_eyesight_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `forescout_eyesight_account` | **HAS** | `forescout_eyesight_scanner` |
| `forescout_eyesight_host` | **HAS** | `forescout_eyesight_vulnerability` |
| `forescout_eyesight_ip_range` | **CONTAINS** | `forescout_eyesight_host` |
| `forescout_eyesight_policy` | **HAS** | `forescout_eyesight_policy_rule` |
| `forescout_eyesight_scanner` | **ASSIGNED** | `forescout_eyesight_policy` |
| `forescout_eyesight_scanner` | **IDENTIFIED** | `forescout_eyesight_host` |
| `forescout_eyesight_user` | **USES** | `forescout_eyesight_host` |

### Forescout Eyesight Account

`forescout_eyesight_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` |  |  |
| 

`vendor` \*

 | `string` |  |  |

---

### Forescout Eyesight Host

`forescout_eyesight_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `function` | `string` | Indicates the most specific endpoint function that was determined in Forescout Eyesight. |  |
| `ipAddress` | `string` |  |  |
| `macAddress` | `string` |  |  |
| `manufacturer` | `string` |  |  |
| `networkSegment` | `string` | When Admin API credentials are not provided, this field is not populated. |  |
| `os` | `string` | Indicates the most specific endpoint operating system that was determined in Forescout Eyesight. |  |

---

### Forescout Eyesight Ip Range

`forescout_eyesight_ip_range` inherits from [IpRange](/data-model/schemas/IpRange.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`active` \*

 | `boolean` |  |  |
| 

`begin` \*

 | `string` |  |  |
| 

`cidr` \*

 | `array` of `string`s |  |  |
| 

`end` \*

 | `string` |  |  |
| 

`public` \*

 | `boolean` | This is evaluated by comparing the begin and end IP addresses to the three private IP ranges defined by the IETF in RFC 1918. |  |

---

### Forescout Eyesight Policy

`forescout_eyesight_policy` inherits from [Policy](/data-model/schemas/Policy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`content` \*

 | `string` | It'll be empty because API doesn't expose a similar data field |  |
| `description` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Forescout Eyesight Policy Rule

`forescout_eyesight_policy_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Forescout Eyesight Scanner

`forescout_eyesight_scanner` inherits from [Scanner](/data-model/schemas/Scanner.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Forescout Eyesight User

`forescout_eyesight_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `department` | `string` |  |  |
| `loggedInStatus` | `string` | Indicates hosts at which users are currently logged in to the network via the HTTP Login action |  |

---

### Forescout Eyesight Vulnerability

`forescout_eyesight_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cvssAvailabilityImpact` | `string` |  |  |
| `cvssConfidentialityImpact` | `string` |  |  |
| `cvssIntegrityImpact` | `string` |  |  |
| `cvssRemediationLevel` | `string` |  |  |
| `cvssReportingConfidence` | `string` |  |  |
| `cvssScore` | `number` |  |  |
| `cvssTemporalScore` | `number` |  |  |
| `icsaId` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| `matchingConfidence` | `string` |  |  |
| 

`severity` \*

 | `string` |  | **descriptions**: Parsed from CVSS Score |
| `suppressed` | `boolean` |  |  |
| 

`title` \*

 | `string` |  |  |
| `vendorSpecificId` | `string` |  |  |

---

### Forescout Eyesight Vulnerability

`forescout_eyesight_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cveId` | `string` |  |  |
| `cvssAvailabilityImpact` | `string` |  |  |
| `cvssConfidentialityImpact` | `string` |  |  |
| `cvssIntegrityImpact` | `string` |  |  |
| `cvssRemediationLevel` | `string` |  |  |
| `cvssReportingConfidence` | `string` |  |  |
| `cvssScore` | `number` |  |  |
| `cvssTemporalScore` | `number` |  |  |
| `icsaId` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| `matchingConfidence` | `string` |  |  |
| 

`severity` \*

 | `string` |  | **descriptions**: Parsed from CVSS Score |
| `suppressed` | `boolean` |  |  |
| 

`title` \*

 | `string` |  |  |
| `vendorSpecificId` | `string` |  |  |

---

## Release Notes

-   **2025-06-04** — Promoted Forescout EyeSight vulnerability findings to carry both the Vulnerability and Finding entity classes, enabling cross-integration vulnerability queries.

---

Source: /integrations/directory/fortra-dlp

# Fortra DLP

Visualize Fortra Digital Guardian DLP watchlists, user groups, host groups, incidents, and monitor data loss prevention events through queries and alerts.

## Installation

### Prerequisites in Fortra Digital Guardian

> **INFO**
> 
> You will need the following parameters from your Digital Guardian Analytics & Reporting Cloud (ARC) account:
> 
> -   **Access Gateway URL**: The base URL for API requests
>     -   Example: `https://accessgw-usw.msp.digitalguardian.com`
> -   **Authorization Server URL**: The OAuth2 token endpoint URL
>     -   Example: `https://authsrv.msp.digitalguardian.com`
> -   **Client ID**: Your API Client ID (Tenant ID)
> -   **Client Secret**: Your API Secret (Authentication Token)

#### Obtaining API Credentials

1.  Log in to the **Digital Guardian Management Console (DGMC)**.
    
2.  Navigate to **ARC Tenant Settings**.
    
3.  Copy and save the following values:
    
    -   **Tenant ID** — This is your Client ID
    -   **Authentication Token** — This is your Client Secret
4.  From the DGMC, also copy:
    
    -   **Access Gateway Base URL**
    -   **Authorization Server URL**

#### Export Profiles (Optional)

To ingest DLP incidents or agent version data, configure Export Profiles in Digital Guardian before setting up the JupiterOne integration:

1.  In DGMC, navigate to **Admin > Reports > Export Profiles**.
    
2.  Create or identify the export profile(s) you want to use.
    
3.  Copy the **Export Profile ID** (UUID) for each profile.
    

For more information, see the [Fortra Digital Guardian product page](https://www.fortra.com/platform/data-loss-prevention/analytics-reporting-cloud).

### Configuration in JupiterOne

To install the Fortra DLP integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Fortra DLP. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Fortra DLP account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Digital Guardian **Access Gateway URL** — The base URL for API requests.
    
-   Your Digital Guardian **Authorization Server URL** — The OAuth2 token endpoint.
    
-   Your Digital Guardian **Client ID** and **Client Secret** for OAuth2 authentication.
    

Click **Create** once all values are provided to finalize the integration.

## Data Volume Configuration

### Data Filtering Options

The following optional fields control which data the integration ingests. Leave both blank to skip incident and agent-version enrichment ingestion.

| Field | Description | Default |
| --- | --- | --- |
| **Export Profile IDs** | Comma-separated UUIDs of Export Profiles to fetch DLP incidents from. Each profile must be pre-configured in DGMC. Leave blank to skip incident ingestion. | _(none)_ |
| **Agent Version Export Profile IDs** | Comma-separated UUIDs of Export Profiles used to enrich host agents with their Digital Guardian agent version. The profiles must include the `dg_machine_name`, `dg_agent_version`, and `dg_guid` fields and must be pre-configured in DGMC. Leave blank to skip agent-version enrichment. | _(none)_ |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (1)

-   `client`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `POST {accessGatewayUrl}/rest/2.0/export_profiles/{profileId}/acknowledge`
-   `{accessGatewayUrl}/rest/1.0/dynamic_group/{group_id}`
-   `{accessGatewayUrl}/rest/1.0/lists/dynamic_user_group`
-   `{accessGatewayUrl}/rest/1.0/lists/machine_group`
-   `{accessGatewayUrl}/rest/1.0/lists/user_group`
-   `{accessGatewayUrl}/rest/1.0/watchlists`
-   `{accessGatewayUrl}/rest/2.0/export_profiles/{profileId}/export`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://support.fortra.com/s/article/Digital-Guardian-External-API-Overview](https://support.fortra.com/s/article/Digital-Guardian-External-API-Overview)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (8)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Fetch Export Profiles | `client` | `{accessGatewayUrl}/rest/2.0/export_profiles/{profileId}/export` |
| Fetch Host Agents | `client` | `{accessGatewayUrl}/rest/1.0/dynamic_group/{group_id}`, `{accessGatewayUrl}/rest/2.0/export_profiles/{profileId}/export`, `POST {accessGatewayUrl}/rest/2.0/export_profiles/{profileId}/acknowledge` |
| Fetch Host Groups | `client` | `{accessGatewayUrl}/rest/1.0/lists/machine_group` |
| Fetch Incidents | `client` | `{accessGatewayUrl}/rest/2.0/export_profiles/{profileId}/export`, `POST {accessGatewayUrl}/rest/2.0/export_profiles/{profileId}/acknowledge` |
| Fetch Service | \- | \- |
| Fetch User Groups | `client` | `{accessGatewayUrl}/rest/1.0/lists/user_group`, `{accessGatewayUrl}/rest/1.0/lists/dynamic_user_group` |
| Fetch Users | `client` | `{accessGatewayUrl}/rest/1.0/dynamic_group/{group_id}` |
| Fetch Watchlists | `client` | `{accessGatewayUrl}/rest/1.0/watchlists` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `fortra_dlp_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Export Profile | `fortra_dlp_export_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Host | `fortra_dlp_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Host Agent | `fortra_dlp_agent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Host Group | `fortra_dlp_host_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Incident | `fortra_dlp_incident` | [Incident](https://docs.jupiterone.io/data-model/schemas/Incident) |
| Service | `fortra_dlp_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `fortra_dlp_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `fortra_dlp_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Watchlist | `fortra_dlp_watchlist` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `fortra_dlp_account` | **HAS** | `fortra_dlp_service` |
| `fortra_dlp_account` | **HAS** | `fortra_dlp_watchlist` |
| `fortra_dlp_account` | **HAS** | `fortra_dlp_user_group` |
| `fortra_dlp_account` | **HAS** | `fortra_dlp_host_group` |
| `fortra_dlp_account` | **HAS** | `fortra_dlp_agent` |
| `fortra_dlp_account` | **HAS** | `fortra_dlp_export_profile` |
| `fortra_dlp_agent` | **PROTECTS** | `fortra_dlp_host` |
| `fortra_dlp_agent` | **IDENTIFIED** | `fortra_dlp_incident` |
| `fortra_dlp_export_profile` | **GENERATED** | `fortra_dlp_incident` |
| `fortra_dlp_host_group` | **HAS** | `fortra_dlp_agent` |
| `fortra_dlp_service` | **IDENTIFIED** | `fortra_dlp_incident` |
| `fortra_dlp_user` | **HAS** | `fortra_dlp_incident` |
| `fortra_dlp_user_group` | **HAS** | `fortra_dlp_user` |

### Fortra Dlp Account

`fortra_dlp_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessGatewayUrl` | `string` |  |  |
| `authorizationServerUrl` | `string` |  |  |

---

### Fortra Dlp Agent

`fortra_dlp_agent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentVersion` | `string` |  |  |
| `domainName` | `string` |  |  |
| `machineId` | `string` |  |  |

---

### Fortra Dlp Export Profile

`fortra_dlp_export_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fieldCount` | `number` |  |  |
| `totalHits` | `number` |  |  |

---

### Fortra Dlp Host

`fortra_dlp_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `domainName` | `string` |  |  |
| `machineId` | `string` |  |  |
| `machineType` | `number` |  |  |

---

### Fortra Dlp Host Group

`fortra_dlp_host_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isReadOnly` | `boolean` |  |  |
| `memberCount` | `number` |  |  |

---

### Fortra Dlp Incident

`fortra_dlp_incident` inherits from [Incident](/data-model/schemas/Incident.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentVersion` | `string` |  |  |
| `alarmName` | `string` |  |  |
| `assignee` | `string` |  |  |
| `eventTime` | `number` |  |  |
| `eventType` | `string` |  |  |
| `guid` | `string` |  |  |
| `machineId` | `string` |  |  |
| `machineName` | `string` |  |  |
| `machineType` | `number` |  |  |
| `machineTypeName` | `string` |  |  |
| `numericSeverity` | `number` |  |  |
| `processedTime` | `number` |  |  |
| `state` | `string` |  |  |
| `userName` | `string` |  |  |

---

### Fortra Dlp Service

`fortra_dlp_service` inherits from [Service](/data-model/schemas/Service.md)

---

### Fortra Dlp User

`fortra_dlp_user` inherits from [User](/data-model/schemas/User.md)

---

### Fortra Dlp User Group

`fortra_dlp_user_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isDynamic` | `boolean` |  |  |
| `isReadOnly` | `boolean` |  |  |
| `memberCount` | `number` |  |  |

---

### Fortra Dlp Watchlist

`fortra_dlp_watchlist` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authorId` | `string` |  |  |
| `grouping` | `string` |  |  |
| `isDeleted` | `boolean` |  |  |
| `permRead` | `string` |  |  |
| `permWrite` | `string` |  |  |
| `scope` | `string` |  |  |
| `tenantId` | `string` |  |  |
| `version` | `number` |  |  |
| `versionAuthor` | `string` |  |  |
| `watchlistType` | `string` |  |  |

---

## Release Notes

-   **2026-02-19** — Added agent version tracking to Fortra DLP host agents, with support for configuring export profiles to retrieve version data.
-   **2026-01-28** — Added hosts and host agents as new entity types to the Fortra DLP integration.
-   **2026-01-27** — New Fortra DLP integration: ingests watchlists, user groups, host groups, export profiles, and incidents.

---

Source: /integrations/directory/freshservice

# Freshservice

Visualize Freshservice information, map Freshservice agents to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need your Freshservice API key to set up this integration. See [Freshservice's documentation](https://support.freshservice.com/en/support/solutions/articles/50000000306-where-do-i-find-my-api-key-) for more information.

### Configuration in JupiterOne

To install the Freshservice integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Freshservice. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Freshservice account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Lastly, your Freshservice **API Key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `freshservice_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Agent | `freshservice_agent` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Agent Group | `freshservice_agent_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Agent Role | `freshservice_agent_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Ticket | `freshservice_ticket` | [RecordEntity](https://docs.jupiterone.io/data-model/schemas/RecordEntity) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `freshservice_account` | **HAS** | `freshservice_agent` |
| `freshservice_account` | **HAS** | `freshservice_agent_group` |
| `freshservice_account` | **HAS** | `freshservice_agent_role` |
| `freshservice_account` | **HAS** | `freshservice_ticket` |
| `freshservice_agent` | **HAS** | `freshservice_ticket` |
| `freshservice_agent_group` | **HAS** | `freshservice_ticket` |
| `freshservice_agent_group` | **HAS** | `freshservice_agent` |
| `freshservice_agent_role` | **ASSIGNED** | `freshservice_agent` |

### Freshservice Agent

`freshservice_agent` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `address` | `string` |  |  |
| `autoAssignStatusChangeOn` | `number` |  |  |
| `autoAssignTickets` | `boolean` |  |  |
| `backgroundInformation` | `string` |  |  |
| `canSeeAllTicketsFromAssociatedDepartments` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `department` | `string` |  |  |
| `externalId` | `string` |  |  |
| `hasLoggedIn` | `boolean` |  |  |
| `id` | `string` |  |  |
| `jobTitle` | `string` |  |  |
| `language` | `string` |  |  |
| `lastActiveOn` | `number` |  |  |
| `lastLoginOn` | `number` |  |  |
| `locationId` | `string` |  |  |
| `mobilePhoneNumber` | `string` |  |  |
| `reportingManagerId` | `string` |  |  |
| `scoreboardLevelId` | `string` |  |  |
| `scoreboardPoints` | `string` |  |  |
| `signature` | `string` |  |  |
| `timeFormat` | `string` |  |  |
| `timeZone` | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `vipUser` | `boolean` |  |  |
| `workPhoneNumber` | `string` |  |  |

---

---

Source: /integrations/directory/gears-sure-mdm

# 42Gears SureMDM

Visualize your 42Gears SureMDM managed devices, device groups, and installed applications, and monitor changes through queries and alerts. This integration ingests the devices enrolled in SureMDM along with their hardware, network, and security details, the group hierarchy that organizes them, and the applications installed on each device to provide visibility into your mobile and endpoint fleet.

## Installation

> **INFO**
> 
> To configure this integration you will need the username and password used to sign in to your SureMDM console, along with your SureMDM API Key. The SureMDM API authenticates each request using Basic Auth (username and password) together with an `ApiKey` header.

### Configuration in SureMDM

**To find your SureMDM API Key:**

1.  Log in to your SureMDM Web Console.
2.  Navigate to **Settings > Account Settings > Account Management**.
3.  Locate the **API Key** shown on the screen and copy it for use in JupiterOne.

See [How to find out the API Key for your SureMDM account](https://knowledgebase.42gears.com/article/how-to-find-out-the-api-key-for-your-suremdm-account/) for more information.

### Configuration in JupiterOne

To install the 42Gears SureMDM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select 42Gears SureMDM. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Username** - The SureMDM console login username (the same username used to sign in to the SureMDM UI), used for Basic Auth against the API.
    
-   **Password** - The password for your SureMDM console login, used for Basic Auth.
    
-   **API Key** - The API Key for your SureMDM account, sent in the `ApiKey` header. Found under **Settings > Account Settings > Account Management** in the SureMDM console.
    
-   **Base URL** - The base URL for the SureMDM API. Defaults to `https://suremdm.42gears.com` for cloud deployments. For on-premises deployments, use your tenant URL (for example, `https://{tenant}.{country}.suremdm.io`).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (1)

-   `API Access`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (4)

-   `api/v2/devicegrid`
-   `api/v2/group/gethomegroupdetails`
-   `api/v2/group/{customerid}/getAll`
-   `api/v2/installedapp/android/{DeviceId}/device/{Limit}/{Offset}/{Search}/{Sort}/{Order}/{Platform}`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://developer.42gears.com/suremdm/api/v2/specs/suremdmapi.yaml](https://developer.42gears.com/suremdm/api/v2/specs/suremdmapi.yaml)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Fetch Devices | `API Access` | `api/v2/devicegrid` |
| Fetch Installed Applications | `API Access` | `api/v2/installedapp/android/{DeviceId}/device/{Limit}/{Offset}/{Search}/{Sort}/{Order}/{Platform}` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `suremdm_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `suremdm_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Device Group | `suremdm_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Installed Application | `suremdm_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `suremdm_account` | **HAS** | `suremdm_group` |
| `suremdm_account` | **HAS** | `suremdm_device` |
| `suremdm_device` | **INSTALLED** | `suremdm_application` |
| `suremdm_group` | **HAS** | `suremdm_group` |
| `suremdm_group` | **HAS** | `suremdm_device` |

### Suremdm Account

`suremdm_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Suremdm Application

`suremdm_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appSize` | `string` **|** `null` | Reported on-device size of the application. |  |
| `appType` | `string` **|** `null` | Whether the application is a system app or an installed (user) app. |  |
| `packageId` | `string` **|** `null` | Package/application identifier assigned by SureMDM (e.g. the Android package name). |  |
| `version` | `string` **|** `null` | Version of the installed application. |  |

---

### Suremdm Device

`suremdm_device` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `afwProfile` | `string` **|** `null` | Android for Work (AFW) profile applied to the device. |  |
| `afwStatus` | `number` **|** `null` | Android for Work (AFW) enrollment status code. |  |
| `agentVersion` | `string` **|** `null` | Version of the SureMDM agent installed on the device. |  |
| `androidId` | `string` **|** `null` | Android ID of the device. |  |
| `availablePhysicalMemory` | `number` **|** `null` | Available physical memory (RAM) on the device, in bytes. |  |
| `batteryHealth` | `string` **|** `null` | Reported battery health of the device. |  |
| `batteryLevel` | `number` **|** `null` | Battery charge remaining on the device, as a percentage. |  |
| `batteryState` | `string` **|** `null` | Current battery state of the device (e.g. charging, discharging). |  |
| `connectionStatus` | `string` **|** `null` | Connection status of the device with SureMDM (e.g. Online, Offline). |  |
| `cpuUsage` | `number` **|** `null` | Current CPU usage of the device, as a percentage. |  |
| `customerId` | `string` **|** `null` | Identifier of the SureMDM customer/account the device belongs to. |  |
| `dataUsage` | `number` **|** `null` | Cellular data usage reported by the device. |  |
| `deviceApprovedStatus` | `number` **|** `null` | Approval status code of the device in SureMDM. |  |
| `deviceUserId` | `string` **|** `null` | Identifier of the user assigned to the device. |  |
| `deviceUserName` | `string` **|** `null` | Name of the user assigned to the device. |  |
| `groupPath` | `string` **|** `null` | Full path of the group the device belongs to within the group hierarchy. |  |
| `imei` | `string` **|** `null` | Primary IMEI of the device. |  |
| `imei2` | `string` **|** `null` | Secondary IMEI of the device (dual-SIM devices). |  |
| `ipAddress` | `string` **|** `null` | Public/primary IP address reported by the device. |  |
| `isBluetoothEnabled` | `boolean` **|** `null` | Indicates whether Bluetooth is enabled on the device. |  |
| `isEnrolled` | `boolean` **|** `null` | Indicates whether the device is enrolled in SureMDM. |  |
| `isGpsEnabled` | `boolean` **|** `null` | Indicates whether GPS/location is enabled on the device. |  |
| `isTrackingEnabled` | `boolean` **|** `null` | Indicates whether location tracking is enabled for the device. |  |
| `knoxStatus` | `string` **|** `null` | Samsung Knox container status of the device. |  |
| `lastCheckedInOn` | `number` **|** `null` | Timestamp (ms since epoch) when the device last checked in with SureMDM. |  |
| `localIpAddress` | `string` **|** `null` | Local/private IP address reported by the device. |  |
| `macAddress` | `string` **|** `null` | MAC address of the device. |  |
| `memoryStorageAvailable` | `number` **|** `null` | Available internal storage on the device, in bytes. |  |
| `networkType` | `string` **|** `null` | Type of network the device is connected to (e.g. WiFi, Mobile). |  |
| `operator` | `string` **|** `null` | Mobile network operator/carrier for the device. |  |
| `osBuildNumber` | `string` **|** `null` | Operating system build number reported by the device. |  |
| `phoneRoaming` | `string` **|** `null` | Indicates whether the device is roaming. |  |
| `phoneSignal` | `number` **|** `null` | Cellular signal strength reported by the device. |  |
| `platformType` | `string` **|** `null` | The raw platform type reported by SureMDM (e.g. Android, iOS, Windows). |  |
| `realDeviceName` | `string` **|** `null` | Hardware/real device name as reported by the device. |  |
| `releaseVersion` | `string` **|** `null` | Operating system release version reported by the device. |  |
| `rootStatus` | `string` **|** `null` | Indicates whether the device is rooted/jailbroken. |  |
| `securityPatchedOn` | `number` **|** `null` | Timestamp (ms since epoch) of the latest security patch applied to the device. |  |
| `simSerialNumber` | `string` **|** `null` | SIM serial number (ICCID) of the device. |  |
| `storageMemoryTotal` | `number` **|** `null` | Total internal storage capacity of the device, in bytes. |  |
| `temperature` | `number` **|** `null` | Current device temperature reading. |  |
| `totalPhysicalMemory` | `number` **|** `null` | Total physical memory (RAM) of the device, in bytes. |  |
| `wifiSignal` | `number` **|** `null` | Wi-Fi signal strength reported by the device. |  |
| `wifiSSID` | `string` **|** `null` | SSID of the Wi-Fi network the device is connected to. |  |

---

### Suremdm Group

`suremdm_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `defaultJobsCount` | `number` **|** `null` | Number of default jobs associated with the group. |  |
| `deviceNameRule` | `string` **|** `null` | The device naming rule applied to devices in the group, null if none. |  |
| 
`groupId` \*

 | `string` | The unique group identifier assigned by SureMDM. |  |
| `groupPath` | `string` **|** `null` | Full path of the group within the group hierarchy (e.g. Home/Devices/Site1). |  |
| `groupType` | `number` **|** `null` | The type of the group (e.g. 0 for a normal group). |  |

---

---

Source: /integrations/directory/github

# GitHub

Visualize GitHub users, teams, repositories, pull requests, issues, code scanning alerts and more. Map GitHub users to employees and training, and monitor software development activities, installations of GitHub apps, and outside collaborators.

## Installation

In order for this integration to run as expected, you will need to have an organization within the GitHub account for which you are creating the integration. Be sure to create an organization in your GitHub account to ensure having the required permissions. [Learn more about GitHub organizations here](https://docs.github.com/en/organizations/collaborating-with-groups-in-organizations/about-organizations).

> **INFO**
> 
> GitHub Cloud & GitHub Enterprise Server Versions 3.3.3 and above have been verified as compatible with this integration. Other versions of GitHub Enterprise may work, but are not fully supported.

### Configuration in JupiterOne

To install the GitHub integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select GitHub. Click **New Instance** to begin configuring the integration.

> **NOTE**
> 
> This integration limits the ingestion of **pull requests** and **issues** to the 500 most recently created or modified since the last execution.

In the new instance configuration, provide:

-   **Account Name** used to identify the GitHub account in JupiterOne. Ingested entities have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **For GitHub Enterprise Servers only**: enable the toggle and provide the relevant **Hostname**, **App ID**, **App Installation ID**, and upload your **API Private Key**.
    

After creating a new GitHub integration configuration in JupiterOne, you will be re-directed to GitHub to install the JupiterOne GitHub app. The app requests read-only permissions to support ingestion of entities and relationships.

View GitHub permissions

##### Note

The Secrets API does not reveal the values of Secrets, only their names and creation dates.

##### Repository Permissions

-   Actions: Read-only
-   Administration: Read-only
-   Contents: Read-only (Only CODEOWNERS file is read when that step is enabled)
-   Dependabot alerts: Read-only
-   Discussions: Read-only
-   Environments: Read-only
-   Issues: Read-only (enables both Issues and private-repo PRs)
-   Metadata: Read-only
-   Pages: Read-only
-   Pull requests: Read-only
-   Secrets: Read-only
-   Secret scanning alerts: Read-only
-   Webhooks: Read-only

##### Organization Permissions

-   Administration: Read-only
-   Members: Read-only
-   Secrets: Read-only
-   Events: Read-only
-   Webhooks: Read-only

##### User Permissioms

-   None

> **INFO**
> 
> Refer to GitHub's documentation information on [setting GitHub app permissions](https://developer.github.com/apps/building-github-apps/setting-permissions-for-github-apps/) and [secret permissions](https://docs.github.com/en/rest/reference/permissions-required-for-github-apps#permission-on-secrets)

## Data Volume Configuration

Control how much data is ingested from GitHub to manage storage and processing.

### Ingestion Windows (Time Ranges)

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Pull Requests Ingestion Window** | Ingestion window for updated pull requests (days ago) | 90 | 90, 180, 275, 365 |
| **Issues Ingestion Window** | Ingestion window for updated issues (days ago) | 90 | 90, 180, 275, 365 |

**How it affects data volume:** Longer windows increase the number of pull requests and issues ingested. The integration limits ingestion to the 500 most recently created or modified items since the last execution.

### Data Filtering Options

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **States Filter** (Dependabot) | Multi-select | Limit ingestion to Dependabot alerts with specified states | Open |
| **Severities Filter** (Dependabot) | Multi-select | Limit ingestion to Dependabot alerts with specified severities | Critical, High, Moderate, Low |
| **Ingest Generic Secret Alerts** | Boolean | Ingest generic secret alerts including default and generic patterns | `false` |

**How it affects data volume:**

-   Dependabot state filtering reduces alerts by excluding dismissed and fixed alerts. By default, only open alerts are ingested.
-   Dependabot severity filtering limits alerts to selected severities. By default, all severity levels are included.
-   Generic secret alerts, when enabled, increases the volume of secret scanning alerts by including generic patterns.

### Hierarchy of data retrieval

This integration uses many steps to retrieve data. Some of the steps depend on others. If there is a crash or error, it might be helpful to understand the hierarchy of step dependency:

-   The root step is `fetch-account`. All other steps depend on it.
-   There are four steps that depend only on `fetch-account` that could be considered primary steps. These are:
    1.  `fetch-apps`
    2.  `fetch-repos`
    3.  `fetch-users`
    4.  `fetch-teams`.
-   Other steps logically require multiple primary steps to complete. Examples include:
    -   `fetch-collaborators`
    -   `fetch-team-members`
    -   `fetch-team-repos`
-   Finally, some sophisticated steps require both primary steps and secondary steps before they can execute. For example, `fetch-prs` needs both `fetch-repos` and `fetch-collaborators` in order to properly label reviewers and approvers.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (2)

-   `Dependabot alerts: Read-only`
-   `read:org`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (2)

-   `{githubApiBaseUrl}/graphql`
-   `{githubApiBaseUrl}/orgs/{org}/credential-authorizations`

### Licenses

Product licenses or SKUs required in the target environment.

Show Licenses (1)

-   `GitHub Enterprise Cloud with SAML single sign-on enabled`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://docs.github.com/en/enterprise-cloud@latest/rest/orgs/orgs?apiVersion=2022-11-28#list-saml-sso-authorizations-for-an-organization](https://docs.github.com/en/enterprise-cloud@latest/rest/orgs/orgs?apiVersion=2022-11-28#list-saml-sso-authorizations-for-an-organization)
-   [https://docs.github.com/en/graphql/reference/dependabot](https://docs.github.com/en/graphql/reference/dependabot)
-   [https://docs.github.com/en/graphql/reference/security-advisories](https://docs.github.com/en/graphql/reference/security-advisories)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `github_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Github App | `github_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Github Branch Protection Rule | `github_branch_protection_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| GitHub Code Scanning Alerts | `github_code_scanning_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| GitHub Container Image | `github_container_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| GitHub Credential Authorization | `github_credential_authorization` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| GitHub Env Secret | `github_env_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Github Environment | `github_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| GitHub IP Range | `github_ip_range` | [IpRange](https://docs.jupiterone.io/data-model/schemas/IpRange) |
| Github Issue | `github_issue` | [Issue](https://docs.jupiterone.io/data-model/schemas/Issue) |
| Github Org Secret | `github_org_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| GitHub Organization Webhook | `github_org_webhook` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| GitHub Package | `github_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Github Pull Request | `github_pullrequest` | [PR](https://docs.jupiterone.io/data-model/schemas/PR) |
| Github Repo | `github_repo` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Github Repo Secret | `github_repo_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| GitHub Repository Webhook | `github_repo_webhook` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| GitHub Secret Scanning Alert | `github_secret_scanning_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Github Team | `github_team` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Github User | `github_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| GitHub Vulnerability Alert | `github_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| GitHub Vulnerability Alert | `github_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| GitHub Vulnerability Alert | `github_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Weakness](https://docs.jupiterone.io/data-model/schemas/Weakness) |
| Organization Role | `github_org_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Ruleset | `github_ruleset` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| Ruleset Rule | `github_ruleset_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `github_account` | **HAS** | `github_user` |
| `github_account` | **OWNS** | `github_repo` |
| `github_account` | **HAS** | `github_team` |
| `github_account` | **INSTALLED** | `github_app` |
| `github_account` | **HAS** | `github_org_secret` |
| `github_account` | **MANAGES** | `github_ruleset` |
| `github_account` | **MANAGES** | `github_org_role` |
| `github_account` | **ALLOWS** | `github_ip_range` |
| `github_account` | **HAS** | `github_package` |
| `github_account` | **HAS** | `github_container_image` |
| `github_account` | **HAS** | `github_org_webhook` |
| `github_account` | **HAS** | `github_credential_authorization` |
| `github_app` | **OVERRIDES** | `github_branch_protection_rule` |
| `github_env_secret` | **OVERRIDES** | `github_org_secret` |
| `github_env_secret` | **OVERRIDES** | `github_repo_secret` |
| `github_environment` | **HAS** | `github_env_secret` |
| `github_finding` | **HAS** | `github_pullrequest` |
| `github_pullrequest` | **CONTAINS** | `github_pullrequest` |
| `github_repo` | **HAS** | `github_code_scanning_finding` |
| `github_repo` | **ALLOWS** | `github_user` |
| `github_repo` | **HAS** | `github_pullrequest` |
| `github_repo` | **HAS** | `github_issue` |
| `github_repo` | **HAS** | `github_environment` |
| `github_repo` | **USES** | `github_org_secret` |
| `github_repo` | **HAS** | `github_repo_secret` |
| `github_repo` | **USES** | `github_repo_secret` |
| `github_repo` | **USES** | `github_env_secret` |
| `github_repo` | **ALLOWS** | `github_team` |
| `github_repo` | **HAS** | `github_finding` |
| `github_repo` | **HAS** | `github_branch_protection_rule` |
| `github_repo` | **HAS** | `github_secret_scanning_finding` |
| `github_repo` | **HAS** | `github_package` |
| `github_repo` | **HAS** | `github_container_image` |
| `github_repo` | **HAS** | `github_repo_webhook` |
| `github_repo_secret` | **OVERRIDES** | `github_org_secret` |
| `github_ruleset` | **ENFORCES** | `github_repo` |
| `github_ruleset` | **HAS** | `github_ruleset_rule` |
| `github_team` | **HAS** | `github_user` |
| `github_team` | **OVERRIDES** | `github_branch_protection_rule` |
| `github_team` | **ASSIGNED** | `github_org_role` |
| `github_team` | **MANAGES** | `github_repo` |
| `github_user` | **MANAGES** | `github_account` |
| `github_user` | **APPROVED** | `github_pullrequest` |
| `github_user` | **OPENED** | `github_pullrequest` |
| `github_user` | **REVIEWED** | `github_pullrequest` |
| `github_user` | **UPDATED** | `github_pullrequest` |
| `github_user` | **CREATED** | `github_issue` |
| `github_user` | **ASSIGNED** | `github_issue` |
| `github_user` | **MANAGES** | `github_team` |
| `github_user` | **OVERRIDES** | `github_branch_protection_rule` |
| `github_user` | **ASSIGNED** | `github_org_role` |
| `github_user` | **MANAGES** | `github_repo` |
| `github_user` | **UPDATED** | `github_repo` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `github_finding` | **IS** | `cve` | FORWARD |
| `github_finding` | **EXPLOITS** | `cwe` | FORWARD |
| `github_issue` | **CREATED** | `github_user` | REVERSE |
| `github_issue` | **ASSIGNED** | `github_user` | REVERSE |
| `github_pullrequest` | **OPENED** | `github_user` | REVERSE |
| `github_pullrequest` | **REVIEWED** | `github_user` | REVERSE |
| `github_pullrequest` | **APPROVED** | `github_user` | REVERSE |

### Github Account

`github_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`accountType` \*

 | `string` |  |  |
| 

`databaseId` \*

 | `number` |  |  |
| 

`email` \*

 | `string` |  |  |
| 

`location` \*

 | `string` |  |  |
| 

`login` \*

 | `string` |  |  |
| 

`node` \*

 | `string` |  |  |
| 

`verified` \*

 | `boolean` |  |  |
| 

`websiteUrl` \*

 | `string` |  |  |

---

### Github App

`github_app` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`appId` \*

 | `number` |  |  |
| 

`appSlug` \*

 | `string` |  |  |
| 

`events` \*

 | `array` of `string`s |  |  |
| 

`hasMultipleSingleFiles` \*

 | `boolean` |  |  |
| 

`installationId` \*

 | `number` |  |  |
| `ownerLogin` | `string` | GitHub login of the user or organization that owns (publishes) the GitHub App |  |
| `ownerType` | `string` | Owner type returned by the API: User or Organization |  |
| `publisherUrl` | `string` | URL of the publisher's GitHub profile (e.g. [https://github.com/dependabot](https://github.com/dependabot)) |  |
| 

`repositorySelection` \*

 | `string` |  | **Any of**:

-   `all`

-   `selected`

 |
| 

`singleFileName` \*

 | `string` |  |  |
| 

`singleFilePaths` \*

 | `array` of `string`s |  |  |
| `suspendedBy` | `string` | GitHub login of the user who suspended the installation, if suspended |  |
| `suspendedOn` | `number` |  |  |
| 

`targetId` \*

 | `number` |  |  |
| 

`targetType` \*

 | `string` |  |  |

---

### Github Branch Protection Rule

`github_branch_protection_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allowDeletions` \*

 | `boolean` |  |  |
| 

`allowForcePushes` \*

 | `boolean` |  |  |
| 

`blockCreations` \*

 | `boolean` |  |  |
| 

`enforceAdmins` \*

 | `boolean` |  |  |
| 

`requireCodeOwnerReviews` \*

 | `boolean` |  |  |
| 

`requiredApprovingReviewCount` \*

 | `number` **|** `null` |  |  |
| 

`requiredConversationResolution` \*

 | `boolean` |  |  |
| 

`requiredLinearHistory` \*

 | `boolean` |  |  |
| 

`requiredSignatures` \*

 | `boolean` |  |  |
| 

`requiredStatusChecks` \*

 | `array` of `string`s |  |  |

---

### Github Code Scanning Finding

`github_code_scanning_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alertSeverity` | `string` |  |  |
| `cwe` | `array` **|** `null` |  |  |
| `dismissedComment` | `string` **|** `null` |  |  |
| `dismissedOn` | `number` |  |  |
| 
`dismissedReason` \*

 | `string` **|** `null` |  | **Any of**:

-   `false positive`

-   `won't fix`

-   `used in tests`

-   `undefined`

 |
| `fixedOn` | `number` |  |  |
| 

`number` \*

 | `number` |  |  |
| `path` | `string` |  |  |
| `ruleTags` | `array` **|** `null` |  |  |
| 

`state` \*

 | `string` |  |  |
| `toolName` | `string` |  |  |
| `toolVersion` | `string` **|** `null` |  |  |
| 

`weblink` \*

 | `string` |  |  |

---

### Github Container Image

`github_container_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`digest` \*

 | `string` **|** `null` |  |  |
| 

`fullName` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`packageId` \*

 | `number` |  |  |
| 

`packageName` \*

 | `string` |  |  |
| 

`packageType` \*

 | `string` |  | **const**: container |
| 

`repositoryId` \*

 | `number` **|** `null` |  |  |
| 

`repositoryName` \*

 | `string` **|** `null` |  |  |
| 

`repositoryNodeId` \*

 | `string` **|** `null` |  |  |
| 

`tags` \*

 | `array` **|** `null` |  |  |
| 

`versionId` \*

 | `number` |  |  |
| 

`visibility` \*

 | `string` |  | **Any of**:

-   `public`

-   `private`

-   `internal`

 |

---

### Github Credential Authorization

`github_credential_authorization` inherits from [AccessKey](/data-model/schemas/AccessKey.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessedOn` \*

 | `number` **|** `null` | Timestamp (epoch milliseconds) the credential was last used; null if it has never been used. |  |
| 

`authorizedCredentialId` \*

 | `number` **|** `null` | Identifier of the specific token or key that was authorized; null when not applicable. |  |
| 

`authorizedCredentialNote` \*

 | `string` **|** `null` | User-supplied note describing the authorized credential; null when none was set. |  |
| 

`authorizedCredentialTitle` \*

 | `string` **|** `null` | User-supplied title of the authorized credential; null when none was set. |  |
| 

`credentialId` \*

 | `number` | GitHub-assigned identifier for the SSO credential authorization. |  |
| 

`credentialType` \*

 | `string` | Kind of credential authorized for SSO, as labelled by GitHub: 'personal access token', 'SSH key', 'OAuth app token', or 'GitHub app token'. |  |
| 

`login` \*

 | `string` | GitHub username of the account that owns the authorized credential. |  |
| 

`scopes` \*

 | `array` **|** `null` | Scopes granted to the authorized credential; returned for personal access tokens (classic) only, null for other credential types. |  |
| 

`tokenLastEight` \*

 | `string` **|** `null` | Last eight characters of the authorized token, used to identify it; null when unavailable. |  |

---

### Github Env Secret

`github_env_secret` inherits from [Secret](/data-model/schemas/Secret.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`visibility` \*

 | `string` |  | **const**: selected |

---

### Github Environment

`github_environment` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`htmlUrl` \*

 | `string` |  |  |
| 

`nodeId` \*

 | `string` |  |  |
| 

`parentRepoDatabaseId` \*

 | `string` |  |  |
| 

`parentRepoKey` \*

 | `string` |  |  |
| 

`parentRepoName` \*

 | `string` |  |  |
| 

`protectionRulesExist` \*

 | `boolean` |  |  |
| 

`url` \*

 | `string` |  |  |

---

### Github Finding

`github_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alertTags` | `array` **|** `null` | Labels GitHub shows under "Tags" on the Dependabot alert: "Runtime dependency" or "Development dependency", "Patch available", "Direct" or "Transitive". Null when none apply |  |
| `databaseId` | `number` |  |  |
| `dependencyRelationship` | `string` **|** `null` | Whether the vulnerable dependency is a direct or transitive dependency of the repository. GitHub Cloud only; null on GitHub Enterprise Server | **Any of**:
-   `DIRECT`

-   `TRANSITIVE`

-   `INCONCLUSIVE`

-   `UNKNOWN`

-   `undefined`

 |
| `dependencyScope` | `string` |  | **Any of**:

-   `RUNTIME`

-   `DEVELOPMENT`

 |
| `dismissedOn` | `number` |  |  |
| `dismisserLogin` | `string` |  |  |
| `dismissReason` | `string` **|** `null` |  |  |
| `epssPercentile` | `number` **|** `null` | EPSS percentile (0-1) of the advisory relative to all scored CVEs, as returned by GitHub. GitHub Cloud and GHE Server 3.16+ |  |
| `epssScore` | `number` **|** `null` | EPSS score: probability (0-1) that the advisory is exploited in the next 30 days (GitHub field securityAdvisory.epss.percentage; GitHub shows it as a percent). GitHub Cloud and GHE Server 3.16+ |  |
| `firstPatchedVersion` | `string` **|** `null` | First version of the vulnerable package that contains a fix, if any |  |
| `fixedOn` | `number` |  |  |
| `ghsaId` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `isPatchAvailable` | `boolean` **|** `null` | True when GitHub reports a patched version of the vulnerable package (the "Patch available" tag in GitHub) |  |
| `number` | `number` |  |  |
| `origin` | `string` |  |  |
| `securityAdvisoryPublishedOn` | `number` |  |  |
| `securityAdvisoryUpdatedOn` | `number` |  |  |
| `securityAdvisoryWithdrawnOn` | `number` |  |  |
| 

`vulnerableManifestFilename` \*

 | `string` |  |  |
| 

`vulnerableManifestPath` \*

 | `string` |  |  |
| `vulnerablePackageEcosystem` | `string` |  |  |
| `vulnerablePackageName` | `string` |  |  |
| 

`vulnerableRequirements` \*

 | `string` |  |  |
| `vulnerableVersionRange` | `string` |  |  |
| 

`weblink` \*

 | `string` |  |  |

---

### Github Finding

`github_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alertTags` | `array` **|** `null` | Labels GitHub shows under "Tags" on the Dependabot alert: "Runtime dependency" or "Development dependency", "Patch available", "Direct" or "Transitive". Null when none apply |  |
| `databaseId` | `number` |  |  |
| `dependencyRelationship` | `string` **|** `null` | Whether the vulnerable dependency is a direct or transitive dependency of the repository. GitHub Cloud only; null on GitHub Enterprise Server | **Any of**:
-   `DIRECT`

-   `TRANSITIVE`

-   `INCONCLUSIVE`

-   `UNKNOWN`

-   `undefined`

 |
| `dependencyScope` | `string` |  | **Any of**:

-   `RUNTIME`

-   `DEVELOPMENT`

 |
| `dismissedOn` | `number` |  |  |
| `dismisserLogin` | `string` |  |  |
| `dismissReason` | `string` **|** `null` |  |  |
| `epssPercentile` | `number` **|** `null` | EPSS percentile (0-1) of the advisory relative to all scored CVEs, as returned by GitHub. GitHub Cloud and GHE Server 3.16+ |  |
| `epssScore` | `number` **|** `null` | EPSS score: probability (0-1) that the advisory is exploited in the next 30 days (GitHub field securityAdvisory.epss.percentage; GitHub shows it as a percent). GitHub Cloud and GHE Server 3.16+ |  |
| `firstPatchedVersion` | `string` **|** `null` | First version of the vulnerable package that contains a fix, if any |  |
| `fixedOn` | `number` |  |  |
| `ghsaId` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `isPatchAvailable` | `boolean` **|** `null` | True when GitHub reports a patched version of the vulnerable package (the "Patch available" tag in GitHub) |  |
| `number` | `number` |  |  |
| `origin` | `string` |  |  |
| `securityAdvisoryPublishedOn` | `number` |  |  |
| `securityAdvisoryUpdatedOn` | `number` |  |  |
| `securityAdvisoryWithdrawnOn` | `number` |  |  |
| 

`vulnerableManifestFilename` \*

 | `string` |  |  |
| 

`vulnerableManifestPath` \*

 | `string` |  |  |
| `vulnerablePackageEcosystem` | `string` |  |  |
| `vulnerablePackageName` | `string` |  |  |
| 

`vulnerableRequirements` \*

 | `string` |  |  |
| `vulnerableVersionRange` | `string` |  |  |
| 

`weblink` \*

 | `string` |  |  |

---

### Github Finding

`github_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Weakness](/data-model/schemas/Weakness.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alertTags` | `array` **|** `null` | Labels GitHub shows under "Tags" on the Dependabot alert: "Runtime dependency" or "Development dependency", "Patch available", "Direct" or "Transitive". Null when none apply |  |
| `databaseId` | `number` |  |  |
| `dependencyRelationship` | `string` **|** `null` | Whether the vulnerable dependency is a direct or transitive dependency of the repository. GitHub Cloud only; null on GitHub Enterprise Server | **Any of**:
-   `DIRECT`

-   `TRANSITIVE`

-   `INCONCLUSIVE`

-   `UNKNOWN`

-   `undefined`

 |
| `dependencyScope` | `string` |  | **Any of**:

-   `RUNTIME`

-   `DEVELOPMENT`

 |
| `dismissedOn` | `number` |  |  |
| `dismisserLogin` | `string` |  |  |
| `dismissReason` | `string` **|** `null` |  |  |
| `epssPercentile` | `number` **|** `null` | EPSS percentile (0-1) of the advisory relative to all scored CVEs, as returned by GitHub. GitHub Cloud and GHE Server 3.16+ |  |
| `epssScore` | `number` **|** `null` | EPSS score: probability (0-1) that the advisory is exploited in the next 30 days (GitHub field securityAdvisory.epss.percentage; GitHub shows it as a percent). GitHub Cloud and GHE Server 3.16+ |  |
| `firstPatchedVersion` | `string` **|** `null` | First version of the vulnerable package that contains a fix, if any |  |
| `fixedOn` | `number` |  |  |
| `ghsaId` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `isPatchAvailable` | `boolean` **|** `null` | True when GitHub reports a patched version of the vulnerable package (the "Patch available" tag in GitHub) |  |
| `number` | `number` |  |  |
| `origin` | `string` |  |  |
| `securityAdvisoryPublishedOn` | `number` |  |  |
| `securityAdvisoryUpdatedOn` | `number` |  |  |
| `securityAdvisoryWithdrawnOn` | `number` |  |  |
| 

`vulnerableManifestFilename` \*

 | `string` |  |  |
| 

`vulnerableManifestPath` \*

 | `string` |  |  |
| `vulnerablePackageEcosystem` | `string` |  |  |
| `vulnerablePackageName` | `string` |  |  |
| 

`vulnerableRequirements` \*

 | `string` |  |  |
| `vulnerableVersionRange` | `string` |  |  |
| 

`weblink` \*

 | `string` |  |  |

---

### Github Ip Range

`github_ip_range` inherits from [IpRange](/data-model/schemas/IpRange.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Github Issue

`github_issue` inherits from [Issue](/data-model/schemas/Issue.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeLockReason` | `string` **|** `null` |  | **Any of**:
-   `OFF_TOPIC`

-   `TOO_HEATED`

-   `RESOLVED`

-   `SPAM`

-   `undefined`

 |
| 

`authorAssociation` \*

 | `string` |  |  |
| `body` | `string` |  |  |
| 

`closed` \*

 | `boolean` |  |  |
| `closedOn` | `number` |  |  |
| 

`createdViaEmail` \*

 | `boolean` |  |  |
| 

`databaseId` \*

 | `number` |  |  |
| 

`labels` \*

 | `array` of `string`s |  |  |
| `lastEditedOn` | `number` |  |  |
| 

`locked` \*

 | `boolean` |  |  |
| 

`number` \*

 | `number` |  |  |
| 

`pinned` \*

 | `boolean` |  |  |
| `publishedOn` | `number` |  |  |
| 

`resourcePath` \*

 | `string` |  |  |
| 

`state` \*

 | `string` |  |  |
| 

`title` \*

 | `string` |  |  |
| 

`url` \*

 | `string` |  |  |

---

### Github Org Role

`github_org_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `baseRole` | `string` **|** `null` |  |  |
| 
`permissions` \*

 | `array` of `string`s |  |  |
| `source` | `string` **|** `null` |  | **Any of**:

-   `Organization`

-   `Enterprise`

-   `Predefined`

-   `undefined`

 |

---

### Github Org Secret

`github_org_secret` inherits from [Secret](/data-model/schemas/Secret.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `selectedRepositoriesLink` | `string` |  |  |
| `visibility` | `string` |  |  |

---

### Github Org Webhook

`github_org_webhook` inherits from [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`active` \*

 | `boolean` | Whether the webhook sends deliveries. |  |
| `contentType` | `string` | Media type of the delivery payload (json or form). |  |
| 

`events` \*

 | `array` of `string`s | Events that trigger the webhook. |  |
| 

`hasSecret` \*

 | `boolean` | Whether a signing secret is configured. The secret itself is never ingested. |  |
| 

`insecureSsl` \*

 | `boolean` | Whether SSL certificate verification is disabled for deliveries. |  |
| `url` | `string` | Scheme and host of the delivery URL. Path, query and credentials are dropped because they can hold tokens. |  |
| 

`webhookId` \*

 | `number` | GitHub webhook id. |  |

---

### Github Package

`github_package` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`packageId` \*

 | `number` |  |  |
| 

`packageType` \*

 | `string` | Examples: npm, maven, rubygems, nuget. |  |
| 

`repositoryId` \*

 | `number` **|** `null` |  |  |
| 

`repositoryName` \*

 | `string` **|** `null` |  |  |
| 

`repositoryNodeId` \*

 | `string` **|** `null` |  |  |
| 

`versionCount` \*

 | `number` **|** `null` |  |  |
| 

`visibility` \*

 | `string` |  | **Any of**:

-   `public`

-   `private`

-   `internal`

 |

---

### Github Pullrequest

`github_pullrequest` inherits from [PR](/data-model/schemas/PR.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountLogin` \*

 | `string` |  |  |
| `allCommitsApproved` | `boolean` | Indicates whether all commits in the pull request are approved. Not available for private repositories. |  |
| `approvalLastAt` | `number` |  |  |
| 

`approvalsCount` \*

 | `number` |  |  |
| 

`approverLogins` \*

 | `array` of `string`s |  |  |
| `approvers` | `array` of `string`s |  |  |
| 

`author` \*

 | `string` |  |  |
| 

`authorLogin` \*

 | `string` |  |  |
| `closedOn` | `number` |  |  |
| `commitMessages` | `array` of `string`s | Commit messages corresponding to each commit in the pull request. Not available for private repositories. |  |
| 

`commits` \*

 | `array` of `string`s | List of commit hashes included in the pull request. Not available for private repositories. |  |
| `commitsApproved` | `array` of `string`s | List of commit hashes that have been approved. Not available for private repositories. |  |
| `commitsByUnknownAuthor` | `array` of `string`s | List of commit hashes authored by users not found in the graph. Not available for private repositories. |  |
| 

`commitsCount` \*

 | `number` | Total number of commits in the pull request. Not available for private repositories. |  |
| 

`commitsNotApproved` \*

 | `array` of `string`s | List of commit hashes that have not been approved. Not available for private repositories. |  |
| `databaseId` | `number` |  |  |
| 

`declined` \*

 | `boolean` |  |  |
| 

`filesChangedCount` \*

 | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`labels` \*

 | `array` of `string`s |  |  |
| `mergeCommitHash` | `string` |  |  |
| 

`merged` \*

 | `boolean` |  |  |
| `mergedBy` | `string` |  |  |
| `mergedByLogin` | `string` |  |  |
| `mergedOn` | `number` |  |  |
| 

`node` \*

 | `string` |  |  |
| 

`number` \*

 | `number` |  |  |
| 

`pullRequestId` \*

 | `string` |  |  |
| `reviewDecision` | `string` **|** `null` |  | **Any of**:

-   `APPROVED`

-   `CHANGES_REQUESTED`

-   `REVIEW_REQUIRED`

-   `undefined`

 |
| 

`reviewerLogins` \*

 | `array` of `string`s |  |  |
| 

`reviewers` \*

 | `array` of `string`s |  |  |
| 

`sourceRefOid` \*

 | `string` |  |  |
| 

`targetRefOid` \*

 | `string` |  |  |

---

### Github Repo

`github_repo` inherits from [CodeRepo](/data-model/schemas/CodeRepo.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `archived` | `boolean` |  |  |
| `autoMergeAllowed` | `boolean` |  |  |
| `databaseId` | `number` |  |  |
| `deleteBranchOnMerge` | `boolean` |  |  |
| `disabled` | `boolean` |  |  |
| `empty` | `boolean` |  |  |
| `fork` | `boolean` |  |  |
| `forkCount` | `number` |  |  |
| `forkingAllowed` | `boolean` |  |  |
| 
`fullName` \*

 | `string` |  |  |
| 

`homepageUrl` \*

 | `string` |  |  |
| `inOrganization` | `boolean` |  |  |
| `locked` | `boolean` |  |  |
| 

`lockReason` \*

 | `string` |  |  |
| `mergeCommitAllowed` | `boolean` |  |  |
| `mirror` | `boolean` |  |  |
| 

`node` \*

 | `string` |  |  |
| `pushedOn` | `number` |  |  |
| `rebaseMergeAllowed` | `boolean` |  |  |
| `securityPolicyEnabled` | `boolean` |  |  |
| `template` | `boolean` |  |  |
| `userConfigurationRepository` | `boolean` |  |  |
| 

`visibility` \*

 | `string` |  | **Any of**:

-   `INTERNAL`

-   `PRIVATE`

-   `PUBLIC`

 |

---

### Github Repo Secret

`github_repo_secret` inherits from [Secret](/data-model/schemas/Secret.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`visibility` \*

 | `string` |  | **const**: selected |

---

### Github Repo Webhook

`github_repo_webhook` inherits from [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`active` \*

 | `boolean` | Whether the webhook sends deliveries. |  |
| `contentType` | `string` | Media type of the delivery payload (json or form). |  |
| 

`events` \*

 | `array` of `string`s | Events that trigger the webhook. |  |
| 

`hasSecret` \*

 | `boolean` | Whether a signing secret is configured. The secret itself is never ingested. |  |
| 

`insecureSsl` \*

 | `boolean` | Whether SSL certificate verification is disabled for deliveries. |  |
| `url` | `string` | Scheme and host of the delivery URL. Path, query and credentials are dropped because they can hold tokens. |  |
| 

`webhookId` \*

 | `number` | GitHub webhook id. |  |

---

### Github Ruleset

`github_ruleset` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`enforcement` \*

 | `string` |  | **Any of**:

-   `DISABLED`

-   `ACTIVE`

-   `EVALUATE`

 |
| 

`source` \*

 | `string` |  | **Any of**:

-   `Enterprise`

-   `Repository`

-   `Organization`

 |
| `target` | `string` |  | **Any of**:

-   `BRANCH`

-   `TAG`

-   `PUSH`

-   `REPOSITORY`

 |

---

### Github Ruleset Rule

`github_ruleset_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowedMergeMethods` | `array` of `string`s |  |  |
| `checkResponseTimeoutMinutes` | `number` |  |  |
| `codeScanningTools` | `array` of `string`s |  |  |
| `dismissStaleReviewsOnPush` | `boolean` |  |  |
| `doNotEnforceOnCreate` | `boolean` |  |  |
| `groupingStrategy` | `string` |  | **Any of**:
-   `ALLGREEN`

-   `HEADGREEN`

 |
| `maxEntriesToBuild` | `number` |  |  |
| `maxEntriesToMerge` | `number` |  |  |
| `maxFilePathLength` | `number` |  |  |
| `maxFileSize` | `number` |  |  |
| `mergeMethod` | `string` |  | **Any of**:

-   `MERGE`

-   `SQUASH`

-   `REBASE`

 |
| `minEntriesToMerge` | `number` |  |  |
| `minEntriesToMergeWaitMinutes` | `number` |  |  |
| `negate` | `boolean` |  |  |
| `operator` | `string` |  |  |
| `pattern` | `string` |  |  |
| `requireCodeOwnerReview` | `boolean` |  |  |
| `requiredApprovingReviewCount` | `number` |  |  |
| `requiredDeploymentEnvironments` | `array` of `string`s |  |  |
| `requiredReviewThreadResolution` | `boolean` |  |  |
| `requireLastPushApproval` | `boolean` |  |  |
| `restrictedFileExtensions` | `array` of `string`s |  |  |
| `restrictedFilePaths` | `array` of `string`s |  |  |
| `statusChecks` | `array` of `string`s |  |  |
| `strictRequiredStatusChecksPolicy` | `boolean` |  |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `AUTHORIZATION`

-   `BRANCH_NAME_PATTERN`

-   `CODE_SCANNING`

-   `COMMITTER_EMAIL_PATTERN`

-   `COMMIT_AUTHOR_EMAIL_PATTERN`

-   `COMMIT_MESSAGE_PATTERN`

-   `CREATION`

-   `DELETION`

-   `FILE_EXTENSION_RESTRICTION`

-   `FILE_PATH_RESTRICTION`

-   `LOCK_BRANCH`

-   `MAX_FILE_PATH_LENGTH`

-   `MAX_FILE_SIZE`

-   `MAX_REF_UPDATES`

-   `MERGE_QUEUE`

-   `MERGE_QUEUE_LOCKED_REF`

-   `NON_FAST_FORWARD`

-   `PULL_REQUEST`

-   `REQUIRED_DEPLOYMENTS`

-   `REQUIRED_LINEAR_HISTORY`

-   `REQUIRED_REVIEW_THREAD_RESOLUTION`

-   `REQUIRED_SIGNATURES`

-   `REQUIRED_STATUS_CHECKS`

-   `REQUIRED_WORKFLOW_STATUS_CHECKS`

-   `SECRET_SCANNING`

-   `TAG_NAME_PATTERN`

-   `UPDATE`

-   `WORKFLOWS`

-   `WORKFLOW_UPDATES`

 |
| `updateAllowsFetchAndMerge` | `boolean` |  |  |
| `workflows` | `array` of `string`s |  |  |

---

### Github Secret Scanning Finding

`github_secret_scanning_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `firstLocationCommitSha` | `string` **|** `null` | SHA of the commit where the secret was first detected, when the first location is a commit. |  |
| `firstLocationPath` | `string` **|** `null` | Path of the file where the secret was first detected, when the first location is a commit. |  |
| `isMultiRepo` | `boolean` **|** `null` | Whether the secret was detected in more than one repository. |  |
| `isPubliclyLeaked` | `boolean` **|** `null` | Whether the secret was publicly leaked. |  |
| 
`number` \*

 | `number` |  |  |
| `pushProtectionBypassed` | `boolean` **|** `null` |  |  |
| `pushProtectionBypassedBy` | `string` |  |  |
| `pushProtectionBypassedOn` | `number` |  |  |
| `resolution` | `string` **|** `null` |  | **Any of**:

-   `false_positive`

-   `wont_fix`

-   `revoked`

-   `used_in_tests`

-   `undefined`

 |
| `resolutionComment` | `string` **|** `null` |  |  |
| `resolvedBy` | `string` |  |  |
| `resolvedOn` | `number` |  |  |
| `secretType` | `string` |  |  |
| `secretTypeDisplayName` | `string` |  |  |
| `state` | `string` |  | **Any of**:

-   `open`

-   `resolved`

 |
| `validity` | `string` **|** `null` | Whether the detected secret is still valid: active, inactive or unknown. |  |

---

### Github Team

`github_team` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`databaseId` \*

 | `number` |  |  |
| 

`fullName` \*

 | `string` |  |  |
| 

`node` \*

 | `string` |  |  |
| 

`privacy` \*

 | `string` |  |  |

---

### Github User

`github_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`company` \*

 | `string` |  |  |
| 

`databaseId` \*

 | `number` |  |  |
| 

`employee` \*

 | `boolean` |  |  |
| 

`location` \*

 | `string` |  |  |
| 

`login` \*

 | `string` |  |  |
| 

`node` \*

 | `string` |  |  |
| 

`organizationId` \*

 | `string` |  |  |
| 

`role` \*

 | `string` |  |  |
| 

`siteAdmin` \*

 | `boolean` |  |  |
| 

`websiteUrl` \*

 | `string` |  |  |

---

## Release Notes

-   **2026-09-14** — Added ingestion of GitHub organization credential authorizations including SSH keys, personal access tokens, and OAuth tokens authorized for SAML SSO.
-   **2026-07-22** — GitHub code scanning findings now include CWE identifiers extracted from the finding rule's security tags.
-   **2026-06-01** — GitHub Apps now include owner login, publisher URL, and account type as queryable properties.
-   **2026-05-29** — Added support for GitHub fine-grained personal access tokens as an authentication method, in addition to classic tokens and GitHub Apps.
-   **2026-05-29** — GitHub integration now supports fine-grained personal access tokens as an authentication option, in addition to classic tokens and GitHub Apps.
-   **2026-04-28** — GitHub users who have recently committed to a repository are now linked to that repository, enabling commit activity analysis.
-   **2026-03-10** — Added webhook entity ingestion for both repositories and organizations, exposing webhook configurations as repository webhook and organization webhook entities.
-   **2026-02-27** — Disambiguated GitHub repository to user access relationships by access source (direct, team, or outside collaborator), enabling more precise permission queries.
-   **2026-01-14** — Added ingestion of repository CODEOWNERS file content and relationships to the owning users and teams.
-   **2025-12-16** — Added ingestion of GitHub Packages and container images as package entities with repository relationships.
-   **2025-10-29** — Added configuration option to limit the maximum number of repositories fetched during GitHub ingestion, useful for large organizations.
-   **2025-09-03** — Added ability to ingest and query GitHub repository Custom Properties as entity properties.
-   **2025-08-28** — Added finding to pull request relationships linking secret scanning and Dependabot findings to their associated pull requests.
-   **2025-07-08** — Added ingestion of GitHub secret scanning generic alerts as secret alert entities.
-   **2025-06-09** — Added configuration option to fetch collaborators via REST API as an alternative to GraphQL.
-   **2025-05-19** — Added allowed IP addresses of the GitHub organization as a queryable property on GitHub organization entities.
-   **2025-05-16** — Added user to pull request update relationship tracking PR update activity.
-   **2025-04-09** — Added Jira user to issue assignment relationship (backport from Jira integration for cross-integration linking).

---

Source: /integrations/directory/gitlab

# GitLab

Visualize GitLab users, groups, code repositories, and merge requests, map GitLab users to employees and development/security trainings, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> To use this integration, JupiterOne requires a [GitLab personal access token](https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html.) configured with read access (`read_api` scope) and the API base URL, such as [https://gitlab.com](https://gitlab.com)).

### Configuration in JupiterOne

To install the GitLab integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select GitLab. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Account Name** by which you'd like to identify this GitLab account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is selected.
    
-   **Description** that will further assist your team when identifying the integration instance.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Personal Access Token** configured for read access in GitLab.
    

> **NOTE**
> 
> Once your token has expired, the integration will no longer run successfully, and the token will be revoked from your GitLab account. You will need to create another token to replace the expired one.

-   Your GitLab **API Base URL** (e.g., `https://gitlab.com`, or your self-managed instance URL).

## Data Volume Configuration

Control how much data is ingested from GitLab to manage storage and processing.

### Ingestion Windows (Time Ranges)

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Merge Requests Ingestion Window** | Ingestion window for updated merge requests (days ago) | 90 | 90, 180, 275, 365 |

**How it affects data volume:** Longer windows increase the number of merge requests ingested from GitLab.

### Data Filtering Options

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **Included Vulnerability Severities** | Multi-select | Select vulnerability severities to ingest | Medium, High, Critical |
| **Included Vulnerability States** | Multi-select | Select vulnerability states to ingest | Confirmed, Detected |
| **Included Vulnerability Report Types** | Multi-select | Select vulnerability report types to ingest | None (all disabled by default) |
| **Ingest Regular Users Only** | Boolean | Skip all bot accounts including project and group bots | `false` |

**How it affects data volume:**

-   Severity filtering reduces vulnerabilities by excluding lower-severity findings. By default, only Medium, High, and Critical severabilities are ingested.
-   State filtering limits vulnerabilities to selected states. By default, only Confirmed and Detected vulnerabilities are ingested (Dismissed and Resolved are excluded).
-   Report type filtering allows selecting specific vulnerability scan types (SAST, DAST, Container Scanning, etc.). By default, all types are disabled and must be explicitly enabled.
-   User filtering, when enabled, excludes bot accounts from ingestion, reducing the number of user entities.

Click **Create** after all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (6)

-   `Administrator`
-   `Developer`
-   `Guest`
-   `Maintainer`
-   `Owner`
-   `Reporter`

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (2)

-   `read_api`
-   `read_user`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (19)

-   `/api/graphql`
-   `/api/v4/groups/:id/access_tokens`
-   `/api/v4/groups/:id/deploy_tokens`
-   `/api/v4/groups/:id/variables`
-   `/api/v4/personal_access_tokens`
-   `/api/v4/projects/:id`
-   `/api/v4/projects/:id/access_tokens`
-   `/api/v4/projects/:id/approval_rules`
-   `/api/v4/projects/:id/approvals`
-   `/api/v4/projects/:id/deploy_tokens`
-   `/api/v4/projects/:id/pipelines`
-   `/api/v4/projects/:id/pipelines/:pipeline_id`
-   `/api/v4/projects/:id/pipelines/:pipeline_id/jobs`
-   `/api/v4/projects/:id/protected_branches`
-   `/api/v4/projects/:id/push_rule`
-   `/api/v4/projects/:id/variables`
-   `/api/v4/projects/:id/vulnerability_findings`
-   `/api/v4/users`
-   `/api/v4/users/:id`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (22)

-   [https://docs.gitlab.com/api/deploy\_tokens/](https://docs.gitlab.com/api/deploy_tokens/)
-   [https://docs.gitlab.com/api/group\_access\_tokens/](https://docs.gitlab.com/api/group_access_tokens/)
-   [https://docs.gitlab.com/api/merge\_request\_approvals/](https://docs.gitlab.com/api/merge_request_approvals/)
-   [https://docs.gitlab.com/api/personal\_access\_tokens/](https://docs.gitlab.com/api/personal_access_tokens/)
-   [https://docs.gitlab.com/api/project\_access\_tokens/](https://docs.gitlab.com/api/project_access_tokens/)
-   [https://docs.gitlab.com/api/project\_push\_rules/](https://docs.gitlab.com/api/project_push_rules/)
-   [https://docs.gitlab.com/api/projects/](https://docs.gitlab.com/api/projects/)
-   [https://docs.gitlab.com/api/protected\_branches/](https://docs.gitlab.com/api/protected_branches/)
-   [https://docs.gitlab.com/ee/api/graphql/reference/#groups](https://docs.gitlab.com/ee/api/graphql/reference/#groups)
-   [https://docs.gitlab.com/ee/api/graphql/reference/#mergerequestcommits](https://docs.gitlab.com/ee/api/graphql/reference/#mergerequestcommits)
-   [https://docs.gitlab.com/ee/api/graphql/reference/#projectbranchrules](https://docs.gitlab.com/ee/api/graphql/reference/#projectbranchrules)
-   [https://docs.gitlab.com/ee/api/graphql/reference/#querycurrentuser](https://docs.gitlab.com/ee/api/graphql/reference/#querycurrentuser)
-   [https://docs.gitlab.com/ee/api/graphql/reference/#querymetadata](https://docs.gitlab.com/ee/api/graphql/reference/#querymetadata)
-   [https://docs.gitlab.com/ee/api/group\_level\_variables.html](https://docs.gitlab.com/ee/api/group_level_variables.html)
-   [https://docs.gitlab.com/ee/api/jobs.html](https://docs.gitlab.com/ee/api/jobs.html)
-   [https://docs.gitlab.com/ee/api/labels.html](https://docs.gitlab.com/ee/api/labels.html)
-   [https://docs.gitlab.com/ee/api/merge\_requests.html](https://docs.gitlab.com/ee/api/merge_requests.html)
-   [https://docs.gitlab.com/ee/api/pipelines.html](https://docs.gitlab.com/ee/api/pipelines.html)
-   [https://docs.gitlab.com/ee/api/project\_level\_variables.html](https://docs.gitlab.com/ee/api/project_level_variables.html)
-   [https://docs.gitlab.com/ee/api/projects.html](https://docs.gitlab.com/ee/api/projects.html)
-   [https://docs.gitlab.com/ee/api/users.html](https://docs.gitlab.com/ee/api/users.html)
-   [https://docs.gitlab.com/ee/api/vulnerability\_findings.html](https://docs.gitlab.com/ee/api/vulnerability_findings.html)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (19)

| Step | Roles | OAuth Scopes | Endpoints |
| --- | --- | --- | --- |
| Fetch Approval Rules | `Developer` | `read_api` | `/api/v4/projects/:id/approval_rules` |
| Fetch Branch Rules | `Maintainer` | `read_api` | `/api/graphql` |
| Fetch CI jobs | `Reporter` | `read_api` | `/api/v4/projects/:id/pipelines/:pipeline_id/jobs` |
| Fetch CI/CD variables | `Maintainer`, `Owner` | `read_api` | `/api/v4/projects/:id/variables`, `/api/v4/groups/:id/variables` |
| Fetch group access tokens | `Owner` | `read_api` | `/api/v4/groups/:id/access_tokens` |
| Fetch group deploy tokens | `Maintainer`, `Owner` | `read_api` | `/api/v4/groups/:id/deploy_tokens` |
| Fetch merge requests | `Reporter` | `read_api` | `/api/graphql` |
| Fetch MR commits | `Reporter` | `read_api` | `/api/graphql` |
| Fetch personal access tokens | `Administrator` | `read_api` | `/api/v4/personal_access_tokens` |
| Fetch pipelines | `Reporter` | `read_api` | `/api/v4/projects/:id/pipelines`, `/api/v4/projects/:id/pipelines/:pipeline_id` |
| Fetch project access tokens | `Maintainer`, `Owner` | `read_api` | `/api/v4/projects/:id/access_tokens` |
| Fetch Project Config | `Developer` | `read_api` | `/api/v4/projects/:id`, `/api/v4/projects/:id/approvals` |
| Fetch project deploy tokens | `Maintainer`, `Owner` | `read_api` | `/api/v4/projects/:id/deploy_tokens` |
| Fetch Project Labels | `Guest` | `read_api` | `/api/graphql` |
| Fetch Project Push Rules | `Maintainer` | `read_api` | `/api/v4/projects/:id/push_rule` |
| Fetch projects | `Guest` | `read_api` | `/api/graphql` |
| Fetch Protected Branches | `Developer` | `read_api` | `/api/v4/projects/:id/protected_branches` |
| Fetch users | `Reporter` | `read_user`, `read_api` | `/api/graphql`, `/api/v4/users`, `/api/v4/users/:id` |
| Fetch Vulnerability Findings | `Developer` | `read_api` | `/api/graphql`, `/api/v4/projects/:id/vulnerability_findings` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `gitlab_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Approval Rule | `gitlab_approval_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Branch Rule | `gitlab_branch_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| CI Job | `gitlab_ci_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| CI/CD Variable | `gitlab_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Commit | `gitlab_commit` | [CodeCommit](https://docs.jupiterone.io/data-model/schemas/CodeCommit) |
| Deploy Token | `gitlab_deploy_token` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Finding | `gitlab_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Group | `gitlab_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Group Access Token | `gitlab_group_access_token` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Label | `gitlab_label` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Merge Request | `gitlab_merge_request` | [CodeReview](https://docs.jupiterone.io/data-model/schemas/CodeReview), [PR](https://docs.jupiterone.io/data-model/schemas/PR) |
| NHI User | `gitlab_user` | [User](https://docs.jupiterone.io/data-model/schemas/User), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Personal Access Token | `gitlab_personal_access_token` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Pipeline | `gitlab_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| Project | `gitlab_project` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo), [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Project Access Token | `gitlab_project_access_token` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Project Setting | `gitlab_project_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Push Rule | `gitlab_push_rule` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| User | `gitlab_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `gitlab_account` | **HAS** | `gitlab_group` |
| `gitlab_account` | **HAS** | `gitlab_project` |
| `gitlab_approval_rule` | **ALLOWS** | `gitlab_user` |
| `gitlab_approval_rule` | **ALLOWS** | `gitlab_group` |
| `gitlab_branch_rule` | **ALLOWS** | `gitlab_user` |
| `gitlab_branch_rule` | **ALLOWS** | `gitlab_group` |
| `gitlab_group` | **HAS** | `gitlab_group` |
| `gitlab_group` | **HAS** | `gitlab_project` |
| `gitlab_group` | **HAS** | `gitlab_user` |
| `gitlab_group` | **HAS** | `gitlab_secret` |
| `gitlab_group` | **HAS** | `gitlab_group_access_token` |
| `gitlab_group` | **HAS** | `gitlab_deploy_token` |
| `gitlab_merge_request` | **HAS** | `gitlab_commit` |
| `gitlab_merge_request` | **HAS** | `gitlab_pipeline` |
| `gitlab_pipeline` | **HAS** | `gitlab_ci_job` |
| `gitlab_project` | **HAS** | `gitlab_user` |
| `gitlab_project` | **HAS** | `gitlab_finding` |
| `gitlab_project` | **HAS** | `gitlab_merge_request` |
| `gitlab_project` | **HAS** | `gitlab_label` |
| `gitlab_project` | **HAS** | `gitlab_branch_rule` |
| `gitlab_project` | **HAS** | `gitlab_push_rule` |
| `gitlab_project` | **HAS** | `gitlab_project_setting` |
| `gitlab_project` | **HAS** | `gitlab_approval_rule` |
| `gitlab_project` | **HAS** | `gitlab_pipeline` |
| `gitlab_project` | **HAS** | `gitlab_secret` |
| `gitlab_project` | **HAS** | `gitlab_project_access_token` |
| `gitlab_project` | **HAS** | `gitlab_deploy_token` |
| `gitlab_user` | **APPROVED** | `gitlab_merge_request` |
| `gitlab_user` | **OPENED** | `gitlab_merge_request` |
| `gitlab_user` | **HAS** | `gitlab_personal_access_token` |

### Gitlab Account

`gitlab_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`enterprise` \*

 | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`revision` \*

 | `string` |  |  |
| 

`vendor` \*

 | `string` |  |  |
| 

`version` \*

 | `string` |  |  |

---

### Gitlab Approval Rule

`gitlab_approval_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `approvalsRequired` | `number` **|** `null` | Number of approvals this rule requires (API approvals\_required). |  |
| `isAppliedToAllProtectedBranches` | `boolean` **|** `null` | Whether the rule applies to all protected branches (API applies\_to\_all\_protected\_branches). |  |
| `isContainingHiddenGroups` | `boolean` **|** `null` | Whether the rule includes groups the token cannot see (API contains\_hidden\_groups). |  |
| `protectedBranches` | `array` **|** `null` | Names of protected branches this rule applies to (API protected\_branches\[\].name). |  |
| `reportType` | `string` **|** `null` | Report type for report\_approver rules (API report\_type). |  |
| `ruleType` | `string` **|** `null` | Approval rule type: regular, code\_owner, report\_approver or any\_approver (API rule\_type). |  |

---

### Gitlab Branch Rule

`gitlab_branch_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowForcePush` | `boolean` **|** `null` | Whether force push is allowed on matching branches. |  |
| `codeOwnerApprovalRequired` | `boolean` **|** `null` | Whether merges to matching branches require code owner approval (Premium/Ultimate). |  |
| `createdOn` | `number` |  |  |
| 
`id` \*

 | `string` |  |  |
| `isDefault` | `boolean` **|** `null` | Whether the rule protects the project default branch (GraphQL only). |  |
| `isInherited` | `boolean` **|** `null` | Whether the protection is inherited from the parent group and cannot be changed at project level (REST inherited, Premium/Ultimate). |  |
| 

`isProtected` \*

 | `boolean` |  |  |
| `matchingBranchesCount` | `number` **|** `null` | Number of existing branches that match the rule (GraphQL only). |  |
| `mergeAccessLevelDescriptions` | `array` **|** `null` | Human-readable descriptions of every merge access entry, including user and group grants. |  |
| `mergeAccessLevels` | `array` **|** `null` | Role access levels allowed to merge (0 = No one, 30 = Developer, 40 = Maintainer, 60 = Admin). |  |
| 

`name` \*

 | `string` |  |  |
| `pushAccessDeployKeyIds` | `array` **|** `null` | Deploy key ids allowed to push (push\_access\_levels\[\].deploy\_key\_id). |  |
| `pushAccessLevelDescriptions` | `array` **|** `null` | Human-readable descriptions of every push access entry, including user and group grants. |  |
| `pushAccessLevels` | `array` **|** `null` | Role access levels allowed to push and merge (0 = No one, 30 = Developer, 40 = Maintainer, 60 = Admin). Individual user and group grants are ALLOWS relationships to gitlab\_user / gitlab\_group. |  |
| `unprotectAccessLevelDescriptions` | `array` **|** `null` | Human-readable descriptions of every unprotect access entry, including user and group grants. |  |
| `unprotectAccessLevels` | `array` **|** `null` | Role access levels allowed to unprotect the branch. |  |
| `updatedOn` | `number` |  |  |

---

### Gitlab Ci Job

`gitlab_ci_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `artifactFileTypes` | `array` of `string`s | List of artifact file types produced by the job (e.g. archive, metadata, trace). |  |
| `artifactsExpireOn` | `number` | Timestamp when this job's artifacts expire. |  |
| `coverage` | `number` | Reported test coverage percentage for the job, if configured. |  |
| `duration` | `number` | Job execution duration in seconds. |  |
| `erasedOn` | `number` | Timestamp the job log was erased, if it was (audit signal). |  |
| `failureReason` | `string` | GitLab-provided enum describing why the job failed (e.g. script\_failure, runner\_system\_failure). |  |
| `finishedOn` | `number` | Timestamp the job finished (epoch millis). |  |
| `hasArtifacts` | `boolean` | True when the job produced one or more artifacts. |  |
| `isAllowedToFail` | `boolean` | True if the job is permitted to fail without failing the pipeline. |  |
| `isArchived` | `boolean` | True when the job has been archived. |  |
| `isRunnerActive` | `boolean` | True when the runner is active. |  |
| `isRunnerShared` | `boolean` | True when the runner is shared (cross-project pool). |  |
| `isTag` | `boolean` | True when the job ran for a Git tag. |  |
| 
`pipelineId` \*

 | `number` | Numeric ID of the pipeline this job belongs to. |  |
| 

`projectId` \*

 | `number` | Numeric ID of the project this job belongs to. Used in \_key for global uniqueness. |  |
| `queuedDuration` | `number` | Time the job spent queued before starting, in seconds. |  |
| `ref` | `string` | Branch or tag this job ran against. |  |
| `runnerDescription` | `string` | Human-readable description of the runner that executed the job. |  |
| `runnerId` | `number` | Numeric ID of the runner that executed the job (if any). |  |
| `runnerType` | `string` | Runner scope: instance\_type, group\_type, or project\_type. |  |
| `sha` | `string` | Commit SHA the job ran against. |  |
| `source` | `string` | Trigger source for the parent pipeline (push, schedule, merge\_request\_event, ...). |  |
| `stage` | `string` | CI stage the job belongs to (e.g. build, test, deploy). |  |
| `startedOn` | `number` | Timestamp the job started executing (epoch millis). |  |
| `tagList` | `array` of `string`s | Runner tags requested by the job (.gitlab-ci.yml `tags`). |  |
| `userId` | `number` | Numeric ID of the user who triggered the job. |  |
| `userUsername` | `string` | Username of the user who triggered the job. |  |

---

### Gitlab Commit

`gitlab_commit` inherits from [CodeCommit](/data-model/schemas/CodeCommit.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authoredOn` | `number` |  |  |
| `authorEmail` | `string` |  |  |
| `authorName` | `string` |  |  |
| 
`branch` \*

 | `string` |  |  |
| `committedOn` | `number` |  |  |
| `committerEmail` | `string` |  |  |
| `committerName` | `string` |  |  |
| 

`commitWebLink` \*

 | `string` |  |  |
| `createdOn` | `number` |  | **deprecated**: true |
| 

`id` \*

 | `string` |  |  |
| 

`merge` \*

 | `boolean` |  |  |
| 

`message` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`shortId` \*

 | `string` |  |  |
| `title` | `string` |  |  |
| 

`versionBump` \*

 | `boolean` |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Gitlab Deploy Token

`gitlab_deploy_token` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isExpired` \*

 | `boolean` **|** `null` | When true, GitLab has computed the token as past its expiry. Supports stale-token detection. |  |
| 

`isRevoked` \*

 | `boolean` **|** `null` | When true, the token has been revoked. |  |
| 

`scopes` \*

 | `array` **|** `null` | The scopes granted to this token (e.g. "read\_repository", "read\_registry"). Registry/repo write access is high-risk. |  |
| 

`username` \*

 | `string` | The username the deploy token authenticates as (e.g. "gitlab+deploy-token-1"). |  |

---

### Gitlab Finding

`gitlab_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`createVulnerabilityFeedbackDismissalPath` \*

 | `string` |  | **deprecated**: true |
| 

`createVulnerabilityFeedbackIssuePath` \*

 | `string` |  | **deprecated**: true |
| 

`createVulnerabilityFeedbackMergeRequestPath` \*

 | `string` |  | **deprecated**: true |
| `description` | `string` |  |  |
| `dismissalFeedback` | `string` |  | **deprecated**: true |
| `dismissalReason` | `string` |  |  |
| `falsePositive` | `boolean` |  |  |
| `identifiers` | `array` of `string`s |  |  |
| `links` | `array` of `string`s |  |  |
| `projectFingerprint` | `string` |  | **deprecated**: true |
| `reportType` | `string` |  |  |
| `scanner.externalId` | `string` |  |  |
| `scanner.name` | `string` |  |  |
| `scanner.vendor` | `string` |  |  |
| `solution` | `string` |  |  |
| `state` | `string` |  |  |
| `uuid` | `string` |  |  |
| `vulnerabilityPath` | `string` |  |  |

---

### Gitlab Group

`gitlab_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `autoDevopsEnabled` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `description` | `string` |  |  |
| `emailsDisabled` | `boolean` |  |  |
| 
`fullName` \*

 | `string` |  |  |
| 

`fullPath` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `lfsEnabled` | `boolean` |  |  |
| `mentionsDisabled` | `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| `parentGroupId` | `string` |  |  |
| 

`path` \*

 | `string` |  |  |
| `projectCreationLevel` | `string` |  |  |
| `requestAccessEnabled` | `boolean` |  |  |
| `requireTwoFactorAuthentication` | `boolean` |  |  |
| `shareWithGroupLock` | `boolean` |  |  |
| `subgroupCreationLevel` | `string` |  |  |
| `twoFactorGracePeriod` | `number` |  |  |
| `visibility` | `string` |  |  |
| 

`webUrl` \*

 | `string` |  |  |

---

### Gitlab Group Access Token

`gitlab_group_access_token` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessLevel` \*

 | `number` **|** `null` | The role the token holds on the group: 10 Guest, 15 Planner, 20 Reporter, 25 Security Manager, 30 Developer, 40 Maintainer, 50 Owner. |  |
| 

`isRevoked` \*

 | `boolean` **|** `null` | When true, the token has been revoked. |  |
| 

`lastUsedOn` \*

 | `number` **|** `null` | Timestamp the token was last used (epoch millis), or null if never used. |  |
| 

`scopes` \*

 | `array` **|** `null` | The scopes granted to this token (e.g. "api", "read\_repository"). |  |
| 

`userId` \*

 | `string` | The id of the bot user GitLab created to back this group access token. |  |

---

### Gitlab Label

`gitlab_label` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`color` \*

 | `string` |  |  |
| `description` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lockOnMerge` \*

 | `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`textColor` \*

 | `string` |  |  |

---

### Gitlab Merge Request

`gitlab_merge_request` inherits from [CodeReview](/data-model/schemas/CodeReview.md), [PR](/data-model/schemas/PR.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowCollaboration` | `boolean` |  |  |
| 
`approved` \*

 | `boolean` |  |  |
| 

`approverIds` \*

 | `array` of `string`s |  |  |
| 

`approverLogins` \*

 | `array` of `string`s |  |  |
| 

`approvers` \*

 | `array` of `string`s |  |  |
| `authorId` | `string` |  |  |
| `authorLogin` | `string` |  |  |
| `authorName` | `string` |  |  |
| `closedOn` | `number` |  |  |
| `commitWebLink` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `forceRemoveSourceBranch` | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`iid` \*

 | `string` |  |  |
| `mergeCommitSha` | `string` |  |  |
| `mergedOn` | `number` |  |  |
| `mergeWhenPipelineSucceeds` | `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`projectId` \*

 | `number` |  |  |
| 

`repository` \*

 | `string` |  |  |
| `sha` | `string` |  |  |
| `shouldRemoveSourceBranch` | `boolean` |  |  |
| 

`source` \*

 | `string` |  |  |
| 

`squash` \*

 | `boolean` |  |  |
| 

`state` \*

 | `string` |  |  |
| 

`target` \*

 | `string` |  |  |
| 

`title` \*

 | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `webLink` | `string` |  |  |

---

### Gitlab Personal Access Token

`gitlab_personal_access_token` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isRevoked` \*

 | `boolean` **|** `null` | When true, the token has been revoked. |  |
| 

`lastUsedOn` \*

 | `number` **|** `null` | Timestamp the token was last used (epoch millis), or null if never used. Supports dormant-credential review. |  |
| 

`scopes` \*

 | `array` **|** `null` | The scopes granted to this token (e.g. "api", "read\_api"). Drives privilege / blast-radius analysis. |  |

---

### Gitlab Pipeline

`gitlab_pipeline` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `beforeSha` | `string` | Previous commit SHA prior to the pipeline run. |  |
| `committedOn` | `number` | Timestamp of the commit that triggered the pipeline (epoch millis). |  |
| `coverage` | `number` | Reported test coverage percentage (0-100), if a coverage parser is configured. |  |
| `duration` | `number` | Pipeline execution duration in seconds. |  |
| `finishedOn` | `number` | Timestamp the pipeline finished (epoch millis). |  |
| `iid` | `string` | Project-internal pipeline number (visible in GitLab UI). |  |
| `isArchived` | `boolean` | True when the pipeline has been archived. |  |
| `isTag` | `boolean` | True when the pipeline ran for a Git tag rather than a branch. |  |
| 
`projectId` \*

 | `number` | Numeric ID of the project this pipeline belongs to. Used in \_key for global uniqueness. |  |
| `queuedDuration` | `number` | Time the pipeline spent queued before starting, in seconds. |  |
| `ref` | `string` | Branch or tag name this pipeline ran against. |  |
| `sha` | `string` | Head commit SHA the pipeline ran against. |  |
| `source` | `string` | Trigger source (push, web, schedule, api, merge\_request\_event, etc.). |  |
| `startedOn` | `number` | Timestamp the pipeline started running (epoch millis). |  |
| `triggeredByUserId` | `number` | Numeric ID of the user who triggered the pipeline. |  |
| `triggeredByUsername` | `string` | Username of the user who triggered the pipeline. |  |
| `yamlErrors` | `string` | YAML parse/validation errors that prevented the pipeline from running, if any. |  |

---

### Gitlab Project

`gitlab_project` inherits from [CodeRepo](/data-model/schemas/CodeRepo.md), [Project](/data-model/schemas/Project.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allowMergeOnSkippedPipeline` \*

 | `boolean` |  |  |
| `archived` | `boolean` |  |  |
| `autocloseReferencedIssues` | `boolean` |  |  |
| `containerRegistryEnabled` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `description` | `string` |  |  |
| 

`fullName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `issuesEnabled` | `boolean` |  |  |
| `jobsEnabled` | `boolean` |  |  |
| `mergeRequestsEnabled` | `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| `onlyAllowMergeIfAllDiscussionsAreResolved` | `boolean` |  |  |
| `onlyAllowMergeIfPipelineSucceeds` | `boolean` |  |  |
| 

`public` \*

 | `boolean` |  |  |
| `publicJobs` | `boolean` |  |  |
| `removeSourceBranchAfterMerge` | `boolean` |  |  |
| `requestAccessEnabled` | `boolean` |  |  |
| `sharedRunnersEnabled` | `boolean` |  |  |
| `snippetsEnabled` | `boolean` |  |  |
| 

`topics` \*

 | `array` of `string`s |  |  |
| `visibility` | `string` |  |  |
| `webLink` | `string` |  |  |
| `wikiEnabled` | `boolean` |  |  |

---

### Gitlab Project Access Token

`gitlab_project_access_token` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessLevel` \*

 | `number` **|** `null` | The role the token holds on the project: 10 Guest, 15 Planner, 20 Reporter, 25 Security Manager, 30 Developer, 40 Maintainer, 50 Owner. |  |
| 

`isRevoked` \*

 | `boolean` **|** `null` | When true, the token has been revoked. |  |
| 

`lastUsedOn` \*

 | `number` **|** `null` | Timestamp the token was last used (epoch millis), or null if never used. |  |
| 

`scopes` \*

 | `array` **|** `null` | The scopes granted to this token (e.g. "api", "read\_repository"). |  |
| 

`userId` \*

 | `string` | The id of the bot user GitLab created to back this project access token. |  |

---

### Gitlab Project Setting

`gitlab_project_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `analyticsAccessLevel` | `string` **|** `null` | Analytics feature access level (API analytics\_access\_level). |  |
| `approvalsBeforeMerge` | `number` **|** `null` | Project-level minimum number of approvals required before merge (API approvals\_before\_merge, deprecated in favor of approval rules). |  |
| `buildsAccessLevel` | `string` **|** `null` | CI/CD feature access level (API builds\_access\_level). |  |
| `defaultBranch` | `string` **|** `null` | The project default branch (API default\_branch). |  |
| `forkingAccessLevel` | `string` **|** `null` | Forking access level (API forking\_access\_level). |  |
| `isApprovalResetOnPush` | `boolean` **|** `null` | Whether all approvals are removed when a commit is added (API reset\_approvals\_on\_push). |  |
| `isApproverOverrideDisabled` | `boolean` **|** `null` | Whether editing approval rules in merge requests is prevented (API disable\_overriding\_approvers\_per\_merge\_request). |  |
| `isAuthorApprovalAllowed` | `boolean` **|** `null` | Whether merge request authors may approve their own merge requests; false means author approval is prevented (API merge\_requests\_author\_approval). |  |
| `isCommitterApprovalDisabled` | `boolean` **|** `null` | Whether users who add commits are prevented from approving (API merge\_requests\_disable\_committers\_approval). |  |
| `isMergePipelinesEnabled` | `boolean` **|** `null` | Whether merged results pipelines are enabled (API merge\_pipelines\_enabled). |  |
| `isMergeTrainsEnabled` | `boolean` **|** `null` | Whether merge trains are enabled (API merge\_trains\_enabled). |  |
| `isMergeTrainSkipAllowed` | `boolean` **|** `null` | Whether merge requests may skip the merge train (API merge\_trains\_skip\_train\_allowed). |  |
| `isReauthenticationRequiredToApprove` | `boolean` **|** `null` | Whether approvers must re-authenticate to approve (API require\_reauthentication\_to\_approve). |  |
| `isSelectiveCodeOwnerRemovalEnabled` | `boolean` **|** `null` | Whether only code owner approvals for changed files are reset on push (API selective\_code\_owner\_removals). |  |
| `isUnwantedCharactersWarningEnabled` | `boolean` **|** `null` | Whether GitLab warns about potentially unwanted characters (API warn\_about\_potentially\_unwanted\_characters). |  |
| `mergeMethod` | `string` **|** `null` | Merge method: merge, rebase\_merge or ff (API merge\_method). |  |
| `mergeRequestsAccessLevel` | `string` **|** `null` | Merge requests feature access level (API merge\_requests\_access\_level). |  |
| `packageRegistryAccessLevel` | `string` **|** `null` | Package registry access level: disabled, private, enabled or public; public means the "Allow anyone to pull from package registry" toggle is on (API package\_registry\_access\_level). |  |
| `repositoryAccessLevel` | `string` **|** `null` | Repository feature access level: disabled, private, enabled or public (API repository\_access\_level). |  |
| `securityAndComplianceAccessLevel` | `string` **|** `null` | Security and compliance feature access level (API security\_and\_compliance\_access\_level). |  |

---

### Gitlab Push Rule

`gitlab_push_rule` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authorEmailRegex` | `string` **|** `null` | Regular expression commit author emails must match (API author\_email\_regex). |  |
| `branchNameRegex` | `string` **|** `null` | Regular expression branch names must match (API branch\_name\_regex). |  |
| `commitMessageNegativeRegex` | `string` **|** `null` | Regular expression commit messages must not match (API commit\_message\_negative\_regex). |  |
| `commitMessageRegex` | `string` **|** `null` | Regular expression commit messages must match (API commit\_message\_regex). |  |
| `fileNameRegex` | `string` **|** `null` | Regular expression of file names that are rejected (API file\_name\_regex). |  |
| `isCommitterCheckEnabled` | `boolean` **|** `null` | Whether only commits from verified committer emails are accepted; GitLab returns null when never enabled, ingested as false (API commit\_committer\_check). |  |
| `isCommitterNameCheckEnabled` | `boolean` **|** `null` | Whether the commit author name must match the GitLab account name (API commit\_committer\_name\_check). |  |
| 
`isConfigured` \*

 | `boolean` | Whether push rules were ever configured for the project. When false, GitLab returned no push rules and every enforcement flag is ingested as false. |  |
| `isMemberCheckEnabled` | `boolean` **|** `null` | Whether the commit author must be an existing GitLab user (API member\_check). |  |
| `isNonDcoCommitRejected` | `boolean` **|** `null` | Whether commits without a DCO sign-off are rejected; GitLab returns null when never enabled, ingested as false (API reject\_non\_dco\_commits). |  |
| `isSecretPushPrevented` | `boolean` **|** `null` | Whether GitLab rejects pushes of files that are likely to contain secrets (API prevent\_secrets). |  |
| `isTagDeletionDenied` | `boolean` **|** `null` | Whether tag deletion is denied (API deny\_delete\_tag). |  |
| `isUnsignedCommitRejected` | `boolean` **|** `null` | Whether commits that are not signed are rejected; GitLab returns null when never enabled, ingested as false (API reject\_unsigned\_commits). |  |
| `maxFileSize` | `number` **|** `null` | Maximum file size in MB allowed in a push; 0 means unlimited (API max\_file\_size). |  |

---

### Gitlab Secret

`gitlab_secret` inherits from [Secret](/data-model/schemas/Secret.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`environmentScope` \*

 | `string` | Environment scope this variable applies to. "\*" means all environments. |  |
| 

`isHidden` \*

 | `boolean` **|** `null` | When true, the variable value is masked in job logs and permanently hidden from the API response. |  |
| 

`isMasked` \*

 | `boolean` **|** `null` | When true, the variable value is masked in job logs. |  |
| 

`isProtected` \*

 | `boolean` **|** `null` | When true, this variable is only exposed to pipelines running on protected branches or tags. |  |
| 

`isRaw` \*

 | `boolean` **|** `null` | When true, the variable is treated as raw and reference variables ($VAR) inside its value are not expanded. |  |
| 

`variableKey` \*

 | `string` | The CI/CD variable key -- its name in the pipeline environment, e.g. "AWS\_ACCESS\_KEY\_ID". This is the variable's identifier, never its value; GitLab calls this field `key`, renamed here to avoid confusion with the SDK-managed `_key` property. |  |
| 

`variableType` \*

 | `string` **|** `null` | Type of CI/CD variable: "env\_var" or "file". |  |

---

### Gitlab User

`gitlab_user` inherits from [User](/data-model/schemas/User.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `canCreateGroup` | `boolean` |  |  |
| `canCreateProject` | `boolean` |  |  |
| `external` | `boolean` |  |  |
| `isBot` | `boolean` | Whether the account is a bot/service account (GitLab GraphQL User.bot). |  |
| `isHuman` | `boolean` | Whether the account is a regular human user (GitLab GraphQL User.human). False indicates a bot or service account. |  |
| `privateProfile` | `boolean` |  |  |
| `publicEmail` | `string` |  |  |
| 
`state` \*

 | `string` |  |  |
| `trial` | `boolean` |  |  |
| `twoFactorEnabled` | `boolean` |  |  |

---

### Gitlab User

`gitlab_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `canCreateGroup` | `boolean` |  |  |
| `canCreateProject` | `boolean` |  |  |
| `external` | `boolean` |  |  |
| `isBot` | `boolean` | Whether the account is a bot/service account (GitLab GraphQL User.bot). |  |
| `isHuman` | `boolean` | Whether the account is a regular human user (GitLab GraphQL User.human). False indicates a bot or service account. |  |
| `privateProfile` | `boolean` |  |  |
| `publicEmail` | `string` |  |  |
| 
`state` \*

 | `string` |  |  |
| `trial` | `boolean` |  |  |
| `twoFactorEnabled` | `boolean` |  |  |

---

## Release Notes

-   **2026-10-18** — Added ingestion of GitLab personal access tokens, project access tokens, group access tokens, and deploy tokens, including scope, expiry, and revocation state.
    
-   **2026-10-14** — GitLab bot and service account users are now classified as Non-Human Identities, and all GitLab users now include human and bot indicator properties.
    
-   **2026-05-15** — GitLab pipelines and CI jobs are now ingested, linked to their parent projects and merge requests.
    
-   **2025-08-22** — Added configuration option to skip disabled GitLab projects during ingestion.
    
-   **2025-08-21** — Added configuration option to fetch all visible GitLab projects regardless of user membership, enabling ingestion of all projects accessible to the authenticated user.
    
-   **2025-08-19** — Added optional separate token configuration for GitLab vulnerability findings ingestion, enabling auditor users to ingest findings when the main API token lacks sufficient permissions.
    
-   **2025-08-04** — Added configuration option to ingest only human GitLab users, excluding bot and service accounts.

---

Source: /integrations/directory/godaddy

# GoDaddy

Visualize GoDaddy domains and domain records and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> To use this integration, JupiterOne requires a GoDaddy customer number (shopper ID), [API key and secret](https://developer.godaddy.com/keys) to interact with the API. In addition, you must have permission in JupiterOne to install new integrations.

### Configuration in JupiterOne

To install the GoDaddy integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select GoDaddy. Click **Add Configuration** to begin configuring your integration.

Creating an instance requires the following:

-   **Account Name** by which you want to identify this GoDaddy account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
    
-   **Description** that will further assist your team when identifying the integration instance.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Customer Number / Shopper ID** for your GoDaddy account.
    
-   **API Key** configured in GoDaddy for API access.
    
-   **API Key Secret** configured in GoDaddy for API access.
    

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `godaddy_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Domain | `godaddy_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| DomainRecord | `godaddy_domain_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `godaddy_account` | **HAS** | `godaddy_domain` |
| `godaddy_domain` | **HAS** | `godaddy_domain_record` |

### Godaddy Account

`godaddy_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`email` \*

 | `string` |  |  |
| `externalId` | `number` |  |  |
| 

`firstName` \*

 | `string` |  |  |
| 

`lastName` \*

 | `string` |  |  |
| 

`marketId` \*

 | `string` |  |  |
| 

`shopperId` \*

 | `string` |  |  |

---

### Godaddy Domain

`godaddy_domain` inherits from [Domain](/data-model/schemas/Domain.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `string` | When the domain was created at GoDaddy (ISO 8601). |  |
| `deletedAt` | `string` | When the domain was deleted, if it was (ISO 8601). |  |
| `domain` | `string` | Domain name, as returned by GoDaddy. |  |
| `domainId` | `number` | Numeric identifier GoDaddy assigns to the domain. |  |
| `expirationProtected` | `boolean` | Whether the domain is protected from expiring. |  |
| `expires` | `string` | When the domain registration expires (ISO 8601). |  |
| `exposeWhois` | `boolean` | Whether the registrant WHOIS information is public. |  |
| `holdRegistrar` | `boolean` | Whether the domain is on registrar hold. |  |
| `nameServers` | `array` of `string`s | Name servers the domain delegates to. |  |
| `privacy` | `boolean` | Whether WHOIS privacy protection is enabled. |  |
| `registrarCreatedAt` | `string` | When the domain was created at the registrar (ISO 8601). |  |
| `renewable` | `boolean` | Whether the domain can currently be renewed. |  |
| `renewAuto` | `boolean` | Whether the domain renews automatically. |  |
| `renewDeadline` | `string` | Last date the domain can be renewed (ISO 8601). |  |
| `subaccountId` | `string` | GoDaddy reseller subaccount that owns the domain. |  |
| `transferAwayEligibleAt` | `string` | When the domain becomes eligible to transfer to another registrar (ISO 8601). |  |
| `transferLock` | `boolean` | Whether the domain is protected from transfer to another registrar (same value as transferProtected). |  |
| `transferProtected` | `boolean` | Whether the domain is protected from transfer to another registrar. |  |

---

### Godaddy Domain Record

`godaddy_domain_record` inherits from [DomainRecord](/data-model/schemas/DomainRecord.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`data` \*

 | `string` |  |  |
| `priority` | `number` |  |  |
| `ttl` | `number` |  |  |

---

## Release Notes

-   **2026-10-13** — GoDaddy domain entities no longer include domain transfer authorization codes, preventing sensitive EPP transfer credentials from appearing in the asset graph.

---

Source: /integrations/directory/google

# Google Workspace

Visualize Google Workspace domain user groups, users, and their authorized tokens, map Google Workspace users to employees and managers, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to add necessary API scopes to your Google Workspace as well as create a dedicated user and role with scopes and privileges for JupiterOne within the Admin console. Every step below is required whether or not your organization signs in through SSO; if it does, read the note under **Create a JupiterOne user in Google Workspace** for how to complete the dedicated user's one-time sign-in.

#### Add the JupiterOne API scopes

Log in to the Google Workspace Admin Console as a super administrator to perform the following actions:

1.  Click **Account > Account Settings > Profile** and retrieve your Customer ID. It will have a format similar to `C1111abcd`. Alternatively, click **Security** and expand Setup single sign-on (SSO) for SAML applications and copy the `idpid` property value from the SSO URL. For example, `https://accounts.google.com/o/saml2/idp?idpid=C1111abcd` provides the ID `C1111abcd`. Retain this value for the **Account ID** field in the JupiterOne integration configuration.
    
2.  Return to the Admin Console home page. Click **Security > Access and data control > API controls**.
    
3.  In the Domain wide delegation pane, select **Manage Domain Wide Delegation**.
    
4.  Click **Add new** and enter the JupiterOne Service Account client ID `102174985137827290632` (US region) or `114158755753045408365` (EU region) into the **Client ID** field. If the JupiterOne integration configuration UI shows you a different client ID, use the one it shows — that value is authoritative for your account.
    
5.  Add the following API scopes (comma separated):
    
    ```text
    https://www.googleapis.com/auth/admin.directory.domain.readonly, https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly, https://www.googleapis.com/auth/admin.directory.user.security, https://www.googleapis.com/auth/apps.groups.settings, https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/admin.directory.device.mobile.readonly, https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly, https://www.googleapis.com/auth/cloud-identity.devices.readonly, https://www.googleapis.com/auth/chrome.management.reports.readonly
    ```
    
6.  Click **Authorize**.
    
7.  Point to the client ID in the list and click **View details** to confirm all of the scopes above were saved. Google's console occasionally does not persist every scope on the first save; if any are missing, click **Edit**, re-add them, and **Authorize** again.
    

> **NOTE**
> 
> If your organization has enabled multi-party approval for sensitive admin actions, authorizing domain-wide delegation requires a second super administrator to approve the change before it takes effect. Scope changes can also take up to 24 hours to propagate.

#### Create a JupiterOne user in Google Workspace

Continuing in the Admin console, create a user the JupiterOne Service Account will impersonate.

1.  Click **Users > Add new user**.
    
2.  Enter First name "JupiterOne", Last name "SystemUser", Primary email "jupiterone-admin". Retain the email address for the Admin Email field in the JupiterOne integration configuration.
    
3.  Click **Add new user**, and retain the temporary generated password for the next step.
    
4.  In another browser (or using Chrome's Incognito feature), log in as the new user to set a complex password and accept the Google Workspaces Terms of Service. You may dispose of the password as it will not be used and may be reset by a super administrator in the future as needed.
    

> **CAUTION**
> 
> **Do not skip step 4, including when your organization signs in through SSO.** Domain-wide delegation cannot impersonate a user who has never signed in: Google only sets the account's `agreedToTerms` flag after that first interactive login, it is an output-only field that no administrator or API call can set on the user's behalf, and until it is set the integration's authorization attempt fails. If your domain routes sign-in to an external identity provider, complete this one-time login through your IdP (provisioning `jupiterone-admin` there), or grant the account a temporary SSO exemption so it can sign in with the Google password, then remove the exemption afterward.
> 
> After that one-time login, the password is no longer used. JupiterOne authenticates as the Service Account and impersonates the address through domain-wide delegation, so the account needs no ongoing password, no IdP app assignment, and no interactive access.

#### Create a JupiterOne role in Google Workspace

Continuing in the Admin console, create a new role that will have only the permissions required by JupiterOne, and which will include only the jupiterone-admin system user.

1.  Click **Users**, then click on the "JupiterOne SystemUser".
    
2.  Click **Admin roles and privileges**, then click the icon to edit the user's roles
    
3.  Click **Create custom role > Create a new role**.
    
4.  Enter Name "JupiterOne System", a Description "Role for JupiterOne user to enable read-only access to Google Workspaces Admin APIs." If you have email controls that filter for employee impersonation attacks, you may want to change the name to something such as "j1-system”.
    
5.  In the **Admin privileges** section, select these permissions:
    
    -   Users -> Read
    -   Groups -> Read
    -   Domains -> Domain Management
    -   Security -> User Security Management
    -   Services -> Mobile Device Management -> Manage Devices and Settings
    -   Services -> Chrome Management -> Manage ChromeOS Devices (read only)
    -   Services -> Chrome Management -> View Extensions List Report

> **NOTE**
> 
> Google has consolidated the privilege tree: the permissions above were previously split across separate **Admin console privileges** and **Admin API privileges** sections, and are now all found under **Admin privileges**. The fastest way to select them is the privileges search box in the role editor rather than expanding each branch.
> 
> Grant **Manage ChromeOS Devices (read only)**, not **Manage ChromeOS Devices**. The integration only reads ChromeOS device data, so the read-only privilege is sufficient and avoids granting write access to your devices.

To ingest role and role assignment data you must grant this account Super Admin permissions in addition to the custom role listed above. Permissions will still be restricted by the readonly API scopes if Super Admin permissions are granted, however access to group setting updates and token deletions will be an incidental side effect due to the limitations in the Google domain wide API settings.

These permissions will not be used by the JupiterOne integration, but if granting those permissions is unacceptable, please do not provide Super Admin permissions. The only ingestion items that will not be ingested due to missing Super Admin permissions are roles, role assignments, and token information.

#### Adding Scopes and Privileges

Changes to the integration may include additional data ingestion requiring authorization of new scopes and additional privileges granted to the custom Admin Role.

To authorize additional scopes, log in to the Google Workspace Admin Console as a super administrator to perform the following actions.

1.  Click **Security > Access and data control > API controls**.
    
2.  In the Domain wide delegation pane, select **Manage Domain Wide Delegation**.
    
3.  Identify the JupiterOne Service Account client ID shown in the JupiterOne integration configuration UI.
    
4.  Click **Edit** to add scopes.
    
5.  Click **Authorize**, then point to the client ID and click **View details** to confirm the new scopes were saved.
    

**To grant additional privileges, return to the Admin console:**

1.  Click **Admin roles**, then click the "JupiterOne System" role.
    
2.  Click **Privileges** to add additional privileges under **Admin privileges** to enable JupiterOne to fetch new data.
    
3.  Click **Save**.
    

### Configuration in JupiterOne

To add the Google Workspace integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Google Workspace. Click New Instance to begin configuring your integration. Enter the following:

-   **Account Name** by which you want to identify this Google Workspace account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName toggle** is enabled.
-   **Description** that assist your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
-   Enter the **Customer ID** collected during the setup of Google Workspace.
-   Enter the **Email Address** of the user created during setup of Google Workspace.

Click **Create** once all values are provided to finalize the integration.

#### Integration Jobs Events

A common log when running the integration job is Permission denied reading tokens for N users. This happens when the credentials provided to JupiterOne are insufficient for reading tokens of users with greater permissions, such as those with the Super Admin role assignment. This is not an error, but is only listed as informational.

As noted, this is due to the "JupiterOne SystemUser" that is configured for integration purposes not having sufficient permissions to list the tokens for users with higher privileges, such as the "Super Admin" Role. These tokens are not necessary for the job to complete and all other data will still be retrieved.

The "Tokens" step involves extensive API usage, often resulting in a long-running integration job. If you find this data less valuable, you may want to consider disabling this step using ingest sources.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (6)

-   `Chrome Management -> Manage Chrome OS Devices`
-   `Chrome Management -> View Extensions List Report`
-   `Domain Management`
-   `Groups -> Read`
-   `Manage Devices and Settings`
-   `Users -> Read`

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `Super Admin`

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (10)

-   `https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly`
-   `https://www.googleapis.com/auth/admin.directory.device.mobile.readonly`
-   `https://www.googleapis.com/auth/admin.directory.domain.readonly`
-   `https://www.googleapis.com/auth/admin.directory.group.readonly`
-   `https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly`
-   `https://www.googleapis.com/auth/admin.directory.user.readonly`
-   `https://www.googleapis.com/auth/admin.directory.user.security`
-   `https://www.googleapis.com/auth/apps.groups.settings`
-   `https://www.googleapis.com/auth/chrome.management.reports.readonly`
-   `https://www.googleapis.com/auth/cloud-identity.devices.readonly`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (12)

-   [https://cloud.google.com/identity/docs/reference/rest/v1/devices](https://cloud.google.com/identity/docs/reference/rest/v1/devices)
-   [https://developers.google.com/chrome/management/reference/rest/v1/customers.reports](https://developers.google.com/chrome/management/reference/rest/v1/customers.reports)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/chromeosdevices](https://developers.google.com/workspace/admin/directory/reference/rest/v1/chromeosdevices)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/domains](https://developers.google.com/workspace/admin/directory/reference/rest/v1/domains)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups](https://developers.google.com/workspace/admin/directory/reference/rest/v1/groups)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/members/list](https://developers.google.com/workspace/admin/directory/reference/rest/v1/members/list)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/mobiledevices](https://developers.google.com/workspace/admin/directory/reference/rest/v1/mobiledevices)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments](https://developers.google.com/workspace/admin/directory/reference/rest/v1/roleAssignments)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/roles](https://developers.google.com/workspace/admin/directory/reference/rest/v1/roles)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/tokens](https://developers.google.com/workspace/admin/directory/reference/rest/v1/tokens)
-   [https://developers.google.com/workspace/admin/directory/reference/rest/v1/users](https://developers.google.com/workspace/admin/directory/reference/rest/v1/users)
-   [https://developers.google.com/workspace/admin/groups-settings/v1/reference/groups](https://developers.google.com/workspace/admin/groups-settings/v1/reference/groups)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (5)

| Step | Permissions | Roles | OAuth Scopes |
| --- | --- | --- | --- |
| Chrome Extension Devices | `Chrome Management -> View Extensions List Report` | \- | `https://www.googleapis.com/auth/chrome.management.reports.readonly` |
| Group Settings | \- | \- | `https://www.googleapis.com/auth/apps.groups.settings` |
| Groups | `Groups -> Read` | \- | `https://www.googleapis.com/auth/admin.directory.group.readonly` |
| Role Assignments | \- | `Super Admin` | `https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly` |
| Tokens | \- | `Super Admin` | `https://www.googleapis.com/auth/admin.directory.user.security` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `google_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Chrome Extension | `google_chrome_extension` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Chrome OS Device | `google_chrome_os_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device | `google_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Domain | `google_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| Group | `google_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Group Settings | `google_group_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Mobile Device | `google_mobile_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Role | `google_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Site | `google_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| Token | `google_token` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| User | `google_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `google_account` | **HAS** | `google_role` |
| `google_account` | **HAS** | `google_user` |
| `google_account` | **HAS** | `google_group` |
| `google_account` | **MANAGES** | `google_chrome_os_device` |
| `google_account` | **MANAGES** | `google_mobile_device` |
| `google_account` | **MANAGES** | `google_device` |
| `google_group` | **HAS** | `google_user` |
| `google_group` | **HAS** | `google_group` |
| `google_group` | **HAS** | `google_group_settings` |
| `google_site` | **HAS** | `google_user` |
| `google_token` | **ALLOWS** | `mapped_entity (class Vendor)` |
| `google_user` | **ASSIGNED** | `google_role` |
| `google_user` | **ASSIGNED** | `google_token` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `google_device` | **INSTALLED** | `google_chrome_extension` | FORWARD |
| `google_group` | **HAS** | `google_user` | FORWARD |
| `google_group` | **HAS** | `google_group` | FORWARD |

### Google Account

`google_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`domains` \*

 | `array` of `string`s |  |  |
| `primaryDomain` | `string` |  |  |
| 

`vendor` \*

 | `string` |  | **default**: Google |

---

### Google Chrome Extension

`google_chrome_extension` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`deviceCount` \*

 | `number` **|** `null` |  |  |
| `disabled` | `boolean` **|** `null` |  |  |
| `installType` | `string` **|** `null` |  |  |
| 

`permissions` \*

 | `string` |  |  |
| `source` | `string` **|** `null` |  |  |
| `type` | `string` **|** `null` |  |  |
| `uri` | `string` **|** `null` |  |  |

---

### Google Chrome Os Device

`google_chrome_os_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `annotatedUser` | `string` **|** `null` |  |  |
| `bootMode` | `string` **|** `null` |  | **Any of**:
-   `Verified`

-   `Dev`

 |
| `firmwareVersion` | `string` **|** `null` |  |  |
| `googleStatus` | `string` **|** `null` |  | **Any of**:

-   `ACTIVE`

-   `DELINQUENT`

-   `PRE_PROVISIONED`

-   `DEPROVISIONED`

-   `DISABLED`

-   `INACTIVE`

-   `RETURN_ARRIVED`

-   `RETURN_REQUESTED`

-   `SHIPPED`

-   `UNKNOWN`

 |
| `lastEnrollementTime` | `number` | This property is deprecated. Use lastEnrollmentTime instead. | **deprecated**: true |
| `lastEnrollmentTime` | `number` |  |  |
| `lastSync` | `number` |  |  |
| `macAddress` | `string` **|** `null` |  |  |
| `platformVersion` | `string` **|** `null` |  |  |
| `recentUsersEmail` | `array` of `string`s |  |  |
| `recentUsersType` | `array` of `string`s |  |  |
| `serialNumber` | `string` **|** `null` |  |  |
| `supportEndDate` | `number` **|** `null` | The final date the device will be supported. This is applicable only for those devices purchased directly from Google. |  |
| `tpmFamily` | `string` | TPM 2.0 style encoding  
  
**Examples**: TPM 1.2: "1.2" -> 312e3200 |  |
| `tpmFirmwareVersion` | `string` |  |  |
| `tpmManufacturer` | `string` |  |  |
| `tpmModel` | `string` |  |  |
| `tpmSpecLevel` | `string` |  |  |
| `tpmVendorId` | `string` |  |  |

---

### Google Device

`google_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `androidEnabledUnknownSources` | `boolean` **|** `null` |  |  |
| `androidOwnerProfileAccount` | `boolean` **|** `null` |  |  |
| `androidOwnershipPrivilege` | `string` **|** `null` |  |  |
| `androidSupportsWorkProfile` | `boolean` **|** `null` |  |  |
| `basebandVersion` | `string` **|** `null` |  |  |
| `bootloaderVersion` | `string` **|** `null` |  |  |
| `brand` | `string` **|** `null` | **Examples**: Samsung |  |
| `buildNumber` | `string` **|** `null` |  |  |
| 
`byod` \*

 | `boolean` | Please use BYOD instead. | **deprecated**: true |
| `compromisedState` | `string` **|** `null` |  |  |
| `deviceType` | `string` **|** `null` |  |  |
| `enabledDeveloperOptions` | `boolean` **|** `null` |  |  |
| `enabledUsbDebugging` | `boolean` **|** `null` |  |  |
| `encryptionState` | `string` **|** `null` |  |  |
| `imei` | `string` **|** `null` |  |  |
| `kernelVersion` | `string` **|** `null` |  |  |
| `lastSyncedOn` | `number` |  |  |
| `macAddress` | `array` **|** `null` |  |  |
| `managementState` | `string` **|** `null` |  |  |
| `meid` | `string` **|** `null` |  |  |
| `networkOperator` | `string` **|** `null` |  |  |
| `osKernel` | `string` **|** `null` |  |  |
| `otherAccounts` | `array` **|** `null` |  |  |
| `ownerType` | `string` **|** `null` |  |  |
| `releaseVersion` | `string` **|** `null` | **Examples**: 6.0 |  |
| `securityPatchedOn` | `number` |  |  |
| `serialNumber` | `string` **|** `null` |  |  |
| `wifiMacAddresses` | `array` **|** `null` |  |  |

---

### Google Domain

`google_domain` inherits from [Domain](/data-model/schemas/Domain.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`primary` \*

 | `boolean` |  |  |
| 

`verified` \*

 | `boolean` |  |  |

---

### Google Group

`google_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `adminCreated` | `boolean` **|** `null` |  |  |
| `aliases` | `array` **|** `null` |  |  |
| `directMembersCount` | `string` **|** `null` |  |  |
| `email` | `string` **|** `null` |  |  |
| `externalMembersCount` | `number` **|** `null` | Number of direct members whose email domain is outside the account's domains (including domain aliases). Null when the account's domains could not be ingested. |  |
| `groupMembersCount` | `number` | Number of direct members of type GROUP (nested groups). |  |
| `isEntireOrganizationMember` | `boolean` | Whether the group has a CUSTOMER-type member, i.e. every user in the Google Workspace organization is a member of this group. |  |
| `isExternalMemberIncluded` | `boolean` **|** `null` | Whether any direct member's email domain is outside the account's domains (including domain aliases). Null when the account's domains could not be ingested. |  |
| `kind` | `string` **|** `null` | The type of the resource. Always admin#directory#group for groups. |  |
| `nonEditableAliases` | `array` **|** `null` | The list of the group's non-editable alias email addresses that are outside of the account's primary domain or subdomains. |  |
| `userMembersCount` | `number` | Number of direct members of type USER. |  |

---

### Google Group Settings

`google_group_settings` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowExternalMembers` | `boolean` **|** `null` |  |  |
| `allowWebPosting` | `boolean` **|** `null` |  |  |
| `archiveOnly` | `boolean` **|** `null` |  |  |
| `customFooterText` | `string` **|** `null` | The maximum number of characters is 1,000. |  |
| `customReplyTo` | `string` **|** `null` |  |  |
| `customRolesEnabledForSettingsToBeMerged` | `boolean` **|** `null` |  |  |
| `defaultMessageDenyNotificationText` | `string` **|** `null` |  |  |
| `email` | `string` |  |  |
| `enableCollaborativeInbox` | `boolean` **|** `null` |  |  |
| `favoriteRepliesOnTop` | `boolean` **|** `null` |  |  |
| `includeCustomFooter` | `boolean` **|** `null` |  |  |
| `includeInGlobalAddressList` | `boolean` **|** `null` |  |  |
| `isArchived` | `boolean` **|** `null` |  |  |
| `membersCanPostAsTheGroup` | `boolean` **|** `null` |  |  |
| `messageModerationLevel` | `string` **|** `null` |  | **Any of**:
-   `MODERATE_ALL_MESSAGES`

-   `MODERATE_NON_MEMBERS`

-   `MODERATE_NEW_MEMBERS`

-   `MODERATE_NONE`

 |
| `primaryLanguage` | `string` **|** `null` |  |  |
| `replyTo` | `string` **|** `null` |  | **Any of**:

-   `REPLY_TO_CUSTOM`

-   `REPLY_TO_SENDER`

-   `REPLY_TO_LIST`

-   `REPLY_TO_OWNER`

-   `REPLY_TO_IGNORE`

-   `REPLY_TO_MANAGERS`

 |
| `sendMessageDenyNotification` | `boolean` **|** `null` |  |  |
| `spamModerationLevel` | `string` **|** `null` |  | **Any of**:

-   `ALLOW`

-   `MODERATE`

-   `SILENTLY_MODERATE`

-   `REJECT`

 |
| `whoCanApproveMembers` | `string` **|** `null` |  | **Any of**:

-   `ALL_MEMBERS_CAN_APPROVE`

-   `ALL_MANAGERS_CAN_APPROVE`

-   `ALL_OWNERS_CAN_APPROVE`

-   `NONE_CAN_APPROVE`

 |
| `whoCanAssistContent` | `string` **|** `null` |  | **Any of**:

-   `ALL_MEMBERS`

-   `OWNERS_AND_MANAGERS`

-   `MANAGERS_ONLY`

-   `OWNERS_ONLY`

-   `NONE`

 |
| `whoCanBanUsers` | `string` **|** `null` |  | **Any of**:

-   `ALL_MEMBERS`

-   `OWNERS_AND_MANAGERS`

-   `OWNERS_ONLY`

-   `NONE`

 |
| `whoCanContactOwner` | `string` **|** `null` |  | **Any of**:

-   `ALL_IN_DOMAIN_CAN_CONTACT`

-   `ALL_MANAGERS_CAN_CONTACT`

-   `ALL_MEMBERS_CAN_CONTACT`

-   `ANYONE_CAN_CONTACT`

-   `ALL_OWNERS_CAN_CONTACT`

 |
| `whoCanDiscoverGroup` | `string` **|** `null` |  | **Any of**:

-   `ALL_MEMBERS_CAN_DISCOVER`

-   `ALL_IN_DOMAIN_CAN_DISCOVER`

-   `ANYONE_CAN_DISCOVER`

 |
| `whoCanJoin` | `string` **|** `null` |  | **Any of**:

-   `ANYONE_CAN_JOIN`

-   `ALL_IN_DOMAIN_CAN_JOIN`

-   `INVITED_CAN_JOIN`

-   `CAN_REQUEST_TO_JOIN`

 |
| `whoCanLeaveGroup` | `string` **|** `null` |  | **Any of**:

-   `ALL_MANAGERS_CAN_LEAVE`

-   `ALL_MEMBERS_CAN_LEAVE`

-   `NONE_CAN_LEAVE`

 |
| `whoCanModerateContent` | `string` **|** `null` |  | **Any of**:

-   `ALL_MEMBERS`

-   `OWNERS_AND_MANAGERS`

-   `OWNERS_ONLY`

-   `NONE`

 |
| `whoCanModerateMembers` | `string` **|** `null` |  | **Any of**:

-   `ALL_MEMBERS`

-   `OWNERS_AND_MANAGERS`

-   `OWNERS_ONLY`

-   `NONE`

 |
| `whoCanPostMessage` | `string` **|** `null` |  | **Any of**:

-   `NONE_CAN_POST`

-   `ALL_MANAGERS_CAN_POST`

-   `ALL_MEMBERS_CAN_POST`

-   `ALL_OWNERS_CAN_POST`

-   `ALL_IN_DOMAIN_CAN_POST`

-   `ANYONE_CAN_POST`

 |
| `whoCanViewGroup` | `string` **|** `null` |  | **Any of**:

-   `ANYONE_CAN_VIEW`

-   `ALL_IN_DOMAIN_CAN_VIEW`

-   `ALL_MEMBERS_CAN_VIEW`

-   `ALL_MANAGERS_CAN_VIEW`

-   `ALL_OWNERS_CAN_VIEW`

 |
| `whoCanViewMembership` | `string` **|** `null` |  | **Any of**:

-   `ALL_IN_DOMAIN_CAN_VIEW`

-   `ALL_MEMBERS_CAN_VIEW`

-   `ALL_MANAGERS_CAN_VIEW`

 |

---

### Google Mobile Device

`google_mobile_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `adbStatus` | `boolean` **|** `null` | Adb (USB debugging) enabled or disabled on device |  |
| `brand` | `string` **|** `null` |  |  |
| `deviceCompromisedStatus` | `string` **|** `null` |  |  |
| `email` | `string` |  |  |
| `encryptionStatus` | `string` **|** `null` |  |  |
| `firstSyncOn` | `number` |  |  |
| `googleStatus` | `string` **|** `null` |  | **Any of**:
-   `ACTIVE`

-   `DELINQUENT`

-   `PRE_PROVISIONED`

-   `DEPROVISIONED`

-   `DISABLED`

-   `INACTIVE`

-   `RETURN_ARRIVED`

-   `RETURN_REQUESTED`

-   `SHIPPED`

-   `UNKNOWN`

 |
| `hardware` | `string` **|** `null` |  |  |
| `hardwareId` | `string` **|** `null` | The IMEI/MEID unique identifier for Android hardware |  |
| `imei` | `string` **|** `null` |  |  |
| `lastSyncOn` | `number` |  |  |
| `macAddress` | `string` **|** `null` |  |  |
| `manufacturer` | `string` **|** `null` |  |  |
| `os` | `string` **|** `null` | **Examples**: IOS 4.3, Android 2.3.5 |  |
| `ownerName` | `string` |  |  |
| `serialNumber` | `string` **|** `null` |  |  |
| `type` | `string` **|** `null` |  |  |
| `userAgent` | `string` **|** `null` |  |  |
| `wifiMacAddress` | `string` **|** `null` |  |  |

---

### Google Role

`google_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `kind` | `string` **|** `null` | The type of the resource. Always admin#directory#role. |  |
| 
`vendor` \*

 | `string` |  | **default**: Google |

---

### Google Site

`google_site` inherits from [Site](/data-model/schemas/Site.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `area` | `string` **|** `null` |  |  |
| `buildingId` | `string` **|** `null` |  |  |
| `floorName` | `string` **|** `null` |  |  |
| `floorSection` | `string` **|** `null` | More specific location within the floor. For example if a floor is divided into sections "A", "B" and "C" this field would identify one of those values. |  |
| 
`name` \*

 | `string` |  |  |
| `type` | `string` **|** `null` |  |  |

---

### Google Token

`google_token` inherits from [AccessKey](/data-model/schemas/AccessKey.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `anonymous` | `boolean` **|** `null` |  |  |
| `clientId` | `string` **|** `null` |  |  |
| `nativeApp` | `boolean` **|** `null` |  |  |
| `scopes` | `array` **|** `null` |  |  |
| `userKey` | `string` **|** `null` |  |  |

---

### Google User

`google_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`admin` \*

 | `boolean` |  |  |
| `agreedToTerms` | `boolean` **|** `null` |  |  |
| `aliases` | `array` **|** `null` |  |  |
| 

`archived` \*

 | `boolean` |  |  |
| `changePasswordAtNextLogin` | `boolean` **|** `null` |  |  |
| `creationTime` | `number` |  |  |
| `customerId` | `string` **|** `null` |  |  |
| `deletionTime` | `number` |  |  |
| `hashFunction` | `string` **|** `null` | **Examples**: MD5, SHA-1, crypt |  |
| 

`includeInGlobalAddressList` \*

 | `boolean` |  |  |
| 

`ipWhitelisted` \*

 | `boolean` |  |  |
| 

`isAdmin` \*

 | `boolean` |  |  |
| 

`isDelegatedAdmin` \*

 | `boolean` |  |  |
| 

`isEnforcedIn2Sv` \*

 | `boolean` |  |  |
| 

`isEnrolledIn2Sv` \*

 | `boolean` |  |  |
| 

`isMailboxSetup` \*

 | `boolean` |  |  |
| `kind` | `string` **|** `null` | The type of the resource. Always admin#directory#user for users. |  |
| `lastLoginOn` | `number` |  |  |
| `lastLoginTime` | `number` |  |  |
| `orgUnitPath` | `string` **|** `null` |  |  |
| `primaryEmail` | `string` **|** `null` |  |  |
| `recoveryEmail` | `string` **|** `null` |  |  |
| `recoveryPhone` | `string` **|** `null` |  |  |
| 

`suspended` \*

 | `boolean` |  |  |
| `suspensionReason` | `string` **|** `null` |  |  |
| `thumbnailPhotoUrl` | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-03-31** — Added OS kernel version property to Google Workspace endpoint device entities.
-   **2025-07-24** — Added relationships linking Google Workspace Chrome extensions to the devices on which they are installed.

---

Source: /integrations/directory/google-cloud

# Google Cloud

Visualize Google Cloud resources, map Google Cloud users to employees, and monitor visibility and governance of the environment through queries and alerts.

## Installation

> **INFO**
> 
> To use this integration, JupiterOne requires the contents of a [Google Cloud service account](https://cloud.google.com/iam/docs/service-accounts-create) key file with the correct API services enabled. In addition, you must have permission in JupiterOne to install new integrations.

### Overview

The Google Cloud integration requires three main configuration steps:

1.  **Enable Google Cloud service APIs** for the services you want to ingest
2.  **Create a service account** with appropriate permissions
3.  **Configure the integration** in JupiterOne with the service account key

### Google Cloud Configuration

Google Cloud has most API services disabled by default. When a Google Cloud service API is disabled, the JupiterOne integration will not ingest the data from that API.

> **TIP**
> 
> You only need to enable the APIs for the services you want JupiterOne to ingest. If a service is not used in your Google Cloud environment, you can skip enabling its API.

See the **Authorization** tab for the full list of required APIs and permissions per ingestion step.

> **INFO**
> 
> **Required APIs**: The following APIs must always be enabled for the integration to function: `cloudasset.googleapis.com`, `cloudresourcemanager.googleapis.com`, `iam.googleapis.com`, and `serviceusage.googleapis.com`. All other APIs are optional and should only be enabled if you want to ingest data from those specific services.

### Enabling Google Cloud Service APIs

Google Cloud service APIs can be enabled from the [Google Cloud Console API Library](https://console.cloud.google.com/apis/library) or using the [`gcloud` CLI](https://cloud.google.com/sdk/gcloud). See the **Authorization** tab for the complete list of APIs used by this integration.

#### Creating Google Cloud project service account

-   See the [Google Cloud service account documentation](https://cloud.google.com/iam/docs/service-accounts-create) for more information on how to create a service account in the project that you would like to ingest data from.

We must assign the correct permissions to the newly created service account for the integration to be run. We recommend using the following roles managed by Google Cloud:

-   [`Security Reviewer`](https://cloud.google.com/iam/docs/understanding-roles#iam.securityReviewer)
-   [`Organization Role Viewer`](https://cloud.google.com/iam/docs/understanding-roles#iam.organizationRoleViewer)
-   [`BigQuery Metadata Viewer`](https://cloud.google.com/bigquery/docs/access-control#bigquery.metadataViewer)
-   [`Secret Manager Secret Accessor`](https://cloud.google.com/secret-manager/docs/creating-and-accessing-secrets#access)

Instead of using the Google Cloud managed roles listed above, you can create a custom IAM role with only the specific permissions required by the JupiterOne integration. See the **Authorization** tab for the complete list of permissions per ingestion step. See the [Google Cloud custom role documentation](https://cloud.google.com/iam/docs/creating-custom-roles#creating_a_custom_role) for information on how custom roles can be configured and assigned.

You may also create a service account using the [`gcloud` CLI](https://cloud.google.com/sdk/gcloud).

#### Generate a service account key

> **NOTE**
> 
> To create a service account key, your Google Cloud user must hold the **Service Account Key Admin** (`roles/iam.serviceAccountKeyAdmin`) role on the project or service account. Ask your administrator to grant it if you do not have it.

In the Google Cloud console, go to **IAM & Admin** > **Service Accounts**, select the service account you created, open the **Keys** tab, and choose **Add key** > **Create new key** > **JSON**. See the [Google Cloud service account key documentation](https://cloud.google.com/iam/docs/keys-create-delete) for more information on how to create a service account key for the service account that you would like to ingest data from.

You may also create a service account key using the [`gcloud` CLI](https://cloud.google.com/sdk/gcloud).

#### JupiterOne + Google Cloud Organization

Given the correct permissions, JupiterOne has the ability to automatically discover each project under a Google Cloud organization and configure integration instances for each of the projects.

##### Setup

1.  Select one Google Cloud project to configure a service account for JupiterOne.
    
2.  Create the service account without a role. Copy the email address of the new service account (e.g. `my-sa@my-j1-project.iam.gserviceaccount.com`).
    
3.  Generate and copy a new service account key.
    
4.  Enable service APIs in both the "main" project and each "child" project that you'd like JupiterOne to access.
    
    **Important**: The following APIs **must be enabled in the "main" project**:
    
    -   `cloudasset.googleapis.com` (Cloud Asset)
    -   `cloudresourcemanager.googleapis.com` (Cloud Resource Manager)
    -   `iam.googleapis.com` (Identity and Access Management)
    -   `serviceusage.googleapis.com` (Service Usage)
    
    **For child projects**: Enable the service APIs for the specific services you want to ingest from each project. Refer to the API table in the earlier section for the complete list of supported services.
    
5.  Switch to the organization that you'd like to create individual integration instances for each project
    
6.  [Create a new custom role](https://cloud.google.com/iam/docs/creating-custom-roles) with the following permissions:
    

resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list serviceusage.services.list resourcemanager.organizations.getIamPolicy cloudasset.assets.searchAllIamPolicies

The integration will also try to ingest organization policy for "storage.publicAccessPrevention" to precisely calculate storage buckets public access, and Access Approval settings for enforcing manual approval of privileged operations (CIS 2.15), it is therefore recommended that the following permissions are also included in the custom role above:

orgpolicy.policy.get accessapproval.settings.get accessapproval.requests.get

The integration will calculate if a storage bucket is public or not based on the following conditions:

-   `Public to internet` means one or more bucket-level permissions grant access to `allUsers` or `allAuthenticatedUsers`.
-   `Not public` means the bucket's policy controls all objects uniformly, and no permissions have been granted to allUsers or allAuthenticatedUsers.
-   `Subject to object ACLs` means fine-grained, object-level access control lists (ACLs) are enabled. Objects may be public if they grant access to allUsers or allAuthenticatedUsers.

1.  Navigate to the Cloud Resource Manager for that organization and [add a new member to the organization](https://cloud.google.com/resource-manager/docs/access-control-org#grant-access). The new member email address is the email address of the service account that was created earlier. Select the new organization role that was created above, as well as the Google Cloud managed role "Security Reviewer" (`roles/iam.securityReviewer`) or an alternative JupiterOne custom role that you've created.
    
2.  Navigate to the JupiterOne Google Cloud integration configuration page to begin configuring the "main" integration instance.
    

Use the generated service account key as the value for the "Service Account Key File" field.

> **NOTE**
> 
> The "Polling Interval" that is selected for the "main" integration instances will be the same polling interval that is used for each of the child integration instances.

1.  Select the "Configure Organization Projects" checkbox.
2.  Enter the numerical value of the Google Cloud organization into the "Organization ID" text field (e.g. "1234567890").
3.  Click `CREATE CONFIGURATION`.

Depending on how many projects exist under a Google Cloud organization, the auto-configuration process may take a few minutes to complete. When the process has been completed, you will see your new integration instances on the JupiterOne Google Cloud integration list page.

### Configuration in JupiterOne

To install the Google Cloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Google Cloud. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Account Name** by which you want to identify this Google Cloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Add AccountName Tag** is enabled.
-   **Description** that will assist your team to identify the integration instance.
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You can leave this as `DISABLED` and manually execute the integration.
-   **Service Account Key File** contents of the Google Cloud service account.
-   Add any tags you want to use to simplify data management and queries.

**Project ID of the Google Cloud project (e.g. abc-123)** (optional): The project ID to target for data ingestion. Defaults to the project ID specified in the service account key file.

Select **Configure Organization Projects** if you want JupiterOne to auto-configure all projects in your organization. JupiterOne applies the configuration to all other projects that do not have the optional `j1-integration: SKIP` tag applied to the project in your infrastructure-as-code. Do not use the optional project ID if you want to use this feature.

When **Configure Organization Projects** is enabled, two additional options become available:

-   **Auto-delete Removed Projects**: When enabled, automatically deletes integration instances for projects that are deleted or removed from your organization. Disabled by default.
-   **Auto-delete Child Integrations**: When enabled, automatically deletes child project instances when this parent organization instance is deleted. Enabled by default.

**Folder Filter** (optional): A numerical folder ID. When set, JupiterOne ingests only projects in the specified folder and its subfolders. When **Configure Organization Projects** is also enabled, JupiterOne auto-configures only projects within this folder.

Click **Create** after all values are provided to finalize the integration.

## Data Volume Configuration

### Data Filtering Options

| Field | Description | Default |
| --- | --- | --- |
| Compute Instance Metadata Fields | Comma-separated metadata field keys to ingest from Compute Engine instances. For example: `key1,key2`. Leave blank to ingest no custom metadata fields. | Empty |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (154)

-   `accessapproval.settings.get`
-   `accesscontextmanager.accessLevels.list`
-   `accesscontextmanager.accessPolicies.list`
-   `accesscontextmanager.servicePerimeters.list`
-   `aiplatform.batchPredictionJobs.list`
-   `aiplatform.datasets.list`
-   `aiplatform.endpoints.list`
-   `aiplatform.models.list`
-   `aiplatform.trainingPipelines.list`
-   `alloydb.backups.get`
-   `alloydb.clusters.list`
-   `alloydb.instances.connect`
-   `alloydb.instances.list`
-   `alloydb.users.list`
-   `apigateway.apiconfigs.getIamPolicy`
-   `apigateway.apiconfigs.list`
-   `apigateway.apis.getIamPolicy`
-   `apigateway.apis.list`
-   `apigateway.gateways.getIamPolicy`
-   `apigateway.gateways.list`
-   `appengine.applications.get`
-   `appengine.instances.list`
-   `appengine.services.list`
-   `appengine.versions.list`
-   `artifactregistry.packages.list`
-   `artifactregistry.repositories.list`
-   `artifactregistry.vpcscconfigs.get`
-   `bigquery.datasets.get`
-   `bigquery.models.getData`
-   `bigquery.models.getMetadata`
-   `bigquery.models.list`
-   `bigquery.tables.get`
-   `bigquery.tables.getIamPolicy`
-   `bigquery.tables.list`
-   `bigtable.appProfiles.list`
-   `bigtable.backups.list`
-   `bigtable.clusters.list`
-   `bigtable.instances.list`
-   `bigtable.tables.list`
-   `billing.accounts.list`
-   `billing.budgets.list`
-   `binaryauthorization.policy.get`
-   `cloudasset.assets.listCloudbillingProjectBillingInfos`
-   `cloudasset.assets.searchAllIamPolicies`
-   `cloudbuild.builds.get`
-   `cloudbuild.builds.list`
-   `cloudbuild.integrations.get`
-   `cloudbuild.integrations.list`
-   `cloudbuild.repositories.get`
-   `cloudbuild.repositories.list`
-   `cloudbuild.workerpools.list`
-   `clouddeploy.automations.list`
-   `clouddeploy.deliveryPipelines.list`
-   `cloudfunctions.functions.list`
-   `cloudkms.cryptoKeys.getIamPolicy`
-   `cloudkms.cryptoKeys.list`
-   `cloudkms.keyRings.list`
-   `cloudsecurityscanner.scanruns.list`
-   `cloudsecurityscanner.scans.list`
-   `cloudsql.backupRuns.list`
-   `cloudsql.databases.list`
-   `cloudsql.instances.list`
-   `cloudsql.sslCerts.list`
-   `cloudsql.users.list`
-   `compute.addresses.list`
-   `compute.backendBuckets.list`
-   `compute.backendServices.list`
-   `compute.disks.list`
-   `compute.externalVpnGateways.list`
-   `compute.firewalls.list`
-   `compute.forwardingRules.list`
-   `compute.globalAddresses.list`
-   `compute.globalForwardingRules.list`
-   `compute.healthChecks.list`
-   `compute.images.get`
-   `compute.images.getIamPolicy`
-   `compute.images.list`
-   `compute.instanceGroups.list`
-   `compute.instances.list`
-   `compute.networks.list`
-   `compute.projects.get`
-   `compute.regionBackendServices.list`
-   `compute.regionHealthChecks.list`
-   `compute.regionSecurityPolicies.list`
-   `compute.regionTargetHttpProxies.list`
-   `compute.regionTargetHttpsProxies.list`
-   `compute.regionUrlMaps.list`
-   `compute.routers.list`
-   `compute.securityPolicies.list`
-   `compute.snapshots.list`
-   `compute.sslPolicies.list`
-   `compute.subnetworks.list`
-   `compute.targetHttpProxies.list`
-   `compute.targetHttpsProxies.list`
-   `compute.targetPools.list`
-   `compute.targetSslProxies.list`
-   `compute.targetVpnGateways.list`
-   `compute.urlMaps.list`
-   `compute.vpnGateways.list`
-   `compute.vpnTunnels.list`
-   `container.clusters.list`
-   `dataproc.clusters.list`
-   `datastore.databases.list`
-   `dlp.jobTriggers.list`
-   `dlp.tableDataProfiles.list`
-   `dns.managedZones.list`
-   `dns.policies.list`
-   `dns.resourceRecordSets.list`
-   `essentialcontacts.contacts.list`
-   `file.instances.list`
-   `iam.roles.list`
-   `iam.serviceAccountKeys.list`
-   `iam.serviceAccounts.list`
-   `iap.webServices.getIamPolicy`
-   `logging.logMetrics.list`
-   `logging.sinks.list`
-   `memcache.instances.list`
-   `monitoring.alertPolicies.list`
-   `orgpolicy.policies.list`
-   `orgpolicy.policy.get`
-   `osconfig.inventories.get`
-   `privateca.caPools.list`
-   `privateca.certificateAuthorities.getIamPolicy`
-   `privateca.certificateAuthorities.list`
-   `privateca.certificates.list`
-   `pubsub.subscriptions.list`
-   `pubsub.topics.getIamPolicy`
-   `pubsub.topics.list`
-   `redis.instances.list`
-   `resourcemanager.folders.list`
-   `resourcemanager.organizations.get`
-   `resourcemanager.projects.get`
-   `resourcemanager.projects.getIamPolicy`
-   `resourcemanager.projects.list`
-   `run.configurations.list`
-   `run.routes.list`
-   `run.services.list`
-   `secretmanager.secrets.list`
-   `secretmanager.versions.list`
-   `securitycenter.findings.list`
-   `serviceusage.services.list`
-   `source.repos.list`
-   `spanner.backups.get`
-   `spanner.databases.getIamPolicy`
-   `spanner.databases.list`
-   `spanner.databasesRoles.list`
-   `spanner.instanceConfigs.list`
-   `spanner.instances.list`
-   `storage.buckets.getIamPolicy`
-   `storage.buckets.list`
-   `workflows.workflows.list`
-   `workstations.clusters.list`
-   `workstations.configs.list`
-   `workstations.workstations.list`

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (3)

-   `roles/iam.securityReviewer`
-   `roles/orgpolicy.policyViewer`
-   `roles/secretmanager.viewer`

### APIs

APIs or services that must be enabled in the target environment.

Show APIs (48)

-   `accessapproval.googleapis.com`
-   `accesscontextmanager.googleapis.com`
-   `aiplatform.googleapis.com`
-   `alloydb.googleapis.com`
-   `apigateway.googleapis.com`
-   `apikeys.googleapis.com`
-   `appengine.googleapis.com`
-   `artifactregistry.googleapis.com`
-   `bigquery.googleapis.com`
-   `bigtable.googleapis.com`
-   `binaryauthorization.googleapis.com`
-   `cloudasset.googleapis.com`
-   `cloudbilling.googleapis.com`
-   `cloudbuild.googleapis.com`
-   `clouddeploy.googleapis.com`
-   `cloudfunctions.googleapis.com`
-   `cloudidentity.googleapis.com`
-   `cloudkms.googleapis.com`
-   `compute.googleapis.com`
-   `container.googleapis.com`
-   `dataproc.googleapis.com`
-   `dlp.googleapis.com`
-   `dns.googleapis.com`
-   `essentialcontacts.googleapis.com`
-   `file.googleapis.com`
-   `firestore.googleapis.com`
-   `iam.googleapis.com`
-   `iap.googleapis.com`
-   `logging.googleapis.com`
-   `memcache.googleapis.com`
-   `monitoring.googleapis.com`
-   `orgpolicy.googleapis.com`
-   `osconfig.googleapis.com`
-   `privateca.googleapis.com`
-   `pubsub.googleapis.com`
-   `redis.googleapis.com`
-   `resourcemanager.googleapis.com`
-   `run.googleapis.com`
-   `secretmanager.googleapis.com`
-   `securitycenter.googleapis.com`
-   `serviceusage.googleapis.com`
-   `sourcerepo.googleapis.com`
-   `spanner.googleapis.com`
-   `sqladmin.googleapis.com`
-   `storage.googleapis.com`
-   `websecurityscanner.googleapis.com`
-   `workflows.googleapis.com`
-   `workstations.googleapis.com`

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (96)

| Step | Permissions | Roles | APIs |
| --- | --- | --- | --- |
| Access Approval Settings | `accessapproval.settings.get` | \- | `accessapproval.googleapis.com` |
| Access Context Manager Access Levels | `accesscontextmanager.accessLevels.list` | \- | `accesscontextmanager.googleapis.com` |
| Access Context Manager Ingress Policies Sources Relationships | \- | \- | \- |
| Access Context Manager Service Perimeters | `accesscontextmanager.servicePerimeters.list` | \- | `accesscontextmanager.googleapis.com` |
| Api Gateway Api Configs | `apigateway.apiconfigs.list`, `apigateway.apiconfigs.getIamPolicy` | \- | `apigateway.googleapis.com` |
| Api Gateway Gateways | `apigateway.gateways.list`, `apigateway.gateways.getIamPolicy` | \- | `apigateway.googleapis.com` |
| API Keys | \- | \- | `apikeys.googleapis.com` |
| API Services | `serviceusage.services.list` | \- | `serviceusage.googleapis.com` |
| AppEngine Instances | `appengine.instances.list` | \- | `appengine.googleapis.com` |
| AppEngine Services | `appengine.services.list` | \- | `appengine.googleapis.com` |
| AppEngine Versions | `appengine.versions.list` | \- | \- |
| Artifact Registry VPC SC configuration and Policy | `artifactregistry.vpcscconfigs.get` | \- | `artifactregistry.googleapis.com` |
| Artifact Repository Package | `artifactregistry.packages.list` | \- | `artifactregistry.googleapis.com` |
| Audit Config IAM Policy | `resourcemanager.projects.getIamPolicy` | \- | `resourcemanager.googleapis.com` |
| Big Query Models | `bigquery.models.list`, `bigquery.models.getData`, `bigquery.models.getMetadata` | \- | `bigquery.googleapis.com` |
| Big Query Tables | `bigquery.tables.list`, `bigquery.tables.getIamPolicy`, `bigquery.tables.get` | \- | `bigquery.googleapis.com` |
| Bigtable AppProfiles | `bigtable.appProfiles.list` | \- | `bigtable.googleapis.com` |
| Bigtable Backups | `bigtable.backups.list` | \- | `bigtable.googleapis.com` |
| Bigtable Clusters | `bigtable.clusters.list` | \- | `bigtable.googleapis.com` |
| Bigtable Tables | `bigtable.tables.list` | \- | `bigtable.googleapis.com` |
| Billing Budgets | `billing.budgets.list` | \- | `cloudbilling.googleapis.com` |
| Binary Authorization Policy | `binaryauthorization.policy.get` | \- | `binaryauthorization.googleapis.com` |
| Build Additional Project Budget Relationships | `cloudasset.assets.listCloudbillingProjectBillingInfos` | \- | `cloudbilling.googleapis.com` |
| Build Device User Is Google User Relationship | \- | \- | \- |
| Build User Assigned AlloyDb Cluster Relationship | `alloydb.users.list` | \- | \- |
| Cloud Deploy Automation | `clouddeploy.automations.list` | \- | `clouddeploy.googleapis.com` |
| Cloud Identity Device Users | \- | \- | `cloudidentity.googleapis.com` |
| Cloud Identity Groups | \- | \- | `cloudidentity.googleapis.com` |
| Cloud Identity Membership Roles | \- | \- | `cloudidentity.googleapis.com` |
| Cloud Identity SAML Provider Uses Group Relationship | \- | \- | `cloudidentity.googleapis.com` |
| Cloud Run Configurations | `run.configurations.list` | \- | `run.googleapis.com` |
| Cloud Run Routes | `run.routes.list` | \- | \- |
| Cloud Spanner Backups | `spanner.backups.get` | \- | `spanner.googleapis.com` |
| Cloud VPN Gateways | `compute.vpnGateways.list` | \- | `compute.googleapis.com` |
| Compute Addresses | `compute.addresses.list` | \- | `compute.googleapis.com` |
| Compute Backend Services | `compute.backendServices.list` | \- | `compute.googleapis.com` |
| Compute Disk Image Relationships | `compute.images.get` | \- | `compute.googleapis.com` |
| Compute Firewalls | `compute.firewalls.list` | \- | `compute.googleapis.com` |
| Compute Forwarding Rules | `compute.forwardingRules.list` | \- | `compute.googleapis.com` |
| Compute Global Addresses | `compute.globalAddresses.list` | \- | `compute.googleapis.com` |
| Compute Global Forwarding Rules | `compute.globalForwardingRules.list` | \- | `compute.googleapis.com` |
| Compute Images | `compute.images.list`, `compute.images.getIamPolicy` | \- | `compute.googleapis.com` |
| Compute Instances | `compute.instances.list`, `osconfig.inventories.get` | \- | `compute.googleapis.com`, `osconfig.googleapis.com` |
| Compute Load Balancers | `compute.urlMaps.list` | \- | `compute.googleapis.com` |
| Compute Project | `compute.projects.get` | \- | `compute.googleapis.com` |
| Compute Region Backend Services | `compute.regionBackendServices.list` | \- | `compute.googleapis.com` |
| Compute Region Load Balancers | `compute.regionUrlMaps.list` | \- | `compute.googleapis.com` |
| Compute Region Target HTTP Proxies | `compute.regionTargetHttpProxies.list` | \- | `compute.googleapis.com` |
| Compute Region Target HTTPS Proxies | `compute.regionTargetHttpsProxies.list` | \- | `compute.googleapis.com` |
| Compute SSL Policies | `compute.sslPolicies.list` | \- | `compute.googleapis.com` |
| Compute Subnetworks | `compute.subnetworks.list` | \- | `compute.googleapis.com` |
| Compute Target HTTP Proxies | `compute.targetHttpProxies.list` | \- | `compute.googleapis.com` |
| Compute Target HTTPS Proxies | `compute.targetHttpsProxies.list` | \- | `compute.googleapis.com` |
| Compute Target Pools | `compute.targetPools.list` | \- | `compute.googleapis.com` |
| Compute Target SSL Proxies | `compute.targetSslProxies.list` | \- | `compute.googleapis.com` |
| Container Clusters | `container.clusters.list` | \- | `container.googleapis.com` |
| DLP Table Data Profiles | `dlp.tableDataProfiles.list` | \- | `dlp.googleapis.com` |
| DNS Managed Zone Records | `dns.resourceRecordSets.list` | \- | `dns.googleapis.com` |
| DNS Policies | `dns.policies.list` | \- | `dns.googleapis.com` |
| Essential Contacts | `essentialcontacts.contacts.list` | \- | `essentialcontacts.googleapis.com` |
| External VPN Gateways | `compute.externalVpnGateways.list` | \- | `compute.googleapis.com` |
| Fetch Cloud Build BitBucket Server Repos | `cloudbuild.repositories.list`, `cloudbuild.repositories.get` | \- | `cloudbuild.googleapis.com` |
| Fetch Scan Runs | `cloudsecurityscanner.scanruns.list` | \- | `websecurityscanner.googleapis.com` |
| Fetch Secret Manager secret versions | `secretmanager.versions.list` | `roles/secretmanager.viewer` | `secretmanager.googleapis.com` |
| Fetch Security Command Center Findings | `securitycenter.findings.list` | \- | `securitycenter.googleapis.com` |
| Fetch SQL Admin Backups | `cloudsql.backupRuns.list` | \- | `sqladmin.googleapis.com` |
| Fetch SQL Admin Instance Databases | `cloudsql.databases.list` | \- | `sqladmin.googleapis.com` |
| Fetch SQL Admin Instance Users | `cloudsql.users.list` | \- | `sqladmin.googleapis.com` |
| Fetch SQL Admin SSL Certs | `cloudsql.sslCerts.list` | \- | `sqladmin.googleapis.com` |
| fetch-alloydb-postgre-sql-connection | `alloydb.instances.connect` | \- | `alloydb.googleapis.com` |
| fetch-alloydb-postgre-sql-instance | `alloydb.instances.list` | \- | `alloydb.googleapis.com` |
| Firestore Service Database Relationships | \- | \- | \- |
| google\_cloud\_workflow\_uses\_iam\_service\_account | \- | \- | \- |
| IAP Backend Service Bindings | `iap.webServices.getIamPolicy` | \- | `iap.googleapis.com` |
| KMS Crypto Keys | `cloudkms.cryptoKeys.list`, `cloudkms.cryptoKeys.getIamPolicy` | \- | `cloudkms.googleapis.com` |
| Logging Metrics | `logging.logMetrics.list` | \- | `logging.googleapis.com` |
| Network Has VPN Gateway Relationships | \- | \- | \- |
| Private CA Certificate Authorities | `privateca.certificateAuthorities.getIamPolicy`, `privateca.certificateAuthorities.list` | \- | `privateca.googleapis.com` |
| Private CA Certificates | `privateca.certificates.list` | \- | `privateca.googleapis.com` |
| PubSub Subscriptions | `pubsub.subscriptions.list` | \- | `pubsub.googleapis.com` |
| Resource Manager Folders | `resourcemanager.folders.list` | \- | `resourcemanager.googleapis.com` |
| Resource Manager Projects | `resourcemanager.projects.list` | \- | `resourcemanager.googleapis.com` |
| Resource Manager Skipped and Deleted Projects | `resourcemanager.projects.get` | \- | `resourcemanager.googleapis.com` |
| Spanner Instance Databases | `spanner.databases.list` | \- | `spanner.googleapis.com` |
| Spanner Instance Databases Role | `spanner.databasesRoles.list` | \- | `spanner.googleapis.com` |
| Spanner Instances | `spanner.instances.list`, `spanner.databases.getIamPolicy` | \- | `spanner.googleapis.com` |
| SQL Admin Instances | `cloudsql.instances.list` | \- | `sqladmin.googleapis.com` |
| Target VPN Gateways | `compute.targetVpnGateways.list` | \- | `compute.googleapis.com` |
| Vertex AI Endpoint Model Relationships | \- | \- | \- |
| VPN Gateway Has Tunnel Relationships | \- | \- | \- |
| VPN Tunnel Uses Router Relationships | \- | \- | \- |
| VPN Tunnels | `compute.vpnTunnels.list` | \- | `compute.googleapis.com` |
| Workflows Service Workflow Relationships | \- | \- | \- |
| Workstations | `workstations.workstations.list` | \- | `workstations.googleapis.com` |
| Workstations Clusters | `workstations.clusters.list` | \- | `workstations.googleapis.com` |
| Workstations Configurations | `workstations.configs.list` | \- | `workstations.googleapis.com` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Access Approval Settings | `google_cloud_access_approval_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Access Context Manager Access Level | `google_access_context_manager_access_level` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| Access Context Manager Access Level Condition | `google_access_context_manager_access_level_condition` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Access Context Manager Access Policy | `google_access_context_manager_access_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Access Context Manager Service Perimeter | `google_access_context_manager_service_perimeter` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Access Context Manager Service Perimeter Api Operation | `google_access_context_manager_service_perimeter_api_operation` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Access Context Manager Service Perimeter Egress Policy | `google_access_context_manager_service_perimeter_egress_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Access Context Manager Service Perimeter Ingress Policy | `google_access_context_manager_service_perimeter_ingress_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Access Context Manager Service Perimeter Method Selector | `google_access_context_manager_service_perimeter_method_selector` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AlloyDB for PostgreSQL | `google_cloud_alloydb` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AlloyDB for PostgreSQL Backup | `google_cloud_alloydb_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AlloyDB for PostgreSQL Cluster | `google_cloud_alloydb_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AlloyDB for PostgreSQL Connection | `google_cloud_alloydb_connection` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AlloyDB for PostgreSQL Instances | `google_cloud_alloydb_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Api Gateway Api | `google_api_gateway_api` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Api Gateway Api Config | `google_api_gateway_api_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Api Gateway Gateway | `google_api_gateway_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| API Key | `google_api_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| AppEngine Application | `google_app_engine_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AppEngine Instance | `google_app_engine_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AppEngine Service | `google_app_engine_service` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| AppEngine Version | `google_app_engine_version` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AppEngine Version Handler | `google_app_engine_version_handler` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Artifact Registry | `google_cloud_artifact_registry` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Artifact Registry Repository | `google_cloud_artifact_registry_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo), [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Artifact Registry VPCSC configuration | `google_cloud_artifact_registry_vpcsc_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Artifact Registry VPCSC Policy | `google_cloud_artifact_registry_vpcsc_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Artifact Repository Package | `google_cloud_artifact_registry_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Audit Config | `google_cloud_audit_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Big Query Dataset | `google_bigquery_dataset` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Big Query Model | `google_bigquery_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| Big Query Table | `google_bigquery_table` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Bigtable AppProfile | `google_bigtable_app_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Bigtable Backup | `google_bigtable_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Bigtable Cluster | `google_bigtable_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Bigtable Instance | `google_bigtable_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Bigtable Table | `google_bigtable_table` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Billing Account | `google_billing_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Billing Budget | `google_billing_budget` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| Binary Authorization Policy | `google_binary_authorization_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Cloud API Service | `google_cloud_api_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Build | `google_cloud_build` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| Cloud Build BitBucket Server Config | `google_cloud_bitbucket_server_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Build BitBucket Server Repo | `google_cloud_bitbucket_server_repo` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Cloud Build GitHub Enterprise Config | `google_cloud_github_enterprise_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Build Trigger | `google_cloud_build_trigger` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Cloud Build Worker Pool | `google_cloud_build_worker_pool` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Cloud Compute Router | `google_cloud_compute_router` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Cloud Deploy Automation | `google_cloud_deploy_automation` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Cloud Deploy Delivery Pipeline | `google_cloud_deploy_delivery_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| Cloud Deploy Service | `google_cloud_deploy_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Function | `google_cloud_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| Cloud Identity Device Users | `google_cloud_identity_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Cloud Identity Devices | `google_cloud_identity_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Cloud Identity Groups | `google_cloud_identity_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Cloud Identity Membership Roles | `google_cloud_identity_member_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Cloud Identity SSO Profile | `google_cloud_sso` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Identity SSO Saml Provider | `google_cloud_identity_saml_provider` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Run Configuration | `google_cloud_run_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Run Route | `google_cloud_run_route` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Cloud Run Service | `google_cloud_run_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Source Repository | `google_cloud_source_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Cloud Spanner | `google_cloud_spanner` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Cloud Spanner Backups | `google_cloud_spanner_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Cloud Storage Bucket | `google_storage_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Compute Address | `google_compute_address` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| Compute Backend Bucket | `google_compute_backend_bucket` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Compute Backend Service | `google_compute_backend_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Compute Disk | `google_compute_disk` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| Compute Firewalls | `google_compute_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Compute Forwarding Rule | `google_compute_forwarding_rule` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Compute Global Address | `google_compute_global_address` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| Compute Global Forwarding Rule | `google_compute_global_forwarding_rule` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Compute Health Check | `google_compute_health_check` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Compute Image | `google_compute_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Compute Instance | `google_compute_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Compute Instance Group | `google_compute_instance_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Compute Instance Group Named Port | `google_compute_instance_group_named_port` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Compute Networks | `google_compute_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Compute Project | `google_compute_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Compute Region Load Balancer | `google_compute_url_map` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Compute Region Target HTTP Proxy | `google_compute_target_http_proxy` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Compute Security Policy | `google_compute_security_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Compute Snapshot | `google_compute_snapshot` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Compute SSL Policy | `google_compute_ssl_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Compute Subnetwork | `google_compute_subnetwork` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Compute Target HTTPS Proxy | `google_compute_target_https_proxy` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Compute Target Pool | `google_compute_target_pool` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Compute Target SSL Proxy | `google_compute_target_ssl_proxy` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Container Cluster | `google_container_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Container Node Pool | `google_container_node_pool` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Dataproc Cluster | `google_dataproc_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| DLP Discovery Config | `google_dlp_discovery_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DLP Table Data Profile | `google_dlp_table_data_profile` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DNS Managed Zone | `google_dns_managed_zone` | [DomainZone](https://docs.jupiterone.io/data-model/schemas/DomainZone) |
| DNS Managed Zone Record | `google_dns_managed_zone_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| DNS Policy | `google_dns_policy` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| Essential Contact | `google_essential_contact` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Folder | `google_cloud_folder` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Google Cloud Filestore Instance | `google_cloud_filestore_instance` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Google Cloud Filestore Service | `google_cloud_filestore_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Google Cloud Firestore Database | `google_cloud_firestore_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Google Cloud Firestore Service | `google_cloud_firestore_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Google Cloud Vertex AI Batch Prediction Job | `google_cloud_vertex_ai_batch_prediction_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Google Cloud Vertex AI Dataset | `google_cloud_vertex_ai_dataset` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Google Cloud Vertex AI Endpoint | `google_cloud_vertex_ai_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Google Cloud Vertex AI Model | `google_cloud_vertex_ai_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| Google Cloud Vertex AI Service | `google_cloud_vertex_ai_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Google Cloud Vertex AI Training Pipeline | `google_cloud_vertex_ai_training_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| Google Cloud VPN Service | `google_cloud_vpn_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Google Cloud Workflow | `google_cloud_workflow` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| Google Cloud Workflows Service | `google_cloud_workflows_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Google Cloud Workstation | `google_cloud_workstation` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Google Cloud Workstations Cluster | `google_cloud_workstations_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Google Cloud Workstations Configuration | `google_cloud_workstations_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Google Cloud Workstations Service | `google_cloud_workstations_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Google Compute External VPN Gateway | `google_compute_external_vpn_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Google Compute HA VPN Gateway | `google_compute_vpn_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Google Compute Target VPN Gateway | `google_compute_target_vpn_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Google Compute VPN Tunnel | `google_compute_vpn_tunnel` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| IAM Binding | `google_iam_binding` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| IAM Custom Role | `google_iam_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| IAM Service Account | `google_iam_service_account` | [User](https://docs.jupiterone.io/data-model/schemas/User), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM Service Account Key | `google_iam_service_account_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAP Binding | `google_iap_binding` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| KMS Crypto Key | `google_kms_crypto_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [CryptoKey](https://docs.jupiterone.io/data-model/schemas/CryptoKey) |
| KMS Key Ring | `google_kms_key_ring` | [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| Logging Metric | `google_logging_metric` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Logging Project Sink | `google_logging_project_sink` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| Memcache Instance | `google_memcache_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Memcache Instance Node | `google_memcache_instance_node` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Monitoring Alert Policy | `google_monitoring_alert_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Organization | `google_cloud_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Private CA Certificate | `google_privateca_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Private CA Certificate Authority | `google_privateca_certificate_authority` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Private CA Pool | `google_privateca_pool` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Project | `google_cloud_project` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| PubSub Subscription | `google_pubsub_subscription` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| PubSub Topic | `google_pubsub_topic` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| Redis Instance | `google_redis_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Scan Config | `google_cloud_scan_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Scan Run | `google_cloud_scan_run` | [Process](https://docs.jupiterone.io/data-model/schemas/Process), [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Secret | `google_secret_manager_secret` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Secret Version | `google_secret_manager_secret_version` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Security Command Center Finding | `google_cloud_security_command_center_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Spanner Instance | `google_spanner_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Spanner Instance Config | `google_spanner_instance_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Spanner Instance Database | `google_spanner_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Spanner Instance Database Role | `google_cloud_spanner_database_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| SQL Admin MySQL Instance | `google_sql_mysql_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| SQL Admin MySQL Instance Backup | `google_sql_mysql_instance_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| SQL Admin MySQL Instance Cert | `google_sql_mysql_instance_cert` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| SQL Admin MySQL Instance Database | `google_sql_mysql_instance_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| SQL Admin MySQL Instance User | `google_sql_mysql_instance_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| SQL Admin Postgres Instance | `google_sql_postgres_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| SQL Admin Postgres Instance Backup | `google_sql_postgres_instance_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| SQL Admin Postgres Instance Cert | `google_sql_postgres_instance_cert` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| SQL Admin Postgres Instance Database | `google_sql_postgres_instance_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| SQL Admin Postgres Instance User | `google_sql_postgres_instance_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| SQL Admin SQL Server Instance | `google_sql_sql_server_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| SQL Admin SQL Server Instance Backup | `google_sql_sql_server_instance_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| SQL Admin SQL Server Instance Database | `google_sql_sql_server_instance_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| SQL Admin SQL Server Instance User | `google_sql_sql_server_instance_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `google_access_context_manager_access_level` | **DEFINES** | `google_access_context_manager_access_level_condition` |
| `google_access_context_manager_access_policy` | **HAS** | `google_access_context_manager_access_level` |
| `google_access_context_manager_access_policy` | **HAS** | `google_access_context_manager_service_perimeter` |
| `google_access_context_manager_service_perimeter` | **HAS** | `google_access_context_manager_service_perimeter_egress_policy` |
| `google_access_context_manager_service_perimeter` | **HAS** | `google_access_context_manager_service_perimeter_ingress_policy` |
| `google_access_context_manager_service_perimeter_api_operation` | **HAS** | `google_access_context_manager_service_perimeter_method_selector` |
| `google_access_context_manager_service_perimeter_egress_policy` | **HAS** | `google_access_context_manager_service_perimeter_api_operation` |
| `google_access_context_manager_service_perimeter_ingress_policy` | **HAS** | `google_access_context_manager_service_perimeter_api_operation` |
| `google_access_context_manager_service_perimeter_ingress_policy` | **ALLOWS** | `google_access_context_manager_access_level` |
| `google_api_gateway_api` | **USES** | `google_api_gateway_api_config` |
| `google_api_gateway_api` | **HAS** | `google_api_gateway_gateway` |
| `google_api_gateway_api_config` | **USES** | `google_iam_service_account` |
| `google_app_engine_application` | **USES** | `google_storage_bucket` |
| `google_app_engine_application` | **HAS** | `google_app_engine_service` |
| `google_app_engine_service` | **HAS** | `google_app_engine_version` |
| `google_app_engine_version` | **HAS** | `google_app_engine_version_handler` |
| `google_app_engine_version` | **HAS** | `google_app_engine_instance` |
| `google_bigquery_dataset` | **USES** | `google_kms_crypto_key` |
| `google_bigquery_dataset` | **HAS** | `google_bigquery_model` |
| `google_bigquery_dataset` | **HAS** | `google_bigquery_table` |
| `google_bigtable_cluster` | **USES** | `google_kms_crypto_key` |
| `google_bigtable_cluster` | **HAS** | `google_bigtable_backup` |
| `google_bigtable_instance` | **HAS** | `google_bigtable_app_profile` |
| `google_bigtable_instance` | **HAS** | `google_bigtable_cluster` |
| `google_bigtable_instance` | **HAS** | `google_bigtable_table` |
| `google_bigtable_table` | **HAS** | `google_bigtable_backup` |
| `google_billing_account` | **HAS** | `google_billing_budget` |
| `google_cloud_alloydb_cluster` | **HAS** | `google_cloud_alloydb_backup` |
| `google_cloud_alloydb_cluster` | **USES** | `google_kms_crypto_key` |
| `google_cloud_alloydb_instance` | **USES** | `google_cloud_alloydb_cluster` |
| `google_cloud_alloydb_instance` | **HAS** | `google_cloud_alloydb_connection` |
| `google_cloud_api_service` | **HAS** | `google_iam_role` |
| `google_cloud_api_service` | **HAS** | `resource` |
| `google_cloud_api_service` | **USES** | `google_cloud_audit_config` |
| `google_cloud_artifact_registry_repository` | **USES** | `google_kms_crypto_key` |
| `google_cloud_artifact_registry_repository` | **USES** | `google_cloud_artifact_registry_package` |
| `google_cloud_artifact_registry_vpcsc_configuration` | **ASSIGNED** | `google_cloud_artifact_registry_vpcsc_policy` |
| `google_cloud_audit_config` | **ALLOWS** | `google_iam_service_account` |
| `google_cloud_audit_config` | **ALLOWS** | `google_user` |
| `google_cloud_audit_config` | **ALLOWS** | `google_group` |
| `google_cloud_audit_config` | **ALLOWS** | `google_domain` |
| `google_cloud_bitbucket_server_config` | **HAS** | `google_cloud_bitbucket_server_repo` |
| `google_cloud_build` | **USES** | `google_storage_bucket` |
| `google_cloud_build` | **USES** | `google_cloud_source_repository` |
| `google_cloud_build_trigger` | **TRIGGERS** | `google_cloud_build` |
| `google_cloud_compute_router` | **USES** | `google_compute_address` |
| `google_cloud_deploy_automation` | **TRIGGERS** | `google_cloud_deploy_delivery_pipeline` |
| `google_cloud_deploy_delivery_pipeline` | **USES** | `google_storage_bucket` |
| `google_cloud_deploy_service` | **HAS** | `google_cloud_deploy_delivery_pipeline` |
| `google_cloud_filestore_instance` | **USES** | `google_compute_network` |
| `google_cloud_filestore_service` | **HAS** | `google_cloud_filestore_instance` |
| `google_cloud_firestore_service` | **HAS** | `google_cloud_firestore_database` |
| `google_cloud_folder` | **HAS** | `google_cloud_folder` |
| `google_cloud_folder` | **HAS** | `google_cloud_project` |
| `google_cloud_function` | **USES** | `google_iam_service_account` |
| `google_cloud_function` | **USES** | `google_cloud_source_repository` |
| `google_cloud_function` | **USES** | `google_storage_bucket` |
| `google_cloud_function` | **USES** | `google_secret_manager_secret` |
| `google_cloud_identity_group` | **ASSIGNED** | `google_cloud_identity_member_role` |
| `google_cloud_identity_saml_provider` | **USES** | `google_cloud_identity_group` |
| `google_cloud_identity_user` | **IS** | `google_user` |
| `google_cloud_identity_user` | **USES** | `google_cloud_identity_device` |
| `google_cloud_organization` | **HAS** | `google_cloud_folder` |
| `google_cloud_organization` | **HAS** | `google_cloud_project` |
| `google_cloud_organization` | **HAS** | `google_essential_contact` |
| `google_cloud_organization` | **HAS** | `google_cloud_access_approval_settings` |
| `google_cloud_project` | **HAS** | `google_cloud_api_service` |
| `google_cloud_project` | **HAS** | `google_iam_service_account` |
| `google_cloud_project` | **CONTAINS** | `google_sql_postgres_instance` |
| `google_cloud_project` | **CONTAINS** | `google_sql_mysql_instance` |
| `google_cloud_project` | **CONTAINS** | `google_sql_sql_server_instance` |
| `google_cloud_project` | **HAS** | `google_binary_authorization_policy` |
| `google_cloud_project` | **HAS** | `google_spanner_instance` |
| `google_cloud_project` | **HAS** | `google_spanner_instance_config` |
| `google_cloud_project` | **HAS** | `google_cloud_spanner` |
| `google_cloud_project` | **HAS** | `google_billing_budget` |
| `google_cloud_project` | **HAS** | `google_cloud_deploy_service` |
| `google_cloud_project` | **HAS** | `google_cloud_alloydb_cluster` |
| `google_cloud_project` | **HAS** | `google_cloud_artifact_registry_repository` |
| `google_cloud_project` | **HAS** | `google_cloud_artifact_registry` |
| `google_cloud_project` | **USES** | `google_cloud_artifact_registry_vpcsc_configuration` |
| `google_cloud_project` | **ASSIGNED** | `google_cloud_artifact_registry_vpcsc_policy` |
| `google_cloud_project` | **HAS** | `google_api_key` |
| `google_cloud_run_service` | **MANAGES** | `google_cloud_run_route` |
| `google_cloud_run_service` | **MANAGES** | `google_cloud_run_configuration` |
| `google_cloud_scan_config` | **PERFORMED** | `google_cloud_scan_run` |
| `google_cloud_sso` | **ASSIGNED** | `google_cloud_identity_group` |
| `google_cloud_vertex_ai_endpoint` | **CONTAINS** | `google_cloud_vertex_ai_model` |
| `google_cloud_vertex_ai_service` | **HAS** | `google_cloud_vertex_ai_model` |
| `google_cloud_vertex_ai_service` | **HAS** | `google_cloud_vertex_ai_endpoint` |
| `google_cloud_vertex_ai_service` | **HAS** | `google_cloud_vertex_ai_dataset` |
| `google_cloud_vertex_ai_service` | **HAS** | `google_cloud_vertex_ai_training_pipeline` |
| `google_cloud_vertex_ai_service` | **HAS** | `google_cloud_vertex_ai_batch_prediction_job` |
| `google_cloud_vpn_service` | **HAS** | `google_compute_vpn_gateway` |
| `google_cloud_vpn_service` | **HAS** | `google_compute_target_vpn_gateway` |
| `google_cloud_vpn_service` | **HAS** | `google_compute_external_vpn_gateway` |
| `google_cloud_vpn_service` | **HAS** | `google_compute_vpn_tunnel` |
| `google_cloud_workflow` | **USES** | `google_iam_service_account` |
| `google_cloud_workflows_service` | **HAS** | `google_cloud_workflow` |
| `google_cloud_workstation` | **USES** | `google_cloud_workstations_configuration` |
| `google_cloud_workstations_cluster` | **HAS** | `google_cloud_workstations_configuration` |
| `google_cloud_workstations_cluster` | **HAS** | `google_cloud_workstation` |
| `google_cloud_workstations_cluster` | **USES** | `google_compute_network` |
| `google_cloud_workstations_service` | **HAS** | `google_cloud_workstations_cluster` |
| `google_compute_backend_bucket` | **HAS** | `google_storage_bucket` |
| `google_compute_backend_service` | **HAS** | `google_compute_instance_group` |
| `google_compute_backend_service` | **HAS** | `google_compute_health_check` |
| `google_compute_backend_service` | **HAS** | `google_compute_target_ssl_proxy` |
| `google_compute_disk` | **CREATED** | `google_compute_snapshot` |
| `google_compute_disk` | **USES** | `google_compute_image` |
| `google_compute_disk` | **USES** | `google_kms_crypto_key` |
| `google_compute_firewall` | **PROTECTS** | `google_compute_network` |
| `google_compute_forwarding_rule` | **USES** | `google_compute_address` |
| `google_compute_forwarding_rule` | **CONNECTS** | `google_compute_backend_service` |
| `google_compute_forwarding_rule` | **CONNECTS** | `google_compute_subnetwork` |
| `google_compute_forwarding_rule` | **CONNECTS** | `google_compute_network` |
| `google_compute_forwarding_rule` | **CONNECTS** | `google_compute_target_http_proxy` |
| `google_compute_forwarding_rule` | **CONNECTS** | `google_compute_target_https_proxy` |
| `google_compute_forwarding_rule` | **CONNECTS** | `google_compute_target_pool` |
| `google_compute_global_forwarding_rule` | **CONNECTS** | `google_compute_backend_service` |
| `google_compute_global_forwarding_rule` | **CONNECTS** | `google_compute_subnetwork` |
| `google_compute_global_forwarding_rule` | **CONNECTS** | `google_compute_network` |
| `google_compute_global_forwarding_rule` | **CONNECTS** | `google_compute_target_http_proxy` |
| `google_compute_global_forwarding_rule` | **CONNECTS** | `google_compute_target_https_proxy` |
| `google_compute_image` | **USES** | `google_compute_image` |
| `google_compute_image` | **USES** | `google_kms_crypto_key` |
| `google_compute_instance` | **USES** | `google_compute_address` |
| `google_compute_instance` | **USES** | `google_compute_disk` |
| `google_compute_instance` | **TRUSTS** | `google_iam_service_account` |
| `google_compute_instance` | **HAS** | `google_cloud_security_command_center_finding` |
| `google_compute_instance_group` | **HAS** | `google_compute_instance_group_named_port` |
| `google_compute_instance_group` | **HAS** | `google_compute_instance` |
| `google_compute_network` | **CONTAINS** | `google_compute_subnetwork` |
| `google_compute_network` | **HAS** | `google_compute_address` |
| `google_compute_network` | **HAS** | `google_compute_global_address` |
| `google_compute_network` | **HAS** | `google_compute_firewall` |
| `google_compute_network` | **CONNECTS** | `google_compute_network` |
| `google_compute_network` | **HAS** | `google_cloud_compute_router` |
| `google_compute_network` | **HAS** | `google_dns_policy` |
| `google_compute_network` | **HAS** | `google_compute_vpn_gateway` |
| `google_compute_network` | **HAS** | `google_compute_target_vpn_gateway` |
| `google_compute_project` | **HAS** | `google_compute_instance` |
| `google_compute_security_policy` | **PROTECTS** | `google_compute_backend_service` |
| `google_compute_snapshot` | **CREATED** | `google_compute_image` |
| `google_compute_subnetwork` | **HAS** | `google_compute_address` |
| `google_compute_subnetwork` | **HAS** | `google_compute_global_address` |
| `google_compute_subnetwork` | **HAS** | `google_compute_instance` |
| `google_compute_target_https_proxy` | **HAS** | `google_compute_ssl_policy` |
| `google_compute_target_pool` | **HAS** | `google_compute_instance` |
| `google_compute_target_ssl_proxy` | **HAS** | `google_compute_ssl_policy` |
| `google_compute_target_vpn_gateway` | **HAS** | `google_compute_vpn_tunnel` |
| `google_compute_url_map` | **HAS** | `google_compute_backend_service` |
| `google_compute_url_map` | **HAS** | `google_compute_backend_bucket` |
| `google_compute_url_map` | **HAS** | `google_compute_target_https_proxy` |
| `google_compute_url_map` | **HAS** | `google_compute_target_http_proxy` |
| `google_compute_vpn_gateway` | **HAS** | `google_compute_vpn_tunnel` |
| `google_compute_vpn_tunnel` | **USES** | `google_cloud_compute_router` |
| `google_container_cluster` | **HAS** | `google_container_node_pool` |
| `google_container_cluster` | **HAS** | `google_cloud_security_command_center_finding` |
| `google_container_node_pool` | **HAS** | `google_compute_instance_group` |
| `google_dataproc_cluster` | **USES** | `google_kms_crypto_key` |
| `google_dataproc_cluster` | **USES** | `google_compute_image` |
| `google_dataproc_cluster` | **USES** | `google_storage_bucket` |
| `google_dlp_discovery_config` | **HAS** | `google_dlp_table_data_profile` |
| `google_dlp_table_data_profile` | **HAS** | `google_bigquery_table` |
| `google_dns_managed_zone` | **HAS** | `google_dns_managed_zone_record` |
| `google_iam_binding` | **ASSIGNED** | `google_domain` |
| `google_iam_binding` | **ASSIGNED** | `google_iam_service_account` |
| `google_iam_binding` | **ASSIGNED** | `google_group` |
| `google_iam_binding` | **ASSIGNED** | `google_user` |
| `google_iam_binding` | **ASSIGNED** | `google_cloud_authenticated_users` |
| `google_iam_binding` | **ASSIGNED** | `everyone` |
| `google_iam_binding` | **ASSIGNED** | `google_iam_role` |
| `google_iam_binding` | **USES** | `google_iam_role` |
| `google_iam_binding` | **ALLOWS** | `resource` |
| `google_iam_service_account` | **HAS** | `google_iam_service_account_key` |
| `google_iam_service_account` | **CREATED** | `google_app_engine_version` |
| `google_iap_binding` | **ALLOWS** | `google_compute_backend_service` |
| `google_iap_binding` | **USES** | `google_iam_role` |
| `google_iap_binding` | **ASSIGNED** | `google_iam_service_account` |
| `google_iap_binding` | **ASSIGNED** | `google_user` |
| `google_iap_binding` | **ASSIGNED** | `google_group` |
| `google_iap_binding` | **ASSIGNED** | `google_domain` |
| `google_kms_key_ring` | **HAS** | `google_kms_crypto_key` |
| `google_logging_metric` | **HAS** | `google_monitoring_alert_policy` |
| `google_logging_project_sink` | **USES** | `google_storage_bucket` |
| `google_memcache_instance` | **HAS** | `google_memcache_instance_node` |
| `google_memcache_instance` | **USES** | `google_compute_network` |
| `google_privateca_certificate_authority` | **CREATED** | `google_privateca_certificate` |
| `google_privateca_certificate_authority` | **USES** | `google_storage_bucket` |
| `google_privateca_pool` | **HAS** | `google_privateca_certificate_authority` |
| `google_pubsub_subscription` | **USES** | `google_pubsub_topic` |
| `google_pubsub_topic` | **USES** | `google_kms_crypto_key` |
| `google_redis_instance` | **USES** | `google_compute_network` |
| `google_secret_manager_secret` | **HAS** | `google_secret_manager_secret_version` |
| `google_spanner_database` | **USES** | `google_kms_crypto_key` |
| `google_spanner_database` | **ASSIGNED** | `google_cloud_spanner_database_role` |
| `google_spanner_instance` | **USES** | `google_spanner_instance_config` |
| `google_spanner_instance` | **HAS** | `google_spanner_database` |
| `google_spanner_instance` | **HAS** | `google_cloud_spanner_backup` |
| `google_sql_mysql_instance` | **CONNECTS** | `google_kms_crypto_key` |
| `google_sql_mysql_instance` | **USES** | `google_iam_service_account` |
| `google_sql_mysql_instance` | **HAS** | `google_sql_mysql_instance_user` |
| `google_sql_mysql_instance` | **HAS** | `google_sql_mysql_instance_database` |
| `google_sql_mysql_instance` | **HAS** | `google_sql_mysql_instance_backup` |
| `google_sql_mysql_instance` | **HAS** | `google_sql_mysql_instance_cert` |
| `google_sql_mysql_instance` | **USES** | `google_kms_crypto_key` |
| `google_sql_postgres_instance` | **CONNECTS** | `google_kms_crypto_key` |
| `google_sql_postgres_instance` | **USES** | `google_iam_service_account` |
| `google_sql_postgres_instance` | **HAS** | `google_sql_postgres_instance_user` |
| `google_sql_postgres_instance` | **HAS** | `google_sql_postgres_instance_database` |
| `google_sql_postgres_instance` | **HAS** | `google_sql_postgres_instance_backup` |
| `google_sql_postgres_instance` | **HAS** | `google_sql_postgres_instance_cert` |
| `google_sql_postgres_instance` | **USES** | `google_kms_crypto_key` |
| `google_sql_sql_server_instance` | **CONNECTS** | `google_kms_crypto_key` |
| `google_sql_sql_server_instance` | **HAS** | `google_sql_sql_server_instance_user` |
| `google_sql_sql_server_instance` | **HAS** | `google_sql_sql_server_instance_database` |
| `google_sql_sql_server_instance` | **HAS** | `google_sql_sql_server_instance_backup` |
| `google_sql_sql_server_instance` | **USES** | `google_kms_crypto_key` |
| `google_user` | **CREATED** | `google_app_engine_version` |
| `google_user` | **ASSIGNED** | `google_cloud_alloydb_cluster` |
| `internet` | **ALLOWS** | `google_compute_firewall` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `google_access_context_manager_service_perimeter` | **PROTECTS** | `google_cloud_project` | FORWARD |
| `google_access_context_manager_service_perimeter` | **LIMITS** | `google_cloud_api_service` | FORWARD |
| `google_cloud_build_trigger` | **USES** | `github_repo` | FORWARD |
| `google_cloud_deploy_delivery_pipeline` | **USES** | `github_repo` | FORWARD |

### Google Api Key

`google_api_key` inherits from [AccessKey](/data-model/schemas/AccessKey.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`androidKeyRestrictions.allowedApplications` \*

 | `array` **|** `null` |  |  |
| `assetName` | `string` |  |  |
| 

`browserKeyRestrictions.allowedReferrers` \*

 | `array` **|** `null` |  |  |
| `createdOn` | `number` |  |  |
| `deletedOn` | `number` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`iosKeyRestrictions.allowedBundleIds` \*

 | `array` **|** `null` |  |  |
| 

`serverKeyRestrictions.allowedIps` \*

 | `array` **|** `null` |  |  |
| 

`uid` \*

 | `string` **|** `null` |  |  |
| `updatedOn` | `number` |  |  |

---

### Google Cloud Access Approval Settings

`google_cloud_access_approval_settings` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`activeKeyVersion` \*

 | `string` **|** `null` |  |  |
| 

`ancestorHasActiveKeyVersion` \*

 | `boolean` |  |  |
| 

`enrolledAncestor` \*

 | `boolean` |  |  |
| 

`enrolledServices` \*

 | `array` **|** `null` |  |  |
| 

`enrollmentCount` \*

 | `number` |  |  |
| 

`enrollmentLevel` \*

 | `string` **|** `null` |  |  |
| 

`hasAllServicesEnrolled` \*

 | `boolean` **|** `null` |  |  |
| 

`hasNotificationEmails` \*

 | `boolean` |  |  |
| 

`invalidKeyVersion` \*

 | `boolean` |  |  |
| 

`isConfigured` \*

 | `boolean` |  |  |
| 

`notificationEmailCount` \*

 | `number` |  |  |
| 

`notificationEmails` \*

 | `array` of `string`s |  |  |
| 

`notificationPubsubTopic` \*

 | `string` **|** `null` |  |  |
| 

`preferNoBroadApprovalRequests` \*

 | `boolean` **|** `null` |  |  |
| 

`preferredRequestExpirationDays` \*

 | `number` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceType` \*

 | `string` |  | **Any of**:

-   `organization`

-   `project`

-   `folder`

 |

---

### Google Cloud Filestore Instance

`google_cloud_filestore_instance` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetName` \*

 | `string` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`fileShareNames` \*

 | `array` **|** `null` |  |  |
| 

`isSatisfyingPzi` \*

 | `boolean` **|** `null` |  |  |
| 

`kmsKeyName` \*

 | `string` **|** `null` |  |  |
| 

`networkNames` \*

 | `array` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`statusMessage` \*

 | `string` **|** `null` |  |  |
| 

`suspensionReasons` \*

 | `array` **|** `null` |  |  |
| 

`tier` \*

 | `string` **|** `null` |  |  |
| 

`zone` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Filestore Service

`google_cloud_filestore_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Firestore Database

`google_cloud_firestore_database` inherits from [Database](/data-model/schemas/Database.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`appEngineIntegrationMode` \*

 | `string` **|** `null` |  |  |
| 

`assetName` \*

 | `string` **|** `null` |  |  |
| 

`concurrencyMode` \*

 | `string` **|** `null` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`keyPrefix` \*

 | `string` **|** `null` |  |  |
| 

`locationId` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |
| 

`updatedOn` \*

 | `number` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Firestore Service

`google_cloud_firestore_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Security Command Center Finding

`google_cloud_security_command_center_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `canonicalName` | `string` |  |  |
| `createTimeOn` | `number` |  |  |
| `description` | `string` |  |  |
| `eventTimeOn` | `number` |  |  |
| `externalUri` | `string` |  |  |
| `findingClass` | `string` |  |  |
| `mute` | `string` |  |  |
| `muteUpdateTimeOn` | `number` |  |  |
| `name` | `string` |  |  |
| `parent` | `string` |  |  |
| `parentDisplayName` | `string` |  |  |
| `resourceName` | `string` |  |  |
| `securityMarksName` | `string` |  |  |
| `sourcePropertiesDescription` | `string` |  |  |
| `state` | `string` |  |  |
| `vulnerabilityCVEId` | `string` |  |  |
| `vulnerabilityCVEReferences` | `array` of `string`s |  |  |
| `vulnerabilityCvssv3AttackComplexity` | `string` |  |  |
| `vulnerabilityCvssv3AttackVector` | `string` |  |  |
| `vulnerabilityCvssv3AvailabilityImpact` | `string` |  |  |
| `vulnerabilityCvssv3BaseScoret` | `number` |  |  |
| `vulnerabilityCvssv3ConfidentialityImpact` | `string` |  |  |
| `vulnerabilityCvssv3IntegrityImpact` | `string` |  |  |
| `vulnerabilityCvssv3PrivilegesRequired` | `string` |  |  |
| `vulnerabilityCvssv3Scope` | `string` |  |  |
| `vulnerabilityCvssv3UserInteraction` | `string` |  |  |
| `vulnerabilityUpstreamFixAvailable` | `boolean` |  |  |

---

### Google Cloud Vertex Ai Batch Prediction Job

`google_cloud_vertex_ai_batch_prediction_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`acceleratorCount` \*

 | `number` **|** `null` |  |  |
| 

`acceleratorType` \*

 | `string` **|** `null` |  |  |
| `aiCategory` | `string` |  |  |
| `aiPlatform` | `string` |  |  |
| `assetName` | `string` |  |  |
| 

`batchSize` \*

 | `number` **|** `null` |  |  |
| 

`bigQueryOutputDataset` \*

 | `string` **|** `null` |  |  |
| 

`bigQueryOutputTable` \*

 | `string` **|** `null` |  |  |
| 

`endedOn` \*

 | `number` **|** `null` |  |  |
| 

`errorCode` \*

 | `number` **|** `null` |  |  |
| 

`errorMessage` \*

 | `string` **|** `null` |  |  |
| 

`failedCount` \*

 | `string` **|** `null` |  |  |
| 

`gcsOutputDirectory` \*

 | `string` **|** `null` |  |  |
| 

`hasExplanationSpec` \*

 | `boolean` **|** `null` |  |  |
| 

`incompleteCount` \*

 | `string` **|** `null` |  |  |
| 

`inputBigQuerySource` \*

 | `string` **|** `null` |  |  |
| 

`inputGcsSource` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` |  |  |
| 

`isContainerLoggingDisabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isExplanationGenerated` \*

 | `boolean` **|** `null` |  |  |
| 

`kmsKeyName` \*

 | `string` **|** `null` |  |  |
| 

`machineType` \*

 | `string` **|** `null` |  |  |
| 

`model` \*

 | `string` **|** `null` |  |  |
| 

`modelVersionId` \*

 | `string` **|** `null` |  |  |
| 

`outputBigQueryDestination` \*

 | `string` **|** `null` |  |  |
| 

`outputGcsDestination` \*

 | `string` **|** `null` |  |  |
| 

`partialFailureCount` \*

 | `number` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`replicaHours` \*

 | `number` **|** `null` |  |  |
| 

`serviceAccount` \*

 | `string` **|** `null` |  |  |
| 

`startedOn` \*

 | `number` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`successfulCount` \*

 | `string` **|** `null` |  |  |
| 

`unmanagedContainerImageUri` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Vertex Ai Dataset

`google_cloud_vertex_ai_dataset` inherits from [DataCollection](/data-model/schemas/DataCollection.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` |  |  |
| `aiPlatform` | `string` |  |  |
| `assetName` | `string` |  |  |
| 
`dataItemCount` \*

 | `string` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` |  |  |
| 

`kmsKeyName` \*

 | `string` **|** `null` |  |  |
| 

`metadataArtifact` \*

 | `string` **|** `null` |  |  |
| 

`metadataSchemaUri` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`savedQueryCount` \*

 | `number` **|** `null` |  |  |
| 

`savedQueryNames` \*

 | `array` **|** `null` |  |  |

---

### Google Cloud Vertex Ai Endpoint

`google_cloud_vertex_ai_endpoint` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` |  |  |
| `aiPlatform` | `string` |  |  |
| `assetName` | `string` |  |  |
| 
`deployedModelCount` \*

 | `number` **|** `null` |  |  |
| 

`deployedModelIds` \*

 | `array` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` |  |  |
| 

`isPrivateServiceConnectEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`kmsKeyName` \*

 | `string` **|** `null` |  |  |
| 

`modelDeploymentMonitoringJob` \*

 | `string` **|** `null` |  |  |
| 

`network` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Vertex Ai Model

`google_cloud_vertex_ai_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` |  |  |
| `aiPlatform` | `string` |  |  |
| 
`artifactUri` \*

 | `string` **|** `null` |  |  |
| `assetName` | `string` |  |  |
| 

`containerArgs` \*

 | `array` **|** `null` |  |  |
| 

`containerCommand` \*

 | `array` **|** `null` |  |  |
| 

`containerImageUri` \*

 | `string` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`hasExplanationSpec` \*

 | `boolean` **|** `null` |  |  |
| `isAi` | `boolean` |  |  |
| 

`kmsKeyName` \*

 | `string` **|** `null` |  |  |
| 

`metadataArtifact` \*

 | `string` **|** `null` |  |  |
| 

`metadataSchemaUri` \*

 | `string` **|** `null` |  |  |
| 

`pipelineJob` \*

 | `string` **|** `null` |  |  |
| 

`predictionSchemaUri` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`supportedDeploymentResourcesTypes` \*

 | `array` **|** `null` |  |  |
| 

`supportedExportFormats` \*

 | `array` **|** `null` |  |  |
| 

`supportedInputStorageFormats` \*

 | `array` **|** `null` |  |  |
| 

`supportedOutputStorageFormats` \*

 | `array` **|** `null` |  |  |
| 

`trainingPipeline` \*

 | `string` **|** `null` |  |  |
| 

`versionAliases` \*

 | `array` **|** `null` |  |  |
| 

`versionCreatedOn` \*

 | `number` **|** `null` |  |  |
| 

`versionDescription` \*

 | `string` **|** `null` |  |  |
| 

`versionId` \*

 | `string` **|** `null` |  |  |
| 

`versionUpdatedOn` \*

 | `number` **|** `null` |  |  |

---

### Google Cloud Vertex Ai Service

`google_cloud_vertex_ai_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` **|** `null` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Vertex Ai Training Pipeline

`google_cloud_vertex_ai_training_pipeline` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` |  |  |
| `aiPlatform` | `string` |  |  |
| `assetName` | `string` |  |  |
| 
`endedOn` \*

 | `number` **|** `null` |  |  |
| 

`errorCode` \*

 | `string` **|** `null` |  |  |
| 

`errorMessage` \*

 | `string` **|** `null` |  |  |
| 

`inputDatasetId` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` |  |  |
| 

`kmsKeyName` \*

 | `string` **|** `null` |  |  |
| 

`modelDisplayName` \*

 | `string` **|** `null` |  |  |
| 

`modelId` \*

 | `string` **|** `null` |  |  |
| 

`parentModel` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`startedOn` \*

 | `number` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`trainingTaskDefinition` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Vpn Service

`google_cloud_vpn_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Workflow

`google_cloud_workflow` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`callLogLevel` \*

 | `string` **|** `null` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`revisionId` \*

 | `string` **|** `null` |  |  |
| 

`serviceAccount` \*

 | `string` **|** `null` |  |  |
| 

`sourceContents` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`updatedOn` \*

 | `number` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Workflows Service

`google_cloud_workflows_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`function` \*

 | `array` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Workstation

`google_cloud_workstation` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`etag` \*

 | `string` **|** `null` |  |  |
| 

`isReconciling` \*

 | `boolean` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`startedOn` \*

 | `number` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`uid` \*

 | `string` **|** `null` |  |  |
| 

`zone` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Workstations Cluster

`google_cloud_workstations_cluster` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allowedProjects` \*

 | `array` **|** `null` |  |  |
| `assetName` | `string` |  |  |
| 

`clusterHostname` \*

 | `string` **|** `null` |  |  |
| 

`conditionCodes` \*

 | `array` **|** `null` |  |  |
| 

`controlPlaneIp` \*

 | `string` **|** `null` |  |  |
| 

`degraded` \*

 | `boolean` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`isPrivateEndpointEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isReconciling` \*

 | `boolean` **|** `null` |  |  |
| 

`network` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`serviceAttachmentUri` \*

 | `string` **|** `null` |  |  |
| 

`subnetwork` \*

 | `string` **|** `null` |  |  |
| 

`uid` \*

 | `string` **|** `null` |  |  |
| 

`zone` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Workstations Configuration

`google_cloud_workstations_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`conditionCodes` \*

 | `array` **|** `null` |  |  |
| 

`containerArgs` \*

 | `array` **|** `null` |  |  |
| 

`containerCommand` \*

 | `array` **|** `null` |  |  |
| 

`containerImage` \*

 | `string` **|** `null` |  |  |
| 

`containerRunAsUser` \*

 | `number` **|** `null` |  |  |
| 

`containerWorkingDir` \*

 | `string` **|** `null` |  |  |
| 

`etag` \*

 | `string` **|** `null` |  |  |
| 

`idleTimeout` \*

 | `string` **|** `null` |  |  |
| 

`isDegraded` \*

 | `boolean` **|** `null` |  |  |
| 

`isReconciling` \*

 | `boolean` **|** `null` |  |  |
| 

`kmsKey` \*

 | `string` **|** `null` |  |  |
| 

`kmsKeyServiceAccount` \*

 | `string` **|** `null` |  |  |
| 

`persistentDirectoriesDiskTypes` \*

 | `array` **|** `null` |  |  |
| 

`persistentDirectoriesFsTypes` \*

 | `array` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`readinessCheckPaths` \*

 | `array` **|** `null` |  |  |
| 

`readinessCheckPorts` \*

 | `array` **|** `null` |  |  |
| 

`replicaZones` \*

 | `array` **|** `null` |  |  |
| 

`runningTimeout` \*

 | `string` **|** `null` |  |  |
| 

`uid` \*

 | `string` **|** `null` |  |  |
| 

`zone` \*

 | `string` **|** `null` |  |  |

---

### Google Cloud Workstations Service

`google_cloud_workstations_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |

---

### Google Compute External Vpn Gateway

`google_compute_external_vpn_gateway` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| 

`interfaceIds` \*

 | `array` **|** `null` |  |  |
| 

`interfaceIpAddresses` \*

 | `array` **|** `null` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`redundancyType` \*

 | `string` **|** `null` |  |  |
| 

`selfLink` \*

 | `string` **|** `null` |  |  |

---

### Google Compute Security Policy

`google_compute_security_policy` inherits from [Policy](/data-model/schemas/Policy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`adaptiveProtectionLayer7DdosDefenseRuleVisibility` \*

 | `string` **|** `null` | STANDARD (opaque) or PREMIUM (transparent) rule visibility for adaptive protection. |  |
| 

`advancedOptionsJsonParsing` \*

 | `string` **|** `null` | JSON request body parsing mode (DISABLED, STANDARD, STANDARD\_WITH\_GRAPHQL). |  |
| 

`advancedOptionsLogLevel` \*

 | `string` **|** `null` | Verbosity of Cloud Armor logs (NORMAL, VERBOSE). |  |
| 

`ddosProtection` \*

 | `string` **|** `null` | Network-edge DDoS protection level (e.g. STANDARD, ADVANCED). |  |
| 

`fingerprint` \*

 | `string` **|** `null` | Optimistic-locking hash of the policy contents (rotates on update). |  |
| 

`function` \*

 | `array` **|** `null` | JupiterOne function facet (\["firewall"\]). |  |
| 

`id` \*

 | `string` | Server-defined unique identifier for the security policy. |  |
| 

`isAdaptiveProtectionLayer7DdosDefenseEnabled` \*

 | `boolean` **|** `null` | Whether Cloud Armor Adaptive Protection L7 DDoS defense (CAAP) is enabled. |  |
| 

`kind` \*

 | `string` **|** `null` | GCP resource kind discriminator (compute#securityPolicy). |  |
| 

`labelFingerprint` \*

 | `string` **|** `null` | Optimistic-locking hash of the policy labels (rotates on setLabels). |  |
| 

`projectId` \*

 | `string` **|** `null` | GCP project that owns the security policy. Source of attribution. |  |
| 

`recaptchaRedirectSiteKey` \*

 | `string` **|** `null` | reCAPTCHA Enterprise site key used by GOOGLE\_RECAPTCHA redirect rules. |  |
| 

`region` \*

 | `string` **|** `null` | Short region name for regional policies; null for global policies. |  |
| 

`regional` \*

 | `boolean` | True if this is a regional security policy; false for global. |  |
| 

`ruleCount` \*

 | `number` | Number of rules attached to the policy (length of `rules[]`). Promoted so that gap analysis queries can target empty policies without retrieving raw data. |  |
| 

`selfLink` \*

 | `string` | Server-defined fully-qualified URL of the resource. Used as `_key`. |  |
| 

`type` \*

 | `string` **|** `null` | Policy type: CLOUD\_ARMOR, CLOUD\_ARMOR\_EDGE, CLOUD\_ARMOR\_INTERNAL\_SERVICE, or CLOUD\_ARMOR\_NETWORK. |  |

---

### Google Compute Target Vpn Gateway

`google_compute_target_vpn_gateway` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`forwardingRules` \*

 | `array` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`network` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`selfLink` \*

 | `string` **|** `null` |  |  |
| 

`tunnels` \*

 | `array` **|** `null` |  |  |

---

### Google Compute Vpn Gateway

`google_compute_vpn_gateway` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`network` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`selfLink` \*

 | `string` **|** `null` |  |  |
| 

`stackType` \*

 | `string` **|** `null` |  |  |
| 

`vpnInterfaceIpAddresses` \*

 | `array` **|** `null` |  |  |

---

### Google Compute Vpn Tunnel

`google_compute_vpn_tunnel` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`detailedStatus` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`ikeVersion` \*

 | `number` **|** `null` |  |  |
| 

`kind` \*

 | `string` **|** `null` |  |  |
| 

`localTrafficSelector` \*

 | `array` **|** `null` |  |  |
| 

`peerExternalGateway` \*

 | `string` **|** `null` |  |  |
| 

`peerExternalGatewayInterface` \*

 | `number` **|** `null` |  |  |
| 

`peerGcpGateway` \*

 | `string` **|** `null` |  |  |
| 

`peerIp` \*

 | `string` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`remoteTrafficSelector` \*

 | `array` **|** `null` |  |  |
| 

`router` \*

 | `string` **|** `null` |  |  |
| 

`selfLink` \*

 | `string` **|** `null` |  |  |
| 

`targetVpnGateway` \*

 | `string` **|** `null` |  |  |
| 

`vpnGateway` \*

 | `string` **|** `null` |  |  |
| 

`vpnGatewayInterface` \*

 | `number` **|** `null` |  |  |

---

### Google Dlp Discovery Config

`google_dlp_discovery_config` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| 
`inspectTemplates` \*

 | `array` **|** `null` |  |  |
| `projectId` | `string` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| `updatedOn` | `number` |  |  |

---

### Google Dlp Table Data Profile

`google_dlp_table_data_profile` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `projectId` | `string` |  |  |
| 
`state` \*

 | `string` **|** `null` |  |  |
| `updatedOn` | `number` |  |  |

---

### Google Essential Contact

`google_essential_contact` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetName` | `string` |  |  |
| 
`email` \*

 | `string` **|** `null` |  |  |
| 

`languageTag` \*

 | `string` **|** `null` |  |  |
| `name` | `string` |  |  |
| 

`notificationCategories` \*

 | `array` **|** `null` |  |  |
| `validateTime` | `number` |  |  |
| 

`validationState` \*

 | `string` **|** `null` |  |  |

---

### Google Iap Binding

`google_iap_binding` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`backendServiceId` \*

 | `string` **|** `null` |  |  |
| 

`backendServiceName` \*

 | `string` **|** `null` |  |  |
| 

`condition.description` \*

 | `string` **|** `null` |  |  |
| 

`condition.expression` \*

 | `string` **|** `null` |  |  |
| 

`condition.location` \*

 | `string` **|** `null` |  |  |
| 

`condition.title` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`members` \*

 | `array` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`permissions` \*

 | `array` **|** `null` |  |  |
| 

`projectId` \*

 | `string` **|** `null` |  |  |
| 

`readonly` \*

 | `boolean` **|** `null` |  |  |
| 

`role` \*

 | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-10-13** — Google Cloud Build trigger configurations no longer include embedded repository credentials, preventing API keys and connection secrets from appearing in build trigger entities.
    
-   **2026-05-20** — GCP Cloud Armor security policies are now mapped to the backend services they protect.
    
-   **2026-05-11** — GCP Compute instances now include a public property indicating whether the instance is publicly accessible.
    
-   **2026-05-05** — GCP IAM service accounts, service account keys, and API keys are now classified as Non-Human Identity entities.
    
-   **2026-05-05** — Vertex AI entities now include AI-specific metadata properties for enhanced AI workload visibility.
    
-   **2026-04-08** — Added configuration option to automatically delete child integration instances when their parent is removed from the Google Cloud integration.
    
-   **2026-04-08** — Improved OS name and OS type detection for Google Cloud Compute Engine instances using inventory OS short names.
    
-   **2026-04-08** — Added relationships linking Google Cloud projects directly to their associated IAM service accounts.
    
-   **2026-03-31** — Added OS kernel version property to Google Cloud Compute Engine instances and Cloud Identity device entities.
    
-   **2025-11-18** — Added additional configuration and metadata properties to Cloud SQL MySQL instance entities.
    
-   **2025-10-29** — Added ingestion of Organization Access Approval settings as new entity types.
    
-   **2025-10-24** — Added Cloud Functions environment variable capture for secret detection analysis.
    
-   **2025-10-24** — Added GCP asset identifier properties (akin to AWS ARNs) to compute, networking, and storage resources across multiple rounds of promotion.
    
-   **2025-10-22** — Added Google Cloud DLP Configuration and DLP Profiles as new ingested entity types.
    
-   **2025-10-22** — Added Identity-Aware Proxy (IAP) ingestion, relating IAP-protected resources to their backend services.
    
-   **2025-10-16** — Added App Engine version handler configurations to App Engine version entities.
    
-   **2025-10-13** — Added Google Cloud API Keys ingestion as new entity types.
    
-   **2025-10-10** — Added computed public property to Google Cloud firewall entities indicating whether the firewall allows public internet access.
    
-   **2025-10-06** — Added HTTP(S) Load Balancer logging configuration properties to backend service entities.
    
-   **2025-10-06** — Added Google Cloud Essential Contacts ingestion for incident notification contacts.
    
-   **2025-10-01** — Added pgAudit enabled property to Cloud SQL PostgreSQL instances, exposing audit logging configuration.
    
-   **2025-09-03** — Added GCP Cloud Workstations ingestion, including workstation clusters and workstations as new entity types.
    
-   **2025-08-20** — Added allowed targets and denied targets queryable properties to GCP firewall entities.
    
-   **2025-08-20** — Added Google Cloud Vertex AI ingestion, including datasets, models, and endpoints.
    
-   **2025-08-18** — Added Google Cloud Filestore ingestion as new entity types.
    
-   **2025-08-18** — Added Google Cloud VPN ingestion, including VPN gateways, tunnels, and router configurations.
    
-   **2025-08-12** — Added Google Cloud Firestore database ingestion as new entity types.
    
-   **2025-08-11** — Added Google Cloud Workflows ingestion as new entity types.
    
-   **2025-05-27** — Added relationship from VPC Service Controls ingress policy to Access Context Manager access levels.
    
-   **2025-04-25** — Added active property to Google IAM service account key entities.

---

Source: /integrations/directory/google-drive

# Google Drive

Visualize Google Drive Shared Drives and their contents, map file permissions and access controls, and monitor changes to files and folders through queries and alerts.

## Installation

For this integration, you will need to add the necessary API scope to your Google Workspace for the JupiterOne Service Account.

### Understanding impersonation

The Google Drive integration uses Domain-Wide Delegation to access your organization's Drive data. Here's how it works:

-   The JupiterOne service account is configured in Google Cloud Platform with Domain-Wide Delegation enabled.
-   In the Google Admin Console, you grant OAuth scopes to the service account.
-   On each request, the service account impersonates a real user from your domain.
-   **Effective permissions = OAuth scopes granted ∩ permissions of the impersonated user**.

### Requirements for the impersonated user

The user you configure as the **Admin Email** in JupiterOne will be impersonated by the service account. This user needs:

-   To be an **active user** in your Google Workspace domain
-   To have **access to Google Drive** (a basic Workspace license is sufficient)
-   To be a **member of the Shared Drives** you want to ingest

The impersonated user does **not** need to be a Super Admin or have any special admin privileges.

**What the integration can see:**

Since the integration uses the `drive.readonly` scope, it will only be able to read:

-   Files and folders in Shared Drives where the impersonated user is a member
-   Metadata such as owners, permissions, dates, and sizes

**Recommendation:** Create a dedicated service user (e.g., `jupiterone-drive@yourdomain.com`) and add it as a member to all Shared Drives you want JupiterOne to ingest.

### Add the JupiterOne API scope

Log in to the Google Workspace Admin Console as a super administrator to perform the following actions:

1.  Click **Account > Account Settings > Profile** and retrieve your Customer ID. It will have a format similar to `C1111abcd`. Alternatively, click **Security** and expand Setup single sign-on (SSO) for SAML applications and copy the `idpid` property value from the SSO URL. For example, `https://accounts.google.com/o/saml2/idp?idpid=C1111abcd` provides the ID `C1111abcd`. Retain this value for the **Customer ID** field in the JupiterOne integration configuration.
    
2.  Return to the Admin Console home page. Click **Security > Access and data control > API controls**.
    
3.  In the Domain wide delegation pane, select **Manage Domain Wide Delegation**.
    
4.  Click **Add new** and enter the JupiterOne Service Account client ID `105066730509134419857` into the **Client ID** field. If the JupiterOne integration configuration UI shows you a different client ID, use the one it shows — that value is authoritative for your account.
    
5.  Add the following API scope:
    
    ```text
    https://www.googleapis.com/auth/drive.readonly
    ```
    
6.  Click **Authorize**.
    

> **NOTE**
> 
> If your organization has enabled multi-party approval for sensitive admin actions, authorizing domain-wide delegation requires a second super administrator to approve the change before it takes effect. Scope changes can also take up to 24 hours to propagate.

### Configuration in JupiterOne

To add the Google Drive integration in JupiterOne, navigate to the Integrations tab and select Google Drive. Click New Instance to begin configuring your integration. Enter the following:

-   **Account Name** by which you want to identify this Google Drive account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName toggle** is enabled.
-   **Description** that assists your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
-   Enter the **Customer ID** collected during the setup of Google Workspace.
-   Enter the **Admin Email** of the Google Workspace user that the service account will impersonate. This user must be a member of the Shared Drives you want to ingest.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| File | `google_drive_file` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| Folder | `google_drive_folder` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Permission | `google_drive_permission` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Shared Drive | `google_drive_shared_drive` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| User | `google_drive_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `google_drive_file` | **ALLOWS** | `google_drive_permission` |
| `google_drive_folder` | **ALLOWS** | `google_drive_permission` |
| `google_drive_folder` | **CONTAINS** | `google_drive_file` |
| `google_drive_folder` | **CONTAINS** | `google_drive_folder` |
| `google_drive_permission` | **ASSIGNED** | `google_drive_user` |
| `google_drive_shared_drive` | **ALLOWS** | `google_drive_permission` |
| `google_drive_shared_drive` | **CONTAINS** | `google_drive_folder` |
| `google_drive_shared_drive` | **CONTAINS** | `google_drive_file` |
| `google_drive_user` | **OWNS** | `google_drive_folder` |
| `google_drive_user` | **OWNS** | `google_drive_file` |
| `google-account` | **HAS** | `google_drive_shared_drive` |
| `google-account` | **HAS** | `google_drive_user` |

### Google Drive File

`google_drive_file` inherits from [DataObject](/data-model/schemas/DataObject.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `canWritersShare` | `boolean` |  |  |
| `doesCopyRequiresWriterPermission` | `boolean` |  |  |
| `driveId` | `string` |  |  |
| `fileExtension` | `string` |  |  |
| `fullFileExtension` | `string` |  |  |
| `headRevisionId` | `string` |  |  |
| `iconLink` | `string` |  |  |
| `isAppAuthorized` | `boolean` |  |  |
| `isExplicitlyTrashed` | `boolean` |  |  |
| `isModifiedByMe` | `boolean` |  |  |
| `isOwnedByMe` | `boolean` |  |  |
| `isShared` | `boolean` |  |  |
| `isStarred` | `boolean` |  |  |
| `isTrashed` | `boolean` |  |  |
| `isViewedByMe` | `boolean` |  |  |
| `lastModifyingUser` | `string` |  |  |
| `md5Checksum` | `string` |  |  |
| `mimeType` | `string` |  |  |
| `modifiedByCurrentUserOn` | `number` |  |  |
| `originalFilename` | `string` |  |  |
| `owners` | `array` of `string`s |  |  |
| `parents` | `array` of `string`s |  |  |
| `permissionIds` | `array` of `string`s |  |  |
| `quotaUsedInBytes` | `string` |  |  |
| `resourceKey` | `string` |  |  |
| `sha1Checksum` | `string` |  |  |
| `sha256Checksum` | `string` |  |  |
| `sharedWithCurrentUserOn` | `number` |  |  |
| `sharingUser` | `string` |  |  |
| `sizeInBytes` | `string` |  |  |
| `spaces` | `array` of `string`s |  |  |
| `thumbnailLink` | `string` |  |  |
| `thumbnailVersion` | `string` |  |  |
| `version` | `string` |  |  |
| `viewedByCurrentUserOn` | `number` |  |  |
| `webContentLink` | `string` |  |  |
| `webViewLink` | `string` |  |  |

---

### Google Drive Folder

`google_drive_folder` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `canWritersShare` | `boolean` |  |  |
| `doesCopyRequiresWriterPermission` | `boolean` |  |  |
| `driveId` | `string` |  |  |
| `fileExtension` | `string` |  |  |
| `fullFileExtension` | `string` |  |  |
| `headRevisionId` | `string` |  |  |
| `iconLink` | `string` |  |  |
| `isAppAuthorized` | `boolean` |  |  |
| `isExplicitlyTrashed` | `boolean` |  |  |
| `isModifiedByMe` | `boolean` |  |  |
| `isOwnedByMe` | `boolean` |  |  |
| `isShared` | `boolean` |  |  |
| `isStarred` | `boolean` |  |  |
| `isTrashed` | `boolean` |  |  |
| `isViewedByMe` | `boolean` |  |  |
| `lastModifyingUser` | `string` |  |  |
| `md5Checksum` | `string` |  |  |
| `mimeType` | `string` |  |  |
| `modifiedByCurrentUserOn` | `number` |  |  |
| `originalFilename` | `string` |  |  |
| `owners` | `array` of `string`s |  |  |
| `parents` | `array` of `string`s |  |  |
| `permissionIds` | `array` of `string`s |  |  |
| `quotaUsedInBytes` | `string` |  |  |
| `resourceKey` | `string` |  |  |
| `sha1Checksum` | `string` |  |  |
| `sha256Checksum` | `string` |  |  |
| `sharedWithCurrentUserOn` | `number` |  |  |
| `sharingUser` | `string` |  |  |
| `sizeInBytes` | `string` |  |  |
| `spaces` | `array` of `string`s |  |  |
| `thumbnailLink` | `string` |  |  |
| `thumbnailVersion` | `string` |  |  |
| `version` | `string` |  |  |
| `viewedByCurrentUserOn` | `number` |  |  |
| `webContentLink` | `string` |  |  |
| `webViewLink` | `string` |  |  |

---

### Google Drive Permission

`google_drive_permission` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowFileDiscovery` | `boolean` |  |  |
| `domain` | `string` |  |  |
| `emailAddress` | `string` |  |  |
| `isDeleted` | `boolean` |  |  |
| `isPendingOwner` | `boolean` |  |  |
| `kind` | `string` |  |  |
| `permissionDetails` | `array` of `string`s |  |  |
| `photoLink` | `string` |  |  |
| `role` | `string` |  |  |
| `teamDrivePermissionDetails` | `array` of `string`s |  |  |
| `type` | `string` |  |  |
| `view` | `string` |  |  |

---

### Google Drive Shared Drive

`google_drive_shared_drive` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `backgroundImageLink` | `string` |  |  |
| `canAddChildren` | `boolean` |  |  |
| `canChangeDriveBackground` | `boolean` |  |  |
| `canComment` | `boolean` |  |  |
| `canCopy` | `boolean` |  |  |
| `canDeleteChildren` | `boolean` |  |  |
| `canDeleteDrive` | `boolean` |  |  |
| `canDownload` | `boolean` |  |  |
| `canEdit` | `boolean` |  |  |
| `canListChildren` | `boolean` |  |  |
| `canManageMembers` | `boolean` |  |  |
| `canReadRevisions` | `boolean` |  |  |
| `canRenameDrive` | `boolean` |  |  |
| `canResetDriveRestrictions` | `boolean` |  |  |
| `canShare` | `boolean` |  |  |
| `canTrashChildren` | `boolean` |  |  |
| `isHidden` | `boolean` |  |  |
| `orgUnitId` | `string` |  |  |
| `themeId` | `string` |  |  |

---

### Google Drive User

`google_drive_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `canCreateDrives` | `boolean` |  |  |
| `canCreateTeamDrives` | `boolean` |  |  |
| `isAppInstalled` | `boolean` |  |  |
| `kind` | `string` |  |  |
| `maxUploadSizeInBytes` | `string` |  |  |
| `storageLimitInBytes` | `string` |  |  |
| `storageUsedByDriveInBytes` | `string` |  |  |
| `storageUsedByTrashInBytes` | `string` |  |  |
| `totalStorageUsageInBytes` | `string` |  |  |
| `userPermissionId` | `string` |  |  |

---

## Release Notes

-   **2026-01-22** — New Google Drive integration: ingests shared drives, folders, files, and permissions, with relationship mapping between drives, folders, files, and users.

---

Source: /integrations/directory/google-firebase

# Google Firebase

Visualize Google Firebase projects and users and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> To use this integration, you must provide the contents of a Google Cloud service account key file with the correct API services enabled. You must also have permission in JupiterOne to install new integrations.

### Configuration in Google Firebase

You must create a Google Cloud service account and a Google Cloud service account key to run the integration. The service account key authenticates on behalf of the integration's Google Cloud project and ingests data into JupiterOne.

To create a Google Firebase service account and service account key:

1.  Go to Project Settings and click the Service Acounts tab.
2.  Click **Create Service Account**.
3.  After the service account is created, click **Generate new private key**.
4.  In the pop-up, click **Generate key**.
5.  Flatten the key and generate the .env file by running `yarn create-env-file ~/SERVICE_ACCOUNT_FILE_PATH_HERE.json`.

### Configuration in JupiterOne

To install this integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Google Firebase. Click **New Instance** to begin configuring the integration.

Configure the following settings:

-   Enter the Account Name by which you'd like to identify this Google Firebase account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is selected.
    
-   Enter a Description that will further assist your team when identifying the integration instance.
    
-   Select a Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.
    
-   Enter the flattened Google Firebase Service Account Key File and generated for use by JupiterOne.
    

Click **Create Configuration** after providing all the values to finalize the integration instance.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `google_firebase_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Project | `google_firebase_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| User | `google_firebase_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Web App | `google_firebase_webapp` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `google_firebase_account` | **HAS** | `google_firebase_project` |
| `google_firebase_project` | **HAS** | `google_firebase_user` |
| `google_firebase_project` | **HAS** | `google_firebase_webapp` |

---

Source: /integrations/directory/govcloud

# GovCloud

Secure your government workloads with JupiterOne's AWS GovCloud integration. Our guide walks you through the installation process and showcases the integration's data model, providing you with comprehensive visibility into your GovCloud environment. Learn how AWS GovCloud integration can help you monitor and manage your security posture, ensuring that you meet government security and compliance requirements

## Installation

To install this integration, you will need to configure settings both within AWS GovCloud and on JupiterOne. Unlike the commercial AWS integration, which assumes an IAM role, the GovCloud integration authenticates with the **Access Key ID** and **Secret Access Key** of a dedicated IAM user, along with the **Account ID** of the GovCloud account to synchronize.

Information is ingested from the AWS GovCloud regions `us-gov-east-1` and `us-gov-west-1`. A small number of AWS services are only offered in `us-gov-west-1`, and are ingested from that region only.

> **INFO**
> 
> The GovCloud integration runs the same ingestion code as the commercial AWS integration, so it produces the same entities and relationships. See the **Data Model** and **Types** tabs for the full list. Resource ARNs use the `aws-us-gov` partition.

### Configuration in AWS GovCloud

JupiterOne maintains the IAM policy, the CloudFormation template, and the Terraform for GovCloud in the public [JupiterOne AWS CloudFormation](https://github.com/JupiterOne/jupiterone-aws-cloudformation/tree/main/cloudformation/iam-cloudformation-govcloud) project on GitHub. Use one of the three options below. CloudFormation is recommended, because the permission set is kept up to date there as the integration adds coverage for new services.

#### Option 1: CloudFormation (recommended)

1.  Download the latest GovCloud CloudFormation template: [iam-cloudformation-govcloud.json](https://jupiterone-prod-us-aws-cloudformation-templates.s3.us-east-2.amazonaws.com/iam-cloudformation-govcloud.json).
2.  In the AWS GovCloud Console, go to **CloudFormation** and select **Stacks**.
3.  Select **Create stack**, then **With new resources (standard)**.
4.  Select **Template is ready** and **Upload a template file**, upload the file you downloaded, and click **Next**.
5.  Enter `JupiterOneAccess` as the stack name, then click **Next**.
6.  On the **Review and create** page, accept the checkbox labeled **I acknowledge that AWS CloudFormation might create IAM resources with custom names**. JupiterOne uses this permission to create the `JupiterOneSecurityAudit` managed policy; you can review the exact permissions it grants in [managed-policy.md](https://raw.githubusercontent.com/JupiterOne/jupiterone-aws-cloudformation/main/cloudformation/iam-cloudformation-govcloud/managed-policy.md).
7.  Click **Submit**.

The stack creates an IAM user named **`JupiterOneAccessUser`** with the AWS-managed `SecurityAudit` policy and the `JupiterOneSecurityAudit` policy attached. Continue to [Create an access key](#create-an-access-key).

#### Option 2: Terraform

1.  Download the latest GovCloud Terraform: [terraform.tf](https://raw.githubusercontent.com/JupiterOne/jupiterone-aws-cloudformation/main/cloudformation/iam-cloudformation-govcloud/terraform.tf).
2.  Apply it in each AWS GovCloud account you want to ingest.

The Terraform creates an IAM user named **`jupiterone-access-user`** with the same two policies attached. Continue to [Create an access key](#create-an-access-key).

#### Option 3: Manual configuration

1.  From the AWS GovCloud Console, search for and select **IAM** under **Services**.
2.  Select **Policies**, click **Create policy**, and select the **JSON** tab.
3.  Paste the policy document from [managed-policy.md](https://raw.githubusercontent.com/JupiterOne/jupiterone-aws-cloudformation/main/cloudformation/iam-cloudformation-govcloud/managed-policy.md). This is the same document deployed by the CloudFormation template and is the authoritative permission set.
4.  Click **Next**, enter `JupiterOneSecurityAudit` as the name, and click **Create policy**.
5.  Go to **Users** and select **Create user**. Enter `JupiterOneAccessUser` as the user name.
6.  On the permissions step, select **Attach policies directly** and select both **SecurityAudit** (the AWS-managed policy) and the **JupiterOneSecurityAudit** policy you just created.
7.  Click **Next**, review the user information, and click **Create user**.

> **CAUTION**
> 
> Keep the manually created policy in sync with [managed-policy.md](https://raw.githubusercontent.com/JupiterOne/jupiterone-aws-cloudformation/main/cloudformation/iam-cloudformation-govcloud/managed-policy.md). A policy that drifts behind the maintained one causes individual ingestion steps to fail with access-denied errors as the integration adds coverage for new services.

#### Create an access key

1.  In the IAM console, open the user created above (`JupiterOneAccessUser` for CloudFormation and manual setups, `jupiterone-access-user` for Terraform).
2.  Select the **Security credentials** tab.
3.  Under **Access keys**, click **Create access key**.
4.  Select **Other**, then create the access key.
5.  Copy both the **Access key ID** and the **Secret access key** (click **Show** to display it). These values are needed for the JupiterOne configuration and the secret cannot be retrieved again after you leave this page.

### Set Permissions

The GovCloud integration requires security auditor permissions in the target AWS GovCloud account, defined by the combination of the AWS-managed `SecurityAudit` policy and the additional `List*`, `Get*`, and `Describe*` permissions that `SecurityAudit` does not cover. The exact policy and permission statements are maintained in the public [JupiterOne AWS CloudFormation](https://github.com/JupiterOne/jupiterone-aws-cloudformation/tree/main/cloudformation/iam-cloudformation-govcloud) project.

For the permissions required by each individual ingestion source, see the **Authorization** tab.

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**.
2.  Scroll to the **GovCloud** integration tile and click it.
3.  Click **New instance** and configure the following settings:
    -   The **Account Name** used to identify this AWS GovCloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    -   A **Description** to assist in identifying the integration instance, if desired.
    -   A **Polling Interval** that fits your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    -   The **Account ID** of the AWS GovCloud account you are ingesting data from.
    -   The **Access Key ID** of the IAM user created above.
    -   The **Secret Access Key** associated with the Access Key ID.
4.  Click **Create Configuration** after all values are provided.

### Service Control Policy Issues

Errors may occur if a Service Control Policy (SCP) is blocking specified services or regions. AWS services that JupiterOne cannot ingest are listed in the **Integration Jobs** logs (**Integrations > Configurations > Settings > Jobs**).

For each SCP that is blocking JupiterOne ingestion, add the following condition to your SCP JSON. Note the `aws-us-gov` partition in the ARN:

```json
"Condition": {
  "ArnNotLike": {
    "aws:PrincipalARN": [
        "arn:aws-us-gov:iam::*:user/JupiterOne*",
        "arn:aws-us-gov:iam::*:user/jupiterone*"
    ]
  }
}
```

Ensure these ARNs match the IAM user used to configure your JupiterOne GovCloud integration.

> **INFO**
> 
> See the [AWS Service control policies documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) for the latest information.

### Differences from the commercial AWS integration

Both integrations ingest the same entity types, but the GovCloud integration instance offers a smaller set of configuration options:

| Capability | AWS | GovCloud |
| --- | --- | --- |
| Authentication | Role ARN with an External ID, optionally chained through an intermediate role | Account ID with an IAM user Access Key ID and Secret Access Key |
| Regions | All AWS regions that do not require additional contractual arrangements with AWS | `us-gov-east-1` and `us-gov-west-1` |
| ARN partition | `aws` | `aws-us-gov` |
| Organization account management | Supported. Sub-account instances are created and managed automatically. | Not supported. Configure one integration instance per GovCloud account. |
| Ingestion window and data filtering options | Configurable per instance (ECR, Inspector V2, and Security Hub findings) | Not configurable. Defaults apply. |
| Ingestion sources | Individually toggleable | Individually toggleable |

### Reference

#### S3 Bucket `public` Property

The `aws_s3_bucket.public` property is calculated based on the **Access** field in the AWS S3 console:

| Access | `aws_s3_bucket.public` |
| --- | --- |
| Public | `true` |
| Objects can be public | `undefined` |
| Bucket and objects not public | `false` |

#### AWS IAM Policies

Each `aws_iam_policy` entity includes a boolean `admin` property that indicates whether the policy grants administrative-level access. The flag is determined from the policy name: if the name contains the word "admin" (case-insensitive), the flag is set to `true`. Examples: `AdministratorAccess`, `AdminPolicy`, `MyCustomAdminRole`.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. See the [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (791)

-   `access-analyzer:ListAnalyzers`
-   `access-analyzer:ListFindings`
-   `account:GetAlternateContact`
-   `account:GetContactInformation`
-   `acm-pca:ListCertificateAuthorities`
-   `acm-pca:ListTags`
-   `acm:DescribeCertificate`
-   `acm:ListCertificates`
-   `acm:ListTagsForCertificate`
-   `aidevops:DescribePrivateConnection`
-   `aidevops:GetAgentSpace`
-   `aidevops:GetOperatorApp`
-   `aidevops:GetService`
-   `aidevops:ListAgentSpaces`
-   `aidevops:ListAssociations`
-   `aidevops:ListPrivateConnections`
-   `aidevops:ListServices`
-   `airflow:GetEnvironment`
-   `airflow:ListEnvironments`
-   `apigateway:GET arn:aws:apigateway:*::/apis`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/authorizers`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/integrations`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/routes`
-   `apigateway:GET arn:aws:apigateway:*::/apis/*/stages`
-   `apigateway:GET arn:aws:apigateway:*::/domainnames`
-   `apigateway:GET arn:aws:apigateway:*::/domainnames/*/apimappings`
-   `apigateway:GET arn:aws:apigateway:*::/restapis`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/authorizers`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/authorizers/*`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*/methods/*`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages`
-   `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages/*`
-   `appconfig:GetAccountSettings`
-   `appconfig:GetConfigurationProfile`
-   `appconfig:GetDeployment`
-   `appconfig:ListApplications`
-   `appconfig:ListConfigurationProfiles`
-   `appconfig:ListDeploymentStrategies`
-   `appconfig:ListDeployments`
-   `appconfig:ListEnvironments`
-   `appconfig:ListHostedConfigurationVersions`
-   `appconfig:ListTagsForResource`
-   `application-autoscaling:DescribeScalableTargets`
-   `application-autoscaling:DescribeScalingPolicies`
-   `aps:DescribeLoggingConfiguration`
-   `aps:DescribeQueryLoggingConfiguration`
-   `aps:DescribeResourcePolicy`
-   `aps:DescribeScraper`
-   `aps:DescribeWorkspace`
-   `aps:DescribeWorkspaceConfiguration`
-   `aps:ListScrapers`
-   `aps:ListWorkspaces`
-   `athena:GetWorkGroup`
-   `athena:ListTagsForResource`
-   `athena:ListWorkGroups`
-   `auditmanager:GetAssessment`
-   `auditmanager:GetAssessmentFramework`
-   `auditmanager:GetControl`
-   `auditmanager:GetDelegations`
-   `auditmanager:GetEvidenceFoldersByAssessmentControl`
-   `auditmanager:GetSettings`
-   `auditmanager:ListAssessmentFrameworks`
-   `auditmanager:ListAssessments`
-   `auditmanager:ListControls`
-   `auditmanager:ListTagsForResource`
-   `autoscaling:DescribeAutoScalingGroups`
-   `autoscaling:DescribeLaunchConfigurations`
-   `autoscaling:DescribePolicies`
-   `aws-marketplace:GetEntitlements`
-   `aws-marketplace:ListEntities`
-   `backup:GetBackupVaultAccessPolicy`
-   `backup:ListBackupJobs`
-   `backup:ListBackupPlans`
-   `backup:ListBackupVaults`
-   `backup:ListCopyJobs`
-   `backup:ListRecoveryPointsByBackupVault`
-   `backup:ListRestoreJobs`
-   `backup:ListRestoreTestingPlans`
-   `backup:ListTags`
-   `backup:ListTagsForResource`
-   `batch:DescribeComputeEnvironments`
-   `batch:DescribeJobDefinitions`
-   `batch:DescribeJobQueues`
-   `batch:ListJobs`
-   `bedrock-agentcore:GetAgentRuntime`
-   `bedrock-agentcore:GetApiKeyCredentialProvider`
-   `bedrock-agentcore:GetBrowser`
-   `bedrock-agentcore:GetCodeInterpreter`
-   `bedrock-agentcore:GetEvaluator`
-   `bedrock-agentcore:GetGateway`
-   `bedrock-agentcore:GetGatewayTarget`
-   `bedrock-agentcore:GetMemory`
-   `bedrock-agentcore:ListAgentRuntimes`
-   `bedrock-agentcore:ListApiKeyCredentialProviders`
-   `bedrock-agentcore:ListBrowserProfiles`
-   `bedrock-agentcore:ListBrowsers`
-   `bedrock-agentcore:ListCodeInterpreters`
-   `bedrock-agentcore:ListEvaluators`
-   `bedrock-agentcore:ListGatewayTargets`
-   `bedrock-agentcore:ListGateways`
-   `bedrock-agentcore:ListMemories`
-   `bedrock-agentcore:ListPolicyEngines`
-   `bedrock-agentcore:ListTagsForResource`
-   `bedrock:GetAgent`
-   `bedrock:GetAgentActionGroup`
-   `bedrock:GetCustomModel`
-   `bedrock:GetDataSource`
-   `bedrock:GetEvaluationJob`
-   `bedrock:GetFlow`
-   `bedrock:GetFoundationModelAvailability`
-   `bedrock:GetGuardrail`
-   `bedrock:GetImportedModel`
-   `bedrock:GetInferenceProfile`
-   `bedrock:GetKnowledgeBase`
-   `bedrock:GetModelCustomizationJob`
-   `bedrock:GetModelInvocationLoggingConfiguration`
-   `bedrock:GetProvisionedModelThroughput`
-   `bedrock:ListAgentActionGroups`
-   `bedrock:ListAgents`
-   `bedrock:ListCustomModels`
-   `bedrock:ListDataSources`
-   `bedrock:ListEvaluationJobs`
-   `bedrock:ListFlows`
-   `bedrock:ListFoundationModels`
-   `bedrock:ListGuardrails`
-   `bedrock:ListImportedModels`
-   `bedrock:ListInferenceProfiles`
-   `bedrock:ListKnowledgeBases`
-   `bedrock:ListModelCustomizationJobs`
-   `bedrock:ListModelInvocationJobs`
-   `bedrock:ListProvisionedModelThroughputs`
-   `bedrock:ListTagsForResource`
-   `cassandra:Select`
-   `cloudformation:DescribeStacks`
-   `cloudformation:ListStacks`
-   `cloudfront:GetDistributionConfig`
-   `cloudfront:ListDistributions`
-   `cloudfront:ListKeyGroups`
-   `cloudfront:ListPublicKeys`
-   `cloudfront:ListTagsForResource`
-   `cloudhsm:DescribeBackups`
-   `cloudhsm:DescribeClusters`
-   `cloudhsm:ListTags`
-   `cloudtrail:DescribeTrails`
-   `cloudtrail:GetEventSelectors`
-   `cloudtrail:GetTrailStatus`
-   `cloudtrail:ListTags`
-   `cloudwatch:DescribeAlarms`
-   `cloudwatch:GetMetricData`
-   `cloudwatch:ListTagsForResource`
-   `codeartifact:DescribeDomain`
-   `codeartifact:DescribeRepository`
-   `codeartifact:GetDomainPermissionsPolicy`
-   `codeartifact:GetRepositoryEndpoint`
-   `codeartifact:GetRepositoryPermissionsPolicy`
-   `codeartifact:ListDomains`
-   `codeartifact:ListPackageGroups`
-   `codeartifact:ListPackages`
-   `codeartifact:ListRepositories`
-   `codeartifact:ListTagsForResource`
-   `codebuild:BatchGetProjects`
-   `codebuild:BatchGetReportGroups`
-   `codebuild:GetResourcePolicy`
-   `codebuild:ListProjects`
-   `codebuild:ListReportGroups`
-   `codecommit:GetRepository`
-   `codecommit:ListRepositories`
-   `codecommit:ListTagsForResource`
-   `codedeploy:BatchGetApplications`
-   `codedeploy:BatchGetDeploymentGroups`
-   `codedeploy:GetDeploymentConfig`
-   `codedeploy:ListApplications`
-   `codedeploy:ListDeploymentConfigs`
-   `codedeploy:ListDeploymentGroups`
-   `codedeploy:ListTagsForResource`
-   `codeguru-profiler:ListProfilingGroups`
-   `codeguru-reviewer:DescribeRepositoryAssociation`
-   `codeguru-reviewer:ListRepositoryAssociations`
-   `codeguru-reviewer:ListTagsForResource`
-   `codepipeline:GetPipeline`
-   `codepipeline:ListPipelines`
-   `cognito-identity:DescribeIdentityPool`
-   `cognito-identity:ListIdentityPools`
-   `cognito-idp:DescribeRiskConfiguration`
-   `cognito-idp:DescribeUserPool`
-   `cognito-idp:DescribeUserPoolClient`
-   `cognito-idp:DescribeUserPoolDomain`
-   `cognito-idp:ListUserPoolClients`
-   `cognito-idp:ListUserPools`
-   `cognito-idp:ListUsers`
-   `config:BatchGetResourceConfig`
-   `config:DescribeComplianceByConfigRule`
-   `config:DescribeConfigRules`
-   `config:GetComplianceDetailsByConfigRule`
-   `datasync:DescribeLocationEfs`
-   `datasync:DescribeLocationFsxLustre`
-   `datasync:DescribeLocationFsxOntap`
-   `datasync:DescribeLocationFsxOpenZfs`
-   `datasync:DescribeLocationFsxWindows`
-   `datasync:DescribeLocationHdfs`
-   `datasync:DescribeLocationNfs`
-   `datasync:DescribeLocationObjectStorage`
-   `datasync:DescribeLocationS3`
-   `datasync:DescribeLocationSmb`
-   `datasync:DescribeTask`
-   `datasync:ListLocations`
-   `datasync:ListTagsForResource`
-   `datasync:ListTasks`
-   `dax:DescribeClusters`
-   `detective:GetInvestigation`
-   `detective:ListGraphs`
-   `detective:ListInvestigations`
-   `detective:ListTagsForResource`
-   `devops-guru:DescribeAccountHealth`
-   `devops-guru:DescribeServiceIntegration`
-   `devops-guru:ListAnomaliesForInsight`
-   `devops-guru:ListInsights`
-   `devops-guru:ListNotificationChannels`
-   `directconnect:DescribeConnections`
-   `directconnect:DescribeDirectConnectGateways`
-   `directconnect:DescribeLags`
-   `directconnect:DescribeVirtualInterfaces`
-   `dms:DescribeEndpoints`
-   `dms:DescribeReplicationInstances`
-   `dms:ListTagsForResource`
-   `ds:DescribeDirectories`
-   `dynamodb:DescribeContinuousBackups`
-   `dynamodb:DescribeGlobalTable`
-   `dynamodb:DescribeTable`
-   `dynamodb:ListBackups`
-   `dynamodb:ListGlobalTables`
-   `dynamodb:ListTables`
-   `dynamodb:ListTagsOfResource`
-   `ec2:DescribeAddresses`
-   `ec2:DescribeCustomerGateways`
-   `ec2:DescribeFlowLogs`
-   `ec2:DescribeHosts`
-   `ec2:DescribeIamInstanceProfileAssociations`
-   `ec2:DescribeImageAttribute`
-   `ec2:DescribeImages`
-   `ec2:DescribeInstanceAttribute`
-   `ec2:DescribeInstances`
-   `ec2:DescribeInternetGateways`
-   `ec2:DescribeKeyPairs`
-   `ec2:DescribeLaunchTemplateVersions`
-   `ec2:DescribeLaunchTemplates`
-   `ec2:DescribeManagedPrefixLists`
-   `ec2:DescribeNatGateways`
-   `ec2:DescribeNetworkAcls`
-   `ec2:DescribeNetworkInterfaces`
-   `ec2:DescribeRegions`
-   `ec2:DescribeRouteTables`
-   `ec2:DescribeSecurityGroupRules`
-   `ec2:DescribeSecurityGroups`
-   `ec2:DescribeSnapshotAttribute`
-   `ec2:DescribeSnapshots`
-   `ec2:DescribeSubnets`
-   `ec2:DescribeTransitGatewayAttachments`
-   `ec2:DescribeTransitGatewayRouteTables`
-   `ec2:DescribeTransitGatewayVpcAttachments`
-   `ec2:DescribeTransitGateways`
-   `ec2:DescribeVolumes`
-   `ec2:DescribeVpcEndpointConnections`
-   `ec2:DescribeVpcEndpointServiceConfigurations`
-   `ec2:DescribeVpcEndpointServicePermissions`
-   `ec2:DescribeVpcEndpointServices`
-   `ec2:DescribeVpcEndpoints`
-   `ec2:DescribeVpcPeeringConnections`
-   `ec2:DescribeVpcs`
-   `ec2:DescribeVpnConnections`
-   `ec2:DescribeVpnGateways`
-   `ec2:GetEbsDefaultKmsKeyId`
-   `ec2:GetEbsEncryptionByDefault`
-   `ec2:GetManagedPrefixListEntries`
-   `ecr:DescribeImageScanFindings`
-   `ecr:DescribeImages`
-   `ecr:DescribeRepositories`
-   `ecr:GetLifecyclePolicy`
-   `ecr:GetRepositoryPolicy`
-   `ecr:ListTagsForResource`
-   `ecs:DescribeClusters`
-   `ecs:DescribeContainerInstances`
-   `ecs:DescribeServices`
-   `ecs:DescribeTaskDefinition`
-   `ecs:DescribeTasks`
-   `ecs:ListClusters`
-   `ecs:ListContainerInstances`
-   `ecs:ListServices`
-   `ecs:ListTaskDefinitionFamilies`
-   `ecs:ListTasks`
-   `eks:DescribeCluster`
-   `eks:DescribeClusterVersions`
-   `eks:DescribeNodegroup`
-   `eks:ListClusters`
-   `eks:ListNodegroups`
-   `elasticache:DescribeCacheClusters`
-   `elasticache:DescribeCacheSubnetGroups`
-   `elasticache:DescribeReplicationGroups`
-   `elasticache:DescribeSnapshots`
-   `elasticache:ListTagsForResource`
-   `elasticfilesystem:DescribeFileSystemPolicy`
-   `elasticfilesystem:DescribeFileSystems`
-   `elasticfilesystem:DescribeMountTargetSecurityGroups`
-   `elasticfilesystem:DescribeMountTargets`
-   `elasticloadbalancing:DescribeListeners`
-   `elasticloadbalancing:DescribeLoadBalancerAttributes`
-   `elasticloadbalancing:DescribeLoadBalancers`
-   `elasticloadbalancing:DescribeRules`
-   `elasticloadbalancing:DescribeTags`
-   `elasticloadbalancing:DescribeTargetGroups`
-   `elasticloadbalancing:DescribeTargetHealth`
-   `elasticmapreduce:DescribeCluster`
-   `elasticmapreduce:DescribeSecurityConfiguration`
-   `elasticmapreduce:ListClusters`
-   `elasticmapreduce:ListInstances`
-   `elasticmapreduce:ListSecurityConfigurations`
-   `emr-serverless:GetApplication`
-   `emr-serverless:ListApplications`
-   `es:DescribeDomains`
-   `es:DescribeElasticsearchDomains`
-   `es:ListDomainNames`
-   `es:ListTags`
-   `events:DescribeApiDestination`
-   `events:DescribeArchive`
-   `events:DescribeConnection`
-   `events:DescribeEventBus`
-   `events:ListApiDestinations`
-   `events:ListArchives`
-   `events:ListConnections`
-   `events:ListEndpoints`
-   `events:ListEventBuses`
-   `events:ListRules`
-   `events:ListTagsForResource`
-   `events:ListTargetsByRule`
-   `firehose:DescribeDeliveryStream`
-   `firehose:ListDeliveryStreams`
-   `firehose:ListTagsForDeliveryStream`
-   `fms:ListAppsLists`
-   `fms:ListPolicies`
-   `fms:ListProtocolsLists`
-   `fms:ListResourceSetResources`
-   `fms:ListResourceSets`
-   `fms:ListTagsForResource`
-   `fsx:DescribeFileSystems`
-   `glacier:GetVaultAccessPolicy`
-   `glacier:GetVaultLock`
-   `glacier:ListTagsForVault`
-   `glacier:ListVaults`
-   `globalaccelerator:ListAccelerators`
-   `globalaccelerator:ListCustomRoutingAccelerators`
-   `globalaccelerator:ListCustomRoutingEndpointGroups`
-   `globalaccelerator:ListCustomRoutingListeners`
-   `globalaccelerator:ListEndpointGroups`
-   `globalaccelerator:ListListeners`
-   `globalaccelerator:ListTagsForResource`
-   `glue:GetConnection`
-   `glue:GetConnections`
-   `glue:GetDataCatalogEncryptionSettings`
-   `glue:GetDatabase`
-   `glue:GetDatabases`
-   `glue:GetDevEndpoint`
-   `glue:GetDevEndpoints`
-   `glue:GetJob`
-   `glue:GetResourcePolicy`
-   `glue:GetSecurityConfigurations`
-   `glue:GetTags`
-   `glue:ListJobs`
-   `glue:ListSessions`
-   `grafana:DescribeWorkspace`
-   `grafana:ListWorkspaces`
-   `guardduty:DescribeOrganizationConfiguration`
-   `guardduty:DescribePublishingDestination`
-   `guardduty:GetDetector`
-   `guardduty:GetFindings`
-   `guardduty:ListDetectors`
-   `guardduty:ListFindings`
-   `guardduty:ListOrganizationAdminAccounts`
-   `guardduty:ListPublishingDestinations`
-   `health:DescribeAffectedEntities`
-   `health:DescribeEventDetails`
-   `health:DescribeEvents`
-   `iam:GenerateCredentialReport`
-   `iam:GetAccessKeyLastUsed`
-   `iam:GetAccountPasswordPolicy`
-   `iam:GetAccountSummary`
-   `iam:GetCredentialReport`
-   `iam:GetGroup`
-   `iam:GetGroupPolicy`
-   `iam:GetOpenIDConnectProvider`
-   `iam:GetPolicyVersion`
-   `iam:GetRole`
-   `iam:GetRolePolicy`
-   `iam:GetSAMLProvider`
-   `iam:GetServerCertificate`
-   `iam:GetUser`
-   `iam:GetUserPolicy`
-   `iam:ListAccessKeys`
-   `iam:ListAccountAliases`
-   `iam:ListEntitiesForPolicy`
-   `iam:ListGroupPolicies`
-   `iam:ListGroups`
-   `iam:ListInstanceProfiles`
-   `iam:ListMFADevices`
-   `iam:ListOpenIDConnectProviderTags`
-   `iam:ListOpenIDConnectProviders`
-   `iam:ListPolicies`
-   `iam:ListRolePolicies`
-   `iam:ListRoleTags`
-   `iam:ListRoles`
-   `iam:ListSAMLProviders`
-   `iam:ListServerCertificates`
-   `iam:ListServiceSpecificCredentials`
-   `iam:ListUserPolicies`
-   `iam:ListUserTags`
-   `iam:ListUsers`
-   `identitystore:ListGroupMemberships`
-   `identitystore:ListGroups`
-   `identitystore:ListUsers`
-   `imagebuilder:GetComponent`
-   `imagebuilder:GetContainerRecipe`
-   `imagebuilder:GetDistributionConfiguration`
-   `imagebuilder:GetImage`
-   `imagebuilder:GetImagePipeline`
-   `imagebuilder:GetInfrastructureConfiguration`
-   `imagebuilder:GetLifecyclePolicy`
-   `imagebuilder:GetWorkflow`
-   `imagebuilder:ListComponents`
-   `imagebuilder:ListContainerRecipes`
-   `imagebuilder:ListDistributionConfigurations`
-   `imagebuilder:ListImageBuildVersions`
-   `imagebuilder:ListImagePipelines`
-   `imagebuilder:ListImages`
-   `imagebuilder:ListInfrastructureConfigurations`
-   `imagebuilder:ListLifecyclePolicies`
-   `imagebuilder:ListWorkflows`
-   `inspector2:DescribeOrganizationConfiguration`
-   `inspector2:GetConfiguration`
-   `inspector2:GetDelegatedAdminAccount`
-   `inspector2:GetEncryptionKey`
-   `inspector2:ListCisScanResultsAggregatedByTargetResource`
-   `inspector2:ListCisScans`
-   `inspector2:ListCoverage`
-   `inspector2:ListFilters`
-   `inspector2:ListFindings`
-   `inspector2:ListTagsForResource`
-   `inspector:DescribeAssessmentRuns`
-   `inspector:DescribeFindings`
-   `inspector:DescribeRulesPackages`
-   `inspector:ListAssessmentRuns`
-   `inspector:ListFindings`
-   `kafka:GetBootstrapBrokers`
-   `kafka:ListClustersV2`
-   `kafka:ListTagsForResource`
-   `kinesis:DescribeStreamSummary`
-   `kinesis:ListStreamConsumers`
-   `kinesis:ListStreams`
-   `kinesis:ListTagsForStream`
-   `kms:DescribeKey`
-   `kms:GetKeyPolicy`
-   `kms:GetKeyRotationStatus`
-   `kms:ListAliases`
-   `kms:ListKeys`
-   `kms:ListResourceTags`
-   `lambda:GetFunction`
-   `lambda:GetFunctionUrlConfig`
-   `lambda:GetPolicy`
-   `lambda:ListCodeSigningConfigs`
-   `lambda:ListFunctions`
-   `lambda:ListFunctionsByCodeSigningConfig`
-   `lambda:ListTags`
-   `lex:DescribeResourcePolicy`
-   `lex:ListBotAliases`
-   `lex:ListBots`
-   `license-manager:ListLicenses`
-   `license-manager:ListReceivedLicenses`
-   `logs:DescribeDestinations`
-   `logs:DescribeLogGroups`
-   `logs:DescribeMetricFilters`
-   `logs:DescribeSubscriptionFilters`
-   `macie2:DescribeClassificationJob`
-   `macie2:DescribeOrganizationConfiguration`
-   `macie2:GetAutomatedDiscoveryConfiguration`
-   `macie2:GetClassificationExportConfiguration`
-   `macie2:GetFindings`
-   `macie2:GetFindingsPublicationConfiguration`
-   `macie2:ListAutomatedDiscoveryAccounts`
-   `macie2:ListClassificationJobs`
-   `macie2:ListFindings`
-   `macie2:ListOrganizationAdminAccounts`
-   `mq:DescribeBroker`
-   `mq:ListBrokers`
-   `neptune-graph:GetGraph`
-   `neptune-graph:GetImportTask`
-   `neptune-graph:ListExportTasks`
-   `neptune-graph:ListGraphSnapshots`
-   `neptune-graph:ListGraphs`
-   `neptune-graph:ListImportTasks`
-   `neptune-graph:ListPrivateGraphEndpoints`
-   `neptune-graph:ListTagsForResource`
-   `neptune:DescribeDBClusters`
-   `neptune:DescribeDBInstances`
-   `network-firewall:DescribeFirewall`
-   `network-firewall:DescribeFirewallPolicy`
-   `network-firewall:DescribeRuleGroup`
-   `network-firewall:ListFirewallPolicies`
-   `network-firewall:ListFirewalls`
-   `network-firewall:ListRuleGroups`
-   `networkmanager:GetConnectPeer`
-   `networkmanager:GetCoreNetwork`
-   `networkmanager:GetCoreNetworkPolicy`
-   `networkmanager:ListAttachmentRoutingPolicyAssociations`
-   `networkmanager:ListAttachments`
-   `networkmanager:ListConnectPeers`
-   `networkmanager:ListCoreNetworkPolicyVersions`
-   `networkmanager:ListCoreNetworkRoutingInformation`
-   `networkmanager:ListCoreNetworks`
-   `nova-act:GetWorkflowDefinition`
-   `nova-act:GetWorkflowRun`
-   `nova-act:ListModels`
-   `nova-act:ListWorkflowDefinitions`
-   `nova-act:ListWorkflowRuns`
-   `organizations:DescribeAccount`
-   `organizations:DescribeOrganization`
-   `organizations:DescribeOrganizationalUnit`
-   `organizations:DescribePolicy`
-   `organizations:ListAccounts`
-   `organizations:ListChildren`
-   `organizations:ListPolicies`
-   `organizations:ListRoots`
-   `organizations:ListTagsForResource`
-   `organizations:ListTargetsForPolicy`
-   `outposts:GetCatalogItem`
-   `outposts:GetOrder`
-   `outposts:GetOutpostInstanceTypes`
-   `outposts:GetOutpostSupportedInstanceTypes`
-   `outposts:GetPrivateConnectivityConfig`
-   `outposts:ListAssetInstances`
-   `outposts:ListAssets`
-   `outposts:ListOrders`
-   `outposts:ListOutposts`
-   `outposts:ListSites`
-   `quicksight:DescribeAccountSettings`
-   `quicksight:DescribeAccountSubscription`
-   `quicksight:DescribeDashboard`
-   `quicksight:DescribeDashboardPermissions`
-   `quicksight:DescribeDataSet`
-   `quicksight:DescribeDataSource`
-   `quicksight:DescribeIpRestriction`
-   `quicksight:DescribeKeyRegistration`
-   `quicksight:DescribeVpcConnection`
-   `quicksight:ListCustomPermissions`
-   `quicksight:ListDashboards`
-   `quicksight:ListDataSets`
-   `quicksight:ListDataSources`
-   `quicksight:ListGroupMemberships`
-   `quicksight:ListGroups`
-   `quicksight:ListNamespaces`
-   `quicksight:ListTagsForResource`
-   `quicksight:ListUsers`
-   `quicksight:ListVpcConnections`
-   `ram:GetResourceShareAssociations`
-   `ram:GetResourceShareInvitations`
-   `ram:GetResourceShares`
-   `ram:ListResources`
-   `rds:DescribeDBClusterParameterGroups`
-   `rds:DescribeDBClusterParameters`
-   `rds:DescribeDBClusterSnapshots`
-   `rds:DescribeDBClusters`
-   `rds:DescribeDBInstances`
-   `rds:DescribeDBParameterGroups`
-   `rds:DescribeDBParameters`
-   `rds:DescribeDBProxies`
-   `rds:DescribeDBProxyTargetGroups`
-   `rds:DescribeDBProxyTargets`
-   `rds:DescribeDBSnapshots`
-   `rds:DescribeDBSubnetGroups`
-   `rds:DescribeOptionGroups`
-   `redshift-serverless:ListEndpointAccess`
-   `redshift-serverless:ListNamespaces`
-   `redshift-serverless:ListRecoveryPoints`
-   `redshift-serverless:ListSnapshots`
-   `redshift-serverless:ListTagsForResource`
-   `redshift-serverless:ListUsageLimits`
-   `redshift-serverless:ListWorkgroups`
-   `redshift:DescribeClusterParameterGroups`
-   `redshift:DescribeClusterParameters`
-   `redshift:DescribeClusters`
-   `redshift:DescribeDataShares`
-   `redshift:DescribeLoggingStatus`
-   `resource-explorer-2:GetDefaultView`
-   `resource-explorer-2:GetIndex`
-   `resource-explorer-2:GetView`
-   `resource-explorer-2:ListIndexes`
-   `resource-explorer-2:ListTagsForResource`
-   `resource-explorer-2:ListViews`
-   `rolesanywhere:GetProfile`
-   `rolesanywhere:GetTrustAnchor`
-   `rolesanywhere:ListProfiles`
-   `rolesanywhere:ListTagsForResource`
-   `rolesanywhere:ListTrustAnchors`
-   `route53:GetHostedZone`
-   `route53:ListHostedZones`
-   `route53:ListResourceRecordSets`
-   `route53domains:GetDomainDetail`
-   `route53domains:ListDomains`
-   `route53domains:ListTagsForDomain`
-   `route53resolver:ListResolverRuleAssociations`
-   `route53resolver:ListResolverRules`
-   `route53resolver:ListTagsForResource`
-   `s3:GetAccountPublicAccessBlock`
-   `s3:GetBucketAcl`
-   `s3:GetBucketLocation`
-   `s3:GetBucketLogging`
-   `s3:GetBucketNotification`
-   `s3:GetBucketObjectLockConfiguration`
-   `s3:GetBucketOwnershipControls`
-   `s3:GetBucketPolicy`
-   `s3:GetBucketPolicyStatus`
-   `s3:GetBucketPublicAccessBlock`
-   `s3:GetBucketTagging`
-   `s3:GetBucketVersioning`
-   `s3:GetBucketWebsite`
-   `s3:GetEncryptionConfiguration`
-   `s3:GetInventoryConfiguration`
-   `s3:GetLifecycleConfiguration`
-   `s3:GetReplicationConfiguration`
-   `s3:ListAccessPoints`
-   `s3:ListAllMyBuckets`
-   `sagemaker:DescribeDomain`
-   `sagemaker:DescribeEndpoint`
-   `sagemaker:DescribeEndpointConfig`
-   `sagemaker:DescribeFeatureGroup`
-   `sagemaker:DescribeInferenceRecommendationsJob`
-   `sagemaker:DescribeModel`
-   `sagemaker:DescribeModelBiasJobDefinition`
-   `sagemaker:DescribeModelQualityJobDefinition`
-   `sagemaker:DescribeNotebookInstance`
-   `sagemaker:DescribePipelineExecution`
-   `sagemaker:DescribeProcessingJob`
-   `sagemaker:DescribeTrainingJob`
-   `sagemaker:DescribeTransformJob`
-   `sagemaker:ListDomains`
-   `sagemaker:ListEndpoints`
-   `sagemaker:ListFeatureGroups`
-   `sagemaker:ListInferenceRecommendationsJobs`
-   `sagemaker:ListModelBiasJobDefinitions`
-   `sagemaker:ListModelQualityJobDefinitions`
-   `sagemaker:ListModels`
-   `sagemaker:ListNotebookInstances`
-   `sagemaker:ListPipelineExecutions`
-   `sagemaker:ListPipelines`
-   `sagemaker:ListProcessingJobs`
-   `sagemaker:ListTags`
-   `sagemaker:ListTrainingJobs`
-   `sagemaker:ListTransformJobs`
-   `secretsmanager:DescribeSecret`
-   `secretsmanager:GetResourcePolicy`
-   `secretsmanager:ListSecretVersionIds`
-   `secretsmanager:ListSecrets`
-   `securityagent:BatchGetAgentSpaces`
-   `securityagent:BatchGetArtifactMetadata`
-   `securityagent:BatchGetTargetDomains`
-   `securityagent:BatchGetThreatModels`
-   `securityagent:ListAgentSpaces`
-   `securityagent:ListApplications`
-   `securityagent:ListArtifacts`
-   `securityagent:ListPrivateConnections`
-   `securityagent:ListTagsForResource`
-   `securityagent:ListTargetDomains`
-   `securityagent:ListThreatModels`
-   `securityhub:DescribeHub`
-   `securityhub:DescribeStandards`
-   `securityhub:DescribeStandardsControls`
-   `securityhub:GetEnabledStandards`
-   `securityhub:GetFindings`
-   `servicecatalog:DescribeConstraint`
-   `servicecatalog:DescribePortfolio`
-   `servicecatalog:DescribeProductAsAdmin`
-   `servicecatalog:ListConstraintsForPortfolio`
-   `servicecatalog:ListLaunchPaths`
-   `servicecatalog:ListPortfolios`
-   `servicecatalog:ListPortfoliosForProduct`
-   `servicecatalog:ListPrincipalsForPortfolio`
-   `servicecatalog:ListProvisioningArtifacts`
-   `servicecatalog:ListResourcesForTagOption`
-   `servicecatalog:ListTagOptions`
-   `servicecatalog:SearchProductsAsAdmin`
-   `servicediscovery:GetInstance`
-   `servicediscovery:ListInstances`
-   `servicediscovery:ListNamespaces`
-   `servicediscovery:ListServices`
-   `servicediscovery:ListTagsForResource`
-   `ses:GetConfigurationSet`
-   `ses:GetEmailIdentity`
-   `ses:ListConfigurationSets`
-   `ses:ListEmailIdentities`
-   `ses:ListReceiptFilters`
-   `shield:DescribeDRTAccess`
-   `shield:DescribeEmergencyContactSettings`
-   `shield:DescribeSubscription`
-   `shield:GetSubscriptionState`
-   `shield:ListProtectionGroups`
-   `shield:ListProtections`
-   `shield:ListResourcesInProtectionGroup`
-   `shield:ListTagsForResource`
-   `signer:GetSigningProfile`
-   `signer:ListProfilePermissions`
-   `signer:ListSigningJobs`
-   `signer:ListSigningProfiles`
-   `sns:GetSubscriptionAttributes`
-   `sns:GetTopicAttributes`
-   `sns:ListSubscriptions`
-   `sns:ListTagsForResource`
-   `sns:ListTopics`
-   `sqs:GetQueueAttributes`
-   `sqs:ListQueueTags`
-   `sqs:ListQueues`
-   `ssm:DescribeDocumentPermission`
-   `ssm:DescribeInstanceInformation`
-   `ssm:DescribeInstancePatchStates`
-   `ssm:DescribeParameters`
-   `ssm:DescribePatchBaselines`
-   `ssm:DescribePatchGroupState`
-   `ssm:DescribePatchGroups`
-   `ssm:GetDocument`
-   `ssm:GetServiceSetting`
-   `ssm:ListAssociations`
-   `ssm:ListComplianceItems`
-   `ssm:ListComplianceSummaries`
-   `ssm:ListDocuments`
-   `ssm:ListInventoryEntries`
-   `ssm:ListTagsForResource`
-   `sso:DescribePermissionSet`
-   `sso:GetInlinePolicyForPermissionSet`
-   `sso:ListAccountAssignments`
-   `sso:ListAccountAssignmentsForPrincipal`
-   `sso:ListAccountsForProvisionedPermissionSet`
-   `sso:ListApplications`
-   `sso:ListCustomerManagedPolicyReferencesInPermissionSet`
-   `sso:ListInstances`
-   `sso:ListManagedPoliciesInPermissionSet`
-   `sso:ListPermissionSets`
-   `sso:ListTagsForResource`
-   `states:DescribeStateMachine`
-   `states:ListStateMachines`
-   `states:ListTagsForResource`
-   `storagegateway:DescribeCachediSCSIVolumes`
-   `storagegateway:DescribeGatewayInformation`
-   `storagegateway:DescribeNFSFileShares`
-   `storagegateway:DescribeSMBFileShares`
-   `storagegateway:DescribeStorediSCSIVolumes`
-   `storagegateway:DescribeTapeArchives`
-   `storagegateway:ListFileShares`
-   `storagegateway:ListGateways`
-   `storagegateway:ListTagsForResource`
-   `storagegateway:ListTapePools`
-   `storagegateway:ListTapes`
-   `storagegateway:ListVolumes`
-   `tag:GetResources`
-   `transfer:DescribeServer`
-   `transfer:ListServers`
-   `transfer:ListTagsForResource`
-   `transfer:ListUsers`
-   `vpc-lattice:ListListeners`
-   `vpc-lattice:ListServiceNetworkServiceAssociations`
-   `vpc-lattice:ListServiceNetworkVpcAssociations`
-   `vpc-lattice:ListServiceNetworkVpcEndpointAssociations`
-   `vpc-lattice:ListServiceNetworks`
-   `vpc-lattice:ListServices`
-   `vpc-lattice:ListTargetGroups`
-   `waf:GetWebACL`
-   `waf:ListWebACLs`
-   `wafv2:GetIPSet`
-   `wafv2:GetLoggingConfiguration`
-   `wafv2:GetRuleGroup`
-   `wafv2:GetWebACL`
-   `wafv2:ListIPSets`
-   `wafv2:ListResourcesForWebACL`
-   `wafv2:ListRuleGroups`
-   `wafv2:ListTagsForResource`
-   `wafv2:ListWebACLs`
-   `workspaces:DescribeTags`
-   `workspaces:DescribeWorkspaceBundles`
-   `workspaces:DescribeWorkspaces`
-   `xray:GetEncryptionConfig`
-   `xray:GetGroups`
-   `xray:ListResourcePolicies`
-   `xray:ListTagsForResource`

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (206)

-   `access-analyzer:List*`
-   `account:Get*`
-   `acm-pca:List*`
-   `acm:Describe*`
-   `acm:List*`
-   `airflow:Get*`
-   `airflow:List*`
-   `apigateway:GET arn:aws:apigateway:*::/*`
-   `appconfig:Get*`
-   `appconfig:List*`
-   `aps:Describe*`
-   `aps:Get*`
-   `aps:List*`
-   `athena:Get*`
-   `athena:List*`
-   `auditmanager:Get*`
-   `auditmanager:List*`
-   `autoscaling:Describe*`
-   `aws-marketplace:Get*`
-   `aws-marketplace:List*`
-   `backup:Get*`
-   `backup:List*`
-   `batch:Describe*`
-   `batch:List*`
-   `bedrock-agentcore:Get*`
-   `bedrock-agentcore:List*`
-   `bedrock:Get*`
-   `bedrock:List*`
-   `cloudformation:Describe*`
-   `cloudformation:List*`
-   `cloudfront:Get*`
-   `cloudfront:List*`
-   `cloudhsm:Describe*`
-   `cloudhsm:List*`
-   `cloudtrail:Describe*`
-   `cloudtrail:Get*`
-   `cloudtrail:List*`
-   `cloudwatch:Describe*`
-   `cloudwatch:Get*`
-   `cloudwatch:List*`
-   `codeartifact:Describe*`
-   `codeartifact:Get*`
-   `codeartifact:List*`
-   `codebuild:BatchGet*`
-   `codebuild:Get*`
-   `codebuild:List*`
-   `codecommit:Get*`
-   `codecommit:List*`
-   `codedeploy:BatchGet*`
-   `codedeploy:Get*`
-   `codedeploy:List*`
-   `codeguru-profiler:List*`
-   `codeguru-reviewer:Describe*`
-   `codeguru-reviewer:List*`
-   `codepipeline:Get*`
-   `codepipeline:List*`
-   `cognito-identity:Describe*`
-   `cognito-identity:List*`
-   `cognito-idp:Describe*`
-   `cognito-idp:List*`
-   `config:BatchGet*`
-   `config:Describe*`
-   `config:Get*`
-   `datasync:Describe*`
-   `datasync:List*`
-   `dax:Describe*`
-   `detective:Get*`
-   `detective:List*`
-   `devops-guru:Describe*`
-   `devops-guru:List*`
-   `directconnect:Describe*`
-   `dms:Describe*`
-   `dms:List*`
-   `ds:Describe*`
-   `dynamodb:Describe*`
-   `dynamodb:List*`
-   `ec2:Describe*`
-   `ec2:Get*`
-   `ecr:Describe*`
-   `ecr:Get*`
-   `ecr:List*`
-   `ecs:Describe*`
-   `ecs:List*`
-   `eks:Describe*`
-   `eks:List*`
-   `elasticache:Describe*`
-   `elasticache:List*`
-   `elasticfilesystem:Describe*`
-   `elasticloadbalancing:Describe*`
-   `elasticmapreduce:Describe*`
-   `elasticmapreduce:List*`
-   `emr-serverless:Get*`
-   `emr-serverless:List*`
-   `es:Describe*`
-   `es:List*`
-   `events:List*`
-   `firehose:Describe*`
-   `firehose:List*`
-   `fms:List*`
-   `fsx:Describe*`
-   `glacier:Get*`
-   `glacier:List*`
-   `globalaccelerator:List*`
-   `glue:Get*`
-   `glue:List*`
-   `grafana:Describe*`
-   `grafana:List*`
-   `guardduty:Describe*`
-   `guardduty:Get*`
-   `guardduty:List*`
-   `health:Describe*`
-   `iam:Generate*`
-   `iam:Get*`
-   `iam:List*`
-   `identitystore:List*`
-   `imagebuilder:Get*`
-   `imagebuilder:List*`
-   `inspector2:Describe*`
-   `inspector2:Get*`
-   `inspector2:List*`
-   `inspector:Describe*`
-   `inspector:List*`
-   `kafka:Get*`
-   `kafka:List*`
-   `kinesis:Describe*`
-   `kinesis:List*`
-   `kms:Describe*`
-   `kms:Get*`
-   `kms:List*`
-   `lambda:Get*`
-   `lambda:List*`
-   `lex:Describe*`
-   `lex:List*`
-   `license-manager:List*`
-   `logs:Describe*`
-   `macie2:Describe*`
-   `macie2:Get*`
-   `macie2:List*`
-   `mq:Describe*`
-   `mq:List*`
-   `neptune-graph:Get*`
-   `neptune-graph:List*`
-   `neptune:Describe*`
-   `network-firewall:Describe*`
-   `network-firewall:List*`
-   `networkmanager:Get*`
-   `networkmanager:List*`
-   `organizations:Describe*`
-   `organizations:List*`
-   `quicksight:Describe*`
-   `quicksight:List*`
-   `ram:Get*`
-   `ram:List*`
-   `rds:Describe*`
-   `redshift-serverless:List*`
-   `redshift:Describe*`
-   `rolesanywhere:Get*`
-   `rolesanywhere:List*`
-   `route53:Get*`
-   `route53:List*`
-   `route53domains:Get*`
-   `route53domains:List*`
-   `route53resolver:List*`
-   `s3:Get*`
-   `s3:List*`
-   `sagemaker:Describe*`
-   `sagemaker:List*`
-   `secretsmanager:Describe*`
-   `secretsmanager:Get*`
-   `secretsmanager:List*`
-   `securityhub:Describe*`
-   `securityhub:Get*`
-   `servicediscovery:Get*`
-   `servicediscovery:List*`
-   `ses:Get*`
-   `ses:List*`
-   `shield:Describe*`
-   `shield:Get*`
-   `shield:List*`
-   `signer:Get*`
-   `signer:List*`
-   `sns:Get*`
-   `sns:List*`
-   `sqs:Get*`
-   `sqs:List*`
-   `ssm:Describe*`
-   `ssm:Get*`
-   `ssm:List*`
-   `sso:Describe*`
-   `sso:Get*`
-   `sso:List*`
-   `states:Describe*`
-   `states:List*`
-   `storagegateway:Describe*`
-   `storagegateway:List*`
-   `tag:Get*`
-   `transfer:Describe*`
-   `transfer:List*`
-   `vpc-lattice:List*`
-   `waf:Get*`
-   `waf:List*`
-   `wafv2:Get*`
-   `wafv2:List*`
-   `workspaces:Describe*`
-   `xray:Get*`
-   `xray:List*`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (8)

-   `GET https://aidevops.{region}.api.aws/v1/agentspaces/{agentSpaceId}`
-   `GET https://aidevops.{region}.api.aws/v1/private-connections`
-   `GET https://aidevops.{region}.api.aws/v1/private-connections/{name}`
-   `GET https://aidevops.{region}.api.aws/v1/services/{serviceId}`
-   `GET https://aidevops.{region}.api.aws/v2/agentspaces/{agentSpaceId}/operator`
-   `POST https://aidevops.{region}.api.aws/v1/agentspaces/list`
-   `POST https://aidevops.{region}.api.aws/v1/agentspaces/{agentSpaceId}/associations/list`
-   `POST https://aidevops.{region}.api.aws/v1/services/list`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (9)

-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_DescribePrivateConnection.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_DescribePrivateConnection.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_GetAgentSpace.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_GetAgentSpace.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_GetOperatorApp.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_GetOperatorApp.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_GetService.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_GetService.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_ListAgentSpaces.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_ListAgentSpaces.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_ListAssociations.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_ListAssociations.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_ListPrivateConnections.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_ListPrivateConnections.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/APIReference/API\_ListServices.html](https://docs.aws.amazon.com/devopsagent/latest/APIReference/API_ListServices.html)
-   [https://docs.aws.amazon.com/devopsagent/latest/userguide/about-aws-devops-agent-supported-regions.html](https://docs.aws.amazon.com/devopsagent/latest/userguide/about-aws-devops-agent-supported-regions.html)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (270)

| Step | Permissions | Roles | Endpoints |
| --- | --- | --- | --- |
| Build AccessAnalyzer Finding Principal Relationships | \- | \- | \- |
| Build ACM Certificate to Cognito User Pool Relationships | `cognito-idp:DescribeUserPoolDomain` | `cognito-idp:Describe*` | \- |
| Build AWS ApiGateway API to Domain Name Relationships | `apigateway:GET arn:aws:apigateway:*::/domainnames/*/apimappings` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Build AWS EC2 VPC Endpoint Service to LB Relationships | \- | \- | \- |
| Build AWS EC2 VPC Endpoint Service to VPC Endpoint Relationships | \- | \- | \- |
| Build Bedrock Action Group to Lambda Function Relationships | \- | \- | \- |
| Build Bedrock Agent Runtime to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Agent Runtime to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Agent Runtime to VPC Relationships | \- | \- | \- |
| Build Bedrock Agent to Foundation Model Relationships | \- | \- | \- |
| Build Bedrock Agent to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Agent to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Agent to KMS Key Relationships | \- | \- | \- |
| Build Bedrock API Key to IAM User Relationships | \- | \- | \- |
| Build Bedrock Browser to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Browser to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Browser to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Browser to VPC Relationships | \- | \- | \- |
| Build Bedrock Code Interpreter to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Code Interpreter to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Code Interpreter to VPC Relationships | \- | \- | \- |
| Build Bedrock Custom Model to Foundation Model Relationships | \- | \- | \- |
| Build Bedrock Custom Model to KMS Key Relationships | \- | \- | \- |
| Build Bedrock Custom Model to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Data Source to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Evaluation Job to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Flow to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Flow to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Flow to KMS Key Relationships | \- | \- | \- |
| Build Bedrock Gateway Target to API Key Credential Provider Relationships | \- | \- | \- |
| Build Bedrock Gateway to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Gateway to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Gateway to KMS Key Relationships | \- | \- | \- |
| Build Bedrock Guardrail to Agent Relationships | \- | \- | \- |
| Build Bedrock Guardrail to KMS Key Relationships | \- | \- | \- |
| Build Bedrock Imported Model to KMS Key Relationships | \- | \- | \- |
| Build Bedrock Imported Model to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Knowledge Base to Foundation Model Relationships | \- | \- | \- |
| Build Bedrock Knowledge Base to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Knowledge Base to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Knowledge Base to OpenSearch Domain Relationships | \- | \- | \- |
| Build Bedrock Logging to CloudWatch Log Group Relationships | \- | \- | \- |
| Build Bedrock Logging to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Memory to IAM Policy Relationships | \- | \- | \- |
| Build Bedrock Memory to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Memory to KMS Key Relationships | \- | \- | \- |
| Build Bedrock Model Customization Job to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Model Invocation Job to Custom Model Relationships | \- | \- | \- |
| Build Bedrock Model Invocation Job to Foundation Model Relationships | \- | \- | \- |
| Build Bedrock Model Invocation Job to IAM Role Relationships | \- | \- | \- |
| Build Bedrock Model Invocation Job to KMS Key Relationships | \- | \- | \- |
| Build Bedrock Model Invocation Job to S3 Bucket Relationships | \- | \- | \- |
| Build Bedrock Provisioned Throughput to Model Relationships | \- | \- | \- |
| Build Bedrock Service to VPC Endpoint Relationships | \- | \- | \- |
| Build CodeArtifact Domain KMS Key Relationships | \- | \- | \- |
| Build CodeArtifact Package Group Parent Relationships | \- | \- | \- |
| Build CodeArtifact VPC Endpoint Relationships | \- | \- | \- |
| Build CodeBuild Project Has VPC Relationship | \- | \- | \- |
| Build CodeDeploy Deployment Group IAM Relationships | \- | \- | \- |
| Build CodeGuru Reviewer Repository Association KMS Key Relationships | \- | \- | \- |
| Build DevOps Agent Agent Space to IAM Role Relationships | \- | \- | \- |
| Build DevOps Agent Agent Space to KMS Key Relationships | \- | \- | \- |
| Build DevOps Agent Agent Space to VPC Endpoint Relationships | \- | \- | \- |
| Build DevOps Agent Association to IAM Role Relationships | \- | \- | \- |
| Build DevOps Agent Association to Service Relationships | \- | \- | \- |
| Build DevOps Agent Private Connection to VPC Relationships | \- | \- | \- |
| Build DevOps Agent Service to IAM Role Relationships | \- | \- | \- |
| Build DevOps Agent Service to KMS Key Relationships | \- | \- | \- |
| Build DevOps Agent Service to Private Connection Relationships | \- | \- | \- |
| Build EC2 Instance uses IAM Instance Profile Relationships | `ec2:DescribeIamInstanceProfileAssociations` | `ec2:Describe*` | \- |
| Build EMR Cluster to IAM Relationships | \- | \- | \- |
| Build EMR Cluster to Security Configuration Relationships | \- | \- | \- |
| Build EMR Cluster to VPC Endpoint Relationships | \- | \- | \- |
| Build GuardDuty Publishing Destination to KMS Key Relationships | \- | \- | \- |
| Build GuardDuty Publishing Destination to S3 Bucket Relationships | \- | \- | \- |
| Build IAM Identity Center Group has User relationships | `identitystore:ListGroupMemberships` | `identitystore:List*` | \- |
| Build IAM Identity Center Permission Set relationships | `sso:ListAccountAssignments`, `sso:ListAccountAssignmentsForPrincipal`, `sso:ListAccountsForProvisionedPermissionSet`, `sso:GetInlinePolicyForPermissionSet`, `sso:ListManagedPoliciesInPermissionSet`, `sso:ListCustomerManagedPolicyReferencesInPermissionSet` | `sso:Get*`, `sso:List*` | \- |
| Build IAM Roles Anywhere Profile to IAM Policy Relationships | \- | \- | \- |
| Build IAM Roles Anywhere Profile to IAM Role Relationships | \- | \- | \- |
| Build IAM Roles Anywhere Trust Anchor to ACM PCA Relationships | \- | \- | \- |
| Build Inspector v2 to KMS Key Relationships | \- | \- | \- |
| Build Inspector v2 to Resource Relationships | `inspector2:ListCoverage` | `inspector2:List*` | \- |
| Build Inspector v2 to VPC Endpoint Relationships | \- | \- | \- |
| Build Kinesis Stream to Consumer Relationships | `kinesis:ListStreamConsumers` | `kinesis:List*` | \- |
| Build Launch Template Version to Ami Relationships | \- | \- | \- |
| Build Nova Act Workflow Definition to S3 Bucket Relationships | \- | \- | \- |
| Build Nova Act Workflow Run to CloudWatch Log Group Relationships | \- | \- | \- |
| Build Nova Act Workflow Run to Model Relationships | \- | \- | \- |
| Build OpenSearch Domain to CloudWatch Log Group Relationships | \- | \- | \- |
| Build Outposts Asset to EC2 Instance Relationships | `outposts:ListAssetInstances` | \- | \- |
| Build Quicksight Group to User Relationships | `quicksight:ListGroupMemberships` | `quicksight:List*` | \- |
| Build Quicksight User to Custom Permissions Relationships | \- | \- | \- |
| Build RDS DB Proxy connects RDS Cluster relationships | \- | \- | \- |
| Build RDS DB Proxy connects RDS DB Instance relationships | \- | \- | \- |
| Build Resource Explorer CloudTrail Relationships | \- | \- | \- |
| Build Resource Explorer VPC Endpoint Relationships | \- | \- | \- |
| Build Route53 Resolver Rules uses VPC relationships | `route53resolver:ListResolverRuleAssociations` | `route53resolver:List*` | \- |
| Build S3 Bucket Lifecycle Rules | `s3:GetLifecycleConfiguration` | `s3:Get*` | \- |
| Build SageMaker Domain Relationships | \- | \- | \- |
| Build SageMaker Endpoint Relationships | \- | \- | \- |
| Build SageMaker Feature Group Relationships | \- | \- | \- |
| Build SageMaker Inference Recommendations Job Relationships | \- | \- | \- |
| Build SageMaker Model Bias Job Definition Relationships | \- | \- | \- |
| Build SageMaker Model Quality Job Definition Relationships | \- | \- | \- |
| Build SageMaker Processing Job Relationships | \- | \- | \- |
| Build SageMaker Training Job Relationships | \- | \- | \- |
| Build SageMaker Transform Job Relationships | \- | \- | \- |
| Build Service Catalog Portfolio Product Relationships | `servicecatalog:ListPortfoliosForProduct` | \- | \- |
| Build Service Catalog Principal Relationships | `servicecatalog:ListPrincipalsForPortfolio` | \- | \- |
| Build Shared DB Cluster Snapshot to Account Relationships | `rds:DescribeDBClusterSnapshots` | `rds:Describe*` | \- |
| Build Shared DB Snapshot to Account Relationships | `rds:DescribeDBSnapshots` | `rds:Describe*` | \- |
| Build States to CloudWatch Log Group Relationships | \- | \- | \- |
| Build States to IAM Relationships | \- | \- | \- |
| Build VPC Endpoint to Service Relationships | \- | \- | \- |
| Build VPC has OpenSearch Domain Relationships | \- | \- | \- |
| Build WAF v2 Web ACL to Resource Relationships | `wafv2:ListResourcesForWebACL` | `wafv2:List*` | \- |
| Build WAF Web ACL to Cognito User Pool Relationships | `wafv2:ListResourcesForWebACL` | `wafv2:List*` | \- |
| Fetch AccessAnalyzer Findings | `access-analyzer:ListFindings` | `access-analyzer:List*` | \- |
| Fetch ApiGateway Api to Integration Relationship | `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources`, `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Fetch ApiGateway Resources | `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources`, `apigateway:GET arn:aws:apigateway:*::/restapis/*/resources/*` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Fetch ApiGateway Stages | `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages`, `apigateway:GET arn:aws:apigateway:*::/restapis/*/stages/*` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Fetch ApiGatewayV2 Authorizers | `apigateway:GET arn:aws:apigateway:*::/apis/*/authorizers` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Fetch ApiGatewayV2 Integrations | `apigateway:GET arn:aws:apigateway:*::/apis/*/integrations` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Fetch ApiGatewayV2 Routes | `apigateway:GET arn:aws:apigateway:*::/apis/*/routes` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Fetch ApiGatewayV2 Stages | `apigateway:GET arn:aws:apigateway:*::/apis/*/stages` | `apigateway:GET arn:aws:apigateway:*::/*` | \- |
| Fetch AppConfig Configuration Profiles | `appconfig:ListConfigurationProfiles`, `appconfig:GetConfigurationProfile` | `appconfig:List*`, `appconfig:Get*` | \- |
| Fetch AppConfig Deployments | `appconfig:ListDeployments`, `appconfig:GetDeployment`, `appconfig:ListTagsForResource` | `appconfig:List*`, `appconfig:Get*` | \- |
| Fetch AppConfig Environments | `appconfig:ListEnvironments` | `appconfig:List*` | \- |
| Fetch AppConfig Hosted Configuration Versions | `appconfig:ListHostedConfigurationVersions` | `appconfig:List*` | \- |
| Fetch Audit Manager Evidence Folders | `auditmanager:GetEvidenceFoldersByAssessmentControl` | `auditmanager:Get*` | \- |
| Fetch Autoscaling Launch Config to Image Relationships | `ec2:DescribeImages` | `ec2:Describe*` | \- |
| Fetch AWS EC2 Images | `ec2:DescribeImages`, `ec2:DescribeImageAttribute` | `ec2:Describe*` | \- |
| Fetch AWS EC2 Internet Gateways | `ec2:DescribeInternetGateways` | `ec2:Describe*` | \- |
| Fetch AWS EC2 Launch Template Versions | `ec2:DescribeLaunchTemplateVersions` | `ec2:Describe*` | \- |
| Fetch AWS EC2 NAT Gateways | `ec2:DescribeNatGateways` | `ec2:Describe*` | \- |
| Fetch AWS EC2 Security Group Rules | `ec2:DescribeSecurityGroupRules` | `ec2:Describe*` | \- |
| Fetch AWS EC2 Subnets | `ec2:DescribeSubnets` | `ec2:Describe*` | \- |
| Fetch AWS EC2 Volumes | `ec2:DescribeVolumes` | `ec2:Describe*` | \- |
| Fetch AWS EC2 VPC Endpoints | `ec2:DescribeVpcEndpoints` | `ec2:Describe*` | \- |
| Fetch AWS EC2 VPN Gateways | `ec2:DescribeVpnGateways`, `ec2:DescribeCustomerGateways` | `ec2:Describe*` | \- |
| Fetch AWS EMR Instances | `elasticmapreduce:ListInstances` | `elasticmapreduce:List*` | \- |
| Fetch AWS Organization | `organizations:DescribeOrganization`, `organizations:ListAccounts`, `organizations:ListTagsForResource` | `organizations:Describe*`, `organizations:List*` | \- |
| Fetch Backup Copy Jobs | `backup:ListCopyJobs` | `backup:List*` | \- |
| Fetch Backup Jobs | `backup:ListBackupJobs` | `backup:List*` | \- |
| Fetch Backup Recovery Points | `backup:ListRecoveryPointsByBackupVault`, `backup:ListTagsForResource` | `backup:List*` | \- |
| Fetch Backup Restore Jobs | `backup:ListRestoreJobs` | `backup:List*` | \- |
| Fetch Batch Jobs | `batch:ListJobs` | `batch:List*` | \- |
| Fetch Bedrock Agent Action Groups | `bedrock:ListAgentActionGroups`, `bedrock:GetAgentActionGroup` | `bedrock:Get*`, `bedrock:List*` | \- |
| Fetch Bedrock Gateway Targets | `bedrock-agentcore:ListGatewayTargets`, `bedrock-agentcore:GetGatewayTarget` | `bedrock-agentcore:Get*`, `bedrock-agentcore:List*` | \- |
| Fetch Bedrock Knowledge Base Data Sources | `bedrock:ListDataSources`, `bedrock:GetDataSource` | `bedrock:Get*`, `bedrock:List*` | \- |
| Fetch Cloudfront Key Groups | `cloudfront:ListKeyGroups` | `cloudfront:List*` | \- |
| Fetch Cloudhsm Backups | `cloudhsm:DescribeBackups` | `cloudhsm:Describe*` | \- |
| Fetch CloudMap Service Instances | `servicediscovery:ListInstances`, `servicediscovery:GetInstance` | `servicediscovery:Get*`, `servicediscovery:List*` | \- |
| Fetch CloudMap Services | `servicediscovery:ListServices`, `servicediscovery:ListTagsForResource` | `servicediscovery:Get*`, `servicediscovery:List*` | \- |
| Fetch Cloudtrail Event Selectors | `cloudtrail:DescribeTrails`, `cloudtrail:GetEventSelectors` | `cloudtrail:Describe*`, `cloudtrail:Get*` | \- |
| Fetch CloudWAN Attachments | `networkmanager:ListAttachments`, `networkmanager:ListAttachmentRoutingPolicyAssociations` | `networkmanager:List*` | \- |
| Fetch CloudWAN Connect Peers | `networkmanager:ListConnectPeers`, `networkmanager:GetConnectPeer` | `networkmanager:List*`, `networkmanager:Get*` | \- |
| Fetch CloudWAN Core Network Policies | `networkmanager:GetCoreNetworkPolicy` | `networkmanager:Get*` | \- |
| Fetch CloudWAN Core Network Policy Versions | `networkmanager:ListCoreNetworkPolicyVersions` | `networkmanager:List*` | \- |
| Fetch CloudWAN Core Network Routes | `networkmanager:ListCoreNetworkRoutingInformation` | `networkmanager:List*` | \- |
| Fetch CloudWatch Log Group Metrics | `cloudwatch:GetMetricData` | `cloudwatch:Get*` | \- |
| Fetch Cloudwatch Logs Metric Filters | `logs:DescribeMetricFilters` | `logs:Describe*` | \- |
| Fetch Cloudwatch Logs Subscription Filters | `logs:DescribeSubscriptionFilters` | `logs:Describe*` | \- |
| Fetch CodeArtifact Package Groups | `codeartifact:ListPackageGroups`, `codeartifact:ListTagsForResource` | `codeartifact:List*` | \- |
| Fetch CodeArtifact Packages | `codeartifact:ListPackages` | `codeartifact:List*` | \- |
| Fetch CodeArtifact Repositories | `codeartifact:ListRepositories`, `codeartifact:DescribeRepository`, `codeartifact:GetRepositoryPermissionsPolicy`, `codeartifact:GetRepositoryEndpoint`, `codeartifact:ListTagsForResource` | `codeartifact:List*`, `codeartifact:Describe*`, `codeartifact:Get*` | \- |
| Fetch CodeDeploy Deployment Groups | `codedeploy:ListDeploymentGroups`, `codedeploy:BatchGetDeploymentGroups`, `codedeploy:ListTagsForResource` | `codedeploy:BatchGet*`, `codedeploy:List*` | \- |
| Fetch Cognito IDP User Pool Clients | `cognito-idp:ListUserPoolClients`, `cognito-idp:DescribeUserPoolClient` | `cognito-idp:Describe*`, `cognito-idp:List*` | \- |
| Fetch Cognito IDP User Pool Users | `cognito-idp:ListUsers` | `cognito-idp:List*` | \- |
| Fetch DataSync Locations | `datasync:ListLocations`, `datasync:DescribeLocationS3`, `datasync:DescribeLocationEfs`, `datasync:DescribeLocationFsxWindows`, `datasync:DescribeLocationFsxLustre`, `datasync:DescribeLocationFsxOntap`, `datasync:DescribeLocationFsxOpenZfs`, `datasync:DescribeLocationNfs`, `datasync:DescribeLocationSmb`, `datasync:DescribeLocationObjectStorage`, `datasync:DescribeLocationHdfs`, `datasync:ListTagsForResource` | `datasync:Describe*`, `datasync:List*` | \- |
| Fetch DataSync Tasks | `datasync:ListTasks`, `datasync:DescribeTask`, `datasync:ListTagsForResource` | `datasync:Describe*`, `datasync:List*` | \- |
| Fetch Detective Investigations | `detective:ListInvestigations`, `detective:GetInvestigation` | `detective:Get*`, `detective:List*` | \- |
| Fetch DevOps Agent Associations | `aidevops:ListAssociations` | \- | `POST https://aidevops.{region}.api.aws/v1/agentspaces/{agentSpaceId}/associations/list` |
| Fetch DevOps Guru Anomalies | `devops-guru:ListAnomaliesForInsight` | `devops-guru:List*` | \- |
| Fetch DevOps Guru Notification Channels | `devops-guru:ListNotificationChannels` | `devops-guru:List*` | \- |
| Fetch EC2 Transit Gateway Attachments | `ec2:DescribeTransitGatewayAttachments` | `ec2:Describe*` | \- |
| Fetch EC2 Transit Gateway Route Tables | `ec2:DescribeTransitGatewayRouteTables` | `ec2:Describe*` | \- |
| Fetch EC2 Transit Gateway VPC Attachments | `ec2:DescribeTransitGatewayVpcAttachments` | `ec2:Describe*` | \- |
| Fetch ECR Image Findings | `ecr:DescribeImageScanFindings` | `ecr:Describe*` | \- |
| Fetch ECR Images | `ecr:DescribeImages` | `ecr:Describe*` | \- |
| Fetch ECS Cluster Services | `ecs:ListServices`, `ecs:DescribeServices` | `ecs:Describe*`, `ecs:List*` | \- |
| Fetch ECS Container Instances | `ecs:DescribeContainerInstances`, `ecs:ListContainerInstances` | `ecs:Describe*`, `ecs:List*` | \- |
| Fetch ECS Task Definitions | `ecs:DescribeTaskDefinition`, `ecs:ListTaskDefinitionFamilies` | `ecs:Describe*`, `ecs:List*` | \- |
| Fetch ECS Tasks | `ecs:DescribeTasks`, `ecs:ListTasks` | `ecs:Describe*`, `ecs:List*` | \- |
| Fetch EFS Mount Targets | `elasticfilesystem:DescribeMountTargetSecurityGroups`, `elasticfilesystem:DescribeMountTargets` | `elasticfilesystem:Describe*` | \- |
| Fetch EKS Node Groups | `eks:ListNodegroups`, `eks:DescribeNodegroup` | `eks:Describe*`, `eks:List*` | \- |
| Fetch Elasticache Clusters Subnet Groups | `elasticache:DescribeCacheSubnetGroups` | `elasticache:Describe*` | \- |
| Fetch Elasticache Snapshots | `elasticache:ListTagsForResource`, `elasticache:DescribeSnapshots` | `elasticache:Describe*`, `elasticache:List*` | \- |
| Fetch ELB Listener Rules | `elasticloadbalancing:DescribeTags`, `elasticloadbalancing:DescribeRules` | `elasticloadbalancing:Describe*` | \- |
| Fetch ELB Listeners | `elasticloadbalancing:DescribeTags`, `elasticloadbalancing:DescribeListeners` | `elasticloadbalancing:Describe*` | \- |
| Fetch ELB Target Groups | `elasticloadbalancing:DescribeTags`, `elasticloadbalancing:DescribeTargetGroups`, `elasticloadbalancing:DescribeTargetHealth` | `elasticloadbalancing:Describe*` | \- |
| Fetch Firewall Manager Resource Set Resources | `fms:ListResourceSetResources` | `fms:List*` | \- |
| Fetch Global Accelerator Custom Routing Endpoint Groups | `globalaccelerator:ListCustomRoutingEndpointGroups` | `globalaccelerator:List*` | \- |
| Fetch Global Accelerator Custom Routing Listeners | `globalaccelerator:ListCustomRoutingListeners` | `globalaccelerator:List*` | \- |
| Fetch Global Accelerator Endpoint Groups | `globalaccelerator:ListEndpointGroups` | `globalaccelerator:List*` | \- |
| Fetch Global Accelerator Listeners | `globalaccelerator:ListListeners` | `globalaccelerator:List*` | \- |
| Fetch Guardduty Findings | `guardduty:ListFindings`, `guardduty:GetFindings` | `guardduty:Get*`, `guardduty:List*` | \- |
| Fetch GuardDuty Publishing Destinations | `guardduty:ListPublishingDestinations`, `guardduty:DescribePublishingDestination` | `guardduty:List*`, `guardduty:Describe*` | \- |
| Fetch IAM Group Policies | `iam:ListGroupPolicies`, `iam:GetGroupPolicy` | `iam:Get*`, `iam:List*` | \- |
| Fetch IAM Group to User Relationships | `iam:GetGroup` | `iam:Get*` | \- |
| Fetch IAM Identity Center Applications | `sso:ListApplications` | `sso:List*` | \- |
| Fetch IAM Identity Center Groups | `identitystore:ListGroups` | `identitystore:List*` | \- |
| Fetch IAM Identity Center Permission Sets | `sso:ListPermissionSets`, `sso:DescribePermissionSet`, `sso:ListTagsForResource` | `sso:Describe*`, `sso:List*` | \- |
| Fetch IAM Identity Center Users | `identitystore:ListUsers` | `identitystore:List*` | \- |
| Fetch IAM Policies | `iam:ListPolicies`, `iam:GetPolicyVersion`, `iam:ListEntitiesForPolicy`, `tag:GetResources` | `iam:Get*`, `iam:List*`, `tag:Get*` | \- |
| Fetch IAM Role Policies | `iam:ListRolePolicies`, `iam:GetRolePolicy` | `iam:Get*`, `iam:List*` | \- |
| Fetch IAM Roles | `iam:ListInstanceProfiles`, `iam:GetRole`, `iam:ListRoles`, `iam:ListRoleTags` | `iam:Get*`, `iam:List*` | \- |
| Fetch IAM User Policies | `iam:ListUserPolicies`, `iam:GetUserPolicy` | `iam:Get*`, `iam:List*` | \- |
| Fetch IAM Users | `iam:GetUser`, `iam:ListUsers`, `iam:ListUserTags`, `iam:ListAccessKeys`, `iam:ListMFADevices`, `iam:GetAccessKeyLastUsed` | `iam:Get*`, `iam:List*` | \- |
| Fetch Inspector Findings | `inspector:DescribeFindings`, `inspector:DescribeRulesPackages`, `inspector:ListFindings` | `inspector:Describe*`, `inspector:List*` | \- |
| Fetch Inspector v2 CIS Findings | `inspector2:ListCisScanResultsAggregatedByTargetResource` | `inspector2:List*` | \- |
| Fetch Instance to Image Relationships | `ec2:DescribeImages` | `ec2:Describe*` | \- |
| Fetch Keyspaces Tables | `cassandra:Select`, `application-autoscaling:DescribeScalableTargets`, `application-autoscaling:DescribeScalingPolicies` | \- | \- |
| Fetch Lex V2 Bot Aliases | `lex:ListBotAliases`, `lex:DescribeResourcePolicy` | `lex:Describe*`, `lex:List*` | \- |
| Fetch Macie Automated Discovery Accounts | `macie2:ListAutomatedDiscoveryAccounts` | `macie2:List*` | \- |
| Fetch Marketplace Entitlements | `aws-marketplace:GetEntitlements` | `aws-marketplace:Get*` | \- |
| Fetch Neptune Analytics Graph Export Tasks | `neptune-graph:ListExportTasks` | `neptune-graph:List*` | \- |
| Fetch Neptune Analytics Graph Import Tasks | `neptune-graph:ListImportTasks`, `neptune-graph:GetImportTask` | `neptune-graph:Get*`, `neptune-graph:List*` | \- |
| Fetch Neptune Analytics Graph Snapshots | `neptune-graph:ListGraphSnapshots`, `neptune-graph:ListTagsForResource` | `neptune-graph:List*` | \- |
| Fetch Nova Act Models | `nova-act:ListModels` | \- | \- |
| Fetch Nova Act Workflow Definitions | `nova-act:ListWorkflowDefinitions`, `nova-act:GetWorkflowDefinition` | \- | \- |
| Fetch Nova Act Workflow Runs | `nova-act:ListWorkflowRuns`, `nova-act:GetWorkflowRun` | \- | \- |
| Fetch Organization Policy Targets | `organizations:ListTargetsForPolicy` | `organizations:List*` | \- |
| Fetch Organization Roots | `organizations:ListRoots` | `organizations:List*` | \- |
| Fetch Organizational Units | `organizations:DescribeOrganizationalUnit`, `organizations:ListChildren` | `organizations:Describe*`, `organizations:List*` | \- |
| Fetch Outposts Assets | `outposts:ListAssets`, `outposts:ListOrders`, `outposts:GetOrder`, `outposts:GetCatalogItem` | \- | \- |
| Fetch Outposts Outposts | `outposts:ListOutposts`, `outposts:GetOutpostInstanceTypes`, `outposts:GetOutpostSupportedInstanceTypes`, `outposts:GetPrivateConnectivityConfig` | \- | \- |
| Fetch Quicksight Dashboards | `quicksight:ListDashboards`, `quicksight:DescribeDashboard`, `quicksight:DescribeDashboardPermissions` | `quicksight:Describe*`, `quicksight:List*` | \- |
| Fetch Quicksight Data Sets | `quicksight:ListDataSets`, `quicksight:DescribeDataSet` | `quicksight:Describe*`, `quicksight:List*` | \- |
| Fetch Quicksight Data Sources | `quicksight:ListDataSources`, `quicksight:DescribeDataSource` | `quicksight:Describe*`, `quicksight:List*` | \- |
| Fetch RAM Resource Share Associations | `ram:GetResourceShareAssociations` | `ram:Get*` | \- |
| Fetch RAM Resource Share Invitations | `ram:GetResourceShareInvitations` | `ram:Get*` | \- |
| Fetch RAM Shared Resources | `ram:ListResources` | `ram:List*` | \- |
| Fetch RDS DB Proxy Target Groups | `rds:DescribeDBProxyTargetGroups` | `rds:Describe*` | \- |
| Fetch Restore Testing Plans | `backup:ListRestoreTestingPlans`, `backup:ListTags` | `backup:List*` | \- |
| Fetch Route53 Records | `route53:ListResourceRecordSets` | `route53:List*` | \- |
| Fetch S3 Access Points | `s3:ListAccessPoints` | `s3:List*` | \- |
| Fetch S3 Buckets | `cloudwatch:GetMetricData`, `s3:ListAllMyBuckets`, `s3:GetBucketLocation`, `s3:GetBucketPolicy`, `s3:GetBucketTagging`, `s3:GetBucketAcl`, `s3:GetBucketLogging`, `s3:GetBucketNotification`, `s3:GetBucketVersioning`, `s3:GetReplicationConfiguration`, `s3:GetBucketPublicAccessBlock`, `s3:GetBucketObjectLockConfiguration`, `s3:GetLifecycleConfiguration`, `s3:GetBucketOwnershipControls`, `s3:GetBucketPolicyStatus`, `s3:GetEncryptionConfiguration`, `s3:GetInventoryConfiguration` | `cloudwatch:Get*`, `s3:Get*`, `s3:List*` | \- |
| Fetch S3 Buckets Website Config | `s3:GetBucketWebsite` | `s3:Get*` | \- |
| Fetch Secret Versions | `secretsmanager:ListSecretVersionIds` | `secretsmanager:List*` | \- |
| Fetch Secrets | `secretsmanager:ListSecrets`, `secretsmanager:DescribeSecret`, `secretsmanager:GetResourcePolicy` | `secretsmanager:Describe*`, `secretsmanager:Get*`, `secretsmanager:List*` | \- |
| Fetch Security Agent Agent Spaces | `securityagent:ListAgentSpaces`, `securityagent:BatchGetAgentSpaces`, `securityagent:ListTagsForResource` | \- | \- |
| Fetch Security Agent Applications | `securityagent:ListApplications` | \- | \- |
| Fetch Security Agent Artifacts | `securityagent:ListArtifacts`, `securityagent:BatchGetArtifactMetadata` | \- | \- |
| Fetch Security Agent Private Connections | `securityagent:ListPrivateConnections` | \- | \- |
| Fetch Security Agent Target Domains | `securityagent:ListTargetDomains`, `securityagent:BatchGetTargetDomains` | \- | \- |
| Fetch Security Agent Threat Models | `securityagent:ListThreatModels`, `securityagent:BatchGetThreatModels` | \- | \- |
| Fetch Service Catalog Constraints | `servicecatalog:ListConstraintsForPortfolio`, `servicecatalog:DescribeConstraint` | \- | \- |
| Fetch Service Catalog Launch Paths | `servicecatalog:ListLaunchPaths` | \- | \- |
| Fetch Service Catalog Provisioning Artifacts | `servicecatalog:ListProvisioningArtifacts` | \- | \- |
| Fetch Service Catalog Tag Options | `servicecatalog:ListTagOptions`, `servicecatalog:ListResourcesForTagOption` | \- | \- |
| Fetch Signer Signing Jobs | `signer:ListSigningJobs` | `signer:List*` | \- |
| Fetch Signer Signing Profiles | `signer:ListSigningProfiles`, `signer:GetSigningProfile`, `signer:ListProfilePermissions` | `signer:List*`, `signer:Get*` | \- |
| Fetch SSM Instance Inventory Entries | `ssm:ListInventoryEntries` | `ssm:List*` | \- |
| Fetch SSM Instance Patch States | `ssm:DescribeInstancePatchStates` | `ssm:Describe*` | \- |
| Fetch SSM Service to EC2 Instance Relationships | `ssm:DescribeInstanceInformation` | `ssm:Describe*` | \- |
| Fetch Storage Gateway File Shares | `storagegateway:ListFileShares`, `storagegateway:DescribeNFSFileShares`, `storagegateway:DescribeSMBFileShares`, `storagegateway:ListTagsForResource` | `storagegateway:Describe*`, `storagegateway:List*` | \- |
| Fetch Storage Gateway Tapes | `storagegateway:ListTapes`, `storagegateway:DescribeTapeArchives`, `storagegateway:ListTagsForResource` | `storagegateway:Describe*`, `storagegateway:List*` | \- |
| Fetch Storage Gateway Volumes | `storagegateway:ListVolumes`, `storagegateway:DescribeCachediSCSIVolumes`, `storagegateway:DescribeStorediSCSIVolumes`, `storagegateway:ListTagsForResource` | `storagegateway:Describe*`, `storagegateway:List*` | \- |
| Fetch Transfer Servers details | \- | \- | \- |
| Fetch Transfer Users | `transfer:ListUsers`, `transfer:ListTagsForResource` | `transfer:List*` | \- |
| Fetch VPC Lattice Listeners | `vpc-lattice:ListListeners` | `vpc-lattice:List*` | \- |
| Fetch VPC Lattice Networks | `vpc-lattice:ListServiceNetworks` | `vpc-lattice:List*` | \- |
| Fetch VPC Lattice Service Network Service Associations | `vpc-lattice:ListServiceNetworkServiceAssociations` | `vpc-lattice:List*` | \- |
| Fetch VPC Lattice Service Network VPC Associations | `vpc-lattice:ListServiceNetworkVpcAssociations` | `vpc-lattice:List*` | \- |
| Fetch VPC Lattice Service Network VPC Endpoint Associations | `vpc-lattice:ListServiceNetworkVpcEndpointAssociations` | `vpc-lattice:List*` | \- |
| Fetch VPC Lattice Services | `vpc-lattice:ListServices` | `vpc-lattice:List*` | \- |
| Fetch VPC Lattice Target Groups | `vpc-lattice:ListTargetGroups` | `vpc-lattice:List*` | \- |
| Fetch VPC to VPC Relationships | `ec2:DescribeVpcPeeringConnections` | `ec2:Describe*` | \- |
| Fetch WAF v2 IP Sets | `wafv2:GetIPSet`, `wafv2:ListIPSets`, `wafv2:ListTagsForResource` | `wafv2:Get*`, `wafv2:List*` | \- |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| AccessAnalyzer Analyzer | `aws_accessanalyzer_analyzer` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment), [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| AccessAnalyzer Finding | `aws_accessanalyzer_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| ACM Certificate | `aws_acm_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Amazon Keyspaces Keyspace | `aws_keyspaces_keyspace` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Amazon Keyspaces Table | `aws_keyspaces_table` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Amazon Managed Grafana | `aws_grafana` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Amazon Managed Service for Prometheus | `aws_prometheus` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| ApiGateway Domain Name | `aws_api_gateway_domain_name` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| ApiGateway Resource | `aws_api_gateway_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| ApiGateway Resource Method | `aws_api_gateway_method` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| ApiGateway Rest Api | `aws_api_gateway_rest_api` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ApiGateway Stage | `aws_api_gateway_stage` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| ApiGateway Stage Method Setting | `aws_api_gateway_stage_method_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ApiGatewayV2 Api | `aws_api_gateway_v2_api` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ApiGatewayV2 Authorizer | `aws_api_gateway_v2_authorizer` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ApiGatewayV2 Integration | `aws_api_gateway_v2_integration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ApiGatewayV2 Route | `aws_api_gateway_v2_route` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| ApiGatewayV2 Stage | `aws_api_gateway_v2_stage` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Athena Work Group | `aws_athena_work_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Audit Manager Assessment | `aws_auditmanager_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Audit Manager Control | `aws_auditmanager_control` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Audit Manager Evidence Folder | `aws_auditmanager_evidence_folder` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| Audit Manager Framework | `aws_auditmanager_framework` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Autoscaling Group | `aws_autoscaling_group` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Autoscaling Launch Configuration | `aws_autoscaling_launch_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Autoscaling Policy | `aws_autoscaling_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AccessAnalyzer Service | `aws_accessanalyzer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Account | `aws_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AWS ACM Service | `aws_acm` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ApiGateway Service | `aws_apigateway` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS AppConfig | `aws_appconfig` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS AppConfig Account Settings | `aws_appconfig_account_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Application | `aws_appconfig_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS AppConfig Configuration Profile | `aws_appconfig_configuration_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Deployment | `aws_appconfig_deployment` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| AWS AppConfig Deployment Strategy | `aws_appconfig_deployment_strategy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Environment | `aws_appconfig_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS AppConfig Hosted Configuration Version | `aws_appconfig_hosted_configuration_version` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Athena Service | `aws_athena` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Audit Manager Delegation | `aws_auditmanager_delegation` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Audit Manager Service | `aws_auditmanager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Audit Manager Settings | `aws_auditmanager_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Auto Scaling Plans Service | `aws_autoscalingplans` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Autoscaling Service | `aws_autoscaling` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Backup Copy Job | `aws_backup_copy_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Backup Job | `aws_backup_job` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Backup Plan | `aws_backup_plan` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Backup Recovery Point | `aws_backup_recovery_point` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Backup Restore Job | `aws_backup_restore_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Backup Service | `aws_backup` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Backup Vault | `aws_backup_vault` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Batch Compute Environment | `aws_batch_compute_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Batch Job Definition | `aws_batch_job_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS Batch Job Queue | `aws_batch_job_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS Batch Service | `aws_batch` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Bedrock Agent | `aws_bedrock_agent` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS Bedrock Agent Action Group | `aws_bedrock_agent_action_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Agent Runtime | `aws_bedrock_agent_runtime` | [Workload](https://docs.jupiterone.io/data-model/schemas/Workload) |
| AWS Bedrock API Key | `aws_bedrock_api_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| AWS Bedrock API Key Credential Provider | `aws_bedrock_api_key_credential_provider` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Browser | `aws_bedrock_browser` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Bedrock Browser Profile | `aws_bedrock_browser_profile` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Bedrock Code Interpreter | `aws_bedrock_code_interpreter` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Bedrock Custom Model | `aws_bedrock_custom_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Bedrock Evaluation Job | `aws_bedrock_evaluation_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Bedrock Evaluator | `aws_bedrock_evaluator` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Flow | `aws_bedrock_flow` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Bedrock Foundation Model | `aws_bedrock_foundation_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Bedrock Gateway | `aws_bedrock_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Bedrock Gateway Target | `aws_bedrock_gateway_target` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Guardrail | `aws_bedrock_guardrail` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| AWS Bedrock Imported Model | `aws_bedrock_imported_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Bedrock Inference Profile | `aws_bedrock_inference_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Knowledge Base | `aws_bedrock_knowledge_base` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Bedrock Knowledge Base Data Source | `aws_bedrock_knowledge_base_data_source` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Memory | `aws_bedrock_memory` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Model Customization Job | `aws_bedrock_model_customization_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Bedrock Model Invocation Job | `aws_bedrock_model_invocation_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Bedrock Model Invocation Logging | `aws_bedrock_model_invocation_logging` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Bedrock Policy Engine | `aws_bedrock_policy_engine` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| AWS Bedrock Provisioned Throughput | `aws_bedrock_provisioned_throughput` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Bedrock Service | `aws_bedrock` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloud WAN Attachment | `aws_networkmanager_attachment` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Cloud WAN Connect Peer | `aws_networkmanager_connect_peer` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloud WAN Core Network | `aws_networkmanager_core_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Cloud WAN Core Network Policy | `aws_networkmanager_core_network_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloud WAN Core Network Policy Version | `aws_networkmanager_core_network_policy_version` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloud WAN Core Network Route | `aws_networkmanager_core_network_route` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS Cloudformation Service | `aws_cloudformation` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloudformation Stacks | `aws_cloudformation_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloudfront Distribution | `aws_cloudfront_distribution` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Cloudfront Distribution Origin | `aws_cloudfront_distribution_origin` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloudfront Key Group | `aws_cloudfront_key_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Cloudfront Public Key | `aws_cloudfront_public_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| AWS Cloudfront Service | `aws_cloudfront` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloudhsm Service | `aws_cloudhsm` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudMap Namespace | `aws_cloudmap_namespace` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS CloudMap Service | `aws_cloudmap` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudMap Service | `aws_cloudmap_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudMap Service Instance | `aws_cloudmap_service_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Cloudtrail Service | `aws_cloudtrail` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudTrail Trail | `aws_cloudtrail_trail` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Cloudwatch Alarms | `aws_cloudwatch_metric_alarm` | Monitor |
| AWS Cloudwatch Event | `aws_cloudwatch_events` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CloudWatch Log Group Metrics | `aws_cloudwatch_log_group_metrics` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS Cloudwatch Logs Service | `aws_cloudwatch_logs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cloudwatch Service | `aws_cloudwatch` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeArtifact Service | `aws_codeartifact` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeBuild Service | `aws_codebuild` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeCommit Service | `aws_codecommit` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeDeploy Service | `aws_codedeploy` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodeGuru Service | `aws_codeguru` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS CodePipeline Service | `aws_codepipeline` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito Identity | `aws_cognito_identity` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito Identity Pool | `aws_cognito_identity_pool` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito IDP Service | `aws_cognito_idp` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Cognito IDP User Pool Client | `aws_cognito_user_pool_client` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Cognito IDP User Pool User | `aws_cognito_user_pool_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS Config Rule Finding | `aws_config_rule_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| AWS Customer Gateway | `aws_customer_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Database Migration Service | `aws_dms` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Database Migration Service Endpoint | `aws_dms_endpoint` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| AWS Database Migration Service Instance | `aws_dms_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS DataSync Location | `aws_datasync_location` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS DataSync Service | `aws_datasync` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS DataSync Task | `aws_datasync_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Dedicated Host | `aws_dedicated_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Detective Service | `aws_detective` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS DevOps Agent Agent Space | `aws_devopsagent_agent_space` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS DevOps Agent Association | `aws_devopsagent_association` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS DevOps Agent Private Connection | `aws_devopsagent_private_connection` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS DevOps Agent Service | `aws_devopsagent_service` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS DevOps Guru Service | `aws_devops_guru` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Direct Connect BGP Peer | `aws_directconnect_bgp_peer` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Direct Connect Connection | `aws_directconnect_connection` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Direct Connect Gateway | `aws_directconnect_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Direct Connect LAG | `aws_directconnect_lag` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Direct Connect Service | `aws_directconnect` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Direct Connect Virtual Interface | `aws_directconnect_virtual_interface` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Directory Service | `aws_ds` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Directory Service Directory | `aws_ds_directory` | [Directory](https://docs.jupiterone.io/data-model/schemas/Directory) |
| AWS DynamoDB Service | `aws_dynamodb` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EC2 Image Builder | `aws_imagebuilder` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EC2 Security Group Rule | `aws_ec2_security_group_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS EC2 Service | `aws_ec2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EC2 Settings | `aws_ec2_settings` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EC2 Transit Gateway | `aws_ec2_transit_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS EC2 Transit Gateway Attachment | `aws_ec2_transit_gateway_attachment` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS EC2 Transit Gateway Route Table | `aws_ec2_transit_gateway_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EC2 Transit Gateway VPC Attachment | `aws_ec2_transit_gateway_vpc_attachment` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS ECR Service | `aws_ecr` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ECS Service | `aws_ecs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EFS Service | `aws_efs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EIP Address | `aws_eip` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| AWS EKS Service | `aws_eks` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ElastiCache Service | `aws_elasticache` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Elasticsearch Service | `aws_es` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ELB Service | `aws_elasticloadbalancing` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EMR Cluster | `aws_elasticmapreduce_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS EMR Security Configuration | `aws_emr_security_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EMR Serverless | `aws_emr_serverless` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS EMR Serverless Application | `aws_emr_serverless_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS EMR Service | `aws_elasticmapreduce` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Firehose Delivery Stream | `aws_firehose_delivery_stream` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection), [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS Firehose Service | `aws_firehose` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Firewall Manager | `aws_fms` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS FSx | `aws_fsx` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Glacier Service | `aws_glacier` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Global Accelerator Accelerator | `aws_global_accelerator_accelerator` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Global Accelerator Endpoint Group | `aws_global_accelerator_endpoint_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Global Accelerator Listener | `aws_global_accelerator_listener` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Global Accelerator Service | `aws_global_accelerator` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Glue Catalog Database | `aws_glue_catalog_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| AWS Glue Connection | `aws_glue_connection` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Glue Data Catalog Encryption Settings | `aws_glue_data_catalog_encryption_settings` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| AWS Glue Dev Endpoint | `aws_glue_dev_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS Glue Job | `aws_glue_job` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Glue Security Configurations | `aws_glue_security_configuration` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| AWS Glue Service | `aws_glue` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Glue Session | `aws_glue_session` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Grafana Workspace | `aws_grafana_workspace` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Guardduty Service | `aws_guardduty` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Health Event | `aws_health_event` | Event |
| AWS Health Service | `aws_health` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS IAM Identity Center | `aws_sso` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS IAM Identity Center Application | `aws_sso_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS IAM Identity Center Group | `aws_sso_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| AWS IAM Identity Center Instance | `aws_sso_instance` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS IAM Identity Center Permission Set | `aws_sso_permission_set` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS IAM Identity Center User | `aws_sso_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS IAM Roles Anywhere Profile | `aws_iam_roles_anywhere_profile` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS IAM Roles Anywhere Service | `aws_iam_roles_anywhere` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS IAM Roles Anywhere Trust Anchor | `aws_iam_roles_anywhere_trust_anchor` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| AWS IAM Service | `aws_iam` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Image | `aws_ami` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource), [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| AWS Image Builder Component | `aws_imagebuilder_component` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| AWS Image Builder Container Recipe | `aws_imagebuilder_container_recipe` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Distribution Configuration | `aws_imagebuilder_distribution_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Image | `aws_imagebuilder_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| AWS Image Builder Image Pipeline | `aws_imagebuilder_image_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Image Builder Infrastructure Configuration | `aws_imagebuilder_infrastructure_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Lifecycle Policy | `aws_imagebuilder_lifecycle_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Image Builder Workflow | `aws_imagebuilder_workflow` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Inspector Assessment | `aws_inspector_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| AWS Inspector Service | `aws_inspector` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Inspector v2 Service | `aws_inspectorv2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Instance | `aws_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Instance Application | `aws_instance_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Internet Gateway | `aws_internet_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Key Pair | `aws_key_pair` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| AWS Keyspaces Service | `aws_keyspaces` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Kinesis Consumer | `aws_kinesis_consumer` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Kinesis Service | `aws_kinesis` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Kinesis Stream | `aws_kinesis_stream` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection), [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| AWS KMS Key | `aws_kms_key` | [CryptoKey](https://docs.jupiterone.io/data-model/schemas/CryptoKey), [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| AWS KMS Service | `aws_kms` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Lambda Service | `aws_lambda` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Launch Template | `aws_launch_template` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Launch Template Version | `aws_launch_template_version` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| AWS Lex V2 Bot | `aws_lexv2_bot` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Lex V2 Bot Alias | `aws_lexv2_bot_alias` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Lex V2 Service | `aws_lexv2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS License Manager License | `aws_license_manager_license` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS License Manager Received License | `aws_license_manager_received_license` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS License Manager Service | `aws_license_manager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Macie Admin Account | `aws_macie_admin_account` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Macie Automated Discovery Account | `aws_macie_automated_discovery_account` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Macie Automated Discovery Configuration | `aws_macie_automated_discovery_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Macie Classification Export Configuration | `aws_macie_classification_export_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Macie Classification Job | `aws_macie_classification_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Macie Finding | `aws_macie_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| AWS Macie Finding Publication Configuration | `aws_macie_finding_publication_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Macie Organization Configuration | `aws_macie_organization_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Macie Service | `aws_macie` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Marketplace Entitlement | `aws_marketplace_entitlement` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS Marketplace Entity | `aws_marketplace_entity` | [Product](https://docs.jupiterone.io/data-model/schemas/Product) |
| AWS Marketplace Service | `aws_marketplace` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS MQ | `aws_mq` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS MQ Broker | `aws_mq_broker` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS MSK | `aws_msk` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS MSK Cluster | `aws_msk_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS MWAA Environment | `aws_mwaa_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS NAT Gateway | `aws_nat_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Neptune Service | `aws_neptune` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Network ACL | `aws_network_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Network Firewall Service | `aws_networkfirewall` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Network Interface | `aws_eni` | [NetworkInterface](https://docs.jupiterone.io/data-model/schemas/NetworkInterface) |
| AWS Network Manager | `aws_networkmanager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Nova Act Model | `aws_nova_act_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS Nova Act Service | `aws_nova_act` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Nova Act Workflow Definition | `aws_nova_act_workflow_definition` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| AWS Nova Act Workflow Run | `aws_nova_act_workflow_run` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS OpenSearch Domain | `aws_opensearch_domain` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS OpenSearch Service | `aws_opensearch` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Organization | `aws_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| AWS Organization Root | `aws_organization_root` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Organizational Unit | `aws_organizational_unit` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS Outpost | `aws_outposts_outpost` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS Outposts Asset | `aws_outposts_asset` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS Outposts Service | `aws_outposts` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Outposts Site | `aws_outposts_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| AWS Prefix List | `aws_prefix_list` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Private Certificate Authority Service | `aws_acm_pca` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Prometheus Scraper | `aws_prometheus_scraper` | [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| AWS Prometheus Workspace | `aws_prometheus_workspace` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Quicksight Service | `aws_quicksight` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS RAM Principal | `aws_ram_principal` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AWS RAM Resource Share | `aws_ram_resource_share` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS RAM Resource Share Invitation | `aws_ram_resource_share_invitation` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| AWS RAM Shared Resource | `aws_ram_shared_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS RDS Service | `aws_rds` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Redshift Serverless Service | `aws_redshift_serverless` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Redshift Service | `aws_redshift` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Resource Access Manager Service | `aws_ram_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Resource Explorer Service | `aws_resource_explorer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Restore Testing Plan | `aws_backup_restore_testing_plan` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Route Table | `aws_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Route53 Domain | `aws_route53_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| AWS Route53 Hosted Zone | `aws_route53_zone` | [DomainZone](https://docs.jupiterone.io/data-model/schemas/DomainZone) |
| AWS Route53 record | `aws_route53_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| AWS Route53 Resolver Rule | `aws_route53_resolver_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS Route53 Service | `aws_route53` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS S3 Access Point | `aws_s3_access_point` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS S3 Bucket | `aws_s3_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS S3 Bucket Lifecycle Rule | `aws_s3_bucket_lifecycle_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS S3 Bucket Policy | `aws_s3_bucket_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS S3 Service | `aws_s3` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS S3 Website Configuration | `aws_s3_website_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SageMaker | `aws_sagemaker` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SageMaker Domain | `aws_sagemaker_domain` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS SageMaker Endpoint | `aws_sagemaker_endpoint` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS SageMaker Feature Group | `aws_sagemaker_feature_group` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS SageMaker Inference Recommendations Job | `aws_sagemaker_inference_recommendations_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS SageMaker Model | `aws_sagemaker_model` | [Model](https://docs.jupiterone.io/data-model/schemas/Model) |
| AWS SageMaker Model Bias Job Definition | `aws_sagemaker_model_bias_job_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SageMaker Model Quality Job Definition | `aws_sagemaker_model_quality_job_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SageMaker Notebook Instance | `aws_sagemaker_notebook_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS SageMaker Pipeline Execution | `aws_sagemaker_pipeline_execution` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS SageMaker Processing Job | `aws_sagemaker_processing_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS SageMaker Training Job | `aws_sagemaker_training_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS SageMaker Transform Job | `aws_sagemaker_transform_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Secrets Manager Service | `aws_secretsmanager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Security Agent Agent Space | `aws_security_agent_agent_space` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Security Agent Application | `aws_security_agent_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AWS Security Agent Artifact | `aws_security_agent_artifact` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| AWS Security Agent Private Connection | `aws_security_agent_private_connection` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Security Agent Service | `aws_securityagent` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Security Agent Target Domain | `aws_security_agent_target_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| AWS Security Agent Threat Model | `aws_security_agent_threat_model` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| AWS Security Group | `aws_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Security Hub | `aws_securityhub` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Security Hub Control | `aws_securityhub_control` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| AWS Security Hub Standard | `aws_securityhub_standard` | [Standard](https://docs.jupiterone.io/data-model/schemas/Standard) |
| AWS Service Catalog | `aws_servicecatalog` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Service Catalog Constraint | `aws_servicecatalog_constraint` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| AWS Service Catalog Launch Path | `aws_servicecatalog_launch_path` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Portfolio | `aws_servicecatalog_portfolio` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Product | `aws_servicecatalog_product` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Provisioning Artifact | `aws_servicecatalog_provisioning_artifact` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Service Catalog Tag Option | `aws_servicecatalog_tag_option` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SES Configuration Set | `aws_ses_configuration_set` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SES Identity | `aws_ses_identity` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS SES Receipt Filter | `aws_ses_receipt_filter` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS SES Service | `aws_ses` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Shield Protection | `aws_shield_protection` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Shield Protection Group | `aws_shield_protection_group` | ResourceGroup |
| AWS Shield Service | `aws_shield` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Shield Subscription | `aws_shield_subscription` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS Signer Service | `aws_signer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Signer Signing Job | `aws_signer_signing_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS Signer Signing Profile | `aws_signer_signing_profile` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| AWS Snapshot | `aws_ebs_snapshot` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS SNS Service | `aws_sns` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SNS Subscription | `aws_sns_subscription` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| AWS SNS Topic | `aws_sns_topic` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| AWS SQS Service | `aws_sqs` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SSM Associations | `aws_ssm_associations` | [Document](https://docs.jupiterone.io/data-model/schemas/Document) |
| AWS SSM Compliance Summary | `aws_ssm_compliance_summary` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| AWS SSM Document | `aws_ssm_document` | [Document](https://docs.jupiterone.io/data-model/schemas/Document) |
| AWS SSM Instance Inventory | `aws_instance_inventory` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SSM Instance Patch State | `aws_instance_patch_state` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| AWS SSM Patch Baseline | `aws_patch_baseline` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SSM Patch Group | `aws_patch_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS SSM Secure String Parameter Metadata | `aws_secure_string_parameter` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| AWS SSM Service | `aws_ssm` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS SSM Service Setting | `aws_ssm_service_setting` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS SSM Session Document | `aws_session_document` | [Document](https://docs.jupiterone.io/data-model/schemas/Document) |
| AWS States Service | `aws_states` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS States State Machine | `aws_states_state_machine` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS Storage Gateway | `aws_storage_gateway_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Storage Gateway File Share | `aws_storage_gateway_file_share` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Storage Gateway Service | `aws_storage_gateway` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Storage Gateway Tape | `aws_storage_gateway_tape` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| AWS Storage Gateway Tape Pool | `aws_storage_gateway_tape_pool` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS Storage Gateway Volume | `aws_storage_gateway_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| AWS Subnet | `aws_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS Transfer Server | `aws_transfer_server` | [Host](https://docs.jupiterone.io/data-model/schemas/Host), [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Transfer Service | `aws_transfer` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS Transfer User | `aws_transfer_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS Volume | `aws_ebs_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| AWS VPC | `aws_vpc` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC Endpoint | `aws_vpc_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS VPC Endpoint Service | `aws_vpc_endpoint_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS VPC Lattice | `aws_vpc_lattice` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS VPC Lattice Listener | `aws_vpc_lattice_listener` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| AWS VPC Lattice Listener Rule | `aws_vpc_lattice_listener_rule` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS VPC Lattice Service | `aws_vpc_lattice_service` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| AWS VPC Lattice Service Network | `aws_vpc_lattice_service_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC Lattice Target Group | `aws_vpc_lattice_target_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS VPC Service | `aws_ec2_vpc` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS VPN Connection | `aws_vpn_connection` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS VPN Gateway | `aws_vpn_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS WAF Classic Service | `aws_waf` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS WAF v2 IP Set | `aws_waf_v2_ip_set` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS WAF v2 Rule Group | `aws_waf_v2_rule_group` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| AWS WAF v2 Service | `aws_wafv2` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS WAF v2 Web ACL | `aws_waf_v2_web_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS WAF v2 Web ACL Firewall Manager Rule Group | `aws_waf_v2_web_acl_firewall_manager_rule_group` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS WAF v2 Web ACL Rule | `aws_waf_v2_web_acl_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| AWS WAF Web ACL | `aws_waf_web_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS WorkSpaces Bundle | `aws_workspaces_bundle` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS WorkSpaces Service | `aws_workspaces` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS WorkSpaces Workspace | `aws_workspace` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS X-Ray Service | `aws_xray` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Batch Job | `aws_batch_job` | [Process](https://docs.jupiterone.io/data-model/schemas/Process), [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Cloudhsm Backup | `aws_cloudhsm_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup), [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| Cloudhsm Cluster | `aws_cloudhsm_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster), [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| Cloudhsm Instance | `aws_cloudhsm_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host), [Vault](https://docs.jupiterone.io/data-model/schemas/Vault) |
| Cloudwatch Events Rule | `aws_cloudwatch_event_rule` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Cloudwatch Logs Destination | `aws_cloudwatch_log_destination` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| Cloudwatch Logs Log Group | `aws_cloudwatch_log_group` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| CloudWatch Logs Metric Filter | `aws_cloudwatch_log_metric_filter` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Cloudwatch Logs Subscription Filter | `aws_cloudwatch_log_subscription_filter` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| CodeArtifact Domain | `aws_codeartifact_domain` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| CodeArtifact Package | `aws_codeartifact_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| CodeArtifact Package Group | `aws_codeartifact_package_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| CodeArtifact Repository | `aws_codeartifact_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| CodeBuild Project | `aws_codebuild_project` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeBuild Report Group | `aws_codebuild_report_group` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| CodeCommit Repository | `aws_codecommit_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| CodeDeploy Application | `aws_codedeploy_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| CodeDeploy Deployment Config | `aws_codedeploy_deployment_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeDeploy Deployment Group | `aws_codedeploy_deployment_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeGuru Profiling Group | `aws_codeguru_profiling_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodeGuru Reviewer Repository Association | `aws_codeguru_reviewer_repository_association` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CodePipeline Pipeline | `aws_codepipeline_pipeline` | [Workflow](https://docs.jupiterone.io/data-model/schemas/Workflow) |
| Cognito User Pool | `aws_cognito_user_pool` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Configservice Rule | `aws_config_rule` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Configservice Service | `aws_config` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Detective Graph | `aws_detective_graph` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Detective Investigation | `aws_detective_investigation` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DevOps Guru Anomaly | `aws_devops_guru_anomaly` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DevOps Guru Insight | `aws_devops_guru_insight` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DevOps Guru Notification Channel | `aws_devops_guru_notification_channel` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| DynamoDB Accelerator (DAX) Cluster | `aws_dax_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| DynamoDB Accelerator (DAX) Service | `aws_dax` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| DynamoDB Global Table | `aws_dynamodb_global_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| DynamoDB Table | `aws_dynamodb_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| ECR Image | `aws_ecr_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| ECR Image Finding | `aws_ecr_image_scan_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| ECR Repository | `aws_ecr_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| ECS Cluster | `aws_ecs_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| ECS Cluster Service | `aws_ecs_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| ECS Container Instance | `aws_ecs_container_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host), [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| ECS Task | `aws_ecs_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task), [Process](https://docs.jupiterone.io/data-model/schemas/Process) |
| ECS Task Container Definition | `aws_ecs_task_container_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ECS Task Definition | `aws_ecs_task_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| EFS File System | `aws_efs_file_system` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| EFS Mount Target | `aws_efs_mount_target` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| EKS Clusters | `aws_eks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| EKS Node Group | `aws_eks_node_group` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Elasticache Cluster | `aws_elasticache_memcached_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Elasticache Node | `aws_elasticache_cluster_node` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Elasticache Redis Cluster | `aws_elasticache_redis_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Elasticache Snapshot | `aws_elasticache_snapshot` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Elasticsearch Domain | `aws_elasticsearch_domain` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| ELB Application Load Balancer | `aws_alb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ELB Gateway Load Balancer | `aws_elb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ELB Listener | `aws_lb_listener` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| ELB Listener Rule | `aws_lb_listener_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| ELB Network Load Balancer | `aws_nlb` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| ELB Target Group | `aws_lb_target_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| EventBridge API Destination | `aws_eventbridge_api_destination` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| EventBridge Archive | `aws_eventbridge_archive` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| EventBridge Connection | `aws_eventbridge_connection` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| EventBridge Event Bus | `aws_eventbridge_event_bus` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| EventBridge Global Endpoint | `aws_eventbridge_endpoint` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Firewall | `aws_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Firewall Policy | `aws_firewall_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Firewall Rule Group | `aws_firewall_rule_group` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| FMS Application List | `aws_fms_application_list` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| FMS Policy | `aws_fms_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| FMS Protocols List | `aws_fms_protocols_list` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| FMS Resource Set | `aws_fms_resource_set` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| FSx File System | `aws_fsx_file_system` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Glacier Vault | `aws_glacier_vault` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Guardduty Detector | `aws_guardduty_detector` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment), [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| Guardduty Finding | `aws_guardduty_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| GuardDuty Publishing Destination | `aws_guardduty_publishing_destination` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| IAM Access Key | `aws_iam_access_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM Account Password Policy | `aws_iam_account_password_policy` | [PasswordPolicy](https://docs.jupiterone.io/data-model/schemas/PasswordPolicy) |
| IAM Group | `aws_iam_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| IAM Group Policy | `aws_iam_group_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| IAM Instance Profile | `aws_iam_instance_profile` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM MFA Device | `mfa_device` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| IAM OIDC Provider | `aws_iam_oidc_provider` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| IAM Policy | `aws_iam_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| IAM Role | `aws_iam_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM Role Policy | `aws_iam_role_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| IAM SAML Provider | `aws_iam_saml_provider` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| IAM Server Certificate | `aws_iam_server_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| IAM User | `aws_iam_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| IAM User Policy | `aws_iam_user_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Inspector Finding | `aws_inspector_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Inspector Finding | `aws_inspector_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Inspector v2 CIS Finding | `aws_inspectorv2_cis_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Inspector v2 CIS Scan | `aws_inspectorv2_cis_scan` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Inspector v2 Configuration | `aws_inspectorv2_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Inspector v2 Filter | `aws_inspectorv2_filter` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Inspector v2 Finding | `aws_inspectorv2_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Inspector v2 Finding | `aws_inspectorv2_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Lambda Functions | `aws_lambda_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| Managed Workflows for Apache Airflow | `aws_mwaa` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Neptune Analytics Graph | `aws_neptune_analytics_graph` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Neptune Analytics Graph Export Task | `aws_neptune_analytics_graph_export_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Neptune Analytics Graph Import Task | `aws_neptune_analytics_graph_import_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Neptune Analytics Graph Snapshot | `aws_neptune_analytics_graph_snapshot` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Neptune Database Cluster | `aws_neptune_database_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Neptune Database Instance | `aws_neptune_database_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Organization Policy | `aws_organization_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Organization Tag Policy | `aws_organization_tag_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Private Certificate Authority | `aws_acm_pca_certificate_authority` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Quicksight Custom Permissions | `aws_quicksight_custom_permissions` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Quicksight Dashboard | `aws_quicksight_dashboard` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Quicksight Data Set | `aws_quicksight_data_set` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Quicksight Data Source | `aws_quicksight_data_source` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Quicksight Group | `aws_quicksight_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Quicksight User | `aws_quicksight_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Quicksight VPC Connection | `aws_quicksight_vpc_connection` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS Cluster | `aws_rds_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| RDS DB Cluster Parameter Group | `aws_rds_cluster_parameter_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Cluster Snapshots | `aws_db_cluster_snapshot` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| RDS DB Instance | `aws_db_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| RDS DB Option Group | `aws_db_option_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Parameter Group | `aws_db_parameter_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Proxy | `aws_db_proxy` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| RDS DB Proxy Target | `aws_db_proxy_target` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Proxy Target Group | `aws_db_proxy_target_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| RDS DB Snapshots | `aws_db_snapshot` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Image](https://docs.jupiterone.io/data-model/schemas/Image), [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| RDS DB Subnet Group | `aws_db_subnet_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Redshift Cluster | `aws_redshift_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Redshift Cluster Parameter Group | `aws_redshift_cluster_parameter_group` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Redshift Datashare | `aws_redshift_datashare` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Redshift Datashare Authorization | `aws_redshift_datashare_authorization` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Redshift Serverless Endpoint Access | `aws_redshift_serverless_endpoint_access` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| Redshift Serverless Namespace | `aws_redshift_serverless_namespace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Redshift Serverless Recovery Point | `aws_redshift_serverless_recovery_point` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Redshift Serverless Snapshot | `aws_redshift_serverless_snapshot` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| Redshift Serverless Usage Limit | `aws_redshift_serverless_usage_limit` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Redshift Serverless Workgroup | `aws_redshift_serverless_workgroup` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Resource Explorer Index | `aws_resource_explorer_index` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Resource Explorer View | `aws_resource_explorer_view` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Secret | `aws_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Secret Version | `aws_secret_version` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Security Hub Account | `aws_securityhub_account` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Security Hub Finding | `aws_securityhub_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Security Hub Finding | `aws_securityhub_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| SQS Queue | `aws_sqs_queue` | [Queue](https://docs.jupiterone.io/data-model/schemas/Queue) |
| X-Ray Encryption Config | `aws_xray_encryption_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| X-Ray Group | `aws_xray_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| X-Ray Resource Policy | `aws_xray_resource_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `aws_accessanalyzer` | **HAS** | `aws_accessanalyzer_analyzer` |
| `aws_accessanalyzer_analyzer` | **IDENTIFIED** | `aws_accessanalyzer_finding` |
| `aws_accessanalyzer_finding` | **IDENTIFIED** | `aws_resource` |
| `aws_account` | **HAS** | `aws_accessanalyzer` |
| `aws_account` | **HAS** | `aws_acm` |
| `aws_account` | **HAS** | `aws_acm_pca` |
| `aws_account` | **HAS** | `aws_autoscalingplans` |
| `aws_account` | **HAS** | `aws_ec2_vpc` |
| `aws_account` | **HAS** | `aws_apigateway` |
| `aws_account` | **HAS** | `aws_appconfig` |
| `aws_account` | **HAS** | `aws_athena` |
| `aws_account` | **HAS** | `aws_auditmanager` |
| `aws_account` | **HAS** | `aws_autoscaling` |
| `aws_account` | **HAS** | `aws_backup` |
| `aws_account` | **HAS** | `aws_batch` |
| `aws_account` | **HAS** | `aws_bedrock` |
| `aws_account` | **HAS** | `aws_cloudformation` |
| `aws_account` | **HAS** | `aws_cloudfront` |
| `aws_account` | **HAS** | `aws_cloudhsm` |
| `aws_account` | **HAS** | `aws_cloudtrail` |
| `aws_account` | **HAS** | `aws_cloudmap` |
| `aws_account` | **HAS** | `aws_cloudwatch_events` |
| `aws_account` | **HAS** | `aws_cloudwatch_logs` |
| `aws_account` | **HAS** | `aws_cloudwatch` |
| `aws_account` | **HAS** | `aws_cognito_idp` |
| `aws_account` | **HAS** | `aws_cognito_identity` |
| `aws_account` | **HAS** | `aws_codeartifact` |
| `aws_account` | **HAS** | `aws_codebuild` |
| `aws_account` | **HAS** | `aws_codedeploy` |
| `aws_account` | **HAS** | `aws_codeguru` |
| `aws_account` | **HAS** | `aws_codecommit` |
| `aws_account` | **HAS** | `aws_codepipeline` |
| `aws_account` | **HAS** | `aws_config` |
| `aws_account` | **HAS** | `aws_datasync` |
| `aws_account` | **HAS** | `aws_detective` |
| `aws_account` | **HAS** | `aws_devops_guru` |
| `aws_account` | **HAS** | `aws_directconnect` |
| `aws_account` | **HAS** | `aws_dms` |
| `aws_account` | **HAS** | `aws_ds` |
| `aws_account` | **HAS** | `aws_dynamodb` |
| `aws_account` | **HAS** | `aws_dax` |
| `aws_account` | **HAS** | `aws_keyspaces` |
| `aws_account` | **HAS** | `aws_securityagent` |
| `aws_account` | **HAS** | `aws_ec2` |
| `aws_account` | **HAS** | `aws_ecr` |
| `aws_account` | **HAS** | `aws_ecs` |
| `aws_account` | **HAS** | `aws_efs` |
| `aws_account` | **HAS** | `aws_eks` |
| `aws_account` | **HAS** | `aws_elasticache` |
| `aws_account` | **HAS** | `aws_elasticloadbalancing` |
| `aws_account` | **HAS** | `aws_elasticmapreduce` |
| `aws_account` | **HAS** | `aws_emr_serverless` |
| `aws_account` | **HAS** | `aws_es` |
| `aws_account` | **HAS** | `aws_firehose` |
| `aws_account` | **HAS** | `aws_fms` |
| `aws_account` | **HAS** | `aws_glacier` |
| `aws_account` | **HAS** | `aws_global_accelerator` |
| `aws_account` | **HAS** | `aws_glue` |
| `aws_account` | **HAS** | `aws_grafana` |
| `aws_account` | **HAS** | `aws_guardduty` |
| `aws_account` | **HAS** | `aws_health` |
| `aws_account` | **HAS** | `aws_health_event` |
| `aws_account` | **HAS** | `aws_iam` |
| `aws_account` | **HAS** | `aws_iam_roles_anywhere` |
| `aws_account` | **HAS** | `aws_imagebuilder` |
| `aws_account` | **HAS** | `aws_inspector` |
| `aws_account` | **HAS** | `aws_inspectorv2` |
| `aws_account` | **HAS** | `aws_kinesis` |
| `aws_account` | **HAS** | `aws_kms` |
| `aws_account` | **HAS** | `aws_lambda` |
| `aws_account` | **HAS** | `aws_license_manager` |
| `aws_account` | **HAS** | `aws_lexv2` |
| `aws_account` | **HAS** | `aws_macie` |
| `aws_account` | **HAS** | `aws_marketplace` |
| `aws_account` | **OWNS** | `aws_marketplace_entity` |
| `aws_account` | **HAS** | `aws_mwaa` |
| `aws_account` | **HAS** | `aws_mq` |
| `aws_account` | **HAS** | `aws_msk` |
| `aws_account` | **HAS** | `aws_neptune` |
| `aws_account` | **HAS** | `aws_networkfirewall` |
| `aws_account` | **HAS** | `aws_networkmanager` |
| `aws_account` | **HAS** | `aws_nova_act` |
| `aws_account` | **HAS** | `aws_prometheus` |
| `aws_account` | **HAS** | `aws_quicksight` |
| `aws_account` | **HAS** | `aws_resource_explorer` |
| `aws_account` | **HAS** | `aws_ram_service` |
| `aws_account` | **HAS** | `aws_rds` |
| `aws_account` | **HAS** | `aws_db_instance` |
| `aws_account` | **HAS** | `aws_redshift_serverless` |
| `aws_account` | **HAS** | `aws_redshift` |
| `aws_account` | **HAS** | `aws_route53` |
| `aws_account` | **HAS** | `aws_s3` |
| `aws_account` | **HAS** | `aws_sagemaker` |
| `aws_account` | **HAS** | `aws_secretsmanager` |
| `aws_account` | **HAS** | `aws_securityhub` |
| `aws_account` | **HAS** | `aws_servicecatalog` |
| `aws_account` | **HAS** | `aws_ses` |
| `aws_account` | **HAS** | `aws_shield` |
| `aws_account` | **HAS** | `aws_signer` |
| `aws_account` | **HAS** | `aws_sns` |
| `aws_account` | **HAS** | `aws_sqs` |
| `aws_account` | **HAS** | `aws_states` |
| `aws_account` | **HAS** | `aws_ssm` |
| `aws_account` | **HAS** | `aws_sso` |
| `aws_account` | **OWNS** | `aws_sso_instance` |
| `aws_account` | **HAS** | `aws_transfer` |
| `aws_account` | **HAS** | `aws_waf` |
| `aws_account` | **HAS** | `aws_wafv2` |
| `aws_account` | **HAS** | `aws_workspaces` |
| `aws_account` | **HAS** | `aws_vpc_lattice` |
| `aws_account` | **HAS** | `aws_fsx` |
| `aws_account` | **HAS** | `aws_opensearch` |
| `aws_account` | **HAS** | `aws_outposts` |
| `aws_account` | **HAS** | `aws_storage_gateway` |
| `aws_account` | **HAS** | `aws_xray` |
| `aws_acm` | **HAS** | `aws_acm_certificate` |
| `aws_acm_certificate` | **PROTECTS** | `aws_cognito_user_pool` |
| `aws_acm_pca` | **HAS** | `aws_acm_pca_certificate_authority` |
| `aws_alb` | **USES** | `aws_eni` |
| `aws_alb` | **HAS** | `aws_security_group` |
| `aws_alb` | **HAS** | `aws_lb_listener` |
| `aws_alb` | **CONNECTS** | `aws_lb_target_group` |
| `aws_ami` | **CONTAINS** | `aws_ebs_snapshot` |
| `aws_api_gateway_domain_name` | **HAS** | `aws_acm_certificate` |
| `aws_api_gateway_resource` | **HAS** | `aws_api_gateway_method` |
| `aws_api_gateway_rest_api` | **TRIGGERS** | `aws_lambda_function` |
| `aws_api_gateway_rest_api` | **HAS** | `aws_api_gateway_resource` |
| `aws_api_gateway_rest_api` | **HAS** | `aws_api_gateway_stage` |
| `aws_api_gateway_rest_api` | **USES** | `aws_api_gateway_domain_name` |
| `aws_api_gateway_stage` | **DEFINES** | `aws_api_gateway_stage_method_setting` |
| `aws_api_gateway_stage` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_api_gateway_v2_api` | **HAS** | `aws_api_gateway_v2_route` |
| `aws_api_gateway_v2_api` | **HAS** | `aws_api_gateway_v2_stage` |
| `aws_api_gateway_v2_api` | **USES** | `aws_api_gateway_domain_name` |
| `aws_api_gateway_v2_authorizer` | **CONNECTS** | `aws_lambda_function` |
| `aws_api_gateway_v2_integration` | **CONNECTS** | `aws_lambda_function` |
| `aws_api_gateway_v2_route` | **HAS** | `aws_api_gateway_v2_authorizer` |
| `aws_api_gateway_v2_route` | **HAS** | `aws_api_gateway_v2_integration` |
| `aws_api_gateway_v2_stage` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_apigateway` | **HAS** | `aws_api_gateway_rest_api` |
| `aws_apigateway` | **HAS** | `aws_api_gateway_domain_name` |
| `aws_apigateway` | **HAS** | `aws_api_gateway_v2_api` |
| `aws_appconfig` | **HAS** | `aws_appconfig_account_settings` |
| `aws_appconfig` | **HAS** | `aws_appconfig_application` |
| `aws_appconfig` | **HAS** | `aws_appconfig_deployment_strategy` |
| `aws_appconfig` | **CONNECTS** | `aws_vpc_endpoint` |
| `aws_appconfig_application` | **HAS** | `aws_appconfig_environment` |
| `aws_appconfig_application` | **HAS** | `aws_appconfig_configuration_profile` |
| `aws_appconfig_application` | **HAS** | `aws_appconfig_deployment` |
| `aws_appconfig_configuration_profile` | **HAS** | `aws_appconfig_hosted_configuration_version` |
| `aws_appconfig_configuration_profile` | **USES** | `aws_kms_key` |
| `aws_appconfig_configuration_profile` | **USES** | `aws_iam_role` |
| `aws_appconfig_deployment` | **USES** | `aws_kms_key` |
| `aws_appconfig_environment` | **USES** | `aws_cloudwatch_metric_alarm` |
| `aws_appconfig_environment` | **USES** | `aws_iam_role` |
| `aws_appconfig_hosted_configuration_version` | **USES** | `aws_kms_key` |
| `aws_athena` | **HAS** | `aws_athena_work_group` |
| `aws_athena_work_group` | **USES** | `aws_iam_role` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_framework` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_assessment` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_control` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_setting` |
| `aws_auditmanager` | **HAS** | `aws_auditmanager_delegation` |
| `aws_auditmanager_assessment` | **USES** | `aws_auditmanager_framework` |
| `aws_auditmanager_assessment` | **HAS** | `aws_auditmanager_evidence_folder` |
| `aws_auditmanager_delegation` | **ASSIGNED** | `aws_iam_role` |
| `aws_auditmanager_delegation` | **HAS** | `aws_auditmanager_assessment` |
| `aws_auditmanager_framework` | **HAS** | `aws_auditmanager_control` |
| `aws_auditmanager_setting` | **USES** | `aws_kms_key` |
| `aws_auditmanager_setting` | **USES** | `aws_sns_topic` |
| `aws_auditmanager_setting` | **ASSIGNED** | `aws_iam_role` |
| `aws_auditmanager_setting` | **USES** | `aws_s3_bucket` |
| `aws_autoscaling` | **HAS** | `aws_autoscaling_group` |
| `aws_autoscaling` | **HAS** | `aws_autoscaling_launch_configuration` |
| `aws_autoscaling_group` | **USES** | `aws_autoscaling_launch_configuration` |
| `aws_autoscaling_group` | **USES** | `aws_launch_template` |
| `aws_autoscaling_group` | **HAS** | `aws_instance` |
| `aws_autoscaling_group` | **USES** | `aws_autoscaling_policy` |
| `aws_autoscaling_launch_configuration` | **USES** | `aws_ami` |
| `aws_backup` | **HAS** | `aws_backup_vault` |
| `aws_backup` | **HAS** | `aws_backup_plan` |
| `aws_backup` | **HAS** | `aws_backup_restore_testing_plan` |
| `aws_backup_copy_job` | **CREATED** | `aws_backup_recovery_point` |
| `aws_backup_copy_job` | **USES** | `aws_backup_recovery_point` |
| `aws_backup_plan` | **HAS** | `aws_backup_job` |
| `aws_backup_plan` | **HAS** | `aws_backup_copy_job` |
| `aws_backup_recovery_point` | **PROTECTS** | `aws_resource` |
| `aws_backup_restore_job` | **HAS** | `aws_instance` |
| `aws_backup_restore_job` | **HAS** | `aws_db_instance` |
| `aws_backup_restore_testing_plan` | **HAS** | `aws_backup_restore_job` |
| `aws_backup_vault` | **HAS** | `aws_backup_recovery_point` |
| `aws_batch` | **HAS** | `aws_batch_job_definition` |
| `aws_batch` | **HAS** | `aws_batch_job_queue` |
| `aws_batch_compute_environment` | **USES** | `aws_iam_role` |
| `aws_batch_compute_environment` | **USES** | `aws_ecs_cluster` |
| `aws_batch_compute_environment` | **HAS** | `aws_security_group` |
| `aws_batch_job_queue` | **HAS** | `aws_batch_job` |
| `aws_bedrock` | **HAS** | `aws_bedrock_evaluation_job` |
| `aws_bedrock` | **HAS** | `aws_bedrock_model_customization_job` |
| `aws_bedrock` | **HAS** | `aws_bedrock_code_interpreter` |
| `aws_bedrock` | **HAS** | `aws_bedrock_foundation_model` |
| `aws_bedrock` | **HAS** | `aws_bedrock_guardrail` |
| `aws_bedrock` | **HAS** | `aws_bedrock_model_invocation_logging` |
| `aws_bedrock` | **HAS** | `aws_bedrock_agent` |
| `aws_bedrock` | **HAS** | `aws_bedrock_knowledge_base` |
| `aws_bedrock` | **HAS** | `aws_bedrock_custom_model` |
| `aws_bedrock` | **HAS** | `aws_bedrock_imported_model` |
| `aws_bedrock` | **HAS** | `aws_bedrock_model_invocation_job` |
| `aws_bedrock` | **HAS** | `aws_bedrock_provisioned_throughput` |
| `aws_bedrock` | **HAS** | `aws_bedrock_flow` |
| `aws_bedrock` | **HAS** | `aws_bedrock_inference_profile` |
| `aws_bedrock` | **HAS** | `aws_bedrock_agent_runtime` |
| `aws_bedrock` | **HAS** | `aws_bedrock_api_key` |
| `aws_bedrock` | **USES** | `aws_vpc_endpoint` |
| `aws_bedrock` | **HAS** | `aws_bedrock_memory` |
| `aws_bedrock` | **HAS** | `aws_bedrock_gateway` |
| `aws_bedrock` | **HAS** | `aws_bedrock_api_key_credential_provider` |
| `aws_bedrock` | **HAS** | `aws_bedrock_browser` |
| `aws_bedrock` | **HAS** | `aws_bedrock_evaluator` |
| `aws_bedrock` | **HAS** | `aws_bedrock_policy_engine` |
| `aws_bedrock` | **HAS** | `aws_bedrock_browser_profile` |
| `aws_bedrock_agent` | **HAS** | `aws_bedrock_agent_action_group` |
| `aws_bedrock_agent` | **USES** | `aws_iam_role` |
| `aws_bedrock_agent` | **USES** | `aws_kms_key` |
| `aws_bedrock_agent` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_agent` | **USES** | `aws_iam_policy` |
| `aws_bedrock_agent_action_group` | **USES** | `aws_lambda_function` |
| `aws_bedrock_agent_runtime` | **USES** | `aws_iam_role` |
| `aws_bedrock_agent_runtime` | **USES** | `aws_security_group` |
| `aws_bedrock_agent_runtime` | **USES** | `aws_subnet` |
| `aws_bedrock_agent_runtime` | **USES** | `aws_iam_policy` |
| `aws_bedrock_browser` | **USES** | `aws_iam_policy` |
| `aws_bedrock_browser` | **USES** | `aws_iam_role` |
| `aws_bedrock_browser` | **USES** | `aws_security_group` |
| `aws_bedrock_browser` | **USES** | `aws_subnet` |
| `aws_bedrock_browser` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_code_interpreter` | **USES** | `aws_iam_role` |
| `aws_bedrock_code_interpreter` | **USES** | `aws_security_group` |
| `aws_bedrock_code_interpreter` | **USES** | `aws_subnet` |
| `aws_bedrock_code_interpreter` | **USES** | `aws_iam_policy` |
| `aws_bedrock_custom_model` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_custom_model` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_custom_model` | **USES** | `aws_kms_key` |
| `aws_bedrock_evaluation_job` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_flow` | **USES** | `aws_iam_role` |
| `aws_bedrock_flow` | **USES** | `aws_kms_key` |
| `aws_bedrock_flow` | **USES** | `aws_iam_policy` |
| `aws_bedrock_gateway` | **USES** | `aws_iam_policy` |
| `aws_bedrock_gateway` | **USES** | `aws_iam_role` |
| `aws_bedrock_gateway` | **USES** | `aws_kms_key` |
| `aws_bedrock_gateway` | **HAS** | `aws_bedrock_gateway_target` |
| `aws_bedrock_gateway_target` | **USES** | `aws_bedrock_api_key_credential_provider` |
| `aws_bedrock_guardrail` | **USES** | `aws_kms_key` |
| `aws_bedrock_guardrail` | **PROTECTS** | `aws_bedrock_agent` |
| `aws_bedrock_imported_model` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_imported_model` | **USES** | `aws_kms_key` |
| `aws_bedrock_knowledge_base` | **HAS** | `aws_bedrock_knowledge_base_data_source` |
| `aws_bedrock_knowledge_base` | **USES** | `aws_iam_role` |
| `aws_bedrock_knowledge_base` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_knowledge_base` | **USES** | `aws_opensearch_domain` |
| `aws_bedrock_knowledge_base` | **USES** | `aws_iam_policy` |
| `aws_bedrock_knowledge_base_data_source` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_memory` | **USES** | `aws_iam_policy` |
| `aws_bedrock_memory` | **USES** | `aws_iam_role` |
| `aws_bedrock_memory` | **USES** | `aws_kms_key` |
| `aws_bedrock_model_customization_job` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_model_customization_job` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_model_invocation_job` | **USES** | `aws_s3_bucket` |
| `aws_bedrock_model_invocation_job` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_model_invocation_job` | **USES** | `aws_iam_role` |
| `aws_bedrock_model_invocation_job` | **USES** | `aws_kms_key` |
| `aws_bedrock_model_invocation_job` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_model_invocation_job` | **USES** | `aws_bedrock_custom_model` |
| `aws_bedrock_model_invocation_logging` | **SENDS** | `aws_s3_bucket` |
| `aws_bedrock_model_invocation_logging` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_bedrock_provisioned_throughput` | **USES** | `aws_bedrock_foundation_model` |
| `aws_bedrock_provisioned_throughput` | **USES** | `aws_bedrock_custom_model` |
| `aws_cloudformation` | **HAS** | `aws_cloudformation_stack` |
| `aws_cloudfront` | **HAS** | `aws_cloudfront_distribution` |
| `aws_cloudfront` | **HAS** | `aws_cloudfront_key_group` |
| `aws_cloudfront` | **HAS** | `aws_cloudfront_public_key` |
| `aws_cloudfront_distribution` | **HAS** | `aws_cloudfront_distribution_origin` |
| `aws_cloudfront_distribution` | **TRIGGERS** | `aws_lambda_function` |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_api_gateway_rest_api` |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_elb` |
| `aws_cloudfront_key_group` | **HAS** | `aws_cloudfront_public_key` |
| `aws_cloudhsm` | **HAS** | `aws_cloudhsm_cluster` |
| `aws_cloudhsm_cluster` | **HAS** | `aws_cloudhsm_instance` |
| `aws_cloudhsm_cluster` | **HAS** | `aws_security_group` |
| `aws_cloudhsm_cluster` | **HAS** | `aws_cloudhsm_backup` |
| `aws_cloudhsm_instance` | **HAS** | `aws_security_group` |
| `aws_cloudmap` | **HAS** | `aws_cloudmap_namespace` |
| `aws_cloudmap_namespace` | **HAS** | `aws_cloudmap_service` |
| `aws_cloudmap_service` | **HAS** | `aws_cloudmap_service_instance` |
| `aws_cloudtrail` | **HAS** | `aws_cloudtrail_trail` |
| `aws_cloudtrail` | **LOGS** | `aws_resource_explorer` |
| `aws_cloudwatch` | **HAS** | `aws_cloudwatch_metric_alarm` |
| `aws_cloudwatch_events` | **HAS** | `aws_cloudwatch_event_rule` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_event_bus` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_archive` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_connection` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_api_destination` |
| `aws_cloudwatch_events` | **HAS** | `aws_eventbridge_endpoint` |
| `aws_cloudwatch_log_group` | **USES** | `aws_kms_key` |
| `aws_cloudwatch_log_group` | **HAS** | `aws_cloudwatch_log_metric_filter` |
| `aws_cloudwatch_log_group` | **HAS** | `aws_cloudwatch_log_group_metrics` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_group` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_destination` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_subscription_filter` |
| `aws_cloudwatch_logs` | **HAS** | `aws_cloudwatch_log_metric_filter` |
| `aws_cloudwatch_metric_alarm` | **TRIGGERS** | `aws_resource` |
| `aws_codeartifact` | **HAS** | `aws_codeartifact_domain` |
| `aws_codeartifact` | **USES** | `aws_vpc_endpoint` |
| `aws_codeartifact_domain` | **HAS** | `aws_codeartifact_repository` |
| `aws_codeartifact_domain` | **HAS** | `aws_codeartifact_package_group` |
| `aws_codeartifact_domain` | **USES** | `aws_kms_key` |
| `aws_codeartifact_package_group` | **HAS** | `aws_codeartifact_package_group` |
| `aws_codeartifact_repository` | **CONTAINS** | `aws_codeartifact_package` |
| `aws_codebuild` | **HAS** | `aws_codebuild_project` |
| `aws_codebuild` | **HAS** | `aws_codebuild_report_group` |
| `aws_codecommit` | **HAS** | `aws_codecommit_repository` |
| `aws_codedeploy` | **HAS** | `aws_codedeploy_application` |
| `aws_codedeploy` | **HAS** | `aws_codedeploy_deployment_config` |
| `aws_codedeploy_application` | **HAS** | `aws_codedeploy_deployment_group` |
| `aws_codedeploy_deployment_group` | **USES** | `aws_codedeploy_deployment_config` |
| `aws_codedeploy_deployment_group` | **USES** | `aws_iam_role` |
| `aws_codeguru` | **HAS** | `aws_codeguru_profiling_group` |
| `aws_codeguru` | **HAS** | `aws_codeguru_reviewer_repository_association` |
| `aws_codeguru_reviewer_repository_association` | **USES** | `aws_kms_key` |
| `aws_codepipeline` | **HAS** | `aws_codepipeline_pipeline` |
| `aws_cognito_identity` | **HAS** | `aws_cognito_identity_pool` |
| `aws_cognito_idp` | **HAS** | `aws_cognito_user_pool` |
| `aws_cognito_user_pool` | **HAS** | `aws_cognito_user_pool_client` |
| `aws_cognito_user_pool` | **HAS** | `aws_cognito_user_pool_user` |
| `aws_config` | **HAS** | `aws_config_rule` |
| `aws_config_rule` | **EVALUATES** | `aws_resource` |
| `aws_config_rule` | **IDENTIFIED** | `aws_config_rule_finding` |
| `aws_datasync` | **HAS** | `aws_datasync_task` |
| `aws_datasync` | **HAS** | `aws_datasync_location` |
| `aws_datasync_location` | **CONNECTS** | `aws_s3_bucket` |
| `aws_datasync_location` | **CONNECTS** | `aws_efs_file_system` |
| `aws_datasync_location` | **CONNECTS** | `aws_fsx_file_system` |
| `aws_datasync_task` | **USES** | `aws_datasync_location` |
| `aws_datasync_task` | **USES** | `aws_cloudwatch_log_group` |
| `aws_dax` | **HAS** | `aws_dax_cluster` |
| `aws_db_cluster_snapshot` | **USES** | `aws_kms_key` |
| `aws_db_instance` | **USES** | `aws_db_parameter_group` |
| `aws_db_instance` | **HAS** | `aws_security_group` |
| `aws_db_instance` | **USES** | `aws_kms_key` |
| `aws_db_instance` | **USES** | `aws_secret` |
| `aws_db_instance` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_db_instance` | **HAS** | `aws_db_snapshot` |
| `aws_db_instance` | **USES** | `aws_db_option_group` |
| `aws_db_instance` | **USES** | `aws_db_subnet_group` |
| `aws_db_proxy` | **USES** | `aws_subnet` |
| `aws_db_proxy` | **USES** | `aws_secret` |
| `aws_db_proxy` | **USES** | `aws_iam_role` |
| `aws_db_proxy` | **USES** | `aws_security_group` |
| `aws_db_proxy` | **HAS** | `aws_db_proxy_target_group` |
| `aws_db_proxy_target` | **CONNECTS** | `aws_db_instance` |
| `aws_db_proxy_target` | **CONNECTS** | `aws_rds_cluster` |
| `aws_db_proxy_target_group` | **HAS** | `aws_db_proxy_target` |
| `aws_db_snapshot` | **USES** | `aws_kms_key` |
| `aws_db_subnet_group` | **USES** | `aws_subnet` |
| `aws_detective` | **HAS** | `aws_detective_graph` |
| `aws_detective_graph` | **IDENTIFIED** | `aws_detective_investigation` |
| `aws_devops_guru` | **HAS** | `aws_devops_guru_notification_channel` |
| `aws_devops_guru` | **IDENTIFIED** | `aws_devops_guru_insight` |
| `aws_devops_guru_insight` | **HAS** | `aws_devops_guru_anomaly` |
| `aws_devops_guru_notification_channel` | **USES** | `aws_sns_topic` |
| `aws_devopsagent_agent_space` | **HAS** | `aws_devopsagent_association` |
| `aws_devopsagent_agent_space` | **USES** | `aws_kms_key` |
| `aws_devopsagent_agent_space` | **USES** | `aws_iam_role` |
| `aws_devopsagent_agent_space` | **USES** | `aws_vpc_endpoint` |
| `aws_devopsagent_association` | **USES** | `aws_devopsagent_service` |
| `aws_devopsagent_association` | **USES** | `aws_iam_role` |
| `aws_devopsagent_private_connection` | **CONNECTS** | `aws_vpc` |
| `aws_devopsagent_service` | **CONNECTS** | `aws_devopsagent_private_connection` |
| `aws_devopsagent_service` | **USES** | `aws_kms_key` |
| `aws_devopsagent_service` | **USES** | `aws_iam_role` |
| `aws_directconnect` | **HAS** | `aws_directconnect_connection` |
| `aws_directconnect` | **HAS** | `aws_directconnect_virtual_interface` |
| `aws_directconnect` | **HAS** | `aws_directconnect_lag` |
| `aws_directconnect` | **HAS** | `aws_directconnect_gateway` |
| `aws_directconnect_lag` | **HAS** | `aws_direct_connect_virtual_interface` |
| `aws_directconnect_lag` | **USES** | `aws_direct_connect_connection` |
| `aws_directconnect_virtual_interface` | **HAS** | `aws_directconnect_bgp_peer` |
| `aws_directconnect_virtual_interface` | **USES** | `aws_directconnect_lag` |
| `aws_directconnect_virtual_interface` | **USES** | `aws_direct_connect_gateway` |
| `aws_dms` | **HAS** | `aws_dms_instance` |
| `aws_dms` | **HAS** | `aws_dms_endpoint` |
| `aws_ds` | **HAS** | `aws_ds_directory` |
| `aws_dynamodb` | **HAS** | `aws_dynamodb_table` |
| `aws_dynamodb` | **HAS** | `aws_dynamodb_global_table` |
| `aws_dynamodb_global_table` | **IS** | `aws_dynamodb_table` |
| `aws_dynamodb_table` | **USES** | `aws_kms_key` |
| `aws_ebs_snapshot` | **USES** | `aws_kms_key` |
| `aws_ebs_volume` | **USES** | `aws_ebs_snapshot` |
| `aws_ebs_volume` | **HAS** | `aws_ebs_snapshot` |
| `aws_ebs_volume` | **USES** | `aws_kms_key` |
| `aws_ec2` | **HAS** | `aws_ec2_settings` |
| `aws_ec2` | **USES** | `aws_kms_key` |
| `aws_ec2` | **HAS** | `aws_instance` |
| `aws_ec2` | **HAS** | `aws_internet_gateway` |
| `aws_ec2` | **HAS** | `aws_key_pair` |
| `aws_ec2` | **HAS** | `aws_launch_template` |
| `aws_ec2` | **HAS** | `aws_network_acl` |
| `aws_ec2` | **HAS** | `aws_prefix_list` |
| `aws_ec2` | **HAS** | `aws_security_group` |
| `aws_ec2` | **HAS** | `aws_subnet` |
| `aws_ec2` | **HAS** | `aws_ec2_transit_gateway` |
| `aws_ec2` | **HAS** | `aws_ebs_volume` |
| `aws_ec2` | **HAS** | `aws_vpc` |
| `aws_ec2` | **HAS** | `aws_vpc_endpoint_service` |
| `aws_ec2` | **HAS** | `aws_dedicated_host` |
| `aws_ec2_transit_gateway` | **HAS** | `aws_ec2_transit_gateway_vpc_attachment` |
| `aws_ec2_transit_gateway` | **HAS** | `aws_ec2_transit_gateway_route_table` |
| `aws_ec2_transit_gateway` | **HAS** | `aws_ec2_transit_gateway_attachment` |
| `aws_ec2_transit_gateway` | **CONNECTS** | `aws_vpn_connection` |
| `aws_ec2_transit_gateway_vpc_attachment` | **USES** | `aws_vpc` |
| `aws_ecr` | **HAS** | `aws_ecr_repository` |
| `aws_ecr_image` | **HAS** | `aws_ecr_image_scan_finding` |
| `aws_ecr_repository` | **HAS** | `aws_ecr_image` |
| `aws_ecs` | **HAS** | `aws_ecs_cluster` |
| `aws_ecs` | **HAS** | `aws_ecs_task_definition` |
| `aws_ecs_cluster` | **HAS** | `aws_ecs_service` |
| `aws_ecs_cluster` | **HAS** | `aws_ecs_container_instance` |
| `aws_ecs_cluster` | **RUNS** | `aws_ecs_task` |
| `aws_ecs_container_instance` | **RUNS** | `aws_ecs_task` |
| `aws_ecs_service` | **USES** | `aws_subnet` |
| `aws_ecs_service` | **HAS** | `aws_security_group` |
| `aws_ecs_task_container_definition` | **USES** | `aws_secret` |
| `aws_ecs_task_definition` | **DEFINES** | `aws_ecs_service` |
| `aws_ecs_task_definition` | **DEFINES** | `aws_ecs_task` |
| `aws_ecs_task_definition` | **USES** | `aws_iam_role` |
| `aws_ecs_task_definition` | **HAS** | `aws_ecs_task_container_definition` |
| `aws_efs` | **HAS** | `aws_efs_file_system` |
| `aws_efs_file_system` | **USES** | `aws_kms_key` |
| `aws_efs_file_system` | **HAS** | `aws_efs_mount_target` |
| `aws_efs_mount_target` | **USES** | `aws_eni` |
| `aws_efs_mount_target` | **HAS** | `aws_security_group` |
| `aws_eks` | **HAS** | `aws_eks_cluster` |
| `aws_eks_cluster` | **HAS** | `aws_instance` |
| `aws_eks_cluster` | **HAS** | `aws_eks_node_group` |
| `aws_eks_cluster` | **HAS** | `aws_security_group` |
| `aws_eks_cluster` | **USES** | `aws_kms_key` |
| `aws_eks_cluster` | **TRUSTS** | `aws_iam_oidc_provider` |
| `aws_eks_node_group` | **HAS** | `aws_instance` |
| `aws_eks_node_group` | **USES** | `aws_iam_role` |
| `aws_elasticache` | **HAS** | `aws_elasticache_memcached_cluster` |
| `aws_elasticache` | **HAS** | `aws_elasticache_redis_cluster` |
| `aws_elasticache_cluster_node` | **USES** | `aws_eni` |
| `aws_elasticache_cluster_node` | **HAS** | `aws_security_group` |
| `aws_elasticache_memcached_cluster` | **USES** | `aws_eni` |
| `aws_elasticache_memcached_cluster` | **HAS** | `aws_security_group` |
| `aws_elasticache_memcached_cluster` | **HAS** | `aws_elasticache_snapshot` |
| `aws_elasticache_redis_cluster` | **HAS** | `aws_elasticache_cluster_node` |
| `aws_elasticache_redis_cluster` | **USES** | `aws_kms_key` |
| `aws_elasticache_snapshot` | **USES** | `aws_kms_key` |
| `aws_elasticloadbalancing` | **HAS** | `aws_alb` |
| `aws_elasticloadbalancing` | **HAS** | `aws_elb` |
| `aws_elasticloadbalancing` | **HAS** | `aws_nlb` |
| `aws_elasticmapreduce` | **HAS** | `aws_elasticmapreduce_cluster` |
| `aws_elasticmapreduce` | **HAS** | `aws_emr_security_configuration` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_kms_key` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_iam_role` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_iam_instance_profile` |
| `aws_elasticmapreduce_cluster` | **HAS** | `aws_instance` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_emr_security_configuration` |
| `aws_elasticmapreduce_cluster` | **USES** | `aws_vpc_endpoint` |
| `aws_elasticsearch_domain` | **USES** | `aws_eni` |
| `aws_elasticsearch_domain` | **HAS** | `aws_security_group` |
| `aws_elb` | **USES** | `aws_eni` |
| `aws_elb` | **CONNECTS** | `aws_instance` |
| `aws_elb` | **HAS** | `aws_security_group` |
| `aws_elb` | **HAS** | `aws_lb_listener` |
| `aws_elb` | **CONNECTS** | `aws_lb_target_group` |
| `aws_emr_serverless` | **HAS** | `aws_emr_serverless_application` |
| `aws_emr_serverless_application` | **USES** | `aws_kms_key` |
| `aws_eni` | **USES** | `aws_eip` |
| `aws_eni` | **HAS** | `aws_security_group` |
| `aws_es` | **HAS** | `aws_elasticsearch_domain` |
| `aws_eventbridge_api_destination` | **USES** | `aws_eventbridge_connection` |
| `aws_eventbridge_endpoint` | **USES** | `aws_eventbridge_event_bus` |
| `aws_eventbridge_event_bus` | **USES** | `aws_kms_key` |
| `aws_eventbridge_event_bus` | **HAS** | `aws_eventbridge_archive` |
| `aws_firehose` | **HAS** | `aws_firehose_delivery_stream` |
| `aws_firehose_delivery_stream` | **USES** | `aws_kms_key` |
| `aws_firehose_delivery_stream` | **USES** | `aws_kinesis_stream` |
| `aws_firehose_delivery_stream` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_firehose_delivery_stream` | **USES** | `aws_vpc_endpoint` |
| `aws_firehose_delivery_stream` | **CONNECTS** | `aws_vpc_endpoint_service` |
| `aws_firehose_delivery_stream` | **USES** | `aws_vpc` |
| `aws_firehose_delivery_stream` | **USES** | `aws_subnet` |
| `aws_firehose_delivery_stream` | **USES** | `aws_security_group` |
| `aws_firewall` | **HAS** | `aws_firewall_policy` |
| `aws_firewall` | **PROTECTS** | `aws_vpc` |
| `aws_firewall_policy` | **HAS** | `aws_firewall_rule_group` |
| `aws_firewall_rule_group` | **USES** | `aws_prefix_list` |
| `aws_fms` | **HAS** | `aws_fms_policy` |
| `aws_fms` | **HAS** | `aws_fms_resource_set` |
| `aws_fms` | **HAS** | `aws_fms_application_list` |
| `aws_fms` | **HAS** | `aws_fms_protocols_list` |
| `aws_fms_resource_set` | **HAS** | `aws_resource` |
| `aws_fsx` | **HAS** | `aws_fsx_file_system` |
| `aws_glacier` | **HAS** | `aws_glacier_vault` |
| `aws_global_accelerator` | **HAS** | `aws_global_accelerator_accelerator` |
| `aws_global_accelerator_accelerator` | **HAS** | `aws_global_accelerator_listener` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_alb` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_elb` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_nlb` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_eip` |
| `aws_global_accelerator_endpoint_group` | **HAS** | `aws_instance` |
| `aws_global_accelerator_listener` | **HAS** | `aws_global_accelerator_endpoint_group` |
| `aws_glue` | **HAS** | `aws_glue_job` |
| `aws_glue` | **HAS** | `aws_glue_catalog_database` |
| `aws_glue` | **HAS** | `aws_glue_data_catalog_encryption_settings` |
| `aws_glue` | **HAS** | `aws_glue_security_configuration` |
| `aws_glue` | **HAS** | `aws_glue_connection` |
| `aws_glue` | **HAS** | `aws_glue_session` |
| `aws_glue_connection` | **USES** | `aws_subnet` |
| `aws_glue_data_catalog_encryption_settings` | **USES** | `aws_kms_key` |
| `aws_glue_job` | **USES** | `aws_glue_connection` |
| `aws_glue_security_configuration` | **USES** | `aws_kms_key` |
| `aws_grafana` | **HAS** | `aws_grafana_workspace` |
| `aws_grafana_workspace` | **USES** | `aws_iam_role` |
| `aws_guardduty` | **HAS** | `aws_guardduty_detector` |
| `aws_guardduty_detector` | **IDENTIFIED** | `aws_guardduty_finding` |
| `aws_guardduty_detector` | **HAS** | `aws_guardduty_publishing_destination` |
| `aws_guardduty_publishing_destination` | **USES** | `aws_s3_bucket` |
| `aws_guardduty_publishing_destination` | **USES** | `aws_kms_key` |
| `aws_health` | **HAS** | `aws_health_event` |
| `aws_iam` | **HAS** | `aws_organization_policy` |
| `aws_iam` | **HAS** | `aws_organization_tag_policy` |
| `aws_iam` | **HAS** | `aws_iam_account_password_policy` |
| `aws_iam` | **HAS** | `aws_iam_group` |
| `aws_iam` | **HAS** | `aws_iam_group_policy` |
| `aws_iam` | **HAS** | `aws_iam_policy` |
| `aws_iam` | **HAS** | `aws_iam_role` |
| `aws_iam` | **HAS** | `aws_iam_role_policy` |
| `aws_iam` | **HAS** | `aws_iam_oidc_provider` |
| `aws_iam` | **HAS** | `aws_iam_saml_provider` |
| `aws_iam` | **HAS** | `aws_iam_user` |
| `aws_iam` | **HAS** | `aws_iam_access_key` |
| `aws_iam` | **HAS** | `aws_iam_user_policy` |
| `aws_iam` | **HAS** | `aws_iam_server_certificate` |
| `aws_iam` | **HAS** | `aws_iam_instance_profile` |
| `aws_iam_group` | **ASSIGNED** | `aws_iam_group_policy` |
| `aws_iam_group` | **HAS** | `aws_iam_user` |
| `aws_iam_group` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_group_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_group_policy` | **DENIES** | `aws_resource` |
| `aws_iam_instance_profile` | **USES** | `aws_role` |
| `aws_iam_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_policy` | **DENIES** | `aws_resource` |
| `aws_iam_policy` | **RESTRICTS** | `aws_iam_role` |
| `aws_iam_policy` | **RESTRICTS** | `aws_iam_user` |
| `aws_iam_role` | **ASSIGNED** | `aws_batch_compute_environment` |
| `aws_iam_role` | **ASSIGNED** | `aws_datasync_location` |
| `aws_iam_role` | **ASSIGNED** | `aws_ecs_task_definition` |
| `aws_iam_role` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_role` | **ASSIGNED** | `aws_iam_role_policy` |
| `aws_iam_role` | **ASSIGNED** | `aws_transfer_server` |
| `aws_iam_role` | **ASSIGNED** | `aws_transfer_user` |
| `aws_iam_role_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_role_policy` | **DENIES** | `aws_resource` |
| `aws_iam_roles_anywhere` | **HAS** | `aws_iam_roles_anywhere_trust_anchor` |
| `aws_iam_roles_anywhere` | **HAS** | `aws_iam_roles_anywhere_profile` |
| `aws_iam_roles_anywhere_profile` | **ALLOWS** | `aws_iam_role` |
| `aws_iam_roles_anywhere_profile` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_roles_anywhere_trust_anchor` | **USES** | `aws_acm_pca_certificate_authority` |
| `aws_iam_user` | **HAS** | `aws_bedrock_api_key` |
| `aws_iam_user` | **ASSIGNED** | `aws_iam_policy` |
| `aws_iam_user` | **HAS** | `aws_iam_access_key` |
| `aws_iam_user` | **ASSIGNED** | `mfa_device` |
| `aws_iam_user` | **ASSIGNED** | `aws_iam_user_policy` |
| `aws_iam_user_policy` | **ALLOWS** | `aws_resource` |
| `aws_iam_user_policy` | **DENIES** | `aws_resource` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_component` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_image_pipeline` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_infrastructure_configuration` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_lifecycle_policy` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_container_recipe` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_distribution_configuration` |
| `aws_imagebuilder` | **HAS** | `aws_imagebuilder_workflow` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_imagebuilder_infrastructure_configuration` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_imagebuilder_distribution_configuration` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_imagebuilder_container_recipe` |
| `aws_imagebuilder_image_pipeline` | **CREATED** | `aws_imagebuilder_image` |
| `aws_imagebuilder_image_pipeline` | **USES** | `aws_iam_role` |
| `aws_imagebuilder_lifecycle_policy` | **USES** | `aws_iam_role` |
| `aws_inspector` | **HAS** | `aws_inspector_assessment` |
| `aws_inspector_assessment` | **IDENTIFIED** | `aws_inspector_finding` |
| `aws_inspectorv2` | **SCANS** | `aws_instance` |
| `aws_inspectorv2` | **SCANS** | `aws_ecr_repository` |
| `aws_inspectorv2` | **SCANS** | `aws_ecr_image` |
| `aws_inspectorv2` | **IDENTIFIED** | `aws_inspectorv2_finding` |
| `aws_inspectorv2` | **HAS** | `aws_inspectorv2_filter` |
| `aws_inspectorv2` | **HAS** | `aws_inspectorv2_configuration` |
| `aws_inspectorv2` | **USES** | `aws_vpc_endpoint` |
| `aws_inspectorv2` | **HAS** | `aws_inspectorv2_cis_scan` |
| `aws_inspectorv2_cis_scan` | **HAS** | `aws_inspectorv2_cis_finding` |
| `aws_inspectorv2_configuration` | **USES** | `aws_kms_key` |
| `aws_instance` | **USES** | `aws_eip` |
| `aws_instance` | **USES** | `aws_key_pair` |
| `aws_instance` | **USES** | `aws_ami` |
| `aws_instance` | **HAS** | `aws_security_group` |
| `aws_instance` | **USES** | `aws_iam_instance_profile` |
| `aws_instance` | **USES** | `aws_eni` |
| `aws_instance` | **USES** | `aws_ebs_volume` |
| `aws_instance` | **USES** | `aws_dedicated_host` |
| `aws_instance` | **HAS** | `aws_inspectorv2_cis_finding` |
| `aws_instance` | **HAS** | `aws_instance_inventory` |
| `aws_instance` | **INSTALLED** | `aws_instance_application` |
| `aws_instance` | **LOGS** | `aws_instance_patch_state` |
| `aws_instance` | **HAS** | `aws_ssm_compliance_summary` |
| `aws_instance` | **HAS** | `aws_ssm_associations` |
| `aws_keyspaces` | **HAS** | `aws_keyspaces_keyspace` |
| `aws_keyspaces_keyspace` | **HAS** | `aws_keyspaces_table` |
| `aws_keyspaces_table` | **USES** | `aws_kms_key` |
| `aws_keyspaces_table` | **USES** | `aws_vpc_endpoint` |
| `aws_kinesis` | **HAS** | `aws_kinesis_stream` |
| `aws_kinesis_consumer` | **USES** | `aws_kinesis_stream` |
| `aws_kinesis_stream` | **USES** | `aws_kms_key` |
| `aws_kms` | **HAS** | `aws_kms_key` |
| `aws_lambda` | **HAS** | `aws_lambda_function` |
| `aws_lambda_function` | **HAS** | `aws_security_group` |
| `aws_lambda_function` | **ASSIGNED** | `aws_iam_role` |
| `aws_lambda_function` | **USES** | `aws_signer_signing_profile` |
| `aws_lambda_function` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_launch_template` | **HAS** | `aws_launch_template_version` |
| `aws_launch_template_version` | **USES** | `aws_ami` |
| `aws_lb_listener` | **HAS** | `aws_lb_listener_rule` |
| `aws_lb_listener` | **USES** | `aws_acm_certificate` |
| `aws_lb_listener` | **USES** | `aws_iam_server_certificate` |
| `aws_lb_target_group` | **HAS** | `aws_instance` |
| `aws_lb_target_group` | **HAS** | `aws_lambda_function` |
| `aws_lb_target_group` | **HAS** | `aws_eni` |
| `aws_lexv2` | **HAS** | `aws_lexv2_bot` |
| `aws_lexv2_bot` | **HAS** | `aws_lexv2_bot_alias` |
| `aws_license_manager` | **HAS** | `aws_license_manager_license` |
| `aws_license_manager` | **HAS** | `aws_license_manager_received_license` |
| `aws_macie` | **HAS** | `aws_macie_automated_discovery_configuration` |
| `aws_macie` | **HAS** | `aws_macie_admin_account` |
| `aws_macie` | **HAS** | `aws_macie_organization_configuration` |
| `aws_macie` | **HAS** | `aws_macie_finding_publication_configuration` |
| `aws_macie` | **HAS** | `aws_macie_classification_export_configuration` |
| `aws_macie` | **HAS** | `aws_macie_classification_job` |
| `aws_macie_automated_discovery_configuration` | **HAS** | `aws_macie_automated_discovery_account` |
| `aws_marketplace` | **HAS** | `aws_marketplace_entity` |
| `aws_marketplace` | **HAS** | `aws_marketplace_entitlement` |
| `aws_marketplace_entitlement` | **ASSIGNED** | `aws_account` |
| `aws_marketplace_entitlement` | **USES** | `aws_license_manager_received_license` |
| `aws_mq` | **HAS** | `aws_mq_broker` |
| `aws_mq_broker` | **USES** | `aws_kms_key` |
| `aws_mq_broker` | **USES** | `aws_subnet` |
| `aws_mq_broker` | **USES** | `aws_security_group` |
| `aws_msk` | **HAS** | `aws_msk_cluster` |
| `aws_mwaa` | **HAS** | `aws_mwaa_environment` |
| `aws_nat_gateway` | **USES** | `aws_eni` |
| `aws_neptune` | **HAS** | `aws_neptune_database_cluster` |
| `aws_neptune` | **HAS** | `aws_neptune_database_instance` |
| `aws_neptune` | **HAS** | `aws_neptune_analytics_graph` |
| `aws_neptune_analytics_graph` | **USES** | `aws_kms_key` |
| `aws_neptune_analytics_graph` | **CONNECTS** | `aws_vpc_endpoint` |
| `aws_neptune_analytics_graph` | **HAS** | `aws_neptune_analytics_graph_snapshot` |
| `aws_neptune_analytics_graph` | **HAS** | `aws_neptune_analytics_graph_export_task` |
| `aws_neptune_analytics_graph` | **HAS** | `aws_neptune_analytics_graph_import_task` |
| `aws_neptune_analytics_graph_export_task` | **USES** | `aws_kms_key` |
| `aws_neptune_analytics_graph_export_task` | **USES** | `aws_iam_role` |
| `aws_neptune_analytics_graph_import_task` | **USES** | `aws_kms_key` |
| `aws_neptune_analytics_graph_import_task` | **USES** | `aws_iam_role` |
| `aws_neptune_analytics_graph_snapshot` | **USES** | `aws_kms_key` |
| `aws_neptune_database_cluster` | **HAS** | `aws_security_group` |
| `aws_neptune_database_cluster` | **USES** | `aws_kms_key` |
| `aws_neptune_database_cluster` | **USES** | `aws_iam_role` |
| `aws_neptune_database_cluster` | **CONTAINS** | `aws_neptune_database_instance` |
| `aws_neptune_database_instance` | **HAS** | `aws_security_group` |
| `aws_neptune_database_instance` | **USES** | `aws_kms_key` |
| `aws_network_acl` | **PROTECTS** | `aws_subnet` |
| `aws_network_acl` | **ALLOWS** | `aws_resource` |
| `aws_network_acl` | **DENIES** | `aws_resource` |
| `aws_networkfirewall` | **HAS** | `aws_firewall` |
| `aws_networkfirewall` | **HAS** | `aws_firewall_policy` |
| `aws_networkfirewall` | **HAS** | `aws_firewall_rule_group` |
| `aws_networkmanager` | **HAS** | `aws_networkmanager_core_network` |
| `aws_networkmanager_attachment` | **HAS** | `aws_networkmanager_connect_peer` |
| `aws_networkmanager_attachment` | **USES** | `aws_vpc` |
| `aws_networkmanager_attachment` | **USES** | `aws_vpn_connection` |
| `aws_networkmanager_attachment` | **USES** | `aws_directconnect_gateway` |
| `aws_networkmanager_attachment` | **USES** | `aws_ec2_transit_gateway_route_table` |
| `aws_networkmanager_connect_peer` | **USES** | `aws_subnet` |
| `aws_networkmanager_core_network` | **HAS** | `aws_networkmanager_core_network_policy` |
| `aws_networkmanager_core_network` | **HAS** | `aws_networkmanager_core_network_route` |
| `aws_networkmanager_core_network` | **HAS** | `aws_networkmanager_core_network_policy_version` |
| `aws_networkmanager_core_network` | **HAS** | `aws_networkmanager_attachment` |
| `aws_nlb` | **USES** | `aws_eni` |
| `aws_nlb` | **HAS** | `aws_security_group` |
| `aws_nlb` | **HAS** | `aws_lb_listener` |
| `aws_nlb` | **CONNECTS** | `aws_lb_target_group` |
| `aws_nova_act` | **HAS** | `aws_nova_act_model` |
| `aws_nova_act` | **HAS** | `aws_nova_act_workflow_definition` |
| `aws_nova_act_workflow_definition` | **HAS** | `aws_nova_act_workflow_run` |
| `aws_nova_act_workflow_definition` | **USES** | `aws_s3_bucket` |
| `aws_nova_act_workflow_run` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_nova_act_workflow_run` | **USES** | `aws_nova_act_model` |
| `aws_opensearch` | **HAS** | `aws_opensearch_domain` |
| `aws_opensearch_domain` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_organization` | **HAS** | `aws_organization_root` |
| `aws_organization_root` | **HAS** | `aws_organizational_unit` |
| `aws_organizational_unit` | **HAS** | `aws_organizational_unit` |
| `aws_outposts` | **HAS** | `aws_outposts_site` |
| `aws_outposts_asset` | **HAS** | `aws_instance` |
| `aws_outposts_outpost` | **HAS** | `aws_outposts_asset` |
| `aws_outposts_outpost` | **USES** | `aws_vpc` |
| `aws_outposts_outpost` | **USES** | `aws_subnet` |
| `aws_outposts_outpost` | **USES** | `aws_vpc_endpoint` |
| `aws_outposts_outpost` | **USES** | `aws_iam_role` |
| `aws_outposts_site` | **HAS** | `aws_outposts_outpost` |
| `aws_patch_baseline` | **GENERATED** | `aws_instance_patch_state` |
| `aws_patch_group` | **USES** | `aws_patch_baseline` |
| `aws_patch_group` | **HAS** | `aws_instance` |
| `aws_prometheus` | **HAS** | `aws_prometheus_workspace` |
| `aws_prometheus` | **HAS** | `aws_prometheus_scraper` |
| `aws_prometheus_scraper` | **SCANS** | `aws_eks_cluster` |
| `aws_prometheus_scraper` | **USES** | `aws_subnet` |
| `aws_prometheus_scraper` | **USES** | `aws_security_group` |
| `aws_prometheus_scraper` | **USES** | `aws_iam_role` |
| `aws_prometheus_scraper` | **SENDS** | `aws_prometheus_workspace` |
| `aws_prometheus_workspace` | **USES** | `aws_kms_key` |
| `aws_prometheus_workspace` | **HAS** | `aws_cloudwatch_log_group` |
| `aws_quicksight` | **HAS** | `aws_quicksight_data_set` |
| `aws_quicksight` | **HAS** | `aws_quicksight_vpc_connection` |
| `aws_quicksight` | **HAS** | `aws_quicksight_user` |
| `aws_quicksight` | **HAS** | `aws_quicksight_group` |
| `aws_quicksight` | **HAS** | `aws_quicksight_custom_permissions` |
| `aws_quicksight_dashboard` | **USES** | `aws_quicksight_data_set` |
| `aws_quicksight_data_set` | **USES** | `aws_quicksight_data_source` |
| `aws_quicksight_data_source` | **CONNECTS** | `aws_quicksight_vpc_connection` |
| `aws_quicksight_group` | **HAS** | `aws_quicksight_user` |
| `aws_quicksight_user` | **ASSIGNED** | `aws_quicksight_custom_permissions` |
| `aws_ram_principal` | **USES** | `aws_ram_shared_resource` |
| `aws_ram_resource_share` | **GENERATED** | `aws_ram_resource_share_invitation` |
| `aws_ram_resource_share` | **CONTAINS** | `aws_ram_shared_resource` |
| `aws_ram_resource_share` | **ALLOWS** | `aws_ram_principal` |
| `aws_ram_service` | **HAS** | `aws_ram_resource_share` |
| `aws_rds` | **HAS** | `aws_rds_cluster` |
| `aws_rds` | **HAS** | `aws_db_instance` |
| `aws_rds` | **HAS** | `aws_db_subnet_group` |
| `aws_rds` | **HAS** | `aws_db_proxy` |
| `aws_rds_cluster` | **HAS** | `aws_security_group` |
| `aws_rds_cluster` | **USES** | `aws_kms_key` |
| `aws_rds_cluster` | **USES** | `aws_secret` |
| `aws_rds_cluster` | **CONTAINS** | `aws_db_instance` |
| `aws_rds_cluster` | **USES** | `aws_rds_cluster_parameter_group` |
| `aws_rds_cluster` | **HAS** | `aws_db_cluster_snapshot` |
| `aws_redshift` | **HAS** | `aws_redshift_cluster` |
| `aws_redshift_cluster` | **USES** | `aws_kms_key` |
| `aws_redshift_cluster` | **HAS** | `aws_security_group` |
| `aws_redshift_cluster` | **USES** | `aws_redshift_cluster_parameter_group` |
| `aws_redshift_cluster` | **HAS** | `aws_redshift_datashare` |
| `aws_redshift_cluster` | **ASSIGNED** | `aws_iam_role` |
| `aws_redshift_datashare_authorization` | **ALLOWS** | `aws_redshift_datashare` |
| `aws_redshift_serverless` | **HAS** | `aws_redshift_serverless_workgroup` |
| `aws_redshift_serverless` | **HAS** | `aws_redshift_serverless_namespace` |
| `aws_redshift_serverless` | **HAS** | `aws_redshift_serverless_usage_limit` |
| `aws_redshift_serverless_namespace` | **HAS** | `aws_redshift_datashare` |
| `aws_resource` | **USES** | `aws_acm_certificate` |
| `aws_resource` | **VIOLATES** | `aws_config_rule_finding` |
| `aws_resource` | **ALLOWS** | `aws_security_group` |
| `aws_resource` | **HAS** | `aws_health_event` |
| `aws_resource` | **HAS** | `aws_inspectorv2_finding` |
| `aws_resource` | **HAS** | `aws_securityhub_finding` |
| `aws_resource_explorer` | **HAS** | `aws_resource_explorer_index` |
| `aws_resource_explorer` | **HAS** | `aws_resource_explorer_view` |
| `aws_resource_explorer` | **USES** | `aws_vpc_endpoint` |
| `aws_route_table` | **USES** | `aws_prefix_list` |
| `aws_route53` | **HAS** | `aws_route53_domain` |
| `aws_route53` | **HAS** | `aws_route53_resolver_rule` |
| `aws_route53` | **HAS** | `aws_route53_zone` |
| `aws_route53_resolver_rule` | **USES** | `aws_vpc` |
| `aws_route53_zone` | **HAS** | `aws_route53_record` |
| `aws_s3` | **HAS** | `aws_s3_bucket` |
| `aws_s3_bucket` | **HAS** | `aws_macie_finding` |
| `aws_s3_bucket` | **HAS** | `aws_s3_access_point` |
| `aws_s3_bucket` | **USES** | `aws_kms_key` |
| `aws_s3_bucket` | **HAS** | `aws_s3_bucket_policy` |
| `aws_s3_bucket` | **NOTIFIES** | `aws_lambda_function` |
| `aws_s3_bucket` | **NOTIFIES** | `aws_sqs_queue` |
| `aws_s3_bucket` | **NOTIFIES** | `aws_sns_topic` |
| `aws_s3_bucket` | **ALLOWS** | `aws_account` |
| `aws_s3_bucket` | **ALLOWS** | `aws_s3` |
| `aws_s3_bucket` | **ALLOWS** | `aws_resource` |
| `aws_s3_bucket` | **DENIES** | `aws_resource` |
| `aws_s3_bucket` | **HAS** | `aws_s3_website_config` |
| `aws_s3_bucket` | **HAS** | `aws_s3_bucket_lifecycle_rule` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_notebook_instance` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_model` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_endpoint` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_domain` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_training_job` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_processing_job` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_transform_job` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_feature_group` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_model_quality_job_definition` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_model_bias_job_definition` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_inference_recommendations_job` |
| `aws_sagemaker` | **HAS** | `aws_sagemaker_pipeline_execution` |
| `aws_sagemaker_domain` | **USES** | `aws_iam_role` |
| `aws_sagemaker_domain` | **USES** | `aws_kms_key` |
| `aws_sagemaker_domain` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_domain` | **CONNECTS** | `aws_vpc` |
| `aws_sagemaker_domain` | **USES** | `aws_efs_file_system` |
| `aws_sagemaker_endpoint` | **USES** | `aws_iam_role` |
| `aws_sagemaker_endpoint` | **USES** | `aws_kms_key` |
| `aws_sagemaker_endpoint` | **USES** | `aws_sagemaker_model` |
| `aws_sagemaker_endpoint` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_endpoint` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_feature_group` | **USES** | `aws_iam_role` |
| `aws_sagemaker_feature_group` | **USES** | `aws_kms_key` |
| `aws_sagemaker_feature_group` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_inference_recommendations_job` | **USES** | `aws_iam_role` |
| `aws_sagemaker_model_bias_job_definition` | **USES** | `aws_iam_role` |
| `aws_sagemaker_model_bias_job_definition` | **USES** | `aws_kms_key` |
| `aws_sagemaker_model_quality_job_definition` | **USES** | `aws_iam_role` |
| `aws_sagemaker_model_quality_job_definition` | **USES** | `aws_kms_key` |
| `aws_sagemaker_processing_job` | **USES** | `aws_iam_role` |
| `aws_sagemaker_processing_job` | **USES** | `aws_kms_key` |
| `aws_sagemaker_processing_job` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_processing_job` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_training_job` | **USES** | `aws_iam_role` |
| `aws_sagemaker_training_job` | **USES** | `aws_kms_key` |
| `aws_sagemaker_training_job` | **CONNECTS** | `aws_subnet` |
| `aws_sagemaker_training_job` | **USES** | `aws_s3_bucket` |
| `aws_sagemaker_transform_job` | **USES** | `aws_sagemaker_model` |
| `aws_sagemaker_transform_job` | **USES** | `aws_kms_key` |
| `aws_sagemaker_transform_job` | **USES** | `aws_s3_bucket` |
| `aws_secret` | **HAS** | `aws_secret_version` |
| `aws_secret` | **USES** | `aws_kms_key` |
| `aws_secretsmanager` | **HAS** | `aws_secret` |
| `aws_security_agent_agent_space` | **CONTAINS** | `aws_security_agent_target_domain` |
| `aws_security_agent_agent_space` | **HAS** | `aws_security_agent_threat_model` |
| `aws_security_agent_agent_space` | **HAS** | `aws_security_agent_artifact` |
| `aws_security_agent_agent_space` | **USES** | `aws_iam_role` |
| `aws_security_agent_agent_space` | **USES** | `aws_kms_key` |
| `aws_security_agent_agent_space` | **USES** | `aws_s3_bucket` |
| `aws_security_agent_agent_space` | **USES** | `aws_secret` |
| `aws_security_agent_agent_space` | **USES** | `aws_vpc` |
| `aws_security_agent_agent_space` | **HAS** | `aws_cloudwatch_log_group` |
| `aws_security_agent_agent_space` | **USES** | `aws_lambda_function` |
| `aws_security_agent_agent_space` | **USES** | `aws_subnet` |
| `aws_security_agent_agent_space` | **USES** | `aws_security_group` |
| `aws_security_agent_application` | **USES** | `aws_kms_key` |
| `aws_security_agent_private_connection` | **USES** | `aws_vpc` |
| `aws_security_agent_threat_model` | **USES** | `aws_iam_role` |
| `aws_security_agent_threat_model` | **HAS** | `aws_cloudwatch_log_group` |
| `aws_security_group` | **PROTECTS** | `aws_batch_compute_environment` |
| `aws_security_group` | **PROTECTS** | `aws_cloudhsm_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_cloudhsm_instance` |
| `aws_security_group` | **PROTECTS** | `aws_instance` |
| `aws_security_group` | **ALLOWS** | `aws_resource` |
| `aws_security_group` | **PROTECTS** | `aws_eni` |
| `aws_security_group` | **HAS** | `aws_ec2_security_group_rule` |
| `aws_security_group` | **USES** | `aws_prefix_list` |
| `aws_security_group` | **ALLOWS** | `aws_prefix_list` |
| `aws_security_group` | **PROTECTS** | `aws_vpc_endpoint` |
| `aws_security_group` | **PROTECTS** | `aws_ecs_service` |
| `aws_security_group` | **PROTECTS** | `aws_efs_mount_target` |
| `aws_security_group` | **PROTECTS** | `aws_eks_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_elasticache_memcached_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_elasticache_cluster_node` |
| `aws_security_group` | **PROTECTS** | `aws_elb` |
| `aws_security_group` | **PROTECTS** | `aws_alb` |
| `aws_security_group` | **PROTECTS** | `aws_nlb` |
| `aws_security_group` | **PROTECTS** | `aws_elasticsearch_domain` |
| `aws_security_group` | **PROTECTS** | `aws_lambda_function` |
| `aws_security_group` | **PROTECTS** | `aws_neptune_database_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_neptune_database_instance` |
| `aws_security_group` | **PROTECTS** | `aws_rds_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_db_instance` |
| `aws_security_group` | **PROTECTS** | `aws_redshift_cluster` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_endpoint` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_domain` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_training_job` |
| `aws_security_group` | **PROTECTS** | `aws_sagemaker_processing_job` |
| `aws_securityagent` | **HAS** | `aws_security_agent_application` |
| `aws_securityagent` | **HAS** | `aws_security_agent_agent_space` |
| `aws_securityagent` | **HAS** | `aws_security_agent_target_domain` |
| `aws_securityagent` | **HAS** | `aws_security_agent_private_connection` |
| `aws_securityhub` | **HAS** | `aws_securityhub_account` |
| `aws_securityhub` | **HAS** | `aws_securityhub_standard` |
| `aws_securityhub_control` | **IDENTIFIED** | `aws_securityhub_finding` |
| `aws_securityhub_finding` | **CONNECTS** | `aws_securityhub_finding` |
| `aws_securityhub_standard` | **HAS** | `aws_securityhub_control` |
| `aws_securityhub_standard` | **IDENTIFIED** | `aws_securityhub_finding` |
| `aws_servicecatalog` | **HAS** | `aws_servicecatalog_portfolio` |
| `aws_servicecatalog` | **HAS** | `aws_servicecatalog_product` |
| `aws_servicecatalog` | **HAS** | `aws_servicecatalog_tag_option` |
| `aws_servicecatalog_portfolio` | **HAS** | `aws_servicecatalog_product` |
| `aws_servicecatalog_portfolio` | **HAS** | `aws_servicecatalog_constraint` |
| `aws_servicecatalog_portfolio` | **HAS** | `aws_servicecatalog_tag_option` |
| `aws_servicecatalog_product` | **HAS** | `aws_servicecatalog_provisioning_artifact` |
| `aws_servicecatalog_product` | **HAS** | `aws_servicecatalog_launch_path` |
| `aws_servicecatalog_product` | **HAS** | `aws_servicecatalog_tag_option` |
| `aws_ses` | **HAS** | `aws_ses_identity` |
| `aws_ses` | **HAS** | `aws_ses_configuration_set` |
| `aws_ses` | **HAS** | `aws_ses_receipt_filter` |
| `aws_ses_identity` | **USES** | `aws_ses_configuration_set` |
| `aws_session_document` | **USES** | `aws_s3_bucket` |
| `aws_session_document` | **USES** | `aws_cloudwatch_log_group` |
| `aws_session_document` | **USES** | `aws_kms_key` |
| `aws_shield` | **HAS** | `aws_shield_subscription` |
| `aws_shield` | **HAS** | `aws_shield_protection_group` |
| `aws_shield` | **HAS** | `aws_shield_protection` |
| `aws_shield_protection` | **PROTECTS** | `aws_resource` |
| `aws_shield_protection_group` | **PROTECTS** | `aws_resource` |
| `aws_shield_protection_group` | **HAS** | `aws_resource` |
| `aws_signer` | **HAS** | `aws_signer_signing_profile` |
| `aws_signer_signing_profile` | **HAS** | `aws_signer_signing_job` |
| `aws_sns` | **HAS** | `aws_sns_topic` |
| `aws_sns_topic` | **HAS** | `aws_sns_subscription` |
| `aws_sns_topic` | **USES** | `aws_kms_key` |
| `aws_sqs` | **HAS** | `aws_sqs_queue` |
| `aws_sqs_queue` | **SENDS** | `aws_sqs_queue` |
| `aws_sqs_queue` | **USES** | `aws_kms_key` |
| `aws_ssm` | **MANAGES** | `aws_instance` |
| `aws_ssm` | **HAS** | `aws_patch_baseline` |
| `aws_ssm` | **HAS** | `aws_patch_group` |
| `aws_ssm` | **MANAGES** | `aws_secure_string_parameter` |
| `aws_ssm` | **HAS** | `aws_session_document` |
| `aws_ssm` | **HAS** | `aws_ssm_document` |
| `aws_ssm` | **HAS** | `aws_ssm_compliance_summary` |
| `aws_ssm` | **HAS** | `aws_ssm_associations` |
| `aws_ssm_service_setting` | **MANAGES** | `aws_ssm` |
| `aws_sso` | **HAS** | `aws_sso_instance` |
| `aws_sso_group` | **ASSIGNED** | `aws_sso_permission_set` |
| `aws_sso_group` | **HAS** | `aws_sso_user` |
| `aws_sso_instance` | **HAS** | `aws_sso_application` |
| `aws_sso_instance` | **HAS** | `aws_sso_permission_set` |
| `aws_sso_instance` | **HAS** | `aws_sso_user` |
| `aws_sso_instance` | **HAS** | `aws_sso_group` |
| `aws_sso_user` | **ASSIGNED** | `aws_sso_permission_set` |
| `aws_states` | **HAS** | `aws_states_state_machine` |
| `aws_states_state_machine` | **USES** | `aws_iam_role` |
| `aws_states_state_machine` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_storage_gateway` | **HAS** | `aws_storage_gateway_gateway` |
| `aws_storage_gateway_file_share` | **USES** | `aws_iam_role` |
| `aws_storage_gateway_file_share` | **USES** | `aws_s3_bucket` |
| `aws_storage_gateway_file_share` | **USES** | `aws_kms_key` |
| `aws_storage_gateway_gateway` | **USES** | `aws_vpc_endpoint` |
| `aws_storage_gateway_gateway` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_storage_gateway_gateway` | **HAS** | `aws_storage_gateway_file_share` |
| `aws_storage_gateway_gateway` | **HAS** | `aws_storage_gateway_volume` |
| `aws_storage_gateway_gateway` | **HAS** | `aws_storage_gateway_tape` |
| `aws_storage_gateway_tape` | **USES** | `aws_kms_key` |
| `aws_storage_gateway_tape_pool` | **CONTAINS** | `aws_storage_gateway_tape` |
| `aws_storage_gateway_volume` | **USES** | `aws_kms_key` |
| `aws_subnet` | **HAS** | `aws_cloudhsm_instance` |
| `aws_subnet` | **HAS** | `aws_instance` |
| `aws_subnet` | **HAS** | `aws_nat_gateway` |
| `aws_subnet` | **USES** | `aws_route_table` |
| `aws_subnet` | **CONNECTS** | `aws_eni` |
| `aws_subnet` | **HAS** | `aws_efs_mount_target` |
| `aws_subnet` | **HAS** | `aws_elasticsearch_domain` |
| `aws_subnet` | **HAS** | `aws_lambda_function` |
| `aws_subnet` | **USES** | `aws_msk_cluster` |
| `aws_subnet` | **HAS** | `aws_workspace` |
| `aws_transfer` | **HAS** | `aws_transfer_server` |
| `aws_transfer_server` | **USES** | `aws_eip` |
| `aws_transfer_server` | **USES** | `aws_api_gateway_rest_api` |
| `aws_transfer_server` | **HAS** | `aws_transfer_user` |
| `aws_transfer_user` | **ALLOWS** | `aws_s3_bucket` |
| `aws_vpc` | **HAS** | `aws_cloudhsm_cluster` |
| `aws_vpc` | **HAS** | `aws_codebuild_project` |
| `aws_vpc` | **HAS** | `aws_vpn_gateway` |
| `aws_vpc` | **HAS** | `aws_internet_gateway` |
| `aws_vpc` | **HAS** | `aws_nat_gateway` |
| `aws_vpc` | **HAS** | `aws_network_acl` |
| `aws_vpc` | **HAS** | `aws_route_table` |
| `aws_vpc` | **HAS** | `aws_security_group` |
| `aws_vpc` | **CONTAINS** | `aws_subnet` |
| `aws_vpc` | **HAS** | `aws_vpc_endpoint` |
| `aws_vpc` | **HAS** | `aws_eks_cluster` |
| `aws_vpc` | **HAS** | `aws_elasticache_memcached_cluster` |
| `aws_vpc` | **HAS** | `aws_elasticache_cluster_node` |
| `aws_vpc` | **HAS** | `aws_elb` |
| `aws_vpc` | **HAS** | `aws_alb` |
| `aws_vpc` | **HAS** | `aws_nlb` |
| `aws_vpc` | **HAS** | `aws_glue_dev_endpoint` |
| `aws_vpc` | **HAS** | `aws_grafana_workspace` |
| `aws_vpc` | **HAS** | `aws_neptune_database_instance` |
| `aws_vpc` | **HAS** | `aws_db_instance` |
| `aws_vpc` | **HAS** | `aws_db_subnet_group` |
| `aws_vpc` | **HAS** | `aws_redshift_serverless_workgroup` |
| `aws_vpc` | **HAS** | `aws_redshift_cluster` |
| `aws_vpc` | **HAS** | `aws_s3_access_point` |
| `aws_vpc` | **HAS** | `aws_transfer_server` |
| `aws_vpc` | **CONNECTS** | `aws_vpc_lattice_service_network` |
| `aws_vpc` | **HAS** | `aws_opensearch_domain` |
| `aws_vpc_endpoint` | **CONNECTS** | `aws_security_agent_private_connection` |
| `aws_vpc_endpoint` | **HAS** | `aws_security_group` |
| `aws_vpc_endpoint` | **USES** | `aws_subnet` |
| `aws_vpc_endpoint` | **USES** | `aws_eni` |
| `aws_vpc_endpoint` | **CONNECTS** | `aws_auditmanager` |
| `aws_vpc_endpoint` | **CONNECTS** | `aws_vpc_lattice_service_network` |
| `aws_vpc_endpoint_service` | **ALLOWS** | `aws_resource` |
| `aws_vpc_endpoint_service` | **CONNECTS** | `aws_nlb` |
| `aws_vpc_endpoint_service` | **CONNECTS** | `aws_elb` |
| `aws_vpc_endpoint_service` | **CONNECTS** | `aws_vpc_endpoint` |
| `aws_vpc_lattice` | **HAS** | `aws_vpc_lattice_service` |
| `aws_vpc_lattice` | **HAS** | `aws_vpc_lattice_service_network` |
| `aws_vpc_lattice` | **HAS** | `aws_vpc_lattice_target_group` |
| `aws_vpc_lattice_listener_rule` | **DEFINES** | `aws_vpc_lattice_listener` |
| `aws_vpc_lattice_listener_rule` | **TRIGGERS** | `aws_vpc_lattice_target_group` |
| `aws_vpc_lattice_service` | **CONNECTS** | `aws_vpc_lattice_listener` |
| `aws_vpc_lattice_service_network` | **CONNECTS** | `aws_vpc_lattice_service` |
| `aws_vpc_lattice_target_group` | **HAS** | `aws_lambda_function` |
| `aws_vpc_lattice_target_group` | **HAS** | `aws_alb` |
| `aws_vpn_connection` | **CONNECTS** | `aws_customer_gateway` |
| `aws_vpn_gateway` | **CONNECTS** | `aws_vpn_connection` |
| `aws_waf` | **HAS** | `aws_waf_web_acl` |
| `aws_waf_v2_rule_group` | **HAS** | `aws_waf_v2_web_acl_rule` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_api_gateway_stage` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_cognito_user_pool` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_cloudfront_distribution` |
| `aws_waf_v2_web_acl` | **PROTECTS** | `aws_alb` |
| `aws_waf_v2_web_acl` | **HAS** | `aws_waf_v2_web_acl_rule` |
| `aws_waf_v2_web_acl` | **HAS** | `aws_waf_v2_web_acl_firewall_manager_rule_group` |
| `aws_waf_v2_web_acl` | **LOGS** | `aws_s3_bucket` |
| `aws_waf_v2_web_acl` | **LOGS** | `aws_firehose_delivery_stream` |
| `aws_waf_v2_web_acl` | **LOGS** | `aws_cloudwatch_log_group` |
| `aws_waf_v2_web_acl_rule` | **USES** | `aws_waf_v2_ip_set` |
| `aws_waf_v2_web_acl_rule` | **USES** | `aws_waf_v2_rule_group` |
| `aws_waf_web_acl` | **PROTECTS** | `aws_api_gateway_stage` |
| `aws_waf_web_acl` | **PROTECTS** | `aws_cloudfront_distribution` |
| `aws_wafv2` | **HAS** | `aws_waf_v2_web_acl` |
| `aws_wafv2` | **HAS** | `aws_waf_v2_ip_set` |
| `aws_wafv2` | **HAS** | `aws_waf_v2_rule_group` |
| `aws_workspace` | **USES** | `aws_workspaces_bundle` |
| `aws_workspaces` | **HAS** | `aws_workspace` |
| `aws_xray` | **HAS** | `aws_xray_group` |
| `aws_xray` | **HAS** | `aws_xray_encryption_config` |
| `aws_xray` | **HAS** | `aws_xray_resource_policy` |
| `aws_xray_encryption_config` | **USES** | `aws_kms_key` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `aws_accessanalyzer_finding` | **IDENTIFIED** | `aws_resource` | FORWARD |
| `aws_account` | **HAS** | `aws_account` | FORWARD |
| `aws_account` | **ALLOWS** | `aws_ami` | FORWARD |
| `aws_account` | **DENIES** | `aws_ami` | FORWARD |
| `aws_account` | **SHARED** | `aws_db_snapshot` | REVERSE |
| `aws_account` | **SHARED** | `aws_db_cluster_snapshot` | REVERSE |
| `aws_account` | **OWNS** | `aws_sso_instance` | REVERSE |
| `aws_acm_certificate` | **CONNECTS** | `aws_route53_record` | FORWARD |
| `aws_api_gateway_domain_name` | **HAS** | `aws_acm_certificate` | FORWARD |
| `aws_api_gateway_rest_api` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_api_gateway_rest_api` | **DENIES** | `aws_resource` | FORWARD |
| `aws_autoscaling_launch_configuration` | **USES** | `aws_ami` | FORWARD |
| `aws_backup_vault` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_backup_vault` | **DENIES** | `aws_resource` | FORWARD |
| `aws_batch_compute_environment` | **USES** | `aws_ami` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_s3_bucket` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_api_gateway_rest_api` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_api_gateway_domain_name` | FORWARD |
| `aws_cloudfront_distribution` | **CONNECTS** | `aws_resource` | FORWARD |
| `aws_cloudtrail` | **LOGS** | `aws_s3_bucket` | FORWARD |
| `aws_cloudtrail` | **LOGS** | `aws_cloudwatch_log_group` | FORWARD |
| `aws_cloudtrail` | **SENDS** | `aws_s3` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_lambda` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_dynamodb` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_s3_bucket` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_lambda_function` | REVERSE |
| `aws_cloudtrail` | **SENDS** | `aws_dynamodb_table` | REVERSE |
| `aws_cloudwatch_event_rule` | **TRIGGERS** | `aws_resource` | FORWARD |
| `aws_codeartifact_domain` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_codeartifact_domain` | **DENIES** | `aws_resource` | FORWARD |
| `aws_codeartifact_repository` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_codeartifact_repository` | **DENIES** | `aws_resource` | FORWARD |
| `aws_datasync_location` | **CONNECTS** | `aws_s3_bucket` | FORWARD |
| `aws_datasync_location` | **CONNECTS** | `aws_efs_file_system` | FORWARD |
| `aws_datasync_location` | **CONNECTS** | `aws_fsx_file_system` | FORWARD |
| `aws_datasync_task` | **USES** | `aws_cloudwatch_log_group` | FORWARD |
| `aws_dynamodb_table` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_dynamodb_table` | **DENIES** | `aws_resource` | FORWARD |
| `aws_ec2` | **HAS** | `aws_ec2_transit_gateway` | FORWARD |
| `aws_ec2_transit_gateway_vpc_attachment` | **USES** | `aws_vpc` | FORWARD |
| `aws_ecr_repository` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_ecr_repository` | **DENIES** | `aws_resource` | REVERSE |
| `aws_ecs_task` | **USES** | `aws_eni` | FORWARD |
| `aws_efs_file_system` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_efs_file_system` | **DENIES** | `aws_resource` | FORWARD |
| `aws_eks_cluster` | **ALLOWS** | `internet` | REVERSE |
| `aws_elasticsearch_domain` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_elasticsearch_domain` | **DENIES** | `aws_resource` | REVERSE |
| `aws_firewall_rule_group` | **USES** | `aws_prefix_list` | FORWARD |
| `aws_fms_resource_set` | **HAS** | `aws_resource` | FORWARD |
| `aws_glacier_vault` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_glacier_vault` | **DENIES** | `aws_resource` | FORWARD |
| `aws_glue_catalog_database` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_glue_catalog_database` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_group_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_group_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_role` | **ASSIGNED** | `aws_auditmanager_setting` | REVERSE |
| `aws_iam_role` | **ASSIGNED** | `aws_auditmanager_delegation` | REVERSE |
| `aws_iam_role` | **ASSIGNED** | `aws_datasync_location` | FORWARD |
| `aws_iam_role` | **TRUSTS** | `aws_resource` | FORWARD |
| `aws_iam_role` | **TRUSTS** | `external_resource` | FORWARD |
| `aws_iam_role` | **USES** | `aws_neptune_analytics_graph_export_task` | REVERSE |
| `aws_iam_role` | **USES** | `aws_neptune_analytics_graph_import_task` | REVERSE |
| `aws_iam_role_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_role_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_iam_saml_provider` | **IS** | `external_resource` | FORWARD |
| `aws_iam_user_policy` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_iam_user_policy` | **DENIES** | `aws_resource` | FORWARD |
| `aws_inspectorv2_finding` | **IS** | `cve` | FORWARD |
| `aws_instance` | **USES** | `aws_ami` | FORWARD |
| `aws_instance_patch_state` | **GENERATED** | `aws_patch_baseline` | REVERSE |
| `aws_kinesis_stream` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_kinesis_stream` | **DENIES** | `aws_resource` | FORWARD |
| `aws_kms_key` | **USES** | `aws_auditmanager_setting` | REVERSE |
| `aws_kms_key` | **USES** | `aws_eventbridge_event_bus` | REVERSE |
| `aws_kms_key` | **USES** | `aws_cloudwatch_log_group` | REVERSE |
| `aws_kms_key` | **USES** | `aws_dynamodb_table` | REVERSE |
| `aws_kms_key` | **USES** | `aws_keyspaces_table` | REVERSE |
| `aws_kms_key` | **USES** | `aws_ebs_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_ebs_volume` | REVERSE |
| `aws_kms_key` | **USES** | `aws_efs_file_system` | REVERSE |
| `aws_kms_key` | **USES** | `aws_elasticache_redis_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_elasticache_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_glue_security_configuration` | REVERSE |
| `aws_kms_key` | **USES** | `aws_guardduty_publishing_destination` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_database_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_database_instance` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph_export_task` | REVERSE |
| `aws_kms_key` | **USES** | `aws_neptune_analytics_graph_import_task` | REVERSE |
| `aws_kms_key` | **USES** | `aws_rds_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_db_instance` | REVERSE |
| `aws_kms_key` | **USES** | `aws_db_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_db_cluster_snapshot` | REVERSE |
| `aws_kms_key` | **USES** | `aws_redshift_cluster` | REVERSE |
| `aws_kms_key` | **USES** | `aws_s3_bucket` | REVERSE |
| `aws_kms_key` | **USES** | `aws_sns_topic` | REVERSE |
| `aws_kms_key` | **USES** | `aws_xray_encryption_config` | REVERSE |
| `aws_kms_key` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_kms_key` | **DENIES** | `aws_resource` | FORWARD |
| `aws_lambda_function` | **USES** | `aws_lambda_layer` | FORWARD |
| `aws_lambda_function` | **USES** | `aws_signer_signing_profile` | FORWARD |
| `aws_lambda_function` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_lambda_function` | **DENIES** | `aws_resource` | FORWARD |
| `aws_launch_template_version` | **USES** | `aws_ami` | FORWARD |
| `aws_lb_target_group` | **HAS** | `aws_eip` | FORWARD |
| `aws_lexv2_bot` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_lexv2_bot` | **DENIES** | `aws_resource` | FORWARD |
| `aws_lexv2_bot_alias` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_lexv2_bot_alias` | **DENIES** | `aws_resource` | FORWARD |
| `aws_macie_classification_export_configuration` | **USES** | `aws_s3_bucket` | FORWARD |
| `aws_macie_classification_export_configuration` | **USES** | `aws_kms_key` | FORWARD |
| `aws_macie_classification_job` | **SCANS** | `aws_s3_bucket` | FORWARD |
| `aws_nat_gateway` | **USES** | `aws_eip` | FORWARD |
| `aws_network_acl` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_network_acl` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_network_acl` | **DENIES** | `aws_resource` | FORWARD |
| `aws_network_acl` | **DENIES** | `aws_resource` | REVERSE |
| `aws_opensearch_domain` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_opensearch_domain` | **DENIES** | `aws_resource` | REVERSE |
| `aws_organization_policy` | **ENFORCES** | `aws_organization_root` | FORWARD |
| `aws_organization_policy` | **ENFORCES** | `aws_account` | FORWARD |
| `aws_organization_policy` | **ENFORCES** | `aws_organizational_unit` | FORWARD |
| `aws_organization_root` | **HAS** | `aws_account` | FORWARD |
| `aws_organizational_unit` | **HAS** | `aws_account` | FORWARD |
| `aws_patch_group` | **USES** | `aws_patch_baseline` | FORWARD |
| `aws_prometheus_scraper` | **SCANS** | `aws_eks_cluster` | FORWARD |
| `aws_prometheus_scraper` | **USES** | `aws_subnet` | FORWARD |
| `aws_prometheus_scraper` | **USES** | `aws_security_group` | FORWARD |
| `aws_prometheus_scraper` | **USES** | `aws_iam_role` | FORWARD |
| `aws_prometheus_scraper` | **SENDS** | `aws_prometheus_workspace` | FORWARD |
| `aws_prometheus_workspace` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_prometheus_workspace` | **DENIES** | `aws_resource` | FORWARD |
| `aws_ram_shared_resource` | **IS** | `aws_resource` | FORWARD |
| `aws_resource` | **USES** | `aws_acm_certificate` | REVERSE |
| `aws_route_table` | **USES** | `aws_prefix_list` | FORWARD |
| `aws_route53_record` | **CONNECTS** | `aws_acm_certificate` | REVERSE |
| `aws_route53_record` | **CONNECTS** | `aws_ses` | FORWARD |
| `aws_route53_record` | **CONNECTS** | `aws_resource` | FORWARD |
| `aws_s3_bucket` | **USES** | `aws_auditmanager_setting` | REVERSE |
| `aws_s3_bucket` | **HAS** | `aws_s3_access_point` | REVERSE |
| `aws_s3_bucket` | **PUBLISHES** | `aws_s3_bucket` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_account` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_account` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `everyone` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `everyone` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `aws_authenticated_users` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_authenticated_users` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `aws_s3` | FORWARD |
| `aws_s3_bucket` | **ALLOWS** | `aws_s3` | REVERSE |
| `aws_s3_bucket` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_s3_bucket` | **DENIES** | `aws_resource` | REVERSE |
| `aws_secret` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_secret` | **DENIES** | `aws_resource` | FORWARD |
| `aws_security_group` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_security_group` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_security_group` | **USES** | `aws_prefix_list` | FORWARD |
| `aws_security_group` | **ALLOWS** | `aws_prefix_list` | FORWARD |
| `aws_servicecatalog_portfolio` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_ses_identity` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_ses_identity` | **DENIES** | `aws_resource` | FORWARD |
| `aws_sns_subscription` | **HAS** | `aws_resource` | FORWARD |
| `aws_sns_topic` | **USES** | `aws_auditmanager_setting` | REVERSE |
| `aws_sns_topic` | **NOTIFIES** | `aws_resource` | FORWARD |
| `aws_sns_topic` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_sns_topic` | **DENIES** | `aws_resource` | REVERSE |
| `aws_sqs_queue` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_sqs_queue` | **DENIES** | `aws_resource` | REVERSE |
| `aws_sso_group` | **ASSIGNED** | `aws_account` | FORWARD |
| `aws_sso_permission_set` | **ASSIGNED** | `aws_iam_policy` | FORWARD |
| `aws_sso_permission_set` | **ASSIGNED** | `aws_account` | FORWARD |
| `aws_sso_user` | **ASSIGNED** | `aws_account` | FORWARD |
| `aws_vpc` | **LOGS** | `aws_cloudwatch_log_group` | FORWARD |
| `aws_vpc` | **LOGS** | `aws_s3_bucket` | FORWARD |
| `aws_vpc` | **CONNECTS** | `aws_vpc` | FORWARD |
| `aws_vpc` | **CONNECTS** | `aws_vpc` | REVERSE |
| `aws_vpc_endpoint` | **ALLOWS** | `aws_resource` | FORWARD |
| `aws_vpc_endpoint` | **ALLOWS** | `aws_resource` | REVERSE |
| `aws_vpc_endpoint` | **DENIES** | `aws_resource` | FORWARD |
| `aws_vpc_endpoint` | **DENIES** | `aws_resource` | REVERSE |

### Aws Api Gateway Stage Method Setting

`aws_api_gateway_stage_method_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cacheTtlInSeconds` | `number` |  |  |
| `isAuthorizationForCacheControlRequired` | `boolean` |  |  |
| `isCacheDataEncrypted` | `boolean` |  |  |
| `isCachingEnabled` | `boolean` |  |  |
| `isDataTraceEnabled` | `boolean` |  |  |
| `isMetricsEnabled` | `boolean` |  |  |
| `loggingLevel` | `string` |  |  |
| `methodPath` | `string` |  |  |
| `throttlingBurstLimit` | `number` |  |  |
| `throttlingRateLimit` | `number` |  |  |
| `unauthorizedCacheControlHeaderStrategy` | `string` |  |  |

---

### Aws Appconfig Account Settings

`aws_appconfig_account_settings` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns these settings. |  |
| 

`deletionProtectionPeriodInMinutes` \*

 | `number` **|** `null` | The interval, in minutes, during which AppConfig monitors for configuration retrieval before allowing deletion of a configuration profile or environment. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | Whether deletion protection is enabled for the account in this region, preventing deletion of actively-used environments and configuration profiles. |  |
| 

`isVendedMetricsEnabled` \*

 | `boolean` **|** `null` | Whether AppConfig publishes vended CloudWatch metrics for the account in this region. |  |
| 

`region` \*

 | `string` | AWS region these account settings apply to. |  |

---

### Aws Appconfig Application

`aws_appconfig_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig application. |  |
| 

`region` \*

 | `string` | AWS region where the application is deployed. |  |

---

### Aws Appconfig Configuration Profile

`aws_appconfig_configuration_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig configuration profile. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt configuration data at rest. |  |
| 

`kmsKeyIdentifier` \*

 | `string` **|** `null` | KMS key identifier (alias or key ID) used for encryption. |  |
| 

`locationUri` \*

 | `string` **|** `null` | URI pointing to the source of configuration data (S3 URI, SSM parameter, or hosted). |  |
| 

`region` \*

 | `string` | AWS region where the profile is deployed. |  |
| 

`retrievalRoleArn` \*

 | `string` **|** `null` | IAM role ARN that AppConfig uses to retrieve configuration from the location URI. |  |
| 

`type` \*

 | `string` **|** `null` | The type of the configuration profile (AWS.AppConfig.FeatureFlags or AWS.Freeform). |  |
| 

`validatorTypes` \*

 | `array` **|** `null` | List of validator types attached to this profile (JSON\_SCHEMA, LAMBDA). |  |

---

### Aws Appconfig Deployment

`aws_appconfig_deployment` inherits from [Deployment](/data-model/schemas/Deployment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig deployment. |  |
| 

`configurationLocationUri` \*

 | `string` **|** `null` | URI of the configuration source used in this deployment. |  |
| 

`configurationName` \*

 | `string` **|** `null` | Name of the configuration profile used in this deployment. |  |
| 

`deploymentNumber` \*

 | `number` | The sequence number of this deployment within the environment. |  |
| 

`deploymentStrategyId` \*

 | `string` **|** `null` | ID of the deployment strategy used for this deployment. |  |
| 

`environmentId` \*

 | `string` | The ID of the environment to which the configuration was deployed. |  |
| 

`extensionId` \*

 | `string` **|** `null` | ID of the AppConfig extension associated with this deployment. |  |
| 

`finalBakeTimeInMinutes` \*

 | `number` **|** `null` | Bake time in minutes applied during this deployment. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt configuration data for this deployment. |  |
| 

`kmsKeyIdentifier` \*

 | `string` **|** `null` | KMS key identifier used during this deployment. |  |
| 

`region` \*

 | `string` | AWS region where the deployment was executed. |  |
| 

`versionLabel` \*

 | `string` **|** `null` | Customer-defined version label for the configuration version deployed. |  |

---

### Aws Appconfig Deployment Strategy

`aws_appconfig_deployment_strategy` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the AppConfig deployment strategy. |  |
| 

`finalBakeTimeInMinutes` \*

 | `number` **|** `null` | Additional time in minutes to monitor after a deployment completes before it is considered successful. |  |
| 

`region` \*

 | `string` | AWS region where the deployment strategy is defined. |  |
| 

`replicateTo` \*

 | `string` **|** `null` | Whether to replicate the deployment strategy to AWS Systems Manager (SSM\_DOCUMENT) or not (NONE). |  |

---

### Aws Appconfig Environment

`aws_appconfig_environment` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alarmArn` \*

 | `string` **|** `null` | ARN of the CloudWatch alarm monitoring this environment. |  |
| 

`alarmRoleArn` \*

 | `string` **|** `null` | IAM role ARN used by AppConfig to evaluate CloudWatch alarms for this environment. |  |
| 

`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the AppConfig environment. |  |
| 

`region` \*

 | `string` | AWS region where the environment is deployed. |  |
| 

`state` \*

 | `string` **|** `null` | The current state of the environment (e.g. READY\_FOR\_DEPLOYMENT, DEPLOYING, ROLLED\_BACK). |  |

---

### Aws Appconfig Hosted Configuration Version

`aws_appconfig_hosted_configuration_version` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` | The ID of the parent AppConfig application. |  |
| 

`arn` \*

 | `string` | The ARN of the hosted configuration version. |  |
| 

`configurationProfileId` \*

 | `string` | The ID of the configuration profile this version belongs to. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt this hosted configuration version. |  |
| 

`region` \*

 | `string` | AWS region where the hosted configuration version is stored. |  |
| 

`versionNumber` \*

 | `number` | The version number of this hosted configuration version. |  |

---

### Aws Athena Work Group

`aws_athena_work_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`additionalConfiguration` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`bytesScannedCutoffPerQuery` \*

 | `number` **|** `null` |  |  |
| 

`customerContentEncryptionKmsKey` \*

 | `string` **|** `null` |  |  |
| 

`encrypted` \*

 | `boolean` |  |  |
| 

`encryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`engineVersionEffective` \*

 | `string` **|** `null` |  |  |
| 

`engineVersionSelected` \*

 | `string` **|** `null` |  |  |
| 

`executionRole` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterApplicationArn` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isEnforceWorkGroupConfiguration` \*

 | `boolean` **|** `null` |  |  |
| 

`isIdentityCenterEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isMinimumEncryptionEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublishCloudWatchMetricsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isRequesterPaysEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resultAclConfiguration` \*

 | `string` **|** `null` |  |  |
| 

`resultEncryptionKmsKey` \*

 | `string` **|** `null` |  |  |
| 

`resultEncryptionOption` \*

 | `string` **|** `null` |  |  |
| 

`resultExpectedBucketOwner` \*

 | `string` **|** `null` |  |  |
| 

`resultOutputLocation` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Auditmanager Assessment

`aws_auditmanager_assessment` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`assessmentReportDestination` \*

 | `string` **|** `null` |  |  |
| 

`awsAccountEmailAddress` \*

 | `string` **|** `null` |  |  |
| 

`awsAccountId` \*

 | `string` **|** `null` |  |  |
| 

`awsAccountName` \*

 | `string` **|** `null` |  |  |
| 

`complianceType` \*

 | `string` **|** `null` |  |  |
| 

`delegationsCount` \*

 | `number` |  |  |
| 

`frameworkArn` \*

 | `string` **|** `null` |  |  |
| 

`frameworkDescription` \*

 | `string` **|** `null` |  |  |
| 

`frameworkId` \*

 | `string` **|** `null` |  |  |
| 

`frameworkName` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`rolesCount` \*

 | `number` |  |  |
| 

`scopeAwsAccounts` \*

 | `array` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |

---

### Aws Auditmanager Control

`aws_auditmanager_control` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`actionPlanInstructions` \*

 | `string` **|** `null` |  |  |
| 

`actionPlanTitle` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`controlMappingSourcesCount` \*

 | `number` |  |  |
| 

`controlSources` \*

 | `string` **|** `null` |  |  |
| 

`createdBy` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastUpdatedBy` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`testingInformation` \*

 | `string` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Aws Auditmanager Delegation

`aws_auditmanager_delegation` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`assessmentId` \*

 | `string` **|** `null` |  |  |
| 

`assessmentName` \*

 | `string` **|** `null` |  |  |
| 

`controlSetName` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Auditmanager Evidence Folder

`aws_auditmanager_evidence_folder` inherits from [DataObject](/data-model/schemas/DataObject.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assessmentId` \*

 | `string` |  |  |
| 

`assessmentReportSelectionCount` \*

 | `number` |  |  |
| 

`author` \*

 | `string` **|** `null` |  |  |
| 

`controlId` \*

 | `string` |  |  |
| 

`controlName` \*

 | `string` **|** `null` |  |  |
| 

`controlSetId` \*

 | `string` |  |  |
| 

`dataSource` \*

 | `string` **|** `null` |  |  |
| 

`evidenceAwsServiceSourceCount` \*

 | `number` |  |  |
| 

`evidenceByTypeComplianceCheckCount` \*

 | `number` |  |  |
| 

`evidenceByTypeComplianceCheckIssuesCount` \*

 | `number` |  |  |
| 

`evidenceByTypeConfigurationDataCount` \*

 | `number` |  |  |
| 

`evidenceByTypeManualCount` \*

 | `number` |  |  |
| 

`evidenceByTypeUserActivityCount` \*

 | `number` |  |  |
| 

`evidenceResourcesIncludedCount` \*

 | `number` |  |  |
| 

`firstEvidenceAddedOn` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`totalEvidence` \*

 | `number` |  |  |

---

### Aws Auditmanager Framework

`aws_auditmanager_framework` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`complianceType` \*

 | `string` **|** `null` |  |  |
| 

`controlsCount` \*

 | `number` |  |  |
| 

`controlSetIds` \*

 | `array` **|** `null` |  |  |
| 

`controlSetsCount` \*

 | `number` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`logo` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Auditmanager Setting

`aws_auditmanager_setting` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`defaultAssessmentReportsDestination` \*

 | `string` **|** `null` |  |  |
| 

`defaultAssessmentReportsDestinationBucketName` \*

 | `string` **|** `null` |  |  |
| 

`defaultAssessmentReportsDestinationType` \*

 | `string` **|** `null` |  |  |
| 

`defaultExportDestination` \*

 | `string` **|** `null` |  |  |
| 

`defaultExportDestinationBucketName` \*

 | `string` **|** `null` |  |  |
| 

`defaultExportDestinationType` \*

 | `string` **|** `null` |  |  |
| 

`defaultProcessOwnerRoleArns` \*

 | `array` **|** `null` |  |  |
| 

`deregistrationDeleteResources` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderBackfillStatus` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderEnablementStatus` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderError` \*

 | `string` **|** `null` |  |  |
| 

`evidenceFinderEventDataStoreArn` \*

 | `string` **|** `null` |  |  |
| 

`isAwsOrgEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isDefaultKmsKey` \*

 | `boolean` **|** `null` |  |  |
| 

`isEvidenceFinderEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`snsTopicArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Bedrock Agent

`aws_bedrock_agent` inherits from [Function](/data-model/schemas/Function.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentCollaboration` \*

 | `string` **|** `null` | Multi-agent collaboration mode (e.g., DISABLED, SUPERVISOR) |  |
| `agentId` | `string` | Unique identifier for the Bedrock agent |  |
| `arn` | `string` | ARN of the Bedrock agent |  |
| 

`customerEncryptionKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt agent resources |  |
| 

`displayName` \*

 | `string` | Display name of the Bedrock agent |  |
| 

`foundationModel` \*

 | `string` **|** `null` | Foundation model identifier used by the agent |  |
| 

`guardrailId` \*

 | `string` **|** `null` | ID of the Bedrock guardrail associated with this agent |  |
| 

`hasInstruction` \*

 | `boolean` **|** `null` | Whether the agent has a system instruction configured; true if instruction text is present |  |
| 

`idleSessionTTLInSeconds` \*

 | `number` **|** `null` | Time in seconds before an idle session expires |  |
| 

`instruction` \*

 | `string` **|** `null` | System instruction prompt given to the agent |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the agent is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`isGuardrailAssociated` \*

 | `boolean` **|** `null` | Whether a guardrail is associated with this agent; true means content filtering is active |  |
| 

`isMemoryEnabled` \*

 | `boolean` **|** `null` | Whether the agent retains memory across sessions |  |
| 

`name` \*

 | `string` | Name of the Bedrock agent |  |
| 

`orchestrationType` \*

 | `string` **|** `null` | Orchestration strategy used by the agent (e.g., DEFAULT, CUSTOM\_ORCHESTRATION) |  |
| `preparedOn` | `number` | Timestamp (epoch ms) when the agent was last prepared |  |
| 

`region` \*

 | `string` | AWS region where the agent is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM role assumed by the agent for API calls |  |

---

### Aws Bedrock Agent Action Group

`aws_bedrock_agent_action_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`actionGroupExecutor` \*

 | `string` **|** `null` | Type of executor for the action group (e.g., LAMBDA, RETURN\_CONTROL) |  |
| `actionGroupId` | `string` | Unique identifier for the action group |  |
| `agentId` | `string` | ID of the parent Bedrock agent that owns this action group |  |
| 

`apiSchemaS3Uri` \*

 | `string` **|** `null` | S3 URI of the OpenAPI schema defining the action group API |  |
| 

`apiSchemaType` \*

 | `string` **|** `null` | Type of API schema used (e.g., S3, INLINE) |  |
| 

`displayName` \*

 | `string` | Display name of the action group |  |
| 

`functionCount` \*

 | `number` **|** `null` | Number of functions defined in the action group |  |
| 

`functionNames` \*

 | `array` **|** `null` | Names of functions defined in the action group function schema |  |
| 

`isLambdaBacked` \*

 | `boolean` **|** `null` | Whether this action group executes via a Lambda function; true means external code execution |  |
| 

`isReturnControl` \*

 | `boolean` **|** `null` | Whether the action group returns control to the caller instead of executing directly |  |
| 

`lambdaFunctionArn` \*

 | `string` **|** `null` | ARN of the Lambda function invoked by this action group |  |
| 

`name` \*

 | `string` | Name of the action group |  |
| 

`parentActionGroupSignature` \*

 | `string` **|** `null` | Signature of a built-in parent action group (e.g., AMAZON.UserInput, AMAZON.CodeInterpreter) |  |
| 

`region` \*

 | `string` | AWS region where the action group is defined |  |

---

### Aws Bedrock Agent Runtime

`aws_bedrock_agent_runtime` inherits from [Workload](/data-model/schemas/Workload.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentRuntimeId` \*

 | `string` **|** `null` |  |  |
| 

`agentRuntimeVersion` \*

 | `string` **|** `null` |  |  |
| `arn` | `string` |  |  |
| 

`failureReason` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublicNetwork` \*

 | `boolean` **|** `null` |  |  |
| 

`isVpcConfigured` \*

 | `boolean` **|** `null` |  |  |
| 

`networkMode` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`serverProtocol` \*

 | `string` **|** `null` |  |  |
| 

`subnetIds` \*

 | `array` **|** `null` |  |  |

---

### Aws Bedrock Api Key

`aws_bedrock_api_key` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiKeyId` \*

 | `string` | IAM ServiceSpecificCredentialId — unique identifier for the API key |  |
| 

`isAutoCreatedUser` \*

 | `boolean` **|** `null` | True when the owning IAM user was auto-created by AWS for this key (UserName starts with "BedrockAPIKey-") |  |
| 

`isExpired` \*

 | `boolean` **|** `null` | True when the API key has reached its expiration date |  |
| 

`isNeverExpiring` \*

 | `boolean` **|** `null` | True when the API key was created without an expiration date — long-lived credential risk |  |
| 

`region` \*

 | `string` | Region label - API keys are global; set to "global" for the entity |  |
| 

`serviceCredentialAlias` \*

 | `string` **|** `null` | Public, non-secret prefix of the bearer token; safe to display |  |
| 

`serviceName` \*

 | `string` | AWS service the credential is scoped to (always bedrock.amazonaws.com) |  |
| 

`serviceUserName` \*

 | `string` **|** `null` | Service-side username generated by IAM for the key |  |
| `status` | `string` | Lifecycle status — Active, Inactive, or Expired |  |
| 

`userName` \*

 | `string` | IAM user that owns the API key |  |

---

### Aws Bedrock Api Key Credential Provider

`aws_bedrock_api_key_credential_provider` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiKeySecretArn` \*

 | `string` **|** `null` | ARN of the Secrets Manager secret holding the API key (ARN only, never the value) |  |
| `arn` | `string` |  |  |
| 

`credentialProviderArn` \*

 | `string` **|** `null` | ARN of the API key credential provider |  |
| 

`region` \*

 | `string` | AWS region where the credential provider is deployed |  |

---

### Aws Bedrock Browser

`aws_bedrock_browser` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`failureReason` \*

 | `string` **|** `null` | Reason the browser entered a failed state, if any |  |
| 

`isPublicNetwork` \*

 | `boolean` **|** `null` | Whether the browser egresses over the public network |  |
| 

`isRecordingEnabled` \*

 | `boolean` **|** `null` | Whether browser session recording to S3 is enabled for the browser |  |
| 

`isVpcConfigured` \*

 | `boolean` **|** `null` | Whether the browser is configured with a VPC |  |
| 

`networkMode` \*

 | `string` **|** `null` | Network mode of the browser (PUBLIC or VPC) |  |
| 

`recordingS3Bucket` \*

 | `string` **|** `null` | Name of the S3 bucket browser session recordings are written to |  |
| 

`recordingS3Prefix` \*

 | `string` **|** `null` | S3 key prefix under which browser session recordings are written |  |
| 

`region` \*

 | `string` | AWS region where the browser is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM execution role the browser assumes |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Security group IDs attached to the browser VPC config |  |
| 

`subnetIds` \*

 | `array` **|** `null` | Subnet IDs attached to the browser VPC config |  |

---

### Aws Bedrock Browser Profile

`aws_bedrock_browser_profile` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`lastSavedBrowserId` \*

 | `string` **|** `null` | Identifier of the browser whose session data was last saved to the profile |  |
| 

`lastSavedBrowserSessionId` \*

 | `string` **|** `null` | Identifier of the browser session whose data was last saved to the profile |  |
| 

`lastSavedOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) browser session data was last saved to the profile |  |
| 

`region` \*

 | `string` | AWS region where the browser profile is deployed |  |

---

### Aws Bedrock Code Interpreter

`aws_bedrock_code_interpreter` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`codeInterpreterId` \*

 | `string` **|** `null` |  |  |
| 

`failureReason` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isPublicNetwork` \*

 | `boolean` **|** `null` |  |  |
| 

`isSandboxed` \*

 | `boolean` **|** `null` |  |  |
| 

`isVpcConfigured` \*

 | `boolean` **|** `null` |  |  |
| 

`networkMode` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`subnetIds` \*

 | `array` **|** `null` |  |  |

---

### Aws Bedrock Custom Model

`aws_bedrock_custom_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the custom model |  |
| 
`baseModelArn` \*

 | `string` **|** `null` | ARN of the foundation model used as the base for customization |  |
| 

`customizationType` \*

 | `string` **|** `null` | Type of customization applied (e.g., FINE\_TUNING, CONTINUED\_PRE\_TRAINING) |  |
| 

`displayName` \*

 | `string` | Display name of the custom model |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the custom model is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`jobArn` \*

 | `string` **|** `null` | ARN of the model customization job that produced this model |  |
| `modelId` | `string` | Unique identifier for the custom model |  |
| 

`modelKmsKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt the custom model |  |
| 

`name` \*

 | `string` | Name of the custom model |  |
| 

`outputDataConfigS3Uri` \*

 | `string` **|** `null` | S3 URI where training output artifacts are stored |  |
| 

`region` \*

 | `string` | AWS region where the custom model is stored |  |
| 

`trainingDataConfigS3Uri` \*

 | `string` **|** `null` | S3 URI of the training dataset used to create the custom model |  |

---

### Aws Bedrock Evaluation Job

`aws_bedrock_evaluation_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationType` \*

 | `string` **|** `null` |  |  |
| `arn` | `string` |  |  |
| 

`customerEncryptionKeyId` \*

 | `string` **|** `null` |  |  |
| 

`evaluationDatasets` \*

 | `array` **|** `null` |  |  |
| 

`evaluationMetrics` \*

 | `array` **|** `null` |  |  |
| 

`failureMessages` \*

 | `array` **|** `null` |  |  |
| 

`isAutomatedEvaluation` \*

 | `boolean` **|** `null` |  |  |
| 

`isHumanEvaluation` \*

 | `boolean` **|** `null` |  |  |
| 

`isModelInference` \*

 | `boolean` **|** `null` |  |  |
| 

`isRagInference` \*

 | `boolean` **|** `null` |  |  |
| 

`jobDescription` \*

 | `string` **|** `null` |  |  |
| 

`jobName` \*

 | `string` **|** `null` |  |  |
| 

`jobType` \*

 | `string` **|** `null` |  |  |
| `lastModifiedOn` | `number` | Timestamp (epoch ms) when the evaluation job was last modified |  |
| 

`modelIdentifiers` \*

 | `array` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`outputDataConfigS3Uri` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`taskType` \*

 | `string` **|** `null` |  |  |

---

### Aws Bedrock Evaluator

`aws_bedrock_evaluator` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`isLockedForModification` \*

 | `boolean` **|** `null` | Whether the evaluator is locked because an active config references it |  |
| 

`level` \*

 | `string` **|** `null` | Evaluation scope level (TOOL\_CALL, TRACE, or SESSION) |  |
| 

`region` \*

 | `string` | AWS region where the evaluator is deployed |  |

---

### Aws Bedrock Flow

`aws_bedrock_flow` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the Bedrock flow |  |
| 
`connectionCount` \*

 | `number` **|** `null` | Number of connections between nodes in the flow |  |
| 

`customerEncryptionKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt flow resources |  |
| 

`displayName` \*

 | `string` | Display name of the flow |  |
| `flowId` | `string` | Unique identifier for the flow |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the flow is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`name` \*

 | `string` | Name of the flow |  |
| 

`nodeCount` \*

 | `number` **|** `null` | Number of nodes in the flow definition |  |
| 

`region` \*

 | `string` | AWS region where the flow is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM role assumed by the flow during execution |  |
| 

`version` \*

 | `string` **|** `null` | Version identifier of the flow |  |

---

### Aws Bedrock Foundation Model

`aws_bedrock_foundation_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agreementStatus` \*

 | `string` **|** `null` | Whether the end user license agreement for the model has been accepted in this account (e.g., AVAILABLE, NOT\_AVAILABLE, ERROR) |  |
| `arn` | `string` | ARN of the foundation model |  |
| 

`authorizationStatus` \*

 | `string` **|** `null` | Whether the account is authorized to invoke the model (e.g., AUTHORIZED, NOT\_AUTHORIZED) |  |
| 

`customizationsSupported` \*

 | `array` **|** `null` | Customization types supported (e.g., FINE\_TUNING, CONTINUED\_PRE\_TRAINING) |  |
| 

`displayName` \*

 | `string` | Display name of the foundation model |  |
| 

`entitlementAvailability` \*

 | `string` **|** `null` | Whether the account is entitled to the model (e.g., AVAILABLE, NOT\_AVAILABLE) |  |
| 

`inferenceTypesSupported` \*

 | `array` **|** `null` | Inference types the model supports (e.g., ON\_DEMAND, PROVISIONED) |  |
| 

`inputModalities` \*

 | `array` **|** `null` | Input modalities supported by the model (e.g., TEXT, IMAGE, EMBEDDING) |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the model lifecycle status is ACTIVE and available for use |  |
| 

`isAuthorized` \*

 | `boolean` **|** `null` | Whether the account is currently authorized to invoke this model; derived from authorizationStatus |  |
| 

`isFineTuneable` \*

 | `boolean` **|** `null` | Whether the model can be fine-tuned with custom training data |  |
| 

`isStreamingSupported` \*

 | `boolean` **|** `null` | Whether the model supports streaming inference responses |  |
| `modelId` | `string` | Unique model identifier (e.g., anthropic.claude-3-sonnet-20240229-v1:0) |  |
| 

`modelLifecycleStatus` \*

 | `string` **|** `null` | Lifecycle status of the model (e.g., ACTIVE, LEGACY) |  |
| 

`modelName` \*

 | `string` **|** `null` | Human-readable name of the model (e.g., Claude 3 Sonnet) |  |
| 

`name` \*

 | `string` | Name of the foundation model |  |
| 

`outputModalities` \*

 | `array` **|** `null` | Output modalities supported by the model (e.g., TEXT, IMAGE, EMBEDDING) |  |
| 

`providerName` \*

 | `string` **|** `null` | Name of the model provider (e.g., Anthropic, Amazon, Meta) |  |
| 

`region` \*

 | `string` | AWS region where the model is available |  |
| 

`regionAvailability` \*

 | `string` **|** `null` | Whether the model is available in the region (e.g., AVAILABLE, NOT\_AVAILABLE) |  |

---

### Aws Bedrock Gateway

`aws_bedrock_gateway` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`authorizerType` \*

 | `string` **|** `null` | Authorizer type that controls access to the gateway |  |
| 

`category` \*

 | `array` of `string`s | OSI-layer category of the gateway |  |
| 

`exceptionLevel` \*

 | `string` **|** `null` | Verbosity of errors returned to callers (DEBUG leaks internals) |  |
| 

`function` \*

 | `array` of `string`s | Function the gateway performs |  |
| 

`gatewayUrl` \*

 | `string` **|** `null` | Public invocation endpoint URL of the gateway |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt the gateway |  |
| 

`protocolType` \*

 | `string` **|** `null` | Protocol the gateway exposes (e.g., MCP) |  |
| 

`public` \*

 | `boolean` | Whether the gateway exposes a public invocation endpoint |  |
| 

`region` \*

 | `string` | AWS region where the gateway is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM role the gateway assumes |  |

---

### Aws Bedrock Gateway Target

`aws_bedrock_gateway_target` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiKeyCredentialProviderArns` \*

 | `array` **|** `null` | ARNs of API key credential providers used by this target (ARNs only, never the secret) |  |
| `arn` | `string` |  |  |
| 

`lastSynchronizedOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) the target was last synchronized |  |
| 

`region` \*

 | `string` | AWS region where the gateway target is deployed |  |
| 

`targetId` \*

 | `string` **|** `null` | Identifier of the target within its gateway |  |

---

### Aws Bedrock Guardrail

`aws_bedrock_guardrail` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the Bedrock guardrail |  |
| 
`blockedInputMessaging` \*

 | `string` **|** `null` | Message returned to users when their input is blocked by the guardrail |  |
| 

`blockedOutputsMessaging` \*

 | `string` **|** `null` | Message returned to users when model output is blocked by the guardrail |  |
| 

`blockedTopicCount` \*

 | `number` **|** `null` | Number of topics configured as blocked in the topic policy |  |
| 

`contentFilterTypes` \*

 | `array` **|** `null` | Types of content filters enabled (e.g., SEXUAL, VIOLENCE, HATE, INSULTS) |  |
| 

`displayName` \*

 | `string` | Display name of the guardrail |  |
| 

`failureRecommendations` \*

 | `array` **|** `null` | Recommendations for resolving guardrail creation or update failures |  |
| 

`groundingThreshold` \*

 | `number` **|** `null` | Minimum grounding score (0-1) required for responses to pass the grounding filter |  |
| `guardrailId` | `string` | Unique identifier for the guardrail |  |
| 

`guardrailProfileArn` \*

 | `string` **|** `null` | ARN of the cross-region guardrail profile for multi-region deployments |  |
| 

`isContentFilterEnabled` \*

 | `boolean` **|** `null` | Whether content filtering is enabled to block harmful content categories |  |
| 

`isContextualGroundingEnabled` \*

 | `boolean` **|** `null` | Whether contextual grounding checks are enabled to reduce hallucination |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the guardrail is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`isPiiDetectionEnabled` \*

 | `boolean` **|** `null` | Whether PII detection is enabled to identify or block personally identifiable information |  |
| 

`isPromptAttackDetectionEnabled` \*

 | `boolean` **|** `null` | Whether prompt attack (injection) detection is enabled to protect against adversarial inputs |  |
| 

`isSensitiveInfoFilterEnabled` \*

 | `boolean` **|** `null` | Whether sensitive information filtering (PII/regex) is enabled |  |
| 

`isTopicPolicyEnabled` \*

 | `boolean` **|** `null` | Whether topic-based blocking policies are configured |  |
| 

`isWordFilterEnabled` \*

 | `boolean` **|** `null` | Whether word-based filtering is enabled to block specific terms |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt guardrail data |  |
| 

`managedWordListTypes` \*

 | `array` **|** `null` | Types of managed word lists applied (e.g., PROFANITY) |  |
| 

`name` \*

 | `string` | Name of the guardrail |  |
| 

`piiEntityTypes` \*

 | `array` **|** `null` | PII entity types detected or blocked (e.g., EMAIL, PHONE, SSN) |  |
| 

`regexPatternCount` \*

 | `number` **|** `null` | Number of custom regex patterns configured for sensitive data detection |  |
| 

`region` \*

 | `string` | AWS region where the guardrail is deployed |  |
| 

`relevanceThreshold` \*

 | `number` **|** `null` | Minimum relevance score (0-1) required for responses to pass the relevance filter |  |
| 

`statusReasons` \*

 | `array` **|** `null` | Reasons explaining the current guardrail status |  |
| `version` | `string` | Version of the guardrail (e.g., DRAFT or a numeric version) |  |

---

### Aws Bedrock Imported Model

`aws_bedrock_imported_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the imported model |  |
| 
`customModelUnitsPerModelCopy` \*

 | `number` **|** `null` | Number of custom model units consumed by each copy of the model |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the imported model is encrypted with a customer-managed KMS key; false means AWS-managed encryption |  |
| 

`isInstructSupported` \*

 | `boolean` **|** `null` | Whether the imported model supports the Converse API |  |
| 

`jobArn` \*

 | `string` **|** `null` | ARN of the model import job that created this model |  |
| 

`jobName` \*

 | `string` **|** `null` | Name of the model import job that created this model |  |
| 

`modelArchitecture` \*

 | `string` **|** `null` | Architecture of the imported model (e.g., llama2, mistral) |  |
| 

`modelDataSourceS3Uri` \*

 | `string` **|** `null` | S3 URI of the model weights that were imported into Bedrock |  |
| `modelId` | `string` | Unique identifier for the imported model |  |
| 

`modelKmsKeyArn` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt the imported model |  |
| 

`region` \*

 | `string` | AWS region where the imported model is stored |  |

---

### Aws Bedrock Inference Profile

`aws_bedrock_inference_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the inference profile |  |
| 
`displayName` \*

 | `string` | Display name of the inference profile |  |
| `inferenceProfileId` | `string` | Unique identifier for the inference profile |  |
| 

`modelArns` \*

 | `array` **|** `null` | ARNs of the models routed to by this inference profile |  |
| 

`name` \*

 | `string` | Name of the inference profile |  |
| 

`region` \*

 | `string` | AWS region where the inference profile is configured |  |
| 

`type` \*

 | `string` **|** `null` | Type of inference profile (e.g., SYSTEM\_DEFINED, APPLICATION) |  |

---

### Aws Bedrock Knowledge Base

`aws_bedrock_knowledge_base` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the Bedrock knowledge base |  |
| 
`displayName` \*

 | `string` | Display name of the knowledge base |  |
| 

`embeddingModelArn` \*

 | `string` **|** `null` | ARN of the embedding model used to vectorize documents |  |
| 

`failureReasons` \*

 | `array` **|** `null` | Reasons why the knowledge base failed to create or update |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the knowledge base is in an active and usable state |  |
| 

`isOpenSearchBacked` \*

 | `boolean` **|** `null` | Whether the knowledge base uses OpenSearch Serverless as its vector store |  |
| `knowledgeBaseId` | `string` | Unique identifier for the knowledge base |  |
| 

`knowledgeBaseType` \*

 | `string` **|** `null` | Type of the knowledge base (e.g., VECTOR, KENDRA) |  |
| 

`name` \*

 | `string` | Name of the knowledge base |  |
| 

`region` \*

 | `string` | AWS region where the knowledge base is deployed |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM role used by the knowledge base to access data sources |  |
| 

`storageConfigurationArn` \*

 | `string` **|** `null` | ARN of the vector store resource used for storage |  |
| 

`storageType` \*

 | `string` **|** `null` | Type of vector store backing the knowledge base (e.g., OPENSEARCH\_SERVERLESS, PINECONE, RDS) |  |

---

### Aws Bedrock Knowledge Base Data Source

`aws_bedrock_knowledge_base_data_source` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`chunkingStrategy` \*

 | `string` **|** `null` | Strategy used to chunk documents (e.g., FIXED\_SIZE, NONE, HIERARCHICAL) |  |
| `dataSourceId` | `string` | Unique identifier for the data source |  |
| 

`dataSourceType` \*

 | `string` **|** `null` | Type of data source (e.g., S3, WEB, CONFLUENCE) |  |
| 

`displayName` \*

 | `string` | Display name of the data source |  |
| 

`failureReason` \*

 | `string` **|** `null` | Reason why the data source failed to sync or create |  |
| 

`isS3Backed` \*

 | `boolean` **|** `null` | Whether the data source reads from an S3 bucket |  |
| 

`isWebCrawler` \*

 | `boolean` **|** `null` | Whether the data source crawls web content |  |
| `knowledgeBaseId` | `string` | ID of the parent knowledge base this data source belongs to |  |
| 

`name` \*

 | `string` | Name of the data source |  |
| 

`region` \*

 | `string` | AWS region where the data source is configured |  |
| 

`s3BucketArn` \*

 | `string` **|** `null` | ARN of the S3 bucket used as the data source |  |
| 

`s3InclusionPrefixes` \*

 | `array` **|** `null` | S3 key prefixes that scope which objects are included in the data source |  |

---

### Aws Bedrock Memory

`aws_bedrock_memory` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`encryptionKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt the memory |  |
| 

`eventExpiryDuration` \*

 | `number` **|** `null` | Number of days memory events are retained before expiry |  |
| 

`failureReason` \*

 | `string` **|** `null` | Reason the memory entered a failed state, if any |  |
| 

`memoryExecutionRoleArn` \*

 | `string` **|** `null` | ARN of the IAM role the memory assumes to execute operations |  |
| 

`region` \*

 | `string` | AWS region where the memory is deployed |  |

---

### Aws Bedrock Model Customization Job

`aws_bedrock_model_customization_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`baseModelArn` \*

 | `string` **|** `null` |  |  |
| 

`customizationType` \*

 | `string` **|** `null` |  |  |
| `endTime` | `number` |  |  |
| 

`failureMessage` \*

 | `string` **|** `null` |  |  |
| 

`jobName` \*

 | `string` **|** `null` |  |  |
| `lastModifiedOn` | `number` | Timestamp (epoch ms) when the customization job was last modified |  |
| 

`name` \*

 | `string` |  |  |
| 

`outputDataConfigS3Uri` \*

 | `string` **|** `null` |  |  |
| 

`outputModelArn` \*

 | `string` **|** `null` |  |  |
| 

`outputModelName` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`trainingDataConfigS3Uri` \*

 | `string` **|** `null` |  |  |
| 

`validationDataConfigS3Uris` \*

 | `array` **|** `null` |  |  |

---

### Aws Bedrock Model Invocation Job

`aws_bedrock_model_invocation_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the model invocation job |  |
| 
`endedOn` \*

 | `number` **|** `null` | Timestamp of when the job ended |  |
| 

`inputDataConfigS3BucketOwner` \*

 | `string` **|** `null` | Account id that owns the input bucket, when specified |  |
| 

`inputDataConfigS3Uri` \*

 | `string` **|** `null` | S3 URI the job reads its input records from |  |
| 

`inputS3Format` \*

 | `string` **|** `null` | Format of the input records (e.g., JSONL) |  |
| 

`isVpcConfigured` \*

 | `boolean` **|** `null` | Whether the job runs inside a customer VPC rather than over the public Bedrock endpoint |  |
| 

`jobModelId` \*

 | `string` **|** `null` | Identifier of the model the job invokes; may be a foundation model id or a custom model ARN |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` | Timestamp of when the job was last modified |  |
| 

`outputDataConfigS3BucketOwner` \*

 | `string` **|** `null` | Account id that owns the output bucket, when specified |  |
| 

`outputDataConfigS3Uri` \*

 | `string` **|** `null` | S3 URI the job writes its output records to |  |
| 

`outputS3EncryptionKeyId` \*

 | `string` **|** `null` | Id or ARN of the KMS key used to encrypt the job output in S3 |  |
| 

`region` \*

 | `string` | AWS region where the job runs |  |
| 

`roleArn` \*

 | `string` **|** `null` | ARN of the IAM service role Bedrock assumes to run the job |  |
| 

`statusMessage` \*

 | `string` **|** `null` | Message describing why the job is in its current status |  |
| 

`submittedOn` \*

 | `number` **|** `null` | Timestamp of when the job was submitted |  |
| 

`timeoutDurationInHours` \*

 | `number` **|** `null` | Number of hours after which the job times out |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` | Security group ids the job is attached to, when VPC configured |  |
| 

`vpcSubnetIds` \*

 | `array` **|** `null` | Subnet ids the job is attached to, when VPC configured |  |

---

### Aws Bedrock Model Invocation Logging

`aws_bedrock_model_invocation_logging` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cloudWatchLogGroupName` \*

 | `string` **|** `null` | Name of the CloudWatch log group receiving invocation logs |  |
| 

`isCloudWatchLoggingEnabled` \*

 | `boolean` **|** `null` | Whether model invocation logs are delivered to CloudWatch Logs |  |
| 

`isEmbeddingDataLogged` \*

 | `boolean` **|** `null` | Whether embedding data is included in invocation logs |  |
| 

`isImageDataLogged` \*

 | `boolean` **|** `null` | Whether image input and output data is included in invocation logs |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` | Whether any model invocation logging is enabled; false means no invocation data is captured |  |
| 

`isS3LoggingEnabled` \*

 | `boolean` **|** `null` | Whether model invocation logs are delivered to an S3 bucket |  |
| 

`isTextDataLogged` \*

 | `boolean` **|** `null` | Whether text input and output data is included in invocation logs |  |
| 

`region` \*

 | `string` | AWS region where logging is configured |  |
| 

`s3BucketName` \*

 | `string` **|** `null` | Name of the S3 bucket where invocation logs are stored |  |
| 

`s3KeyPrefix` \*

 | `string` **|** `null` | S3 key prefix for organizing invocation log files |  |

---

### Aws Bedrock Policy Engine

`aws_bedrock_policy_engine` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| 
`region` \*

 | `string` | AWS region where the policy engine is deployed |  |
| 

`statusReasons` \*

 | `array` **|** `null` | Reasons explaining the current status of the policy engine |  |

---

### Aws Bedrock Provisioned Throughput

`aws_bedrock_provisioned_throughput` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` | ARN of the provisioned throughput |  |
| 
`commitmentDuration` \*

 | `string` **|** `null` | Commitment duration for the provisioned throughput (e.g., OneMonth, SixMonths) |  |
| `commitmentExpirationTime` | `number` | Timestamp (epoch ms) when the commitment period expires |  |
| 

`desiredModelUnits` \*

 | `number` **|** `null` | Desired number of model units for the provisioned throughput |  |
| 

`displayName` \*

 | `string` | Display name of the provisioned throughput |  |
| 

`failureMessage` \*

 | `string` **|** `null` | Error message if the provisioned throughput failed to create or update |  |
| 

`foundationModelArn` \*

 | `string` **|** `null` | ARN of the underlying foundation model |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the provisioned throughput is currently in service and accepting requests |  |
| `lastModifiedOn` | `number` | Timestamp (epoch ms) when the provisioned throughput was last modified |  |
| 

`modelArn` \*

 | `string` **|** `null` | ARN of the model associated with this provisioned throughput |  |
| 

`modelUnits` \*

 | `number` **|** `null` | Number of model units currently provisioned |  |
| 

`name` \*

 | `string` | Name of the provisioned throughput |  |
| `provisionedModelId` | `string` | Unique identifier for the provisioned model throughput |  |
| 

`region` \*

 | `string` | AWS region where the provisioned throughput is deployed |  |

---

### Aws Cloudmap Namespace

`aws_cloudmap_namespace` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`creatorRequestId` \*

 | `string` **|** `null` |  |  |
| 

`hostedZoneId` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isHttpNamespace` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceCount` \*

 | `number` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Aws Cloudmap Service

`aws_cloudmap_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`creatorRequestId` \*

 | `string` **|** `null` |  |  |
| 

`dnsRecordTtl` \*

 | `number` **|** `null` |  |  |
| 

`dnsRecordType` \*

 | `string` **|** `null` |  |  |
| 

`healthCheckFailureThreshold` \*

 | `number` **|** `null` |  |  |
| 

`healthCheckResourcePath` \*

 | `string` **|** `null` |  |  |
| 

`healthCheckType` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`instanceCount` \*

 | `number` **|** `null` |  |  |
| 

`isHealthCheckEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`namespaceId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`routingPolicy` \*

 | `string` **|** `null` |  |  |

---

### Aws Cloudmap Service Instance

`aws_cloudmap_service_instance` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`creatorRequestId` \*

 | `string` **|** `null` |  |  |
| 

`customAttributesCount` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`instanceId` \*

 | `string` **|** `null` |  |  |
| 

`port` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceId` \*

 | `string` |  |  |

---

### Aws Cloudwatch Log Group Metrics

`aws_cloudwatch_log_group_metrics` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`collectedOn` \*

 | `number` |  |  |
| 

`dailyDeliveryErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyDeliveryThrottling` \*

 | `number` **|** `null` |  |  |
| 

`dailyEMFParsingErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyEMFValidationErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyForwardedBytes` \*

 | `number` **|** `null` |  |  |
| 

`dailyForwardedLogEvents` \*

 | `number` **|** `null` |  |  |
| 

`dailyIncomingBytes` \*

 | `number` **|** `null` |  |  |
| 

`dailyIncomingLogEvents` \*

 | `number` **|** `null` |  |  |
| 

`dailyLogEventsWithFindings` \*

 | `number` **|** `null` |  |  |
| 

`dailyTransformationErrors` \*

 | `number` **|** `null` |  |  |
| 

`dailyTransformedBytes` \*

 | `number` **|** `null` |  |  |
| 

`dailyTransformedLogEvents` \*

 | `number` **|** `null` |  |  |
| 

`endedOn` \*

 | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`logGroupName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`period` \*

 | `number` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`startedOn` \*

 | `number` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Cloudwatch Log Metric Filter

`aws_cloudwatch_log_metric_filter` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`defaultValue` \*

 | `number` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`filterName` \*

 | `string` |  |  |
| 

`filterPattern` \*

 | `string` **|** `null` |  |  |
| 

`isApplyOnTransformedLogs` \*

 | `boolean` **|** `null` |  |  |
| 

`logGroupName` \*

 | `string` |  |  |
| 

`metricName` \*

 | `string` **|** `null` |  |  |
| 

`metricNamespace` \*

 | `string` **|** `null` |  |  |
| 

`metricTransformationCount` \*

 | `number` **|** `null` |  |  |
| 

`metricValue` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`pattern` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`unit` \*

 | `string` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Codeartifact Domain

`aws_codeartifact_domain` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the domain. |  |
| 

`arn` \*

 | `string` | The ARN of the domain. |  |
| 

`assetSizeBytes` \*

 | `number` **|** `null` | The total size, in bytes, of all assets in the domain. |  |
| 

`domainOwner` \*

 | `string` **|** `null` | The 12-digit account number of the AWS account that owns the domain. |  |
| 

`encryptionKeyArn` \*

 | `string` **|** `null` | The ARN of the KMS key used to encrypt assets in the domain. |  |
| 

`hasResourcePolicy` \*

 | `boolean` **|** `null` | True when a domain permissions policy is attached, false when none is attached, and null when the policy could not be read. |  |
| 

`isCrossAccountAccessAllowed` \*

 | `boolean` **|** `null` | True when the domain permissions policy grants access to a principal outside the ingesting account; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | True when the domain permissions policy grants access to any principal; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`region` \*

 | `string` | The AWS region the domain resides in. |  |
| 

`repositoryCount` \*

 | `number` **|** `null` | The number of repositories in the domain. |  |
| 

`resourcePolicyPrincipalAccountIds` \*

 | `array` **|** `null` | Distinct external account ids referenced as principals in the domain permissions policy. |  |
| 

`resourcePolicyRevision` \*

 | `string` **|** `null` | The current revision of the domain permissions policy. |  |
| 

`s3BucketArn` \*

 | `string` **|** `null` | The ARN of the S3 bucket that stores the package assets in the domain. |  |

---

### Aws Codeartifact Package

`aws_codeartifact_package` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the package. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the domain that contains the package. |  |
| 

`format` \*

 | `string` | The package format (e.g. npm, pypi, maven, nuget, generic). |  |
| 

`isUpstreamAllowed` \*

 | `boolean` **|** `null` | True when package versions may be pulled from an upstream source. |  |
| 

`namespace` \*

 | `string` **|** `null` | The namespace of the package (e.g. Maven groupId or npm scope). |  |
| 

`packageName` \*

 | `string` | The name of the package. |  |
| 

`publishRestriction` \*

 | `string` **|** `null` | Whether publishing new package versions is ALLOW or BLOCK. |  |
| 

`region` \*

 | `string` | The AWS region the package resides in. |  |
| 

`repositoryName` \*

 | `string` **|** `null` | The name of the repository that contains the package. |  |
| 

`upstreamRestriction` \*

 | `string` **|** `null` | Whether pulling package versions from upstream is ALLOW or BLOCK. |  |

---

### Aws Codeartifact Package Group

`aws_codeartifact_package_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the package group. |  |
| 

`arn` \*

 | `string` | The ARN of the package group. |  |
| 

`contactInfo` \*

 | `string` **|** `null` | The contact information of the package group. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the domain that contains the package group. |  |
| 

`domainOwner` \*

 | `string` **|** `null` | The 12-digit account number that owns the domain. |  |
| 

`externalUpstreamRestrictionMode` \*

 | `string` **|** `null` | The origin restriction mode (ALLOW, BLOCK, or INHERIT) for retaining package versions from external, public repositories. |  |
| 

`internalUpstreamRestrictionMode` \*

 | `string` **|** `null` | The origin restriction mode (ALLOW, BLOCK, or INHERIT) for retaining package versions from internal upstream repositories. |  |
| 

`parentPattern` \*

 | `string` **|** `null` | The pattern of the parent package group. |  |
| 

`pattern` \*

 | `string` | The pattern the package group matches. |  |
| 

`publishRestrictionMode` \*

 | `string` **|** `null` | The origin restriction mode (ALLOW, BLOCK, or INHERIT) for publishing package versions to the group. |  |
| 

`region` \*

 | `string` | The AWS region the package group resides in. |  |

---

### Aws Codeartifact Repository

`aws_codeartifact_repository` inherits from [Repository](/data-model/schemas/Repository.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The AWS account id ingesting the repository. |  |
| 

`administratorAccount` \*

 | `string` **|** `null` | The account that manages the repository. |  |
| 

`arn` \*

 | `string` | The ARN of the repository. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the domain that contains the repository. |  |
| 

`domainOwner` \*

 | `string` **|** `null` | The 12-digit account number that owns the domain. |  |
| 

`endpointGeneric` \*

 | `string` **|** `null` | The generic endpoint URL of the repository. |  |
| 

`endpointMaven` \*

 | `string` **|** `null` | The Maven endpoint URL of the repository. |  |
| 

`endpointNpm` \*

 | `string` **|** `null` | The npm endpoint URL of the repository. |  |
| 

`endpointNuget` \*

 | `string` **|** `null` | The NuGet endpoint URL of the repository. |  |
| 

`endpointPypi` \*

 | `string` **|** `null` | The PyPI endpoint URL of the repository. |  |
| 

`externalConnectionNames` \*

 | `array` **|** `null` | The names of the external connections (e.g. public:npmjs) the repository proxies. |  |
| 

`externalConnectionStatus` \*

 | `string` **|** `null` | The status of the external connection when a single connection is configured. |  |
| 

`hasExternalConnections` \*

 | `boolean` **|** `null` | True when the repository has at least one external connection. |  |
| 

`hasResourcePolicy` \*

 | `boolean` **|** `null` | True when a repository permissions policy is attached, false when none is attached, and null when the policy could not be read. |  |
| 

`isCrossAccountAccessAllowed` \*

 | `boolean` **|** `null` | True when the repository permissions policy grants access to a principal outside the ingesting account; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | True when the repository permissions policy grants access to any principal; false when it does not (including when no policy is attached); null when the policy could not be read. |  |
| 

`region` \*

 | `string` | The AWS region the repository resides in. |  |
| 

`resourcePolicyPrincipalAccountIds` \*

 | `array` **|** `null` | Distinct external account ids referenced as principals in the repository permissions policy. |  |
| 

`resourcePolicyRevision` \*

 | `string` **|** `null` | The current revision of the repository permissions policy. |  |
| 

`upstreamRepositoryNames` \*

 | `array` **|** `null` | The names of the upstream repositories. |  |

---

### Aws Codedeploy Application

`aws_codedeploy_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`applicationId` \*

 | `string` **|** `null` |  |  |
| 

`applicationName` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`gitHubAccountName` \*

 | `string` **|** `null` |  |  |
| 

`isLinkedToGitHub` \*

 | `boolean` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Codedeploy Deployment Config

`aws_codedeploy_deployment_config` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`canaryInterval` \*

 | `number` **|** `null` |  |  |
| 

`canaryPercentage` \*

 | `number` **|** `null` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`deploymentConfigId` \*

 | `string` **|** `null` |  |  |
| 

`deploymentConfigName` \*

 | `string` |  |  |
| 

`firstZoneMonitorDurationInSeconds` \*

 | `number` **|** `null` |  |  |
| 

`isBuiltIn` \*

 | `boolean` |  |  |
| 

`linearInterval` \*

 | `number` **|** `null` |  |  |
| 

`linearPercentage` \*

 | `number` **|** `null` |  |  |
| 

`minimumHealthyHostsPerZoneType` \*

 | `string` **|** `null` |  |  |
| 

`minimumHealthyHostsPerZoneValue` \*

 | `number` **|** `null` |  |  |
| 

`minimumHealthyHostsType` \*

 | `string` **|** `null` |  |  |
| 

`minimumHealthyHostsValue` \*

 | `number` **|** `null` |  |  |
| 

`monitorDurationInSeconds` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`trafficRoutingType` \*

 | `string` **|** `null` |  |  |

---

### Aws Codedeploy Deployment Group

`aws_codedeploy_deployment_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`alarmNames` \*

 | `array` **|** `null` |  |  |
| 

`applicationKey` \*

 | `string` |  |  |
| 

`applicationName` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`autoRollbackEvents` \*

 | `array` **|** `null` |  |  |
| 

`autoScalingGroups` \*

 | `array` **|** `null` |  |  |
| 

`blueGreenTerminateAction` \*

 | `string` **|** `null` |  |  |
| 

`blueGreenTerminationWaitTime` \*

 | `number` **|** `null` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`deploymentConfigName` \*

 | `string` **|** `null` |  |  |
| 

`deploymentGroupId` \*

 | `string` **|** `null` |  |  |
| 

`deploymentGroupName` \*

 | `string` |  |  |
| 

`deploymentOption` \*

 | `string` **|** `null` |  |  |
| 

`deploymentType` \*

 | `string` **|** `null` |  |  |
| 

`ecsClusterName` \*

 | `string` **|** `null` |  |  |
| 

`ecsServiceName` \*

 | `string` **|** `null` |  |  |
| 

`elbNames` \*

 | `array` **|** `null` |  |  |
| 

`greenFleetProvisioningAction` \*

 | `string` **|** `null` |  |  |
| 

`isAlarmsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoRollbackEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isIgnorePollAlarmFailure` \*

 | `boolean` **|** `null` |  |  |
| 

`isTerminationHookEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`lastAttemptedDeploymentId` \*

 | `string` **|** `null` |  |  |
| 

`lastAttemptedDeploymentStatus` \*

 | `string` **|** `null` |  |  |
| 

`lastSuccessfulDeploymentId` \*

 | `string` **|** `null` |  |  |
| 

`lastSuccessfulDeploymentStatus` \*

 | `string` **|** `null` |  |  |
| 

`outdatedInstancesStrategy` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`targetGroupNames` \*

 | `array` **|** `null` |  |  |
| 

`triggerNames` \*

 | `array` **|** `null` |  |  |
| 

`triggerTargetArns` \*

 | `array` **|** `null` |  |  |

---

### Aws Codeguru Profiling Group

`aws_codeguru_profiling_group` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`computePlatform` \*

 | `string` **|** `null` |  |  |
| 

`isProfilingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`latestAgentPingOn` \*

 | `number` **|** `null` |  |  |
| 

`latestProfileReceivedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Codeguru Reviewer Repository Association

`aws_codeguru_reviewer_repository_association` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`associationId` \*

 | `string` **|** `null` |  |  |
| 

`connectionArn` \*

 | `string` **|** `null` |  |  |
| 

`encryptedKeyRef` \*

 | `string` **|** `null` |  |  |
| 

`encryptionOption` \*

 | `string` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`providerType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`s3BucketName` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` **|** `null` |  |  |
| 

`stateReason` \*

 | `string` **|** `null` |  |  |

---

### Aws Cognito Identity Pool

`aws_cognito_identity_pool` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`developerProviderName` \*

 | `null` **|** `string` |  |  |
| 

`identityPoolId` \*

 | `null` **|** `string` |  |  |
| 

`isClassicFlowAllowed` \*

 | `null` **|** `boolean` |  |  |
| 

`isUnauthenticatedIdentitiesAllowed` \*

 | `null` **|** `boolean` |  |  |
| 

`openIdConnectProviderArns` \*

 | `null` **|** `array` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`samlProviderArns` \*

 | `null` **|** `array` |  |  |

---

### Aws Cognito User Pool

`aws_cognito_user_pool` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountTakeoverHighActionEvent` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverHighActionNotify` \*

 | `null` **|** `boolean` |  |  |
| 

`accountTakeoverLowActionEvent` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverLowActionNotify` \*

 | `null` **|** `boolean` |  |  |
| 

`accountTakeoverMediumActionEvent` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverMediumActionNotify` \*

 | `null` **|** `boolean` |  |  |
| 

`accountTakeoverNotifyFrom` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverNotifyReplyTo` \*

 | `null` **|** `string` |  |  |
| 

`accountTakeoverNotifySourceArn` \*

 | `null` **|** `string` |  |  |
| 

`adminCreateUserConfigAllowAdminCreateUserOnly` \*

 | `null` **|** `boolean` |  |  |
| 

`adminCreateUserConfigUnusedAccountValidityDays` \*

 | `null` **|** `number` |  |  |
| 

`arn` \*

 | `null` **|** `string` |  |  |
| 

`compromisedCredentialsEventAction` \*

 | `null` **|** `string` |  |  |
| 

`compromisedCredentialsEventFilter` \*

 | `null` **|** `array` |  |  |
| 

`customDomain` \*

 | `null` **|** `string` |  |  |
| 

`deletionProtection` \*

 | `null` **|** `string` |  |  |
| 

`deviceConfigurationChallengeRequiredOnNewDevice` \*

 | `null` **|** `boolean` |  |  |
| 

`deviceConfigurationDeviceOnlyRememberedOnUserPrompt` \*

 | `null` **|** `boolean` |  |  |
| 

`domain` \*

 | `null` **|** `string` |  |  |
| 

`emailConfigurationEmailSendingAccount` \*

 | `null` **|** `string` |  |  |
| 

`estimatedNumberOfUsers` \*

 | `null` **|** `number` |  |  |
| 

`mfaConfiguration` \*

 | `null` **|** `string` |  |  |
| 

`policiesPasswordPolicyMinimumLength` \*

 | `null` **|** `number` |  |  |
| 

`policiesPasswordPolicyRequireLowercase` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyRequireNumbers` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyRequireSymbols` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyRequireUppercase` \*

 | `null` **|** `boolean` |  |  |
| 

`policiesPasswordPolicyTemporaryPasswordValidityDays` \*

 | `null` **|** `number` |  |  |
| 

`policiesSignInPolicyAllowedFirstAuthFactors` \*

 | `null` **|** `array` |  |  |
| 

`region` \*

 | `null` **|** `string` |  |  |
| 

`riskConfigurationLastModifiedOn` \*

 | `null` **|** `number` |  |  |
| 

`riskExceptionBlockedIPRangeList` \*

 | `null` **|** `array` |  |  |
| 

`riskExceptionSkippedIPRangeList` \*

 | `null` **|** `array` |  |  |
| 

`smsConfigurationExternalId` \*

 | `null` **|** `string` |  |  |
| 

`smsConfigurationFailure` \*

 | `null` **|** `string` |  |  |
| 

`smsConfigurationSnsCallerArn` \*

 | `null` **|** `string` |  |  |
| 

`smsConfigurationSnsRegion` \*

 | `null` **|** `string` |  |  |
| 

`userAttributeUpdateSettingsAttributesRequireVerificationBeforeUpdate` \*

 | `null` **|** `array` |  |  |
| 

`usernameConfigurationCaseSensitive` \*

 | `null` **|** `boolean` |  |  |
| 

`userPoolAddOnsAdvancedSecurityAdditionalFlowsTypeCustomAuthMode` \*

 | `null` **|** `string` |  |  |
| 

`userPoolAddOnsAdvancedSecurityMode` \*

 | `null` **|** `string` |  |  |
| 

`verificationMessageTemplateDefaultEmailOption` \*

 | `null` **|** `string` |  |  |

---

### Aws Cognito User Pool Client

`aws_cognito_user_pool_client` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessTokenValidity` | `number` |  |  |
| `accountId` | `string` |  |  |
| `allowedOAuthFlows` | `array` of `string`s |  |  |
| `allowedOAuthScopes` | `array` of `string`s |  |  |
| `analyticsConfigurationApplicationId` | `string` |  |  |
| `analyticsConfigurationExternalId` | `string` |  |  |
| `analyticsConfigurationRoleArn` | `string` |  |  |
| `authSessionValidity` | `number` |  |  |
| `callbackURLs` | `array` of `string`s |  |  |
| `createdOn` | `number` |  |  |
| `defaultRedirectURI` | `string` |  |  |
| `explicitAuthFlows` | `array` of `string`s |  |  |
| 
`id` \*

 | `string` |  |  |
| `idTokenValidity` | `number` |  |  |
| `isAnalyticsConfigurationUserDataShared` | `boolean` |  |  |
| `isOAuthFlowsUserPoolClientAllowed` | `boolean` |  |  |
| `isPropagateAdditionalUserContextDataEnabled` | `boolean` |  |  |
| `isTokenRevocationEnabled` | `boolean` |  |  |
| `lastModifiedOn` | `number` |  |  |
| `logoutURLs` | `array` of `string`s |  |  |
| `preventUserExistenceErrors` | `string` |  |  |
| `readAttributes` | `array` of `string`s |  |  |
| `refreshTokenValidity` | `number` |  |  |
| 

`region` \*

 | `string` |  |  |
| `supportedIdentityProviders` | `array` of `string`s |  |  |
| `tokenValidityUnitsAccessToken` | `string` |  |  |
| `tokenValidityUnitsIdToken` | `string` |  |  |
| `tokenValidityUnitsRefreshToken` | `string` |  |  |
| `userPoolId` | `string` |  |  |
| `writeAttributes` | `array` of `string`s |  |  |

---

### Aws Cognito User Pool User

`aws_cognito_user_pool_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `isEnabled` | `boolean` |  |  |
| `lastModifiedOn` | `number` |  |  |
| `mfaDeilveryMediums` | `array` of `string`s |  |  |
| `mfaDeliveryAttributes` | `array` of `string`s |  |  |
| 
`region` \*

 | `string` |  |  |
| `userStatus` | `string` |  |  |

---

### Aws Config Rule Finding

`aws_config_rule_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`annotation` \*

 | `string` **|** `null` |  |  |
| 

`configRuleArn` \*

 | `string` **|** `null` |  |  |
| 

`configRuleInvokedOn` \*

 | `number` **|** `null` |  |  |
| 

`configRuleName` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`resourceArn` \*

 | `string` **|** `null` |  |  |
| 

`resourceId` \*

 | `string` |  |  |
| 

`resourceType` \*

 | `string` |  |  |
| 

`resultRecordedOn` \*

 | `number` **|** `null` |  |  |

---

### Aws Datasync Location

`aws_datasync_location` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`efsFileSystemArn` \*

 | `null` **|** `string` |  |  |
| 

`fsxFileSystemArn` \*

 | `null` **|** `string` |  |  |
| 

`isEfsLocation` \*

 | `null` **|** `boolean` |  |  |
| 

`isFsxLocation` \*

 | `null` **|** `boolean` |  |  |
| 

`isOnPremisesLocation` \*

 | `null` **|** `boolean` |  |  |
| 

`isS3Location` \*

 | `null` **|** `boolean` |  |  |
| 

`locationType` \*

 | `string` |  |  |
| 

`locationUri` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`s3BucketAccessRoleArn` \*

 | `null` **|** `string` |  |  |

---

### Aws Datasync Task

`aws_datasync_task` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`cloudWatchLogGroupArn` \*

 | `null` **|** `string` |  |  |
| 

`createdOn` \*

 | `number` |  |  |
| 

`currentTaskExecutionArn` \*

 | `null` **|** `string` |  |  |
| 

`destinationLocationArn` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isCloudWatchLoggingEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`isScheduled` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`overwriteMode` \*

 | `null` **|** `string` |  |  |
| 

`posixPermissions` \*

 | `null` **|** `string` |  |  |
| 

`preserveDeletedFiles` \*

 | `null` **|** `string` |  |  |
| 

`preserveDevices` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`securityDescriptorCopyFlags` \*

 | `null` **|** `array` |  |  |
| 

`sourceLocationArn` \*

 | `string` |  |  |
| 

`transferMode` \*

 | `null` **|** `string` |  |  |
| 

`verifyMode` \*

 | `null` **|** `string` |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Dedicated Host

`aws_dedicated_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allocatedOn` | `number` |  |  |
| `allowsMultipleInstanceTypes` | `string` |  | **Any of**:
-   `off`

-   `on`

 |
| `assetId` | `string` |  |  |
| `autoPlacement` | `string` |  | **Any of**:

-   `off`

-   `on`

 |
| `availabilityZone` | `string` |  |  |
| `cores` | `number` |  |  |
| `hostId` | `string` |  |  |
| `hostMaintenance` | `string` |  | **Any of**:

-   `off`

-   `on`

 |
| `hostRecovery` | `string` |  | **Any of**:

-   `off`

-   `on`

 |
| `hostReservationId` | `string` |  |  |
| `instanceFamily` | `string` |  |  |
| `instanceType` | `string` |  |  |
| `memberOfServiceLinkedResourceGroup` | `boolean` |  |  |
| `outpostArn` | `string` |  |  |
| `ownerId` | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| `releasedOn` | `number` |  |  |
| `sockets` | `number` |  |  |
| `state` | `string` |  | **Any of**:

-   `available`

-   `pending`

-   `permanent-failure`

-   `released`

-   `released-permanent-failure`

-   `under-assessment`

 |
| `totalVCpus` | `number` |  |  |

---

### Aws Devops Guru Anomaly

`aws_devops_guru_anomaly` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`anomalyEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyId` \*

 | `string` |  |  |
| 

`anomalyReportedEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyReportedStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`anomalyType` \*

 | `string` **|** `null` |  |  |
| 

`associatedInsightId` \*

 | `string` **|** `null` |  |  |
| 

`limitValue` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`sourceResourceName` \*

 | `string` **|** `null` |  |  |
| 

`sourceResourceType` \*

 | `string` **|** `null` |  |  |
| 

`sourceService` \*

 | `string` **|** `null` |  |  |
| 

`stackNames` \*

 | `array` **|** `null` |  |  |

---

### Aws Devops Guru Insight

`aws_devops_guru_insight` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`associatedResourceArns` \*

 | `array` **|** `null` |  |  |
| 

`insightEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`insightId` \*

 | `string` |  |  |
| 

`insightStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`insightType` \*

 | `string` **|** `null` |  |  |
| 

`predictionEndedOn` \*

 | `number` **|** `null` |  |  |
| 

`predictionStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceNames` \*

 | `array` **|** `null` |  |  |
| 

`stackNames` \*

 | `array` **|** `null` |  |  |

---

### Aws Devops Guru Notification Channel

`aws_devops_guru_notification_channel` inherits from [Channel](/data-model/schemas/Channel.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`channelId` \*

 | `string` |  |  |
| 

`messageTypes` \*

 | `array` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`severities` \*

 | `array` **|** `null` |  |  |
| 

`snsTopicArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Devopsagent Agent Space

`aws_devopsagent_agent_space` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentSpaceId` \*

 | `string` | The unique identifier of the agent space. |  |
| 

`isElevatedActionsEnabled` \*

 | `boolean` **|** `null` | Whether elevated actions are enabled on the agent space (flattened from the `elevatedActionsEnabled` preference), or null when the preference is not set. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | The ARN of the customer managed KMS key used to encrypt agent space resources, or null when an AWS owned key is used. |  |
| 

`locale` \*

 | `string` **|** `null` | The locale configured for the agent space, which determines the language used in agent responses, or null when not set. |  |
| 

`operatorAppRoleArns` \*

 | `array` **|** `null` | The IAM role ARNs the operator app assumes (collected from the IAM, IdC and IdP auth configurations), or null when no operator app is configured. |  |
| 

`region` \*

 | `string` | The AWS region the agent space resides in, for example `us-east-1`. |  |

---

### Aws Devopsagent Association

`aws_devopsagent_association` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentSpaceId` \*

 | `string` **|** `null` | The id of the agent space the association belongs to, or null when not reported. |  |
| 

`associationId` \*

 | `string` | The unique identifier of the association. |  |
| 

`capabilities` \*

 | `array` **|** `null` | The capabilities enabled on the association (capabilities configured but switched off are excluded), or null when none are enabled. |  |
| 

`region` \*

 | `string` | The AWS region the association resides in, for example `us-east-1`. |  |
| 

`serviceId` \*

 | `string` **|** `null` | The id of the registered service the association targets, or null when not reported. |  |

---

### Aws Devopsagent Private Connection

`aws_devopsagent_private_connection` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`certificateExpiresOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when the private connection certificate expires, or null when no certificate expiry is reported. |  |
| 

`dnsResolution` \*

 | `string` **|** `null` | How DNS is resolved for resources behind the connection, for example `IN_VPC` or `PUBLIC`, or null when not reported. |  |
| 

`failureMessage` \*

 | `string` **|** `null` | The failure message reported for the private connection, or null when it is not in a failed state. |  |
| 

`hostAddress` \*

 | `string` **|** `null` | The host address the private connection targets, or null when not reported. |  |
| 

`region` \*

 | `string` | The AWS region the private connection resides in, for example `us-east-1`. |  |
| 

`resourceConfigurationId` \*

 | `string` **|** `null` | The id of the resource configuration backing the private connection, or null when not reported. |  |
| 

`resourceGatewayId` \*

 | `string` **|** `null` | The id of the resource gateway backing the private connection, or null when not reported. |  |
| 

`type` \*

 | `string` **|** `null` | The type of the private connection, for example `SELF_MANAGED` or `SERVICE_MANAGED`, or null when not reported. |  |
| 

`vpcId` \*

 | `string` **|** `null` | The id of the VPC the private connection reaches into, or null when not reported. |  |

---

### Aws Devopsagent Service

`aws_devopsagent_service` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessibleResources` \*

 | `array` **|** `null` | The resources the service is scoped to (the plain-string entries of the opaque JSON values the API returns), or null when none are reported. |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | The ARN of the customer managed KMS key used to encrypt the service configuration, or null when an AWS owned key is used. |  |
| 

`privateConnectionName` \*

 | `string` **|** `null` | The name of the private connection the service reaches its endpoint through, or null when the service is not behind a private connection. |  |
| 

`region` \*

 | `string` | The AWS region the service is registered in, for example `us-east-1`. |  |
| 

`serviceId` \*

 | `string` | The unique identifier of the registered service. |  |
| 

`serviceType` \*

 | `string` **|** `null` | The type of the registered service, for example `github` or `slack`, or null when not reported. |  |

---

### Aws Ec2 Security Group Rule

`aws_ec2_security_group_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` **|** `null` | The ARN of the security group rule. |  |
| 

`cidrIpv4` \*

 | `string` **|** `null` | The IPv4 CIDR range this rule applies to. |  |
| 

`cidrIpv6` \*

 | `string` **|** `null` | The IPv6 CIDR range this rule applies to. |  |
| 

`fromPort` \*

 | `number` **|** `null` | The start of the port range, or the ICMP type. Null when all ports are allowed. |  |
| 

`groupOwnerId` \*

 | `string` **|** `null` | The ID of the AWS account that owns the security group. |  |
| 

`ipProtocol` \*

 | `string` **|** `null` | The IP protocol (e.g. tcp, udp, icmp). Normalized to "all" when the API returns -1 (all protocols). |  |
| 

`isEgress` \*

 | `boolean` **|** `null` | Indicates whether the rule is an outbound (egress) rule. False for inbound (ingress) rules. |  |
| 

`prefixListId` \*

 | `string` **|** `null` | The ID of the prefix list this rule applies to. |  |
| 

`referencedGroupId` \*

 | `string` **|** `null` | The ID of the security group referenced by this rule, if any. |  |
| 

`referencedGroupOwnerId` \*

 | `string` **|** `null` | The AWS account ID that owns the referenced security group. |  |
| 

`referencedVpcId` \*

 | `string` **|** `null` | The ID of the VPC of the referenced security group, if any. |  |
| 

`region` \*

 | `string` | The AWS region the security group rule resides in. |  |
| 

`securityGroupRuleId` \*

 | `string` | The ID of the security group rule. |  |
| 

`toPort` \*

 | `number` **|** `null` | The end of the port range, or the ICMP code. Null when all ports are allowed. |  |

---

### Aws Elasticsearch Domain

`aws_elasticsearch_domain` inherits from [Database](/data-model/schemas/Database.md), [DataStore](/data-model/schemas/DataStore.md), [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessPolicies` \*

 | `string` **|** `null` | Raw JSON string of the IAM resource-based access policy attached to the Elasticsearch domain. |  |
| 

`atRestEncryptionEnabled` \*

 | `boolean` **|** `null` | Deprecated. Whether encryption at rest is enabled. Use encryptedAtRest instead. | **deprecated**: true |
| 

`encryptionAtRestKmsKeyId` \*

 | `string` **|** `null` | Identifier of the AWS KMS key used to encrypt data at rest in the Elasticsearch domain. May be a key ID, alias, or ARN depending on how the domain was configured. |  |
| 

`isAppLoggingEnabled` \*

 | `boolean` **|** `null` | Whether application log (ES\_APPLICATION\_LOGS) publishing to CloudWatch Logs is enabled. |  |
| 

`isAuditLoggingEnabled` \*

 | `boolean` **|** `null` | Whether audit log (AUDIT\_LOGS) publishing to CloudWatch Logs is enabled for this domain. |  |
| 

`isSlowIndexLoggingEnabled` \*

 | `boolean` **|** `null` | Whether slow index log (INDEX\_SLOW\_LOGS) publishing to CloudWatch Logs is enabled. |  |
| 

`region` \*

 | `string` | The AWS region the Elasticsearch domain resides in. |  |
| 

`transitEncryptionEnabled` \*

 | `boolean` **|** `null` | Deprecated. Whether node-to-node (in-transit) encryption is enabled. Use encryptedInTransit instead. | **deprecated**: true |

---

### Aws Emr Security Configuration

`aws_emr_security_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | Synthesized ARN of the EMR security configuration (also the entity \_key). |  |
| 

`isAtRestEncryptionEnabled` \*

 | `boolean` | Whether at-rest encryption is enabled. |  |
| 

`isEncryptionConfigured` \*

 | `boolean` | Whether an encryption configuration block is present. |  |
| 

`isInTransitEncryptionEnabled` \*

 | `boolean` | Whether in-transit encryption is enabled. |  |
| 

`isKerberosConfigured` \*

 | `boolean` | Whether Kerberos authentication is configured. |  |
| 

`isKerberosCrossRealmTrustConfigured` \*

 | `boolean` | Whether a cross-realm trust is configured (presence only). |  |
| 

`isLocalDiskEbsEncryptionEnabled` \*

 | `boolean` | Whether EBS encryption is enabled for local disks. |  |
| 

`isLocalDiskEncryptionConfigured` \*

 | `boolean` | Whether a local-disk encryption block is present. |  |
| 

`isSecureNamespaceConfigured` \*

 | `boolean` | Whether Lake Formation secure-namespace info is present. |  |
| 

`isTlsCertificateConfigured` \*

 | `boolean` | Whether an in-transit TLS certificate configuration is present. |  |
| 

`kerberosADDomainJoinUser` \*

 | `string` **|** `null` | Active Directory domain-join user for Kerberos. |  |
| 

`kerberosProvider` \*

 | `string` **|** `null` | Kerberos provider (ClusterDedicatedKdc, ExternalKdc). |  |
| 

`kerberosRealm` \*

 | `string` **|** `null` | Kerberos realm. |  |
| 

`lakeFormationQueryEngineRoleArn` \*

 | `string` **|** `null` | IAM role ARN used by the Lake Formation query engine. |  |
| 

`localDiskEncryptionAwsKmsKeyArn` \*

 | `string` **|** `null` | KMS key ARN used for local-disk encryption, if any. |  |
| 

`localDiskEncryptionKeyProviderType` \*

 | `string` **|** `null` | Local-disk encryption key provider type. |  |
| 

`region` \*

 | `string` | AWS region the security configuration was ingested from. |  |
| 

`s3EncryptionAwsKmsKeyArn` \*

 | `string` **|** `null` | KMS key ARN used for S3 encryption, if any. |  |
| 

`s3EncryptionKeyProviderType` \*

 | `string` **|** `null` | S3 encryption key provider type (AWS\_KMS, SERVICE\_DEFAULT). |  |
| 

`s3EncryptionMode` \*

 | `string` **|** `null` | S3 encryption mode (SSE-S3, SSE-KMS, CSE-KMS, CSE-Custom). |  |
| 

`secureNamespaceClusterId` \*

 | `string` **|** `null` | ID of the EKS cluster backing the Lake Formation secure namespace (EMR on EKS). |  |
| 

`secureNamespaceName` \*

 | `string` **|** `null` | Lake Formation secure namespace name. |  |
| 

`tlsCertificateProviderType` \*

 | `string` **|** `null` | TLS certificate provider type (PEM, Custom). |  |
| 

`tlsPrivateCertificateSecretArn` \*

 | `string` **|** `null` | Secrets Manager ARN of the private TLS certificate. |  |
| 

`tlsPublicCertificateSecretArn` \*

 | `string` **|** `null` | Secrets Manager ARN of the public TLS certificate. |  |

---

### Aws Emr Serverless Application

`aws_emr_serverless_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applicationId` \*

 | `string` |  |  |
| 

`applicationType` \*

 | `string` |  |  |
| 

`architecture` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`autoStopIdleTimeoutMinutes` \*

 | `number` **|** `null` |  |  |
| 

`cloudWatchLoggingEncryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`cloudWatchLogGroupName` \*

 | `string` **|** `null` |  |  |
| 

`encryptedKeyRef` \*

 | `string` **|** `null` |  |  |
| 

`isAutoStartEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoStopEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCloudWatchLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`isLivyEndpointEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isManagedPersistenceEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isStudioEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`managedPersistenceEncryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`maximumCapacityCpu` \*

 | `string` **|** `null` |  |  |
| 

`maximumCapacityDisk` \*

 | `string` **|** `null` |  |  |
| 

`maximumCapacityMemory` \*

 | `string` **|** `null` |  |  |
| 

`networkSecurityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`networkSubnetIds` \*

 | `array` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`releaseLabel` \*

 | `string` |  |  |
| 

`s3MonitoringEncryptionKeyArn` \*

 | `string` **|** `null` |  |  |
| 

`s3MonitoringLogUri` \*

 | `string` **|** `null` |  |  |
| 

`state` \*

 | `string` |  |  |
| 

`stateDetails` \*

 | `string` **|** `null` |  |  |

---

### Aws Fsx File System

`aws_fsx_file_system` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `null` **|** `string` |  |  |
| 

`createdOn` \*

 | `null` **|** `number` |  |  |
| 

`dnsName` \*

 | `null` **|** `string` |  |  |
| 

`fileSystemType` \*

 | `null` **|** `string` |  |  |
| 

`fileSystemTypeVersion` \*

 | `null` **|** `string` |  |  |
| 

`id` \*

 | `null` **|** `string` |  |  |
| 

`kmsKeyId` \*

 | `null` **|** `string` |  |  |
| 

`lifecycle` \*

 | `null` **|** `string` |  |  |
| 

`lustreAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`lustreDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`lustreDataCompressionType` \*

 | `null` **|** `string` |  |  |
| 

`lustreDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`lustreDriveCacheType` \*

 | `null` **|** `string` |  |  |
| 

`lustreIsCopyingTagsToBackups` \*

 | `null` **|** `boolean` |  |  |
| 

`lustreIsEfaEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`lustreMountName` \*

 | `null` **|** `string` |  |  |
| 

`lustrePerUnitStorageThroughput` \*

 | `null` **|** `number` |  |  |
| 

`lustreWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |
| 

`networkInterfaceIds` \*

 | `null` **|** `array` |  |  |
| 

`ontapAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`ontapDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`ontapDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`ontapEndpointIpAddressRange` \*

 | `null` **|** `string` |  |  |
| 

`ontapHAPairs` \*

 | `null` **|** `number` |  |  |
| 

`ontapPreferredSubnetId` \*

 | `null` **|** `string` |  |  |
| 

`ontapRouteTableIds` \*

 | `null` **|** `array` |  |  |
| 

`ontapThroughputCapacity` \*

 | `null` **|** `number` |  |  |
| 

`ontapThroughputCapacityPerHAPair` \*

 | `null` **|** `number` |  |  |
| 

`ontapWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |
| 

`openzfsAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`openzfsDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`openzfsDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`openzfsEndpointIpAddress` \*

 | `null` **|** `string` |  |  |
| 

`openzfsEndpointIpAddressRange` \*

 | `null` **|** `string` |  |  |
| 

`openzfsIsCopyingTagsToBackups` \*

 | `null` **|** `boolean` |  |  |
| 

`openzfsIsCopyingTagsToVolumes` \*

 | `null` **|** `boolean` |  |  |
| 

`openzfsPreferredSubnetId` \*

 | `null` **|** `string` |  |  |
| 

`openzfsRootVolumeId` \*

 | `null` **|** `string` |  |  |
| 

`openzfsRouteTableIds` \*

 | `null` **|** `array` |  |  |
| 

`openzfsThroughputCapacity` \*

 | `null` **|** `number` |  |  |
| 

`openzfsWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |
| 

`ownerId` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `null` **|** `string` |  |  |
| 

`storageCapacity` \*

 | `null` **|** `number` |  |  |
| 

`storageType` \*

 | `null` **|** `string` |  |  |
| 

`subnetIds` \*

 | `null` **|** `array` |  |  |
| 

`vpcId` \*

 | `null` **|** `string` |  |  |
| 

`windowsActiveDirectoryId` \*

 | `null` **|** `string` |  |  |
| 

`windowsAutomaticBackupRetentionDays` \*

 | `null` **|** `number` |  |  |
| 

`windowsDailyAutomaticBackupStartTime` \*

 | `null` **|** `string` |  |  |
| 

`windowsDeploymentType` \*

 | `null` **|** `string` |  |  |
| 

`windowsIsCopyingTagsToBackups` \*

 | `null` **|** `boolean` |  |  |
| 

`windowsPreferredFileServerIp` \*

 | `null` **|** `string` |  |  |
| 

`windowsPreferredSubnetId` \*

 | `null` **|** `string` |  |  |
| 

`windowsRemoteAdministrationEndpoint` \*

 | `null` **|** `string` |  |  |
| 

`windowsThroughputCapacity` \*

 | `null` **|** `number` |  |  |
| 

`windowsWeeklyMaintenanceStartTime` \*

 | `null` **|** `string` |  |  |

---

### Aws Grafana Workspace

`aws_grafana_workspace` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountAccessType` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`authenticationProviders` \*

 | `array` **|** `null` |  |  |
| 

`dataSources` \*

 | `array` **|** `null` |  |  |
| 

`endpoint` \*

 | `string` **|** `null` |  |  |
| 

`freeTrialExpirationOn` \*

 | `number` **|** `null` |  |  |
| 

`grafanaToken` \*

 | `string` **|** `null` |  |  |
| 

`grafanaVersion` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` |  |  |
| 

`isFreeTrialConsumed` \*

 | `boolean` **|** `null` |  |  |
| 

`isNetworkAccessRestricted` \*

 | `boolean` **|** `null` |  |  |
| 

`licenseExpirationOn` \*

 | `number` **|** `null` |  |  |
| 

`licenseType` \*

 | `string` **|** `null` |  |  |
| 

`modifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`networkAccessPrefixListIds` \*

 | `array` **|** `null` |  |  |
| 

`networkAccessVpceIds` \*

 | `array` **|** `null` |  |  |
| 

`notificationDestinations` \*

 | `array` **|** `null` |  |  |
| 

`organizationalUnits` \*

 | `array` **|** `null` |  |  |
| 

`organizationRoleName` \*

 | `string` **|** `null` |  |  |
| 

`permissionType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`samlConfigurationStatus` \*

 | `string` **|** `null` |  |  |
| 

`stackSetName` \*

 | `string` **|** `null` |  |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`vpcSubnetIds` \*

 | `array` **|** `null` |  |  |
| 

`webLink` \*

 | `string` |  |  |
| 

`workspaceId` \*

 | `string` **|** `null` |  |  |
| 

`workspaceRoleArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Guardduty Publishing Destination

`aws_guardduty_publishing_destination` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`destinationArn` \*

 | `string` **|** `null` | ARN of the S3 bucket/folder receiving exported findings. |  |
| 

`destinationId` \*

 | `string` | Identifier of the export destination. |  |
| 

`destinationType` \*

 | `string` **|** `null` | Export target type (currently only S3). |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether exported findings are encrypted with a KMS key (KmsKeyArn present). |  |
| 

`isPublishing` \*

 | `boolean` **|** `null` | Whether the export is actively publishing (Status === PUBLISHING). |  |
| 

`kmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key encrypting exported findings (kept as a flat property in addition to the USES relationship, an intentional ADR-005 exception mirroring inspectorv2 kmsKeyId). |  |
| 

`publishingFailureStartedOn` \*

 | `number` **|** `null` | Epoch ms at which GuardDuty first failed to publish to this destination; non-null indicates an active export failure. |  |
| 

`region` \*

 | `string` | AWS region of the publishing destination. |  |

---

### Aws Iam Roles Anywhere Profile

`aws_iam_roles_anywhere_profile` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`durationSeconds` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isInstancePropertiesRequired` \*

 | `boolean` **|** `null` |  |  |
| 

`isRoleSessionNameAccepted` \*

 | `boolean` **|** `null` |  |  |
| 

`managedPolicyArns` \*

 | `array` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArns` \*

 | `array` **|** `null` |  |  |
| 

`sessionPolicy` \*

 | `string` **|** `null` |  |  |
| 

`updatedOn` \*

 | `number` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Iam Roles Anywhere Trust Anchor

`aws_iam_roles_anywhere_trust_anchor` inherits from [Certificate](/data-model/schemas/Certificate.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`areNotificationsEnabled` \*

 | `boolean` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`notificationChannels` \*

 | `array` **|** `null` |  |  |
| 

`notificationEvents` \*

 | `array` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`sourceAcmPcaArn` \*

 | `string` **|** `null` |  |  |
| 

`sourceType` \*

 | `string` **|** `null` |  |  |
| 

`updatedOn` \*

 | `number` **|** `null` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Imagebuilder Component

`aws_imagebuilder_component` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the component. |  |
| 

`arn` \*

 | `string` | The ARN of the Image Builder component. |  |
| 

`changeDescription` \*

 | `string` **|** `null` | The change description of the component for this version. |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` | Whether the component document is encrypted at rest using a customer-managed KMS key. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | The KMS key ID used to encrypt the component. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform the component supports (Windows or Linux). |  |
| 

`region` \*

 | `string` | AWS region where the component is defined. |  |
| 

`supportedOsVersions` \*

 | `array` **|** `null` | The operating system versions the component supports. |  |
| 

`type` \*

 | `string` **|** `null` | The type of the component (BUILD or TEST). |  |
| 

`version` \*

 | `string` **|** `null` | The version of the component. |  |

---

### Aws Imagebuilder Container Recipe

`aws_imagebuilder_container_recipe` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the recipe. |  |
| 

`arn` \*

 | `string` | The ARN of the container recipe. |  |
| 

`componentArns` \*

 | `array` **|** `null` | ARNs of the components included in the recipe. |  |
| 

`componentCount` \*

 | `number` **|** `null` | The number of components in the recipe. |  |
| 

`containerType` \*

 | `string` **|** `null` | The type of container produced by the recipe (DOCKER). |  |
| 

`isDockerfileTemplatePresent` \*

 | `boolean` **|** `null` | Whether a Dockerfile template is present in the recipe. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | KMS key ID used to encrypt the container recipe. |  |
| 

`parentImage` \*

 | `string` **|** `null` | The base image used for the container recipe. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform for the container recipe (Linux or Windows). |  |
| 

`region` \*

 | `string` | AWS region where the recipe is defined. |  |
| 

`targetRepositoryName` \*

 | `string` **|** `null` | The name of the target repository for the container image. |  |
| 

`targetRepositoryService` \*

 | `string` **|** `null` | The service for the target repository (ECR or other). |  |
| 

`version` \*

 | `string` **|** `null` | The version of the container recipe. |  |
| 

`workingDirectory` \*

 | `string` **|** `null` | The working directory used during container image builds. |  |

---

### Aws Imagebuilder Distribution Configuration

`aws_imagebuilder_distribution_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the configuration. |  |
| 

`amiDistributionKmsKeyIds` \*

 | `array` **|** `null` | KMS key IDs used to encrypt distributed AMIs, aggregated across all distributions. |  |
| 

`amiDistributionLaunchPermissionGroupNames` \*

 | `array` **|** `null` | Group names granted launch permission on distributed AMIs. |  |
| 

`amiDistributionLaunchPermissionOrganizationArns` \*

 | `array` **|** `null` | Organization ARNs granted launch permission on distributed AMIs. |  |
| 

`amiDistributionLaunchPermissionUserIds` \*

 | `array` **|** `null` | User IDs granted launch permission on distributed AMIs. |  |
| 

`amiDistributionTargetAccountIds` \*

 | `array` **|** `null` | Target AWS account IDs for AMI distribution. |  |
| 

`arn` \*

 | `string` | The ARN of the distribution configuration. |  |
| 

`containerDistributionTargetAccountIds` \*

 | `array` **|** `null` | Target account IDs for container image distribution. Always null — the SDK does not expose container cross-account sharing (governed by ECR repository policy). |  |
| 

`containerDistributionTargetRepositoryNames` \*

 | `array` **|** `null` | Target repository names for container image distribution, aggregated across all distributions. |  |
| 

`distributionRegions` \*

 | `array` **|** `null` | The AWS regions where images are distributed. |  |
| 

`isSharedCrossAccount` \*

 | `boolean` | Whether any distributed AMI is shared with specific AWS accounts, users, or organizations (distinct from public exposure). |  |
| 

`public` \*

 | `boolean` | Whether any distributed AMI is shared publicly (launchPermission grants the reserved `all` group). |  |
| 

`region` \*

 | `string` | AWS region where the configuration is defined. |  |

---

### Aws Imagebuilder Image

`aws_imagebuilder_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the image. |  |
| 

`arn` \*

 | `string` | The ARN of the Image Builder image build version. |  |
| 

`containerRecipeArn` \*

 | `string` **|** `null` | ARN of the container recipe used to build this image. |  |
| 

`distributionConfigurationArn` \*

 | `string` **|** `null` | ARN of the distribution configuration used for this image. |  |
| 

`ebsKmsKeyIds` \*

 | `array` **|** `null` | KMS key IDs used for EBS block device encryption, collected across every mapped device in the image recipe or container recipe instance configuration. Values may be a key ARN or an alias. Null when no mapped device names a key. |  |
| 

`imageRecipeArn` \*

 | `string` **|** `null` | ARN of the image recipe used to build this image. |  |
| 

`infrastructureConfigurationArn` \*

 | `string` **|** `null` | ARN of the infrastructure configuration used to build this image. |  |
| 

`isEbsEncrypted` \*

 | `boolean` **|** `null` | True when every EBS block device mapped by the build instance declares encryption. Collected from the image recipe (AMI images) or the container recipe instance configuration (container images). Null when the image maps no EBS devices. |  |
| 

`isImageScanningEnabled` \*

 | `boolean` **|** `null` | Whether image scanning was enabled for this build. |  |
| 

`isImageTestsEnabled` \*

 | `boolean` **|** `null` | Whether image tests were enabled for this build. |  |
| 

`osVersion` \*

 | `string` **|** `null` | The OS version of the image. |  |
| 

`outputResourcesAmiIds` \*

 | `array` **|** `null` | AMI IDs produced as output resources. |  |
| 

`outputResourcesContainerImages` \*

 | `array` **|** `null` | Container image URIs produced as output resources. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform of the image (Windows or Linux). |  |
| 

`region` \*

 | `string` | AWS region where the image was built. |  |
| 

`sourcePipelineArn` \*

 | `string` **|** `null` | ARN of the pipeline that created this image, if pipeline-created. |  |
| 

`state` \*

 | `string` **|** `null` | The current build state of the image (from state.status). |  |
| 

`stateReason` \*

 | `string` **|** `null` | The reason for the current state. |  |
| 

`type` \*

 | `string` **|** `null` | The type of image output (AMI or DOCKER). |  |
| 

`version` \*

 | `string` **|** `null` | The semantic version of the image. |  |

---

### Aws Imagebuilder Image Pipeline

`aws_imagebuilder_image_pipeline` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the pipeline. |  |
| 

`arn` \*

 | `string` | The ARN of the image pipeline. |  |
| 

`containerRecipeArn` \*

 | `string` **|** `null` | ARN of the container recipe used by this pipeline (container pipelines). |  |
| 

`distributionConfigurationArn` \*

 | `string` **|** `null` | ARN of the distribution configuration used by this pipeline. |  |
| 

`executionRoleArn` \*

 | `string` **|** `null` | ARN of the IAM role used to execute the pipeline. |  |
| 

`imageRecipeArn` \*

 | `string` **|** `null` | ARN of the image recipe used by this pipeline (AMI pipelines). |  |
| 

`imageTestsConfigurationTimeoutMinutes` \*

 | `number` **|** `null` | The timeout in minutes for image tests. |  |
| 

`infrastructureConfigurationArn` \*

 | `string` **|** `null` | ARN of the infrastructure configuration used by this pipeline. |  |
| 

`isEnhancedImageMetadataEnabled` \*

 | `boolean` **|** `null` | Whether enhanced image metadata is enabled for the pipeline. |  |
| 

`isImageScanningConfigurationEnabled` \*

 | `boolean` **|** `null` | Whether image scanning is enabled for this pipeline. |  |
| 

`isImageTestsConfigurationEnabled` \*

 | `boolean` **|** `null` | Whether image tests are enabled for this pipeline. |  |
| 

`lastRunOn` \*

 | `number` **|** `null` | Timestamp of the last pipeline execution. |  |
| 

`nextRunOn` \*

 | `number` **|** `null` | Timestamp of the next scheduled pipeline execution. |  |
| 

`platform` \*

 | `string` **|** `null` | The platform of the pipeline (Windows or Linux). |  |
| 

`region` \*

 | `string` | AWS region where the pipeline is defined. |  |
| 

`scheduleExpression` \*

 | `string` **|** `null` | The cron expression for the pipeline schedule. |  |
| 

`schedulePipelineExecutionStartCondition` \*

 | `string` **|** `null` | The condition under which the scheduled pipeline runs. |  |
| 

`scheduleTimezone` \*

 | `string` **|** `null` | The timezone for the schedule. |  |

---

### Aws Imagebuilder Infrastructure Configuration

`aws_imagebuilder_infrastructure_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the configuration. |  |
| 

`arn` \*

 | `string` | The ARN of the infrastructure configuration. |  |
| 

`iamInstanceProfileName` \*

 | `string` **|** `null` | The IAM instance profile name attached to the build instance. |  |
| 

`instanceMetadataHttpPutResponseHopLimit` \*

 | `number` **|** `null` | The HTTP PUT response hop limit for IMDSv2. |  |
| 

`instanceMetadataHttpTokens` \*

 | `string` **|** `null` | IMDSv2 token requirement setting (required or optional). |  |
| 

`instanceTypes` \*

 | `array` **|** `null` | The instance types used for the build EC2 instance. |  |
| 

`isTerminateInstanceOnFailure` \*

 | `boolean` **|** `null` | Whether to terminate the build instance on failure. |  |
| 

`keyPair` \*

 | `string` **|** `null` | The EC2 key pair name used for the build instance. |  |
| 

`region` \*

 | `string` | AWS region where the configuration is defined. |  |
| 

`s3LogsBucketName` \*

 | `string` **|** `null` | S3 bucket name for storing build logs. |  |
| 

`s3LogsKeyPrefix` \*

 | `string` **|** `null` | S3 key prefix for build log files. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Security group IDs attached to the build EC2 instance. |  |
| 

`snsTopicArn` \*

 | `string` **|** `null` | ARN of the SNS topic for build notifications. |  |
| 

`subnetId` \*

 | `string` **|** `null` | The subnet ID where the build instance runs. |  |

---

### Aws Imagebuilder Lifecycle Policy

`aws_imagebuilder_lifecycle_policy` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the policy. |  |
| 

`arn` \*

 | `string` | The ARN of the lifecycle policy. |  |
| 

`executionRoleArn` \*

 | `string` **|** `null` | ARN of the IAM role used to execute lifecycle actions. |  |
| 

`lastRunOn` \*

 | `number` **|** `null` | Timestamp of the last policy execution. |  |
| 

`policyDetailActionType` \*

 | `string` **|** `null` | The action type from the first policy detail (DELETE, DEPRECATE, or DISABLE). |  |
| 

`policyDetailFilterType` \*

 | `string` **|** `null` | The filter type from the first policy detail (AGE or COUNT). |  |
| 

`policyDetailFilterUnit` \*

 | `string` **|** `null` | The filter unit from the first policy detail (DAYS, WEEKS, MONTHS, or YEARS). |  |
| 

`policyDetailFilterValue` \*

 | `number` **|** `null` | The filter threshold value from the first policy detail. |  |
| 

`policyDetailRetentionAtLeastCount` \*

 | `number` **|** `null` | The minimum number of images to retain per the first policy detail. |  |
| 

`region` \*

 | `string` | AWS region where the policy is defined. |  |
| 

`resourceType` \*

 | `string` **|** `null` | The type of resource the policy applies to (AMI\_IMAGE or CONTAINER\_IMAGE). |  |

---

### Aws Imagebuilder Workflow

`aws_imagebuilder_workflow` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | AWS account ID that owns the workflow. |  |
| 

`arn` \*

 | `string` | The ARN of the Image Builder workflow. |  |
| 

`changeDescription` \*

 | `string` **|** `null` | The change description for this workflow version. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | KMS key ID used to encrypt the workflow. |  |
| 

`region` \*

 | `string` | AWS region where the workflow is defined. |  |
| 

`type` \*

 | `string` **|** `null` | The type of the workflow (BUILD, TEST, or DISTRIBUTION). |  |
| 

`version` \*

 | `string` **|** `null` | The version of the workflow. |  |
| 

`workflowState` \*

 | `string` **|** `null` | The current state status of the workflow (from state.status). |  |

---

### Aws Inspector Finding

`aws_inspector_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws Inspector Finding

`aws_inspector_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws Inspectorv2 Cis Finding

`aws_inspectorv2_cis_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | AWS account ID owning the assessed instance. Differs from the integration account when CIS scans are read through an Inspector delegated administrator. |  |
| 

`failedChecks` \*

 | `number` **|** `null` | Number of CIS checks that failed on this instance. |  |
| 

`passedChecks` \*

 | `number` **|** `null` | Number of CIS checks that passed on this instance. |  |
| 

`platform` \*

 | `string` **|** `null` | OS platform assessed (e.g. AMAZON\_LINUX\_2, WINDOWS\_SERVER\_2019). |  |
| 

`region` \*

 | `string` | AWS region where the CIS scan was executed. |  |
| 

`scanArn` \*

 | `string` | ARN of the parent CIS scan. |  |
| 

`skippedChecks` \*

 | `number` **|** `null` | Number of CIS checks skipped on this instance. |  |
| 

`targetResourceId` \*

 | `string` **|** `null` | EC2 instance ID that was assessed (e.g. i-0abc123). |  |
| 

`targetStatus` \*

 | `string` **|** `null` | Status of the CIS scan target: TIMED\_OUT | CANCELLED | COMPLETED. |  |
| 

`targetStatusReason` \*

 | `string` **|** `null` | Reason for target status (e.g. UNSUPPORTED\_OS, SSM\_UNMANAGED). |  |

---

### Aws Inspectorv2 Cis Scan

`aws_inspectorv2_cis_scan` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the CIS scan run. |  |
| 

`failedChecks` \*

 | `number` **|** `null` | Number of CIS checks that failed. |  |
| 

`region` \*

 | `string` | AWS region the scan was executed in. |  |
| 

`scanConfigurationArn` \*

 | `string` **|** `null` | ARN of the CIS scan configuration that triggered this scan. |  |
| 

`scheduledBy` \*

 | `string` **|** `null` | Account or entity that scheduled the scan. |  |
| 

`securityLevel` \*

 | `string` **|** `null` | CIS security level: LEVEL\_1 or LEVEL\_2. |  |
| 

`totalChecks` \*

 | `number` **|** `null` | Total number of CIS checks evaluated. |  |

---

### Aws Inspectorv2 Configuration

`aws_inspectorv2_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`ec2ScanMode` \*

 | `string` **|** `null` | EC2 automated scan mode (EC2\_HYBRID or EC2\_SSM\_AGENT\_BASED). |  |
| 

`ec2ScanModeStatus` \*

 | `string` **|** `null` | Status of the EC2 scan mode setting (PENDING/SUCCESS). |  |
| 

`ecrPullDateRescanDuration` \*

 | `string` **|** `null` | ECR re-scan duration measured from image pull date (e.g. DAYS\_30). |  |
| 

`ecrPullDateRescanMode` \*

 | `string` **|** `null` | ECR pull-date re-scan mode. |  |
| 

`ecrRescanDuration` \*

 | `string` **|** `null` | ECR automated re-scan duration (e.g. DAYS\_30, LIFETIME). |  |
| 

`ecrRescanDurationStatus` \*

 | `string` **|** `null` | Status of changes to the ECR re-scan duration (FAILED/PENDING/SUCCESS). |  |
| 

`ecrRescanDurationUpdatedOn` \*

 | `number` **|** `null` | When the ECR re-scan duration setting was last changed (epoch ms). |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | ARN of the customer-managed KMS key used to encrypt Inspector Lambda code scan data in this region (the only scan type that supports a customer-managed key; absent when using an AWS-owned key). |  |
| 

`region` \*

 | `string` | The AWS region this configuration applies to. |  |

---

### Aws Inspectorv2 Filter

`aws_inspectorv2_filter` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `string` **|** `null` | The action applied to findings that match the filter (NONE or SUPPRESS). |  |
| 

`arn` \*

 | `string` | The Amazon Resource Number (ARN) associated with this filter. |  |
| 

`criteriaFields` \*

 | `array` **|** `null` | The names of the FilterCriteria fields that are populated on this filter (e.g. "severity", "resourceType"). Only the field names are captured, not their matched values, so this indicates which dimensions the filter constrains but not the specific values it matches or suppresses. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The AWS account ID of the account that created the filter. |  |
| 

`reason` \*

 | `string` **|** `null` | The reason for the filter. |  |
| 

`region` \*

 | `string` **|** `null` | The AWS region the filter was read from. |  |

---

### Aws Inspectorv2 Finding

`aws_inspectorv2_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws Inspectorv2 Finding

`aws_inspectorv2_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `id` | `string` |  |  |

---

### Aws License Manager License

`aws_license_manager_license` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`beneficiary` \*

 | `string` **|** `null` |  |  |
| 

`expiresOn` \*

 | `number` **|** `null` |  |  |
| 

`homeRegion` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`issuerKeyFingerprint` \*

 | `string` **|** `null` |  |  |
| 

`issuerName` \*

 | `string` **|** `null` |  |  |
| 

`productName` \*

 | `string` **|** `null` |  |  |
| 

`productSku` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`validityStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`version` \*

 | `string` **|** `null` |  |  |

---

### Aws License Manager Received License

`aws_license_manager_received_license` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allowedOperations` \*

 | `array` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`beneficiary` \*

 | `string` **|** `null` |  |  |
| 

`borrowMaxTimeToLiveInMinutes` \*

 | `number` **|** `null` |  |  |
| 

`consumptionRenewType` \*

 | `string` **|** `null` |  |  |
| 

`expiresOn` \*

 | `number` **|** `null` |  |  |
| 

`homeRegion` \*

 | `string` **|** `null` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isBorrowAllowEarlyCheckIn` \*

 | `boolean` **|** `null` |  |  |
| 

`issuerKeyFingerprint` \*

 | `string` **|** `null` |  |  |
| 

`issuerName` \*

 | `string` **|** `null` |  |  |
| 

`issuerSignKey` \*

 | `string` **|** `null` |  |  |
| 

`productName` \*

 | `string` **|** `null` |  |  |
| 

`productSku` \*

 | `string` **|** `null` |  |  |
| 

`provisionalMaxTimeToLiveInMinutes` \*

 | `number` **|** `null` |  |  |
| 

`receivedStatus` \*

 | `string` **|** `null` |  |  |
| 

`receivedStatusReason` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`validityStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`version` \*

 | `string` **|** `null` |  |  |

---

### Aws Macie Admin Account

`aws_macie_admin_account` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`adminAccountId` \*

 | `string` | Identifier of the AWS account delegated as the Amazon Macie administrator for the organization. |  |

---

### Aws Macie Automated Discovery Account

`aws_macie_automated_discovery_account` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | Identifier of the AWS organization member account whose automated sensitive data discovery status this records. The status itself is on the inherited `status` property. |  |

---

### Aws Macie Automated Discovery Configuration

`aws_macie_automated_discovery_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | Identifier of the AWS account this automated discovery configuration belongs to. |  |
| 

`autoEnableOrganizationMembers` \*

 | `string` **|** `null` | Which organization member accounts automated sensitive data discovery is enabled for as they join: `ALL`, `NEW` or `NONE`. Null when the account is not a Macie administrator. |  |
| 

`classificationScopeId` \*

 | `string` **|** `null` | Identifier of the classification scope that defines which S3 buckets automated discovery excludes, or null when no scope applies. |  |
| 

`disabledOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when automated sensitive data discovery was most recently disabled, or null if it has never been disabled. |  |
| 

`firstEnabledOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when automated sensitive data discovery was first enabled for the account, or null if it has never been enabled. |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when the automated sensitive data discovery status was last changed, or null when it has never changed. |  |
| 

`sensitivityInspectionTemplateId` \*

 | `string` **|** `null` | Identifier of the sensitivity inspection template that defines which managed and custom data identifiers automated discovery uses, or null when no template applies. |  |

---

### Aws Macie Classification Export Configuration

`aws_macie_classification_export_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | Identifier of the AWS account this classification export configuration belongs to. |  |
| 

`region` \*

 | `string` | The AWS region this classification export configuration applies to, for example `us-east-1`. The configuration is per-region. |  |
| 

`s3DestinationBucketName` \*

 | `string` **|** `null` | Name of the S3 bucket sensitive data discovery results are exported to, or null when no export destination is configured. |  |
| 

`s3DestinationKeyPrefix` \*

 | `string` **|** `null` | Key prefix within the destination S3 bucket that exported results are written under, or null when results are written to the bucket root or no export destination is configured. |  |
| 

`s3DestinationKmsKeyArn` \*

 | `string` **|** `null` | ARN of the KMS key used to encrypt exported sensitive data discovery results, or null when no export destination is configured. |  |

---

### Aws Macie Classification Job

`aws_macie_classification_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`approximateObjectsToProcess` \*

 | `number` **|** `null` | Approximate number of objects the job is expected to analyse, across all of its runs. |  |
| 

`arn` \*

 | `string` | The Amazon Resource Name (ARN) of the classification job. |  |
| 

`isInitialRun` \*

 | `boolean` **|** `null` | Whether the job is configured to analyse all eligible existing objects immediately on its first run. |  |
| 

`isScheduleDailyEnabled` \*

 | `boolean` **|** `null` | Whether the job runs on a daily schedule. Null when the job has no schedule at all (a one-time job). |  |
| 

`jobExpiresOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when a job paused by a user expires and is cancelled automatically, or null when the job is not user-paused. |  |
| 

`jobId` \*

 | `string` | Identifier of the classification job. |  |
| 

`jobPausedOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when a user most recently paused the job, or null when the job has not been user-paused. |  |
| 

`jobStatus` \*

 | `string` **|** `null` | Current status of the job, for example `RUNNING`, `PAUSED`, `CANCELLED`, `COMPLETE`, `IDLE` or `USER_PAUSED`. |  |
| 

`jobType` \*

 | `string` **|** `null` | Whether the job runs once or on a schedule: `ONE_TIME` or `SCHEDULED`. |  |
| 

`lastRunErrorCode` \*

 | `string` **|** `null` | Error code from the job run that most recently failed, or null when the last run did not error. |  |
| 

`lastRunOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when the job last started running, or null when it has never run. |  |
| 

`managedDataIdentifierSelector` \*

 | `string` **|** `null` | How the job selects AWS managed data identifiers: `ALL`, `EXCLUDE`, `INCLUDE`, `NONE` or `RECOMMENDED`. |  |
| 

`numberOfRuns` \*

 | `number` **|** `null` | Total number of times the job has run. |  |
| 

`region` \*

 | `string` | The AWS region the classification job is defined in, for example `us-east-1`. |  |
| 

`samplingPercentage` \*

 | `number` **|** `null` | Percentage of eligible objects the job analyses, from 1 to 100. Below 100 the job samples rather than analysing everything. |  |
| 

`scheduleDayOfMonth` \*

 | `number` **|** `null` | Day of the month the job runs on, from 1 to 31, or null when the job is not on a monthly schedule. |  |
| 

`scheduleDayOfWeek` \*

 | `string` **|** `null` | Day of the week the job runs on, for example `MONDAY`, or null when the job is not on a weekly schedule. |  |

---

### Aws Macie Finding Publication Configuration

`aws_macie_finding_publication_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | Identifier of the AWS account this finding publication configuration belongs to. |  |
| 

`isPublishClassificationFindings` \*

 | `boolean` **|** `null` | Whether Amazon Macie publishes sensitive data findings to AWS Security Hub. |  |
| 

`isPublishPolicyFindings` \*

 | `boolean` **|** `null` | Whether Amazon Macie publishes policy findings to AWS Security Hub. |  |
| 

`region` \*

 | `string` | The AWS region this finding publication configuration applies to, for example `us-east-1`. The configuration is per-region. |  |

---

### Aws Macie Organization Configuration

`aws_macie_organization_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | Identifier of the delegated Macie administrator account this organization configuration was read from. |  |
| 

`isAutoEnabled` \*

 | `boolean` **|** `null` | Whether Amazon Macie is automatically enabled for new accounts as they join the organization. |  |
| 

`isMaxAccountLimitReached` \*

 | `boolean` **|** `null` | Whether the organization has reached the quota for the number of accounts Amazon Macie can be enabled for. When true, new accounts are not enabled automatically. |  |

---

### Aws Marketplace Entitlement

`aws_marketplace_entitlement` inherits from [Subscription](/data-model/schemas/Subscription.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`customerIdentifier` \*

 | `string` **|** `null` | Entitlement.CustomerIdentifier — opaque buyer handle from ResolveCustomer. |  |
| 

`dimension` \*

 | `string` **|** `null` | Entitlement.Dimension — the capacity dimension this entitlement covers (e.g. Users, DataGB). |  |
| 

`productCode` \*

 | `string` | Marketplace ProductCode used to query GetEntitlements. Equals AWS License Manager GrantedLicense.ProductSKU. |  |
| 

`region` \*

 | `string` | AWS region (always us-east-1 for the AWS Marketplace Entitlement Service). |  |
| 

`valueBoolean` \*

 | `boolean` **|** `null` | Entitlement.Value.BooleanValue when present. |  |
| 

`valueDouble` \*

 | `number` **|** `null` | Entitlement.Value.DoubleValue when present. |  |
| 

`valueInteger` \*

 | `number` **|** `null` | Entitlement.Value.IntegerValue when present. |  |
| 

`valueString` \*

 | `string` **|** `null` | Entitlement.Value.StringValue when present. |  |

---

### Aws Marketplace Entity

`aws_marketplace_entity` inherits from [Product](/data-model/schemas/Product.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | EntityArn from ListEntities, e.g. arn:aws:aws-marketplace:::AmiProduct/prod-xxxx. |  |
| 

`entityId` \*

 | `string` | Opaque catalog entity ID, e.g. prod-xxxx. |  |
| 

`entityType` \*

 | `string` | Marketplace entity discriminator: AmiProduct, ContainerProduct, SaaSProduct, DataProduct, Offer, or ResaleAuthorization. |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` | EntitySummary.LastModifiedDate parsed via parseTimePropertyValue (milliseconds since epoch). |  |
| 

`offerAvailableUntilOn` \*

 | `number` **|** `null` | OfferSummary.AvailabilityEndDate parsed via parseTimePropertyValue. |  |
| 

`offerBuyerAccountIds` \*

 | `array` **|** `null` | OfferSummary.BuyerAccounts — AWS account IDs targeted by a private offer. |  |
| 

`offerOfferSetId` \*

 | `string` **|** `null` | OfferSummary.OfferSetId. |  |
| 

`offerProductId` \*

 | `string` **|** `null` | OfferSummary.ProductId — references another aws\_marketplace\_entity EntityId. |  |
| 

`offerReleasedOn` \*

 | `number` **|** `null` | OfferSummary.ReleaseDate parsed via parseTimePropertyValue. |  |
| 

`offerResaleAuthorizationId` \*

 | `string` **|** `null` | OfferSummary.ResaleAuthorizationId — references a ResaleAuthorization entity EntityId. |  |
| 

`offerState` \*

 | `string` **|** `null` | OfferSummary.State. |  |
| 

`offerTargeting` \*

 | `array` **|** `null` | OfferSummary.Targeting — string targeting tokens (e.g. None, BuyerAccounts, CountryCodes). |  |
| 

`ownershipType` \*

 | `string` | Ownership filter under which the entity was discovered: SELF (owned by calling account) or SHARED (visible via private offer/RAM share). |  |
| 

`productTitle` \*

 | `string` **|** `null` | Product title from {AmiProduct|ContainerProduct|SaaSProduct|DataProduct}Summary.ProductTitle. |  |
| 

`productVisibility` \*

 | `string` **|** `null` | Per-product visibility from the type-specific product sub-summary. |  |
| 

`region` \*

 | `string` | AWS region (always us-east-1 for the AWS Marketplace Catalog Service). |  |
| 

`resaleAvailableUntilOn` \*

 | `number` **|** `null` | ResaleAuthorizationSummary.AvailabilityEndDate parsed via parseTimePropertyValue. |  |
| 

`resaleManufacturerAccountId` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ManufacturerAccountId — counterparty AWS account. |  |
| 

`resaleManufacturerLegalName` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ManufacturerLegalName. |  |
| 

`resaleOfferExtendedStatus` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.OfferExtendedStatus. |  |
| 

`resaleProductId` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ProductId. |  |
| 

`resaleProductName` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ProductName. |  |
| 

`resaleResellerAccountId` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ResellerAccountID — counterparty AWS account. |  |
| 

`resaleResellerLegalName` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.ResellerLegalName. |  |
| 

`resaleStatus` \*

 | `string` **|** `null` | ResaleAuthorizationSummary.Status. |  |
| 

`visibility` \*

 | `string` **|** `null` | Top-level entity visibility from ListEntities (e.g. Public, Limited, Restricted). |  |

---

### Aws Networkmanager Attachment

`aws_networkmanager_attachment` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The synthesized attachment ARN (arn:aws:networkmanager::{ownerAccountId}:attachment/{attachmentId}); entity \_key. |  |
| 

`associatedRoutingPolicies` \*

 | `array` **|** `null` | Routing policies currently associated with this attachment (flattened across all ListAttachmentRoutingPolicyAssociations records). |  |
| 

`attachmentId` \*

 | `string` | The CloudWAN attachment ID (attachment-…). |  |
| 

`attachmentPolicyRuleNumber` \*

 | `number` **|** `null` | Rule number from the attachment-policies\[\] that bound this attachment to its segment. |  |
| 

`attachmentType` \*

 | `string` **|** `null` | One of VPC | SITE\_TO\_SITE\_VPN | CONNECT | DIRECT\_CONNECT\_GATEWAY | TRANSIT\_GATEWAY\_ROUTE\_TABLE. |  |
| 

`coreNetworkArn` \*

 | `string` **|** `null` | ARN of the owning core network. |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`edgeLocation` \*

 | `string` **|** `null` | Edge location the attachment is bound to. |  |
| 

`edgeLocations` \*

 | `array` **|** `null` | Edge locations associated with the attachment — set on Direct Connect Gateway attachments that span multiple edges. |  |
| 

`hasLastModificationErrors` \*

 | `boolean` | True when LastModificationErrors\[\] has one or more entries. |  |
| 

`id` \*

 | `string` | The CloudWAN attachment ID (attachment-…). |  |
| 

`isPendingAcceptance` \*

 | `boolean` | True when the attachment is awaiting acceptance (PENDING\_ATTACHMENT\_ACCEPTANCE or PENDING\_TAG\_ACCEPTANCE). |  |
| 

`lastModificationErrorCodes` \*

 | `array` **|** `null` | Error codes from LastModificationErrors\[\].Code if any. |  |
| 

`networkFunctionGroupName` \*

 | `string` **|** `null` | Network function group binding for service-insertion attachments. |  |
| 

`ownerAccountId` \*

 | `string` **|** `null` | AWS account that owns this attachment — present even when the underlying resource is in a different account. |  |
| 

`pendingRoutingPolicies` \*

 | `array` **|** `null` | Routing policies pending association with this attachment (flattened across all ListAttachmentRoutingPolicyAssociations records). |  |
| 

`proposedNetworkFunctionGroupName` \*

 | `string` **|** `null` | Proposed network-function-group binding from a pending change (drift detection). |  |
| 

`proposedSegmentName` \*

 | `string` **|** `null` | Proposed segment binding from a pending change (drift detection). |  |
| 

`region` \*

 | `string` **|** `null` | Edge location (AWS region) the attachment terminates in — alias of edgeLocation. |  |
| 

`resourceArn` \*

 | `string` **|** `null` | The underlying VPC/VPN/Direct-Connect-Gateway/Transit-Gateway-Route-Table ARN. Kept on the entity to support compliance queries against cross-account targets that may not be ingested. |  |
| 

`routingPolicyLabels` \*

 | `array` **|** `null` | Routing-policy labels associated with this attachment, sourced from ListAttachmentRoutingPolicyAssociations. |  |
| 

`segmentName` \*

 | `string` **|** `null` | Segment the attachment is bound to (compliance pivot). |  |
| 

`state` \*

 | `string` **|** `null` | Lifecycle state. |  |

---

### Aws Networkmanager Connect Peer

`aws_networkmanager_connect_peer` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | The owning AWS account ID. |  |
| 

`arn` \*

 | `string` | The synthesized connect-peer ARN (arn:aws:networkmanager::{ownerAccountId}:connect-peer/{connectPeerId}); entity \_key. |  |
| 

`bgpPeerAsns` \*

 | `array` **|** `null` | BGP peer ASNs (one per Configuration.BgpConfigurations entry). |  |
| 

`connectAttachmentId` \*

 | `string` | The Connect attachment ID this peer is bound to (relationship pivot). |  |
| 

`connectPeerId` \*

 | `string` | The Connect Peer ID. |  |
| 

`coreNetworkAddress` \*

 | `string` **|** `null` | BGP local address on the core network side. |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`edgeLocation` \*

 | `string` **|** `null` | Edge location. |  |
| 

`hasLastModificationErrors` \*

 | `boolean` | True when LastModificationErrors\[\] has one or more entries. |  |
| 

`id` \*

 | `string` | The Connect Peer ID. |  |
| 

`insideCidrBlocks` \*

 | `array` **|** `null` | Inside CIDR blocks (GRE only). |  |
| 

`peerAddress` \*

 | `string` **|** `null` | BGP peer address (customer/appliance side). |  |
| 

`protocol` \*

 | `string` **|** `null` | Encapsulation protocol. | **Any of**:

-   `GRE`

-   `NO_ENCAP`

-   `undefined`

 |
| 

`region` \*

 | `string` **|** `null` | Edge location of this peer (alias of edgeLocation). |  |
| 

`state` \*

 | `string` **|** `null` | Lifecycle state. |  |
| 

`subnetArn` \*

 | `string` **|** `null` | Subnet ARN for NO\_ENCAP peers. Kept on the entity to support cross-account compliance queries. |  |

---

### Aws Networkmanager Core Network

`aws_networkmanager_core_network` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | The owning AWS account ID derived from the ARN. |  |
| 

`arn` \*

 | `string` | The CloudWAN core network ARN; entity \_key. |  |
| 

`coreNetworkId` \*

 | `string` | The CloudWAN core network ID (e.g. core-network-…). |  |
| 

`edgeAsns` \*

 | `array` **|** `null` | Per-edge BGP ASNs assigned by the core network at each edge location. |  |
| 

`edgeLocations` \*

 | `array` **|** `null` | All edge locations (AWS regions) the core network is deployed to. |  |
| 

`globalNetworkId` \*

 | `string` | The parent NetworkManager global network ID. |  |
| 

`id` \*

 | `string` | The CloudWAN core network ID (e.g. core-network-…). |  |
| 

`latestPolicyVersionId` \*

 | `number` **|** `null` | Policy version ID currently aliased LATEST — used to detect drift versus LIVE. |  |
| 

`livePolicyVersionId` \*

 | `number` **|** `null` | Policy version ID currently aliased LIVE on the core network — the enforced policy. |  |
| 

`networkFunctionGroupNames` \*

 | `array` **|** `null` | Names of network function groups defined for service insertion on the core network. |  |
| 

`region` \*

 | `string` | The control-plane region for the core network (us-west-2 for commercial, us-gov-west-1 for GovCloud). |  |
| 

`segmentNames` \*

 | `array` **|** `null` | Names of segments (logical isolation domains) defined on the core network. |  |
| 

`state` \*

 | `string` **|** `null` | Lifecycle state (AVAILABLE, UPDATING, CREATING, DELETING, …). |  |

---

### Aws Networkmanager Core Network Policy

`aws_networkmanager_core_network_policy` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | The owning AWS account ID derived from the ARN. |  |
| 

`alias` \*

 | `string` **|** `null` | Alias of this version (LIVE = enforced, LATEST = latest published). | **Any of**:

-   `LIVE`

-   `LATEST`

-   `undefined`

 |
| 

`asnRanges` \*

 | `array` **|** `null` | BGP ASN ranges available to the core network (from core-network-configuration.asn-ranges). |  |
| 

`attachmentPolicyRuleCount` \*

 | `number` **|** `null` | Number of attachment-policy rules — a quick gauge of policy complexity. |  |
| 

`changeSetState` \*

 | `string` **|** `null` | Change-set state (READY\_TO\_EXECUTE, EXECUTING, OUT\_OF\_DATE, FAILED, …). |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`hasPolicyErrors` \*

 | `boolean` | True when the policy has one or more PolicyErrors entries (compliance signal). |  |
| 

`id` \*

 | `string` | The policy version ID (string-coerced) — natural AWS resource identifier scoped to the parent core network. |  |
| 

`insideCidrBlocks` \*

 | `array` **|** `null` | Inside CIDR blocks reserved for Connect attachments (from core-network-configuration.inside-cidr-blocks). |  |
| 

`isLive` \*

 | `boolean` | True when this policy version is aliased LIVE. |  |
| 

`isVpnEcmpSupportEnabled` \*

 | `boolean` **|** `null` | Whether VPN ECMP support is enabled on the core network (from core-network-configuration.vpn-ecmp-support). |  |
| 

`networkFunctionGroupNames` \*

 | `array` **|** `null` | All network-function-group names declared in the policy. |  |
| 

`policyErrorCodes` \*

 | `array` **|** `null` | Error codes from PolicyErrors\[\].ErrorCode if any. |  |
| 

`policyVersionId` \*

 | `number` | The policy version (monotonically increasing). |  |
| 

`region` \*

 | `string` | Control-plane region the policy was retrieved from. |  |
| 

`segmentNames` \*

 | `array` **|** `null` | All segment names declared in the policy. |  |

---

### Aws Networkmanager Core Network Policy Version

`aws_networkmanager_core_network_policy_version` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alias` \*

 | `string` **|** `null` | Alias (LIVE = enforced, LATEST = latest published, null = historical). | **Any of**:

-   `LIVE`

-   `LATEST`

-   `undefined`

 |
| 

`changeSetState` \*

 | `string` **|** `null` | Change-set state (READY\_TO\_EXECUTE, EXECUTING, OUT\_OF\_DATE, EXECUTION\_SUCCEEDED, FAILED). |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`isLive` \*

 | `boolean` | True when this version is currently aliased LIVE. |  |
| 

`policyVersionId` \*

 | `number` | The monotonically-increasing policy version number. |  |
| 

`region` \*

 | `string` | Control-plane region the version was retrieved from. |  |

---

### Aws Networkmanager Core Network Route

`aws_networkmanager_core_network_route` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`asPaths` \*

 | `array` **|** `null` | BGP AS\_PATH segments. |  |
| 

`communities` \*

 | `array` **|** `null` | BGP community values. |  |
| 

`coreNetworkId` \*

 | `string` | The owning core network ID. |  |
| 

`edgeLocation` \*

 | `string` **|** `null` | Edge location (AWS region) this route was learned from. |  |
| 

`localPreference` \*

 | `string` **|** `null` | BGP LOCAL\_PREF value. |  |
| 

`med` \*

 | `string` **|** `null` | BGP MED (Multi-Exit Discriminator) value. |  |
| 

`nextHopAttachmentId` \*

 | `string` **|** `null` | Core Network attachment ID of the next hop. |  |
| 

`nextHopEdgeLocation` \*

 | `string` **|** `null` | Edge location of the next hop. |  |
| 

`nextHopIpAddress` \*

 | `string` **|** `null` | BGP next-hop IP address. |  |
| 

`nextHopResourceId` \*

 | `string` **|** `null` | Resource ID of the next hop. |  |
| 

`nextHopResourceType` \*

 | `string` **|** `null` | Resource type of the next hop (e.g. "vpc", "vpn-connection"). |  |
| 

`nextHopSegmentName` \*

 | `string` **|** `null` | Segment of the next hop (inter-segment routing). |  |
| 

`prefix` \*

 | `string` **|** `null` | IP prefix for this route entry (e.g. "10.0.0.0/24"). |  |
| 

`region` \*

 | `string` | Control-plane region; same as edgeLocation. |  |
| 

`segmentName` \*

 | `string` | The segment this route entry belongs to. |  |

---

### Aws Nova Act Model

`aws_nova_act_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isActive` \*

 | `boolean` | Whether the model lifecycle status is `ACTIVE` and the model can be used by new workflow runs. |  |
| 

`lifecycleStatus` \*

 | `string` | Lifecycle status reported by Nova Act for the model, for example `ACTIVE` or `DEPRECATED`. |  |
| 

`minimumCompatibilityVersion` \*

 | `number` | Lowest Nova Act client compatibility version that can invoke this model. |  |
| 

`modelId` \*

 | `string` | Identifier of the Nova Act model, for example `nova-act-1.0`. |  |
| 

`region` \*

 | `string` | An AWS region the model is offered in, for example `us-east-1`. Models are offered in more than one region; this reports one of them. |  |

---

### Aws Nova Act Workflow Definition

`aws_nova_act_workflow_definition` inherits from [Workflow](/data-model/schemas/Workflow.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The Amazon Resource Name (ARN) of the workflow definition. |  |
| 

`region` \*

 | `string` | The AWS region the workflow definition is defined in, for example `us-east-1`. |  |
| 

`s3ExportBucketName` \*

 | `string` **|** `null` | Name of the S3 bucket workflow run artifacts are exported to, or null when no export destination is configured. |  |
| 

`s3ExportKeyPrefix` \*

 | `string` **|** `null` | Key prefix within the export S3 bucket that workflow run artifacts are written under, or null when no prefix is configured. |  |

---

### Aws Nova Act Workflow Run

`aws_nova_act_workflow_run` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The Amazon Resource Name (ARN) of the workflow run. |  |
| `endedOn` | `number` | Timestamp (epoch ms) when the workflow run ended |  |
| 

`logGroupName` \*

 | `string` **|** `null` | Name of the CloudWatch Logs log group the run writes logs to, or null when logging is not configured. |  |
| 

`modelId` \*

 | `string` | Identifier of the Nova Act model the run executed with. |  |
| 

`region` \*

 | `string` | The AWS region the workflow run executed in, for example `us-east-1`. |  |
| `startedOn` | `number` | Timestamp (epoch ms) when the workflow run started |  |
| 

`workflowRunId` \*

 | `string` | Identifier of the workflow run, unique within its workflow definition. |  |

---

### Aws Opensearch Domain

`aws_opensearch_domain` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessPolicies` \*

 | `string` **|** `null` | Raw JSON string of the IAM resource-based access policy attached to the OpenSearch domain. |  |
| 

`anonymousAuthDisabledOn` \*

 | `number` **|** `null` |  |  |
| 

`appLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` **|** `null` |  |  |
| 

`auditLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`autoTuneErrorMessage` \*

 | `string` **|** `null` |  |  |
| 

`autoTuneStartedOn` \*

 | `number` **|** `null` |  |  |
| 

`autoTuneState` \*

 | `string` **|** `null` |  |  |
| 

`autoTuneUseOffPeakWindow` \*

 | `boolean` **|** `null` |  |  |
| 

`availabilityZoneCount` \*

 | `number` **|** `null` |  |  |
| 

`availabilityZones` \*

 | `array` **|** `null` |  |  |
| 

`changeProgressDetails` \*

 | `string` **|** `null` |  |  |
| 

`cognitoIdentityPoolId` \*

 | `string` **|** `null` |  |  |
| 

`cognitoRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`cognitoUserPoolId` \*

 | `string` **|** `null` |  |  |
| 

`customEndpoint` \*

 | `string` **|** `null` |  |  |
| 

`customEndpointCertificateArn` \*

 | `string` **|** `null` |  |  |
| 

`domainEndpointV2HostedZoneId` \*

 | `string` **|** `null` |  |  |
| 

`domainId` \*

 | `string` **|** `null` |  |  |
| 

`domainName` \*

 | `string` **|** `null` |  |  |
| 

`domainProcessingStatus` \*

 | `string` **|** `null` |  |  |
| 

`encryptionAtRestKmsKeyId` \*

 | `string` **|** `null` |  |  |
| 

`endpoint` \*

 | `string` **|** `null` |  |  |
| 

`endpoints` \*

 | `string` **|** `null` |  |  |
| 

`endpointV2` \*

 | `string` **|** `null` |  |  |
| 

`engineVersion` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterApplicationArn` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterInstanceArn` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterRolesKey` \*

 | `string` **|** `null` |  |  |
| 

`identityCenterSubjectKey` \*

 | `string` **|** `null` |  |  |
| 

`instanceCount` \*

 | `number` **|** `null` |  |  |
| 

`instanceType` \*

 | `string` **|** `null` |  |  |
| 

`iops` \*

 | `number` **|** `null` |  |  |
| 

`ipAddressType` \*

 | `string` **|** `null` |  |  |
| 

`isAdvancedSecurityEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAnonymousAuthEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAppLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAuditLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoSoftwareUpdateEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isAutoTuneEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCognitoEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isColdStorageEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isCreated` \*

 | `boolean` **|** `null` |  |  |
| 

`isCustomEndpointEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isDedicatedMasterEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isDeleted` \*

 | `boolean` **|** `null` |  |  |
| 

`isEbsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncryptionAtRestEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isHttpsEnforced` \*

 | `boolean` **|** `null` |  |  |
| 

`isInternalUserDatabaseEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isInVpc` \*

 | `boolean` **|** `null` |  |  |
| 

`isJwtEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isMultiAzWithStandbyEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isNodeToNodeEncryptionEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isOffPeakWindowEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isProcessing` \*

 | `boolean` **|** `null` |  |  |
| 

`isSamlEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isSlowIndexLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isSlowSearchLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isUpgradeProcessing` \*

 | `boolean` **|** `null` |  |  |
| 

`isWarmEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isZoneAwarenessEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`jwtRolesKey` \*

 | `string` **|** `null` |  |  |
| 

`jwtSubjectKey` \*

 | `string` **|** `null` |  |  |
| 

`masterInstanceCount` \*

 | `number` **|** `null` |  |  |
| 

`masterInstanceType` \*

 | `string` **|** `null` |  |  |
| 

`modifyingProperties` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`naturalLanguageQueryGenerationCurrentState` \*

 | `string` **|** `null` |  |  |
| 

`naturalLanguageQueryGenerationDesiredState` \*

 | `string` **|** `null` |  |  |
| 

`offPeakWindowStartHours` \*

 | `number` **|** `null` |  |  |
| 

`offPeakWindowStartMinutes` \*

 | `number` **|** `null` |  |  |
| 

`opensearchVersion` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` |  |  |
| 

`samlRolesKey` \*

 | `string` **|** `null` |  |  |
| 

`samlSessionTimeoutMinutes` \*

 | `number` **|** `null` |  |  |
| 

`samlSubjectKey` \*

 | `string` **|** `null` |  |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`serviceSoftwareOptions` \*

 | `string` **|** `null` |  |  |
| 

`slowIndexLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`slowSearchLoggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`snapshotOptions` \*

 | `string` **|** `null` |  |  |
| 

`subnetIds` \*

 | `array` **|** `null` |  |  |
| 

`throughput` \*

 | `number` **|** `null` |  |  |
| 

`tlsSecurityPolicy` \*

 | `string` **|** `null` |  |  |
| 

`volumeSize` \*

 | `number` **|** `null` |  |  |
| 

`volumeType` \*

 | `string` **|** `null` |  |  |
| 

`vpcId` \*

 | `string` **|** `null` |  |  |
| 

`warmCount` \*

 | `number` **|** `null` |  |  |
| 

`warmType` \*

 | `string` **|** `null` |  |  |

---

### Aws Organization Root

`aws_organization_root` inherits from [Organization](/data-model/schemas/Organization.md), [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the organization root. |  |
| 

`enabledPolicyTypes` \*

 | `array` of `string`s | AWS Organizations policy types currently enabled for this organization root, as reported by ListRoots (for example SERVICE\_CONTROL\_POLICY, RESOURCE\_CONTROL\_POLICY, S3\_POLICY). Policy types absent from this list are not enabled for the root. |  |
| 

`isAiServicesOptOutPolicyEnabled` \*

 | `boolean` | Whether AI services opt-out policies are enabled for this organization root. These policies control whether AWS may store and use customer content submitted to AI services to improve those services. False when the policy type is disabled or is still being enabled. |  |
| 

`isBackupPolicyEnabled` \*

 | `boolean` | Whether backup policies are enabled for this organization root. Backup policies centrally define AWS Backup plans for the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isBedrockPolicyEnabled` \*

 | `boolean` | Whether Amazon Bedrock policies are enabled for this organization root. Bedrock policies centrally enforce Bedrock Guardrails on model inference calls made from the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isChatbotPolicyEnabled` \*

 | `boolean` | Whether chat applications policies are enabled for this organization root. These policies control which chat workspaces (Slack, Microsoft Teams) member accounts may connect to AWS. False when the policy type is disabled or is still being enabled. |  |
| 

`isDeclarativePolicyEc2Enabled` \*

 | `boolean` | Whether declarative policies for EC2 are enabled for this organization root. Declarative EC2 policies centrally enforce EC2 account attributes such as instance metadata defaults, serial console access, image block public access, and allowed AMI providers. False when the policy type is disabled or is still being enabled. |  |
| 

`isInspectorPolicyEnabled` \*

 | `boolean` | Whether Amazon Inspector policies are enabled for this organization root. Inspector policies centrally enable and configure Amazon Inspector scanning across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isNetworkSecurityDirectorPolicyEnabled` \*

 | `boolean` | Whether AWS Shield network security director policies are enabled for this organization root. These policies centrally enable AWS Shield network security director, which discovers compute, networking, and network security resources and evaluates their configuration against network topology, AWS best practices, and threat intelligence, across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isResourceControlPolicyEnabled` \*

 | `boolean` | Whether resource control policies (RCPs) are enabled for this organization root. RCPs set the maximum available permissions on resources in the member accounts, regardless of the calling principal's account. False when the policy type is disabled or is still being enabled. |  |
| 

`isS3PolicyEnabled` \*

 | `boolean` | Whether Amazon S3 policies are enabled for this organization root. S3 policies centrally enforce the four S3 Block Public Access settings across the member accounts, overriding account-level configuration. False when the policy type is disabled or is still being enabled. |  |
| 

`isSecurityHubPolicyEnabled` \*

 | `boolean` | Whether Security Hub policies are enabled for this organization root. Security Hub policies centrally configure Security Hub enablement, standards, and controls across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isServiceControlPolicyEnabled` \*

 | `boolean` | Whether service control policies (SCPs) are enabled for this organization root. SCPs set the maximum available permissions for principals in the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isTagPolicyEnabled` \*

 | `boolean` | Whether tag policies are enabled for this organization root. Tag policies standardise tag keys and values on resources across the member accounts. False when the policy type is disabled or is still being enabled. |  |
| 

`isUpgradeRolloutPolicyEnabled` \*

 | `boolean` | Whether upgrade rollout policies are enabled for this organization root. Upgrade rollout policies centrally control how AWS service upgrades are staged across the member accounts. False when the policy type is disabled or is still being enabled. |  |

---

### Aws Organization Tag Policy

`aws_organization_tag_policy` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `awsManaged` | `boolean` |  |  |
| `content` | `string` |  |  |
| `type` | `string` |  |  |

---

### Aws Outposts Asset

`aws_outposts_asset` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetId` \*

 | `string` | The ID of the asset, unique within its Outpost. |  |
| 

`assetType` \*

 | `string` **|** `null` | The type of the asset (`COMPUTE`, `STORAGE`, `POWERSHELF`, `SWITCH`, `NETWORKING`), or null when AWS does not return it. |  |
| 

`catalogItemEc2Capacities` \*

 | `array` **|** `null` | The EC2 capacity the catalog item provides, one entry per capacity formatted as `<family>.<maxSize> x<quantity>` (for example `m5.24xlarge x1`). Null when the catalog item could not be read. |  |
| 

`catalogItemId` \*

 | `string` **|** `null` | The ID of the Outposts catalog item (hardware configuration) the asset was ordered as, for example `OR-0123456`. Null when no order line item references the asset. |  |
| 

`catalogItemPowerKva` \*

 | `number` **|** `null` | The power draw of the catalog item, in kVA, or null when the catalog item could not be read. |  |
| 

`catalogItemStatus` \*

 | `string` **|** `null` | The status of the catalog item (`AVAILABLE`, `DISCONTINUED`), or null when the catalog item could not be read. |  |
| 

`catalogItemSupportedStorage` \*

 | `array` **|** `null` | The storage options the catalog item supports (`EBS`, `S3`), or null when the catalog item could not be read. |  |
| 

`catalogItemSupportedUplinkGbps` \*

 | `array` **|** `null` | The uplink speeds, in Gbps, the catalog item supports, or null when the catalog item could not be read. |  |
| 

`catalogItemWeightLbs` \*

 | `number` **|** `null` | The weight of the catalog item, in pounds, or null when the catalog item could not be read. |  |
| 

`configuredInstanceCount` \*

 | `number` **|** `null` | The total number of instance slots configured across the asset capacity, or null for non-compute assets. |  |
| 

`configuredInstanceTypes` \*

 | `array` **|** `null` | The EC2 instance types configured on the asset capacity, or null for non-compute assets. |  |
| 

`hostId` \*

 | `string` **|** `null` | The EC2 dedicated host ID running on the asset, or null for non-compute assets. |  |
| 

`instanceFamilies` \*

 | `array` **|** `null` | The EC2 instance families supported by the asset, or null for non-compute assets. |  |
| 

`isActive` \*

 | `boolean` | Whether the compute asset state is `ACTIVE`. |  |
| 

`lineItemStatus` \*

 | `string` **|** `null` | The status of the order line item the asset shipped on, for example `INSTALLED`. Null when no order line item references the asset. |  |
| 

`maxVcpus` \*

 | `number` **|** `null` | The maximum number of vCPUs the asset provides, or null for non-compute assets. |  |
| 

`orderId` \*

 | `string` **|** `null` | The ID of the Outposts order the asset shipped on, for example `oo-0123456789abcdef0`. Null when no order line item references the asset or the order calls were denied. |  |
| 

`rackElevation` \*

 | `number` **|** `null` | The position of the asset in the rack, or null when AWS does not return it. |  |
| 

`rackId` \*

 | `string` **|** `null` | The rack ID the asset is installed in, or null when AWS does not return it. |  |
| 

`region` \*

 | `string` | The AWS Region whose Outposts control plane returned the asset, for example `us-east-1`. |  |
| 

`state` \*

 | `string` **|** `null` | The state of the compute asset (`ACTIVE`, `ISOLATED`, `RETIRING`, `INSTALLING`), or null for non-compute assets. |  |

---

### Aws Outposts Outpost

`aws_outposts_outpost` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The Amazon Resource Name (ARN) of the Outpost. |  |
| 

`availabilityZone` \*

 | `string` **|** `null` | The Availability Zone the Outpost is homed to, for example `us-east-1a`. Null when AWS does not return it. |  |
| 

`availabilityZoneId` \*

 | `string` **|** `null` | The ID of the Availability Zone the Outpost is homed to, for example `use1-az1`. Null when AWS does not return it. |  |
| 

`configuredInstanceTypes` \*

 | `array` **|** `null` | The EC2 instance types currently configured on the Outpost, or null when the call was denied or returned nothing. |  |
| 

`generation` \*

 | `string` **|** `null` | The hardware generation of the Outpost (`GENERATION_1`, `GENERATION_2`), or null when AWS does not return it. |  |
| 

`isActive` \*

 | `boolean` | Whether the Outpost lifecycle status is `ACTIVE`. |  |
| 

`lifeCycleStatus` \*

 | `string` **|** `null` | The lifecycle status of the Outpost, for example `ACTIVE`. Null when AWS does not return it. |  |
| 

`outpostId` \*

 | `string` | The ID of the Outpost, for example `op-0ab23c4567890def1`. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The AWS account ID of the Outpost owner, or null when AWS does not return it. |  |
| 

`privateConnectivityProvisioningRoleArn` \*

 | `string` **|** `null` | ARN of the IAM role used to provision private connectivity, or null when private connectivity is not configured. |  |
| 

`privateConnectivityRoleArn` \*

 | `string` **|** `null` | ARN of the IAM role used by the private connectivity configuration, or null when private connectivity is not configured. |  |
| 

`privateConnectivityStatus` \*

 | `string` **|** `null` | The status of private connectivity for the Outpost (`AVAILABLE`, `NOT_AVAILABLE`). Null when private connectivity is not configured or the call was denied. |  |
| 

`rackScalingType` \*

 | `string` **|** `null` | Whether the Outpost is a single rack or multiple racks (`SINGLE_RACK`, `MULTI_RACK`), or null when AWS does not return it. |  |
| 

`region` \*

 | `string` | The AWS Region whose Outposts control plane returned the Outpost, for example `us-east-1`. |  |
| 

`supportedHardwareType` \*

 | `string` **|** `null` | The type of hardware the Outpost supports (`RACK`, `SERVER`), or null when AWS does not return it. |  |
| 

`supportedInstanceTypes` \*

 | `array` **|** `null` | The EC2 instance types the Outpost supports, or null when the call was denied or returned nothing. |  |

---

### Aws Outposts Site

`aws_outposts_site` inherits from [Site](/data-model/schemas/Site.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` | The ID of the AWS account that owns the site, or null when AWS does not return it. |  |
| 

`arn` \*

 | `string` | The Amazon Resource Name (ARN) of the site. |  |
| 

`fiberOpticCableType` \*

 | `string` **|** `null` | The type of fiber optic cable used for the rack uplink (`SINGLE_MODE`, `MULTI_MODE`), or null when the rack physical properties are not set. |  |
| 

`maximumSupportedWeightLbs` \*

 | `string` **|** `null` | The maximum rack weight the site can support, in pounds, reported by AWS as a range string such as `MAX_1400_LBS`. Null when not set. |  |
| 

`operatingAddressCity` \*

 | `string` **|** `null` | City of the site operating address, or null when the address is not shared with this account. |  |
| 

`operatingAddressCountryCode` \*

 | `string` **|** `null` | Country code of the site operating address, or null when the address is not shared with this account. |  |
| 

`operatingAddressStateOrRegion` \*

 | `string` **|** `null` | State or region of the site operating address, or null when the address is not shared with this account. |  |
| 

`opticalStandard` \*

 | `string` **|** `null` | The type of optical standard used to attach the rack to the network, for example `OPTIC_10GBASE_LR`. Null when not set. |  |
| 

`powerConnector` \*

 | `string` **|** `null` | The power connector AWS should plug the rack into, for example `L6_30P`. Null when not set. |  |
| 

`powerDrawKva` \*

 | `string` **|** `null` | The power draw available at the hardware, in kVA, reported by AWS as a string such as `POWER_10_KVA`. Null when not set. |  |
| 

`powerFeedDrop` \*

 | `string` **|** `null` | Whether the power feed comes above or below the rack (`ABOVE_RACK`, `BELOW_RACK`), or null when not set. |  |
| 

`powerPhase` \*

 | `string` **|** `null` | The power option provided for the hardware (`SINGLE_PHASE`, `THREE_PHASE`), or null when not set. |  |
| 

`region` \*

 | `string` | The AWS Region whose Outposts control plane returned the site, for example `us-east-1`. |  |
| 

`siteId` \*

 | `string` **|** `null` | The ID of the site, or null when AWS does not return it. |  |
| 

`uplinkCount` \*

 | `string` **|** `null` | The number of uplinks each Outpost network device is connected with, reported by AWS as a string such as `UPLINK_COUNT_2`. Null when not set. |  |
| 

`uplinkGbps` \*

 | `string` **|** `null` | The uplink speed the rack supports, reported by AWS as a string such as `UPLINK_1G`. Null when not set. |  |

---

### Aws Prometheus Scraper

`aws_prometheus_scraper` inherits from [Scanner](/data-model/schemas/Scanner.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alias` \*

 | `string` **|** `null` | Customer-assigned alias for the scraper (not unique). |  |
| 

`arn` \*

 | `string` | The full ARN of the scraper. |  |
| 

`destinationWorkspaceArn` \*

 | `string` **|** `null` | destination.ampConfiguration.workspaceArn — the AMP workspace the scraper writes metrics to. Used to build the SENDS relationship. |  |
| 

`eksClusterArn` \*

 | `string` **|** `null` | EKS cluster ARN the scraper collects from. Populated only when sourceType is EKS. |  |
| 

`isCrossAccountScrape` \*

 | `boolean` | True when DescribeScraper.roleConfiguration is present, indicating a cross-account scraping setup (source-account role + target-account role). |  |
| 

`region` \*

 | `string` | AWS region where the scraper runs. |  |
| 

`roleArn` \*

 | `string` | IAM role ARN the managed collector assumes to discover targets and write to the destination workspace. Required by the API. |  |
| 

`scraperId` \*

 | `string` | The AMP scraper identifier (e.g. s-abcd1234-...). |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Security group IDs applied to the scraper ENIs. Pulled from source.eksConfiguration.securityGroupIds or source.vpcConfiguration.securityGroupIds. May be null/empty for EKS (the field is optional on EksConfiguration). |  |
| 

`sourceAccountId` \*

 | `string` **|** `null` | AWS account ID parsed from `sourceRoleArn`. Used by the relationship-builder to construct subnet/security-group ARNs in the source account for cross-account scrapers, so mapped relationships resolve to the correct entities. Null when single-account. |  |
| 

`sourceRoleArn` \*

 | `string` **|** `null` | roleConfiguration.sourceRoleArn — IAM role in the source account used for cross-account scraping. Null when single-account. |  |
| 

`sourceType` \*

 | `string` **|** `null` | Discriminator for the source UNION. EKS when source.eksConfiguration is set, VPC when source.vpcConfiguration is set (MSK), null when neither (forward-compat). |  |
| 

`statusCode` \*

 | `string` **|** `null` | Scraper lifecycle status from DescribeScraper.status.statusCode (CREATING|ACTIVE|DELETING|CREATION\_FAILED|DELETION\_FAILED). |  |
| 

`statusReason` \*

 | `string` **|** `null` | Free-text reason for the current scraper status, populated when statusCode is a \*\_FAILED state. |  |
| 

`subnetIds` \*

 | `array` **|** `null` | Subnet IDs the scraper attaches its ENIs to. Pulled from source.eksConfiguration.subnetIds or source.vpcConfiguration.subnetIds. |  |
| 

`targetRoleArn` \*

 | `string` **|** `null` | roleConfiguration.targetRoleArn — IAM role in the target (workspace) account used for cross-account scraping. Null when single-account. |  |
| 

`webLink` \*

 | `string` **|** `null` | Link to the scraper in the AWS console. |  |

---

### Aws Prometheus Workspace

`aws_prometheus_workspace` inherits from [Logs](/data-model/schemas/Logs.md), [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alias` \*

 | `string` **|** `null` | Customer-assigned alias for the workspace (not unique). |  |
| 

`arn` \*

 | `string` | The full ARN of the workspace. |  |
| 

`configurationStatusCode` \*

 | `string` **|** `null` | Status code from DescribeWorkspaceConfiguration.status.statusCode (e.g. ACTIVE, UPDATING). |  |
| 

`displayName` \*

 | `string` | Human-readable name (alias when set, workspace ID otherwise). |  |
| 

`endpointStatusCode` \*

 | `string` **|** `null` | Workspace lifecycle status from DescribeWorkspace.status.statusCode (CREATING|ACTIVE|UPDATING|DELETING|CREATION\_FAILED). |  |
| 

`hasResourcePolicy` \*

 | `boolean` **|** `null` | True when DescribeResourcePolicy returned an attached policy (workspace is shared cross-account or cross-principal). False when no policy is attached. Null when the Describe call failed. |  |
| 

`isCustomerManagedEncryption` \*

 | `boolean` | True when the workspace is encrypted with a customer-managed KMS key; false when using an AWS-owned key. |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` | True when DescribeLoggingConfiguration returned a configuration with a logGroupArn. False when no configuration is attached. Null when the Describe call failed (e.g. AccessDenied or throttling) — distinguishes "feature off" from "could not determine". |  |
| 

`isQueryLoggingEnabled` \*

 | `boolean` **|** `null` | True when at least one CloudWatch Logs destination is configured for query logging. False when no configuration is attached. Null when the Describe call failed. |  |
| 

`loggingStatusCode` \*

 | `string` **|** `null` | Status code from DescribeLoggingConfiguration.status.statusCode. |  |
| 

`logGroupArn` \*

 | `string` **|** `null` | CloudWatch Logs log group ARN receiving rules/alerting logs; null when logging not configured. |  |
| 

`name` \*

 | `string` | The AMP workspace identifier (used as the entity name). |  |
| 

`policyDocument` \*

 | `string` **|** `null` | The raw JSON IAM policy document attached to the workspace via DescribeResourcePolicy. Used downstream to build IAM principal relationships. Null when no policy. |  |
| 

`prometheusEndpoint` \*

 | `string` **|** `null` | The Prometheus query API endpoint URL exposed by the workspace. |  |
| 

`queryLoggingQspThreshold` \*

 | `number` **|** `null` | Query samples processed (QSP) threshold filter for query logging — only queries above this threshold are logged. |  |
| 

`queryLoggingStatusCode` \*

 | `string` **|** `null` | Status code from DescribeQueryLoggingConfiguration.status.statusCode. |  |
| 

`queryLogGroupArn` \*

 | `string` **|** `null` | CloudWatch Logs log group ARN receiving query logs (first destination). Null when query logging not configured. |  |
| 

`queryLogGroupArns` \*

 | `array` **|** `null` | All CloudWatch Logs log group ARNs configured as query logging destinations (the API allows multiple even though current AWS console only supports one). |  |
| 

`region` \*

 | `string` | AWS region where the workspace lives. |  |
| 

`resourcePolicyStatusCode` \*

 | `string` **|** `null` | Lifecycle of the resource-based policy from DescribeResourcePolicy.policyStatus (CREATING|ACTIVE|UPDATING|DELETING). Null when no policy. |  |
| 

`retentionPeriodInDays` \*

 | `number` **|** `null` | Metric retention period in days from DescribeWorkspaceConfiguration. Null when DescribeWorkspaceConfiguration fails or is unavailable. |  |
| 

`webLink` \*

 | `string` **|** `null` | Link to the workspace in the AWS console. |  |
| 

`workspaceId` \*

 | `string` | The AMP workspace identifier (e.g. ws-abcd1234-...). |  |

---

### Aws Ram Principal

`aws_ram_principal` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` **|** `null` |  |  |
| 

`arn` \*

 | `string` |  |  |
| 

`associatedResourceShares` \*

 | `array` **|** `null` |  |  |
| 

`associationStatus` \*

 | `string` **|** `null` |  |  |
| 

`associationStatusMessage` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isExternal` \*

 | `boolean` **|** `null` |  |  |
| 

`isOwnedBySelf` \*

 | `boolean` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`organizationId` \*

 | `string` **|** `null` |  |  |
| 

`principalArn` \*

 | `string` |  |  |
| 

`principalType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`sourceOwner` \*

 | `string` |  |  |
| 

`vendor` \*

 | `string` |  |  |

---

### Aws Ram Resource Share

`aws_ram_resource_share` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isAllowExternalPrincipals` \*

 | `boolean` **|** `null` |  |  |
| 

`isFeatureSet` \*

 | `string` **|** `null` |  |  |
| 

`isOwnedBySelf` \*

 | `boolean` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`owningAccountId` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceShareArn` \*

 | `string` **|** `null` |  |  |
| 

`sourceOwner` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`statusMessage` \*

 | `string` **|** `null` |  |  |

---

### Aws Ram Resource Share Invitation

`aws_ram_resource_share_invitation` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`invitationTimestamp` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`receiverAccountId` \*

 | `string` **|** `null` |  |  |
| 

`receiverArn` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceShareArn` \*

 | `string` **|** `null` |  |  |
| 

`resourceShareName` \*

 | `string` **|** `null` |  |  |
| 

`senderAccountId` \*

 | `string` **|** `null` |  |  |
| 

`status` \*

 | `string` |  |  |

---

### Aws Ram Shared Resource

`aws_ram_shared_resource` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isOwnedBySelf` \*

 | `boolean` |  |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`resourceGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`resourceRegionScope` \*

 | `string` **|** `null` |  |  |
| 

`sourceOwner` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |

---

### Aws Redshift Datashare

`aws_redshift_datashare` inherits from [DataCollection](/data-model/schemas/DataCollection.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` **|** `null` |  |  |
| 

`authorizationCount` \*

 | `number` **|** `null` |  |  |
| 

`datashareArn` \*

 | `string` **|** `null` |  |  |
| 

`datashareId` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` **|** `null` |  |  |
| 

`isProducerFromOtherAccount` \*

 | `boolean` **|** `null` |  |  |
| 

`isProducerFromOtherRegion` \*

 | `boolean` **|** `null` |  |  |
| 

`isPubliclyAccessibleByConsumers` \*

 | `boolean` **|** `null` |  |  |
| 

`managedBy` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`producerArn` \*

 | `string` **|** `null` |  |  |
| 

`producerType` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`webLink` \*

 | `string` **|** `null` |  |  |

---

### Aws Redshift Datashare Authorization

`aws_redshift_datashare_authorization` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`consumerIdentifier` \*

 | `string` **|** `null` |  |  |
| 

`consumerRegion` \*

 | `string` **|** `null` |  |  |
| 

`datashareArn` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`producerAllowedWrites` \*

 | `boolean` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`statusChangedOn` \*

 | `number` **|** `null` |  |  |

---

### Aws Resource Explorer Index

`aws_resource_explorer_index` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the index. |  |
| 

`isAggregator` \*

 | `boolean` **|** `null` | True if this is the aggregator index. |  |
| 

`region` \*

 | `string` | AWS region. |  |
| 

`replicatingFrom` \*

 | `array` **|** `null` | For an AGGREGATOR index: the Regions that replicate their content into this index. |  |
| 

`replicatingTo` \*

 | `array` **|** `null` | For a LOCAL index: the Regions whose content this index replicates to (i.e. the aggregator region). |  |
| 

`state` \*

 | `string` **|** `null` | Index state. |  |
| 

`type` \*

 | `string` **|** `null` | Index type: LOCAL or AGGREGATOR. |  |

---

### Aws Resource Explorer View

`aws_resource_explorer_view` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the view. |  |
| 

`filtersString` \*

 | `string` **|** `null` | Filter expression string. |  |
| 

`includedProperties` \*

 | `array` **|** `null` | Additional resource property names included in results. |  |
| 

`isDefaultView` \*

 | `boolean` **|** `null` | True if this is the account default view. |  |
| 

`ownerAccountId` \*

 | `string` **|** `null` | AWS account ID that owns this view. |  |
| 

`region` \*

 | `string` | AWS region. |  |
| 

`scope` \*

 | `string` **|** `null` | Scope ARN of the view. |  |
| 

`viewName` \*

 | `string` **|** `null` | View name. |  |

---

### Aws S3 Bucket Lifecycle Rule

`aws_s3_bucket_lifecycle_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`abortIncompleteMultipartUploadDays` \*

 | `number` **|** `null` | Days after multipart-upload initiation before the upload is aborted and parts deleted (rule.AbortIncompleteMultipartUpload.DaysAfterInitiation). Storage-cost and security hygiene signal. |  |
| 

`appliesToAllObjects` \*

 | `boolean` | True iff the rule has no filter (no prefix, no tag, no size bounds, no And operator). Wide-scope rules are a key compliance review signal. |  |
| 

`expirationDate` \*

 | `number` **|** `null` | Absolute date (epoch ms) at which current versions expire (rule.Expiration.Date). Most rules use Days OR Date, not both. |  |
| 

`expirationDays` \*

 | `number` **|** `null` | Days after object creation when current versions are expired (rule.Expiration.Days). Maps directly to retention policy in NIST SI-12 / SOC 2 CC6.5 / HIPAA 164.310(d)(2)(i) / PCI DSS 3.1. |  |
| 

`filterAndTagKeys` \*

 | `array` **|** `null` | Tag keys used in the multi-tag conjunction filter (rule.Filter.And.Tags). Parallel-array to filterAndTagValues — same index = same tag. |  |
| 

`filterAndTagValues` \*

 | `array` **|** `null` | Tag values used in the multi-tag conjunction filter. Index-aligned with filterAndTagKeys. |  |
| 

`filterObjectSizeGreaterThan` \*

 | `number` **|** `null` | Minimum object size in bytes for the rule to apply (rule.Filter.ObjectSizeGreaterThan or rule.Filter.And.ObjectSizeGreaterThan). |  |
| 

`filterObjectSizeLessThan` \*

 | `number` **|** `null` | Maximum object size in bytes for the rule to apply (rule.Filter.ObjectSizeLessThan or rule.Filter.And.ObjectSizeLessThan). |  |
| 

`filterPrefix` \*

 | `string` **|** `null` | Object key prefix the rule applies to. Pulled from rule.Prefix (deprecated), rule.Filter.Prefix, or rule.Filter.And.Prefix in that order. Null when no prefix is configured — see appliesToAllObjects for the "applies to every object" signal. |  |
| 

`filterTagKey` \*

 | `string` **|** `null` | Key of the single object tag that scopes this rule (when rule.Filter.Tag is set). |  |
| 

`filterTagValue` \*

 | `string` **|** `null` | Value of the single object tag that scopes this rule (when rule.Filter.Tag is set). |  |
| 

`hasAnyAction` \*

 | `boolean` | True iff the rule has at least one action defined (expiration, transition, noncurrent-version action, or abort-incomplete-multipart-upload). False indicates a misconfiguration — a rule with no action does nothing. |  |
| 

`isAppliedToNoncurrentVersions` \*

 | `boolean` | True iff the rule has any NoncurrentVersion\* action defined. Combined with bucket-level versioningEnabled in J1QL to spot misconfigurations. |  |
| 

`isEnabled` \*

 | `boolean` | Whether the lifecycle rule is currently being enforced (true iff Status === "Enabled"). Disabled rules look like coverage but are not applied — a key compliance signal. |  |
| 

`isExpiredObjectDeleteMarkerEnabled` \*

 | `boolean` **|** `null` | Whether the rule cleans up expired-object delete markers (rule.Expiration.ExpiredObjectDeleteMarker). Used to keep versioned bucket listings tidy. |  |
| 

`noncurrentExpirationDays` \*

 | `number` **|** `null` | Days a version is retained after becoming noncurrent before expiration (rule.NoncurrentVersionExpiration.NoncurrentDays). Critical for compliance on versioned buckets. |  |
| 

`noncurrentExpirationNewerVersions` \*

 | `number` **|** `null` | Number of newer noncurrent versions to retain before expiring older ones (rule.NoncurrentVersionExpiration.NewerNoncurrentVersions). |  |
| 

`noncurrentTransitionCount` \*

 | `number` | Number of noncurrent-version transitions defined on this rule. |  |
| 

`noncurrentTransitionDays` \*

 | `array` **|** `null` | Days after object version becomes noncurrent for each transition (rule.NoncurrentVersionTransitions\[\].NoncurrentDays). Index-aligned with noncurrentTransitionStorageClasses and noncurrentTransitionNewerVersions. A value of -1 indicates NoncurrentDays was missing in the source response. |  |
| 

`noncurrentTransitionNewerVersions` \*

 | `array` **|** `null` | Number of newer noncurrent versions to retain before transitioning, for each noncurrent transition (rule.NoncurrentVersionTransitions\[\].NewerNoncurrentVersions, max 100). Index-aligned. A value of -1 means NewerNoncurrentVersions was not configured for that transition. |  |
| 

`noncurrentTransitionStorageClasses` \*

 | `array` **|** `null` | Destination storage class for each noncurrent-version transition (rule.NoncurrentVersionTransitions\[\].StorageClass). Index-aligned. Empty string indicates the source response omitted StorageClass. |  |
| 

`region` \*

 | `string` **|** `null` | AWS region of the parent S3 bucket. Null for legacy buckets without a recorded region. |  |
| 

`ruleId` \*

 | `string` **|** `null` | AWS-side rule identifier (rule.ID). May be absent on rules created without an explicit ID — in that case the entity key falls back to an index-based synthesis. |  |
| 

`transitionCount` \*

 | `number` | Number of current-version transitions defined on this rule (rule.Transitions?.length ?? 0). Convenience for J1QL. |  |
| 

`transitionDates` \*

 | `array` **|** `null` | Absolute transition dates (epoch ms) for each transition (rule.Transitions\[\].Date). Index-aligned with transitionDays / transitionStorageClasses. A value of 0 at index i indicates that transition i is Days-based rather than Date-based; consult transitionDays\[i\] in that case. Null when there are no transitions. |  |
| 

`transitionDays` \*

 | `array` **|** `null` | Days after object creation for each transition (rule.Transitions\[\].Days). Parallel-array, index-aligned with transitionDates and transitionStorageClasses. A value of -1 at index i indicates that transition i is Date-based rather than Days-based; consult transitionDates\[i\] in that case. Null when there are no transitions. |  |
| 

`transitionStorageClasses` \*

 | `array` **|** `null` | Destination storage class for each transition (rule.Transitions\[\].StorageClass): one of STANDARD\_IA, ONEZONE\_IA, INTELLIGENT\_TIERING, GLACIER, GLACIER\_IR, DEEP\_ARCHIVE. Index-aligned with transitionDays / transitionDates. Empty string indicates the source response omitted StorageClass. |  |

---

### Aws Sagemaker Domain

`aws_sagemaker_domain` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`appNetworkAccessType` \*

 | `string` **|** `null` | Network egress mode for Studio apps: 'PublicInternetOnly' (SageMaker-managed VPC with direct internet access) or 'VpcOnly' (all traffic through the customer VPC). |  |
| 

`appSecurityGroupManagement` \*

 | `string` **|** `null` | Who creates and manages inter-app security groups in VpcOnly mode: 'Service' or 'Customer'. |  |
| 

`arn` \*

 | `string` | The ARN of the SageMaker domain. |  |
| 

`authMode` \*

 | `string` **|** `null` | How users authenticate into Studio: 'SSO' (IAM Identity Center) or 'IAM'. |  |
| 

`defaultSpaceExecutionRoleArn` \*

 | `string` **|** `null` | The default IAM execution role assumed by shared spaces in the domain. |  |
| 

`defaultSpaceSecurityGroupIds` \*

 | `array` **|** `null` | Default security groups applied to shared spaces in the domain. |  |
| 

`defaultUserExecutionRoleArn` \*

 | `string` **|** `null` | The default IAM execution role assumed by user profiles that do not override it. |  |
| 

`defaultUserSecurityGroupIds` \*

 | `array` **|** `null` | Default security groups applied to user-profile apps. |  |
| 

`dockerTrustedAccountIds` \*

 | `array` **|** `null` | AWS account IDs trusted to serve Docker images to this domain in VpcOnly mode — a cross-account trust list. |  |
| 

`domainId` \*

 | `string` | The SageMaker-assigned domain identifier (e.g. d-abc123defghi). |  |
| 

`domainSecurityGroupIds` \*

 | `array` **|** `null` | Domain-level security groups governing traffic between domain-level apps and user apps. |  |
| 

`executionRoleIdentityConfig` \*

 | `string` **|** `null` | Whether the user profile name is stamped onto assumed-role sessions as sts:SourceIdentity ('USER\_PROFILE\_NAME') or not ('DISABLED'). When DISABLED, CloudTrail cannot attribute Studio actions to an individual user. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the domain failed to provision, when applicable. |  |
| 

`homeEfsFileSystemId` \*

 | `string` **|** `null` | The ID of the EFS file system managed by the domain, which stores all user notebooks and code. |  |
| 

`homeEfsFileSystemKmsKeyId` \*

 | `string` **|** `null` | Deprecated by AWS in favour of kmsKeyId; usually absent on modern domains. Absence does not mean unencrypted. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isDockerAccessEnabled` \*

 | `boolean` **|** `null` | Whether local Docker interaction is enabled for Studio apps in this domain, which expands the container-escape surface. |  |
| 

`isPublicInternetAccessEnabled` \*

 | `boolean` | Whether Studio apps in this domain reach the internet directly through the SageMaker-managed VPC rather than being confined to the customer VPC. Describes egress, not inbound reachability. Defaults to true when AppNetworkAccessType is absent, matching the AWS default of PublicInternetOnly. |  |
| 

`kmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key used to encrypt the EFS volume attached to the domain. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |
| 

`region` \*

 | `string` | The AWS region hosting the domain. |  |
| 

`securityGroupIdForDomainBoundary` \*

 | `string` **|** `null` | The security group authorizing traffic between RSessionGateway apps and the RStudioServerPro app. |  |
| 

`subnetIds` \*

 | `array` **|** `null` | The VPC subnet IDs the domain uses for communication. |  |
| 

`url` \*

 | `string` **|** `null` | The Studio entry-point URL for the domain. |  |
| 

`vpcId` \*

 | `string` **|** `null` | The ID of the VPC the domain uses for communication. |  |

---

### Aws Sagemaker Endpoint

`aws_sagemaker_endpoint` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` |  |  |
| `createdOn` | `number` |  |  |
| `dataCaptureDestinationS3Uri` | `string` | The S3 URI where captured inference payloads are written. |  |
| `dataCaptureKmsKeyId` | `string` | The customer-managed KMS key used to encrypt captured inference data. May be a key ID, key ARN, alias, or alias ARN. Absence means an AWS-managed key is used, not that the data is unencrypted. |  |
| `dataCaptureModes` | `array` of `string`s | Which payloads are captured: 'Input', 'Output', or both. |  |
| `dataCaptureSamplingPercentage` | `number` | Percentage of live inference traffic persisted to S3, which may include sensitive payloads. |  |
| 

`displayName` \*

 | `string` |  |  |
| `endpointConfigName` | `string` |  |  |
| 

`endpointName` \*

 | `string` |  |  |
| `executionRoleArn` | `string` |  |  |
| `failureReason` | `string` |  |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| `isDataCaptureEnabled` | `boolean` | Whether inference request/response payloads are captured to S3. False when no DataCaptureConfig is configured on the endpoint config. |  |
| `kmsKeyId` | `string` |  |  |
| `modelNames` | `array` of `string`s |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `vpcSecurityGroupIds` | `array` of `string`s |  |  |
| `vpcSubnets` | `array` of `string`s |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Sagemaker Feature Group

`aws_sagemaker_feature_group` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the feature group. |  |
| 

`eventTimeFeatureName` \*

 | `string` **|** `null` | The name of the feature holding the event time of each record. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the feature group failed to be created, when applicable. |  |
| 

`featureCount` \*

 | `number` | The number of feature definitions declared on the feature group. |  |
| 

`featureGroupName` \*

 | `string` | The name of the feature group. |  |
| 

`glueCatalog` \*

 | `string` **|** `null` | The Glue data catalog the offline store is registered in, which governs who can query the data through Athena. |  |
| 

`glueDatabase` \*

 | `string` **|** `null` | The Glue database containing the offline store table. |  |
| 

`glueTableName` \*

 | `string` **|** `null` | The Glue table exposing the offline store. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isCustomerManagedKeyEncrypted` \*

 | `boolean` | Whether at least one store is encrypted with a customer-managed KMS key. Both stores are always encrypted at rest with an AWS-managed key when this is false. |  |
| 

`isGlueTableCreationDisabled` \*

 | `boolean` | Whether automatic Glue table creation for the offline store is disabled. |  |
| 

`isOnlineStoreEnabled` \*

 | `boolean` | Whether a low-latency online serving store exists for this feature group. |  |
| 

`offlineStoreBlockedReason` \*

 | `string` **|** `null` | Why replication into the offline store is blocked, when applicable. |  |
| 

`offlineStoreKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the offline S3 store. Absence means an AWS-managed key is used, not that the store is unencrypted. |  |
| 

`offlineStoreResolvedS3Uri` \*

 | `string` **|** `null` | The resolved S3 prefix feature records physically land in. |  |
| 

`offlineStoreS3Uri` \*

 | `string` **|** `null` | The S3 URI the offline store writes feature records to. |  |
| 

`offlineStoreStatus` \*

 | `string` **|** `null` | Whether replication into the offline store is 'Active', 'Blocked' or 'Disabled'. A blocked store silently loses data. |  |
| 

`onlineStoreKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the online store. Absence means an AWS-managed key is used, not that the store is unencrypted. |  |
| 

`onlineStoreStorageType` \*

 | `string` **|** `null` | The storage backing the online store: 'Standard' or 'InMemory'. |  |
| 

`onlineStoreTotalSizeBytes` \*

 | `number` **|** `null` | The total size of the online store in bytes, i.e. the volume of data at risk. |  |
| 

`recordIdentifierFeatureName` \*

 | `string` **|** `null` | The name of the feature that uniquely identifies a record in the feature group. |  |
| 

`region` \*

 | `string` | The AWS region hosting the feature group. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM role Feature Store assumes to persist records into the offline S3 store. |  |
| 

`tableFormat` \*

 | `string` **|** `null` | The table format of the offline store: 'Default' (Glue) or 'Iceberg'. |  |
| 

`ttlDurationUnit` \*

 | `string` **|** `null` | The unit of the default online store record time-to-live: 'Seconds', 'Minutes', 'Hours', 'Days' or 'Weeks'. |  |
| 

`ttlDurationValue` \*

 | `number` **|** `null` | The value of the default online store record time-to-live, expressed in ttlDurationUnit. |  |

---

### Aws Sagemaker Inference Recommendations Job

`aws_sagemaker_inference_recommendations_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the inference recommendations job. |  |
| 

`completedOn` \*

 | `number` **|** `null` | The time the job completed, in milliseconds since the epoch. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the inference recommendations job failed, when applicable. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`jobType` \*

 | `string` **|** `null` | The type of inference recommendations job: 'Default' or 'Advanced'. |  |
| 

`modelName` \*

 | `string` **|** `null` | The name of the SageMaker model used for inference benchmarking. |  |
| 

`modelPackageVersionArn` \*

 | `string` **|** `null` | The ARN of the model package version used for inference benchmarking. |  |
| 

`region` \*

 | `string` | The AWS region the inference recommendations job ran in. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM execution role assumed by the inference recommendations job. |  |

---

### Aws Sagemaker Model

`aws_sagemaker_model` inherits from [Model](/data-model/schemas/Model.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` |  |  |
| 

`containerCount` \*

 | `number` |  |  |
| 

`createdOn` \*

 | `number` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`executionRoleArn` \*

 | `string` **|** `null` |  |  |
| 

`inferenceExecutionMode` \*

 | `string` **|** `null` |  |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` |  |  |
| 

`modelName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`primaryContainerHostname` \*

 | `string` **|** `null` |  |  |
| 

`primaryContainerImage` \*

 | `string` **|** `null` |  |  |
| 

`primaryContainerMode` \*

 | `string` **|** `null` |  |  |
| 

`primaryContainerModelDataUrl` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` |  |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` |  |  |
| 

`webLink` \*

 | `string` |  |  |

---

### Aws Sagemaker Model Bias Job Definition

`aws_sagemaker_model_bias_job_definition` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the model bias monitoring job definition. |  |
| 

`baselineConstraintsS3Uri` \*

 | `string` **|** `null` | The S3 URI of the baseline constraints file used by the monitoring job. |  |
| 

`biasConfigS3Uri` \*

 | `string` **|** `null` | The S3 URI of the SHAP/bias analysis configuration file. |  |
| 

`imageUri` \*

 | `string` **|** `null` | The container image registry path used to run the model bias monitoring job. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for monitoring. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for monitoring. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isInterContainerTrafficEncryptionEnabled` \*

 | `boolean` | Whether traffic between the nodes of a distributed monitoring job is encrypted in transit. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` | Whether the monitoring container is isolated from the network. |  |
| 

`maxRuntimeInSeconds` \*

 | `number` **|** `null` | The maximum runtime allowed for the monitoring job in seconds. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting monitoring outputs written to S3. |  |
| 

`region` \*

 | `string` | The AWS region hosting this job definition. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM execution role the monitoring job assumes to access data and write results. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume. |  |
| 

`volumeSizeInGB` \*

 | `number` **|** `null` | The size of the ML storage volume attached to the monitoring instances. |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` | The security group IDs applied to the monitoring containers. |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` | The VPC subnet IDs the monitoring containers were attached to. |  |

---

### Aws Sagemaker Model Quality Job Definition

`aws_sagemaker_model_quality_job_definition` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the model quality monitoring job definition. |  |
| 

`baselineConstraintsS3Uri` \*

 | `string` **|** `null` | The S3 URI of the baseline constraints file used by the monitoring job. |  |
| 

`imageUri` \*

 | `string` **|** `null` | The container image registry path used to run the model quality monitoring job. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for monitoring. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for monitoring. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isInterContainerTrafficEncryptionEnabled` \*

 | `boolean` | Whether traffic between the nodes of a distributed monitoring job is encrypted in transit. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` | Whether the monitoring container is isolated from the network. |  |
| 

`maxRuntimeInSeconds` \*

 | `number` **|** `null` | The maximum runtime allowed for the monitoring job in seconds. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting monitoring outputs written to S3. |  |
| 

`problemType` \*

 | `string` **|** `null` | The ML problem type for model quality monitoring: 'BinaryClassification', 'MulticlassClassification', or 'Regression'. |  |
| 

`region` \*

 | `string` | The AWS region hosting this job definition. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM execution role the monitoring job assumes to access data and write results. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume. |  |
| 

`volumeSizeInGB` \*

 | `number` **|** `null` | The size of the ML storage volume attached to the monitoring instances. |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` | The security group IDs applied to the monitoring containers inside the customer VPC. |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` | The VPC subnet IDs the monitoring containers were attached to. |  |

---

### Aws Sagemaker Pipeline Execution

`aws_sagemaker_pipeline_execution` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the pipeline execution. |  |
| 

`experimentName` \*

 | `string` **|** `null` | The SageMaker Experiments experiment name this execution is associated with. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the pipeline execution failed, when applicable. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`maxParallelExecutionSteps` \*

 | `number` **|** `null` | The maximum number of pipeline steps that can run in parallel within this execution. |  |
| 

`pipelineArn` \*

 | `string` **|** `null` | The ARN of the pipeline this execution belongs to. |  |
| 

`region` \*

 | `string` | The AWS region the pipeline execution ran in. |  |
| 

`sourceExecutionArn` \*

 | `string` **|** `null` | The ARN of the source pipeline execution for selective re-runs. |  |
| 

`trialName` \*

 | `string` **|** `null` | The SageMaker Experiments trial name this execution is associated with. |  |

---

### Aws Sagemaker Processing Job

`aws_sagemaker_processing_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the SageMaker processing job. |  |
| 

`endedOn` \*

 | `number` **|** `null` | The time processing ended, in milliseconds since the epoch. |  |
| 

`exitMessage` \*

 | `string` **|** `null` | An optional string the processing container wrote on exit, describing the outcome. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the processing job failed, when applicable. |  |
| 

`imageUri` \*

 | `string` **|** `null` | The container image registry path used to run the processing job. Custom or unvetted images are a supply-chain signal. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for processing. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for processing. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isInterContainerTrafficEncryptionEnabled` \*

 | `boolean` | Whether traffic between the nodes of a distributed processing job is encrypted in transit. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` | Whether the processing container is isolated from the network, preventing outbound calls from the container. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the processing outputs written to S3. Absence means an AWS-managed key is used, not that the output is unencrypted. |  |
| 

`outputS3Uris` \*

 | `array` **|** `null` | The S3 URIs the processing job writes its outputs to. Processing jobs are a common bulk data egress path. |  |
| 

`processingJobName` \*

 | `string` | The name of the processing job. |  |
| 

`region` \*

 | `string` | The AWS region the processing job ran in. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM execution role assumed by the processing job to read input data and write results. |  |
| 

`startedOn` \*

 | `number` **|** `null` | The time processing started, in milliseconds since the epoch. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume attached to the processing instances. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` | The security group IDs applied to the processing containers inside the customer VPC. |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` | The VPC subnet IDs the processing containers were attached to. Absent when the job ran outside a customer VPC. |  |

---

### Aws Sagemaker Training Job

`aws_sagemaker_training_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the SageMaker training job. |  |
| 

`checkpointS3Uri` \*

 | `string` **|** `null` | The S3 URI training checkpoints are written to — a second, frequently overlooked sink for training data. |  |
| 

`endedOn` \*

 | `number` **|** `null` | The time training ended, in milliseconds since the epoch. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the training job failed, when applicable. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for training. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for training. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isInterContainerTrafficEncryptionEnabled` \*

 | `boolean` | Whether traffic between the nodes of a distributed training job is encrypted in transit. |  |
| 

`isManagedSpotTrainingEnabled` \*

 | `boolean` | Whether the job used managed spot instances, which explains interruptions and availability gaps. |  |
| 

`isNetworkIsolationEnabled` \*

 | `boolean` | Whether the training container is isolated from the network, preventing outbound calls from the algorithm container. |  |
| 

`modelArtifactsS3Uri` \*

 | `string` **|** `null` | The S3 URI of the model artifacts actually produced by the training job. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the model artifacts written to S3. Absence means an AWS-managed key is used, not that the output is unencrypted. |  |
| 

`outputS3Path` \*

 | `string` **|** `null` | The S3 path the training job writes its model artifacts to. |  |
| 

`region` \*

 | `string` | The AWS region the training job ran in. |  |
| 

`roleArn` \*

 | `string` **|** `null` | The IAM execution role assumed by the training job to read input data and write model artifacts. |  |
| 

`secondaryStatus` \*

 | `string` **|** `null` | The detailed job substatus, which distinguishes cases such as 'Interrupted' and 'MaxRuntimeExceeded'. |  |
| 

`startedOn` \*

 | `number` **|** `null` | The time training started, in milliseconds since the epoch. |  |
| 

`trainingImage` \*

 | `string` **|** `null` | The container image registry path used to train the model. Custom or unvetted images are a supply-chain signal. |  |
| 

`trainingJobName` \*

 | `string` | The name of the training job. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume attached to the training instances. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |
| 

`vpcSecurityGroupIds` \*

 | `array` **|** `null` | The security group IDs applied to the training containers inside the customer VPC. |  |
| 

`vpcSubnets` \*

 | `array` **|** `null` | The VPC subnet IDs the training containers were attached to. Absent when the job ran outside a customer VPC. |  |

---

### Aws Sagemaker Transform Job

`aws_sagemaker_transform_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiCategory` | `string` | The kind of AI relevance: serving, fine\_tuned\_model, training\_environment, etc. |  |
| `aiPlatform` | `string` | The AI platform or vendor this entity belongs to (e.g. aws-sagemaker). |  |
| 
`arn` \*

 | `string` | The ARN of the SageMaker batch transform job. |  |
| 

`dataCaptureDestinationS3Uri` \*

 | `string` **|** `null` | The S3 URI captured batch inference payloads are written to. |  |
| 

`dataCaptureKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting captured batch inference data. Absence means an AWS-managed key is used, not that the data is unencrypted. |  |
| 

`endedOn` \*

 | `number` **|** `null` | The time the transform job ended, in milliseconds since the epoch. |  |
| 

`failureReason` \*

 | `string` **|** `null` | Why the transform job failed, when applicable. |  |
| 

`inputS3Uri` \*

 | `string` **|** `null` | The S3 URI of the dataset the transform job reads. |  |
| 

`instanceCount` \*

 | `number` **|** `null` | The number of ML compute instances used for the transform job. |  |
| 

`instanceType` \*

 | `string` **|** `null` | The ML compute instance type used for the transform job. |  |
| `isAi` | `boolean` | Whether this entity is associated with an AI agent, model, or AI-powered workload. |  |
| 

`isDataCaptureEnabled` \*

 | `boolean` | Whether inference inputs and outputs are captured to S3. Batch data capture has no explicit enable flag — the presence of the capture configuration is the signal. |  |
| 

`modelName` \*

 | `string` | The name of the SageMaker model used for inference. The model carries the execution role, VPC and network isolation posture of the job. |  |
| 

`outputKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the inference results written to S3. Absence means an AWS-managed key is used, not that the output is unencrypted. |  |
| 

`outputS3Path` \*

 | `string` **|** `null` | The S3 path the transform job writes inference results to. |  |
| 

`region` \*

 | `string` | The AWS region the transform job ran in. |  |
| 

`startedOn` \*

 | `number` **|** `null` | The time the transform job started, in milliseconds since the epoch. |  |
| 

`transformJobName` \*

 | `string` | The name of the batch transform job. |  |
| 

`volumeKmsKeyId` \*

 | `string` **|** `null` | The customer-managed KMS key encrypting the ML storage volume attached to the transform instances. Absence means an AWS-managed key is used, not that the volume is unencrypted. |  |

---

### Aws Secret

`aws_secret` inherits from [Secret](/data-model/schemas/Secret.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| `encryptionKeyRef` | `string` |  |  |
| `kmsKeyId` | `string` |  |  |
| `lastAccessedDate` | `number` |  |  |
| `lastChangedDate` | `number` |  |  |
| `lastRotatedDate` | `number` |  |  |
| `nextRotationDate` | `number` |  |  |
| `owningService` | `string` |  |  |
| `policyDocument` | `string` |  |  |
| `primaryRegion` | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| `replicationStatus` | `array` of `string`s |  |  |
| `rotateAutomaticallyAfterDays` | `number` |  |  |
| `rotationEnabled` | `boolean` |  |  |
| `rotationLambdaArn` | `string` |  |  |
| `rotationScheduleExpression` | `string` |  |  |
| `rotationWindow` | `string` |  |  |
| `versionIdsToStages` | `string` |  |  |

---

### Aws Secret Version

`aws_secret_version` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `lastAccessedDate` | `number` |  |  |
| 
`versionId` \*

 | `string` |  |  |
| `versionStages` | `array` of `string`s |  |  |

---

### Aws Securityhub Account

`aws_securityhub_account` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`controlFindingGenerator` \*

 | `string` **|** `null` |  |  |
| 

`isAutoEnableControlsEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isEnabled` \*

 | `boolean` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`subscribedOn` \*

 | `number` **|** `null` |  |  |

---

### Aws Securityhub Finding

`aws_securityhub_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `companyName` | `string` |  |  |
| `complianceStatus` | `string` |  |  |
| `confidence` | `number` |  |  |
| `criticality` | `number` |  |  |
| `generatorId` | `string` |  |  |
| `id` | `string` |  |  |
| `productArn` | `string` |  |  |
| `productName` | `string` |  |  |
| `recordState` | `string` |  |  |
| `region` | `string` |  |  |
| `remediationUrl` | `string` |  |  |
| `resourceIds` | `array` of `string`s |  |  |
| `resourceTypes` | `array` of `string`s |  |  |
| `sourceUrl` | `string` |  |  |
| `state` | `string` |  |  |
| `types` | `array` of `string`s |  |  |
| `workflowState` | `string` |  |  |
| `workflowStatus` | `string` |  |  |

---

### Aws Securityhub Finding

`aws_securityhub_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `companyName` | `string` |  |  |
| `complianceStatus` | `string` |  |  |
| `confidence` | `number` |  |  |
| `criticality` | `number` |  |  |
| `generatorId` | `string` |  |  |
| `id` | `string` |  |  |
| `productArn` | `string` |  |  |
| `productName` | `string` |  |  |
| `recordState` | `string` |  |  |
| `region` | `string` |  |  |
| `remediationUrl` | `string` |  |  |
| `resourceIds` | `array` of `string`s |  |  |
| `resourceTypes` | `array` of `string`s |  |  |
| `sourceUrl` | `string` |  |  |
| `state` | `string` |  |  |
| `types` | `array` of `string`s |  |  |
| `workflowState` | `string` |  |  |
| `workflowStatus` | `string` |  |  |

---

### Aws Servicecatalog Constraint

`aws_servicecatalog_constraint` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`constraintId` \*

 | `string` | The ID of the Service Catalog constraint. |  |
| 

`constraintParameters` \*

 | `string` **|** `null` | The constraint parameters as a raw JSON string. Structure varies by constraint type. |  |
| 

`productId` \*

 | `string` **|** `null` | The ID of the product this constraint applies to, if product-specific. |  |
| 

`region` \*

 | `string` | AWS region where the constraint is defined. |  |
| 

`type` \*

 | `string` | The type of constraint (LAUNCH, NOTIFICATION, RESOURCE\_UPDATE, STACKSET, TEMPLATE, TAG). |  |

---

### Aws Servicecatalog Launch Path

`aws_servicecatalog_launch_path` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`constraintTypes` \*

 | `array` **|** `null` | The types of constraint applied along this launch path (e.g. LAUNCH, NOTIFICATION, TEMPLATE, STACKSET). The constraint descriptions are not duplicated here; they are carried on the corresponding aws\_servicecatalog\_constraint entities. |  |
| 

`pathId` \*

 | `string` | The ID of the launch path. |  |
| 

`region` \*

 | `string` | AWS region where the launch path is available. |  |

---

### Aws Servicecatalog Portfolio

`aws_servicecatalog_portfolio` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the Service Catalog portfolio. |  |
| 

`portfolioId` \*

 | `string` | The ID of the Service Catalog portfolio. |  |
| 

`providerName` \*

 | `string` **|** `null` | The name of the person or organization who owns the portfolio. |  |
| 

`region` \*

 | `string` | AWS region where the portfolio is defined. |  |

---

### Aws Servicecatalog Product

`aws_servicecatalog_product` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` | The ARN of the Service Catalog product. |  |
| 

`distributor` \*

 | `string` **|** `null` | The distributor of the product. |  |
| 

`hasDefaultPath` \*

 | `boolean` **|** `null` | Whether the product has a default launch path. |  |
| 

`productId` \*

 | `string` | The ID of the Service Catalog product. |  |
| 

`region` \*

 | `string` | AWS region where the product is defined. |  |
| 

`supportDescription` \*

 | `string` **|** `null` | The support information about the product, as supplied by the administrator. |  |
| 

`supportEmail` \*

 | `string` **|** `null` | The email address of the support contact for the product. |  |
| 

`supportUrl` \*

 | `string` **|** `null` | The URL for product support. |  |
| 

`type` \*

 | `string` **|** `null` | The product type (e.g. CLOUD\_FORMATION\_TEMPLATE, TERRAFORM\_OPEN\_SOURCE). |  |

---

### Aws Servicecatalog Provisioning Artifact

`aws_servicecatalog_provisioning_artifact` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`artifactId` \*

 | `string` | The ID of the provisioning artifact. |  |
| 

`guidance` \*

 | `string` **|** `null` | The guidance for the provisioning artifact (DEFAULT or DEPRECATED). |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether this provisioning artifact is active. |  |
| 

`region` \*

 | `string` | AWS region where the provisioning artifact is defined. |  |
| 

`sourceRevision` \*

 | `string` **|** `null` | The source revision of the provisioning artifact. |  |
| 

`type` \*

 | `string` **|** `null` | The type of provisioning artifact (CLOUD\_FORMATION\_TEMPLATE, TERRAFORM\_OPEN\_SOURCE, etc.). |  |

---

### Aws Servicecatalog Tag Option

`aws_servicecatalog_tag_option` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isActive` \*

 | `boolean` **|** `null` | Whether this TagOption is active. |  |
| 

`key` \*

 | `string` | The TagOption key. |  |
| 

`region` \*

 | `string` | AWS region where the TagOption is defined. |  |
| 

`tagOptionId` \*

 | `string` | The ID of the TagOption. |  |
| 

`value` \*

 | `string` **|** `null` | The TagOption value. |  |

---

### Aws States State Machine

`aws_states_state_machine` inherits from [Function](/data-model/schemas/Function.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`availabilityZone` \*

 | `string` **|** `null` |  |  |
| 

`createdOn` \*

 | `number` **|** `null` |  |  |
| 

`definition` \*

 | `string` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` **|** `null` |  |  |
| 

`encryptedkeyref` \*

 | `string` **|** `null` |  |  |
| 

`encryptionKmsDataKeyReusePeriodSeconds` \*

 | `number` **|** `null` |  |  |
| 

`encryptionKmsKeyId` \*

 | `string` **|** `null` |  |  |
| 

`encryptionType` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isActive` \*

 | `boolean` **|** `null` |  |  |
| 

`isEncrypted` \*

 | `boolean` **|** `null` |  |  |
| 

`isExecutionDataIncluded` \*

 | `boolean` **|** `null` |  |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isTracingEnabled` \*

 | `boolean` **|** `null` |  |  |
| 

`isVariableReferencesPresent` \*

 | `boolean` **|** `null` |  |  |
| 

`label` \*

 | `string` **|** `null` |  |  |
| 

`lastModifiedOn` \*

 | `number` **|** `null` |  |  |
| 

`loggingCloudWatchLogGroupArn` \*

 | `string` **|** `null` |  |  |
| 

`loggingLevel` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`revisionId` \*

 | `string` **|** `null` |  |  |
| 

`roleArn` \*

 | `string` **|** `null` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`type` \*

 | `string` **|** `null` |  |  |
| 

`variableReferencesCount` \*

 | `number` **|** `null` |  |  |

---

### Aws Storage Gateway File Share

`aws_storage_gateway_file_share` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`auditDestinationArn` \*

 | `null` **|** `string` |  |  |
| 

`authentication` \*

 | `null` **|** `string` |  |  |
| 

`clientList` \*

 | `null` **|** `array` |  |  |
| 

`defaultStorageClass` \*

 | `null` **|** `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`fileShareId` \*

 | `string` |  |  |
| 

`fileShareStatus` \*

 | `null` **|** `string` |  |  |
| 

`gatewayArn` \*

 | `string` |  |  |
| 

`isAccessBasedEnumeration` \*

 | `null` **|** `boolean` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isEncrypted` \*

 | `null` **|** `boolean` |  |  |
| 

`isLoggingEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`isReadOnly` \*

 | `null` **|** `boolean` |  |  |
| 

`isSmbAclEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`locationArn` \*

 | `null` **|** `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`protocol` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`roleArn` \*

 | `null` **|** `string` |  |  |
| 

`squash` \*

 | `null` **|** `string` |  |  |

---

### Aws Storage Gateway Gateway

`aws_storage_gateway_gateway` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`availabilityZone` \*

 | `null` **|** `string` |  |  |
| 

`category` \*

 | `array` of `string`s |  |  |
| 

`cloudWatchLogGroupArn` \*

 | `null` **|** `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`ec2InstanceId` \*

 | `null` **|** `string` |  |  |
| 

`endpointType` \*

 | `null` **|** `string` |  |  |
| 

`function` \*

 | `array` of `string`s |  |  |
| 

`gatewayId` \*

 | `string` |  |  |
| 

`gatewayState` \*

 | `null` **|** `string` |  |  |
| 

`gatewayTimezone` \*

 | `null` **|** `string` |  |  |
| 

`gatewayType` \*

 | `string` |  |  |
| 

`hostEnvironment` \*

 | `null` **|** `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isLoggingEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`public` \*

 | `boolean` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`softwareVersion` \*

 | `null` **|** `string` |  |  |
| 

`vpcEndpoint` \*

 | `null` **|** `string` |  |  |
| 

`vpcId` \*

 | `null` **|** `string` |  |  |

---

### Aws Storage Gateway Tape

`aws_storage_gateway_tape` inherits from [DataStore](/data-model/schemas/DataStore.md), [Backup](/data-model/schemas/Backup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`completedOn` \*

 | `null` **|** `number` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`gatewayArn` \*

 | `null` **|** `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isArchived` \*

 | `null` **|** `boolean` |  |  |
| 

`isEncrypted` \*

 | `null` **|** `boolean` |  |  |
| 

`isWorm` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`poolId` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`tapeBarcode` \*

 | `string` |  |  |
| 

`tapeSizeInBytes` \*

 | `null` **|** `number` |  |  |
| 

`tapeStatus` \*

 | `string` |  |  |
| 

`tapeUsedInBytes` \*

 | `null` **|** `number` |  |  |

---

### Aws Storage Gateway Tape Pool

`aws_storage_gateway_tape_pool` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`poolId` \*

 | `string` |  |  |
| 

`poolStatus` \*

 | `null` **|** `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`retentionLockTimeInDays` \*

 | `null` **|** `number` |  |  |
| 

`retentionLockType` \*

 | `null` **|** `string` |  |  |
| 

`storageClass` \*

 | `null` **|** `string` |  |  |

---

### Aws Storage Gateway Volume

`aws_storage_gateway_volume` inherits from [DataStore](/data-model/schemas/DataStore.md), [Disk](/data-model/schemas/Disk.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`arn` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`gatewayArn` \*

 | `string` |  |  |
| 

`isActive` \*

 | `null` **|** `boolean` |  |  |
| 

`isChapEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`isEncrypted` \*

 | `null` **|** `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`targetArn` \*

 | `null` **|** `string` |  |  |
| 

`volumeDiskId` \*

 | `null` **|** `string` |  |  |
| 

`volumeId` \*

 | `string` |  |  |
| 

`volumeSizeInBytes` \*

 | `null` **|** `number` |  |  |
| 

`volumeStatus` \*

 | `null` **|** `string` |  |  |
| 

`volumeType` \*

 | `string` |  |  |
| 

`volumeUsedInBytes` \*

 | `null` **|** `number` |  |  |

---

### Aws Vpc Lattice Listener

`aws_vpc_lattice_listener` inherits from [NetworkEndpoint](/data-model/schemas/NetworkEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`port` \*

 | `number` **|** `null` |  |  |
| 

`protocol` \*

 | `string` **|** `null` |  | **Any of**:

-   `HTTP`

-   `HTTPS`

-   `TLS_PASSTHROUGH`

-   `undefined`

 |
| 

`region` \*

 | `string` |  |  |
| 

`serviceArn` \*

 | `string` **|** `null` |  |  |

---

### Aws Vpc Lattice Listener Rule

`aws_vpc_lattice_listener_rule` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`isDefault` \*

 | `boolean` **|** `null` |  |  |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`listenerArn` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` **|** `null` |  |  |
| 

`priority` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`serviceArn` \*

 | `string` **|** `null` |  |  |
| 

`statusCode` \*

 | `number` **|** `null` |  |  |
| 

`targetGroupIdentifiers` \*

 | `array` **|** `null` |  |  |
| 

`type` \*

 | `string` **|** `null` |  | **Any of**:

-   `ForwardMember`

-   `FixedResponseMember`

-   `undefined`

 |

---

### Aws Vpc Lattice Service

`aws_vpc_lattice_service` inherits from [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`customDomainName` \*

 | `string` **|** `null` |  |  |
| 

`domainName` \*

 | `string` **|** `null` |  |  |
| 

`hostedZoneId` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Vpc Lattice Service Network

`aws_vpc_lattice_service_network` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`numberOfAssociatedResourceConfigurations` \*

 | `number` **|** `null` |  |  |
| 

`numberOfAssociatedServices` \*

 | `number` **|** `null` |  |  |
| 

`numberOfAssociatedVPCs` \*

 | `number` **|** `null` |  |  |
| 

`region` \*

 | `string` |  |  |

---

### Aws Vpc Lattice Target Group

`aws_vpc_lattice_target_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| 
`arn` \*

 | `string` |  |  |
| 

`createdAt` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`ipAddressType` \*

 | `string` **|** `null` |  | **Any of**:

-   `IPV4`

-   `IPV6`

-   `undefined`

 |
| 

`lambdaEventStructureVersion` \*

 | `string` **|** `null` |  | **Any of**:

-   `V1`

-   `V2`

-   `undefined`

 |
| 

`lastUpdatedAt` \*

 | `string` **|** `null` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`port` \*

 | `number` **|** `null` |  |  |
| 

`protocol` \*

 | `string` **|** `null` |  | **Any of**:

-   `NOT_SET`

-   `HTTP`

-   `HTTPS`

-   `TCP`

-   `undefined`

 |
| 

`region` \*

 | `string` |  |  |
| 

`serviceArns` \*

 | `array` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  | **Any of**:

-   `NOT_SET`

-   `ACTIVE`

-   `CREATE_FAILED`

-   `CREATE_IN_PROGRESS`

-   `DELETE_FAILED`

-   `DELETE_IN_PROGRESS`

-   `undefined`

 |
| 

`type` \*

 | `string` **|** `null` |  | **Any of**:

-   `NOT_SET`

-   `ALB`

-   `INSTANCE`

-   `IP`

-   `LAMBDA`

-   `undefined`

 |
| 

`vpcIdentifier` \*

 | `string` **|** `null` |  |  |

---

### Aws Waf V2 Ip Set

`aws_waf_v2_ip_set` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `addresses` | `array` of `string`s |  |  |
| `arn` | `string` |  |  |
| `description` | `string` |  |  |
| `id` | `string` |  |  |
| `ipAddressVersion` | `string` |  | **Any of**:
-   `IPV4`

-   `IPV6`

 |
| `region` | `string` |  |  |

---

### Aws Waf V2 Rule Group

`aws_waf_v2_rule_group` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `arn` | `string` |  |  |
| `capacity` | `number` |  |  |
| `description` | `string` |  |  |
| `id` | `string` |  |  |
| `isVisibilityConfigCloudWatchMetricsEnabled` | `boolean` |  |  |
| `isVisibilityConfigSampledRequestsEnabled` | `boolean` |  |  |
| `labelNamespace` | `string` |  |  |
| `region` | `string` |  |  |
| `ruleCount` | `number` |  |  |
| `scope` | `string` |  |  |
| `visibilityConfigMetricName` | `string` |  |  |
| `webLink` | `string` |  |  |

---

---

Source: /integrations/directory/hackerone

# HackerOne

Visualize HackerOne bounty programs and findings, and monitor changes through queries and alerts.

## Installation

To use this integration JupiterOne requires an **API key**, **API key name**, and the **Program handle** of your HackerOne program.

> **INFO**
> 
> HackerOne provides [detailed instructions on creating an API token](https://docs.hackerone.com/organizations/api-tokens.html) within your HackerOne account. When selecting the programs and groups you want to add, choose `Admin`.

### Configuration in JupiterOne

To install the HackerOne integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select HackerOne. Click **New Instance** to begin configuring your integration with the following settings:

-   Account Name by which you want to identify this HackerOne account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when Tag with Account Name is selected.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Select a Polling Interval that you feel is sufficient for your monitoring needs. You can leave this as `DISABLED` and manually execute the integration.
    
-   Enter the **API Key** and **API Key Name** to authenticate with HackerOne.
    
-   Enter the **Program Handle** or name of your HackerOne program.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Finding | `hackerone_report` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Finding | `hackerone_report` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Finding | `hackerone_report` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Weakness](https://docs.jupiterone.io/data-model/schemas/Weakness) |
| Service | `hackerone_program` | [Service](https://docs.jupiterone.io/data-model/schemas/Service), [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `hackerone_program` | **HAS** | `hackerone_report` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `hackerone_report` | **HAS** | `cwe` | FORWARD |
| `hackerone_report` | **HAS** | `cve` | FORWARD |

### Hackerone Report

`hackerone_report` inherits from [Finding](/data-model/schemas/Finding.md)

---

### Hackerone Report

`hackerone_report` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

---

### Hackerone Report

`hackerone_report` inherits from [Finding](/data-model/schemas/Finding.md), [Weakness](/data-model/schemas/Weakness.md)

---

---

Source: /integrations/directory/haekka

# Haekka

The Haekka integration with JupiterOne enables organizations to map their security awareness training data, including employee training progress, phishing simulation results, and engagement metrics, to their broader security and compliance posture, providing a comprehensive view of their security culture and training effectiveness.

## Installation

### Requirements

-   User requires API key generated in Haekka Account
-   You must have permission in JupiterOne to install new integrations

### Configuration in Haekka

#### Create API Key

1.  Contact Haekka support to have API access enabled for your account
2.  Generate a new API key from your Haekka account
3.  Give the key an accurate name and store it in a secure location following your organization's security policies. Note: Haekka does not store API keys, so if lost, you will need to regenerate it

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**
2.  Search for the **Haekka** and select it
3.  Click on the **Add Instance** button and configure the following settings:

-   Enter the **Account Name** by which you'd like to identify this Haekka instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
-   Enter a **Description** that will further assist your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
-   Enter the **Haekka API Key** generated for use by JupiterOne.

4.  Click **Create Configuration** once all values are provided.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Employee | `haekka_employee` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Training | `haekka_training` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `haekka_employee` | **ASSIGNED** | `haekka_training` |

### Haekka Employee

`haekka_employee` inherits from [User](/data-model/schemas/User.md)

---

### Haekka Training

`haekka_training` inherits from [Training](/data-model/schemas/Training.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`completionPercentage` \*

 | `number` |  |  |
| 

`employeesAssigned` \*

 | `number` |  |  |
| 

`employeesCompleted` \*

 | `number` |  |  |
| 

`employeesNotCompleted` \*

 | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`numberOfLessons` \*

 | `number` |  |  |
| 

`renews` \*

 | `boolean` |  |  |
| `startedOn` | `number` |  |  |

---

---

Source: /integrations/directory/hashicorp-vault

# HashiCorp Vault

Visualize Hashicorp Vault users and secret engines, map Vault users to employees, and monitor changes through queries and alerts.

## Installation

This integration ingests HashiCorp Vault accounts, secret engines, secrets, auth backends, users, and OIDC identity entities. It supports both standalone (on-premise) and HashiCorp Vault Cloud (HCP). Three authentication methods are available: a static **Vault token**, **OIDC via Azure Entra ID**, or **AppRole (Role ID + Secret ID)**.

### Prerequisites

The Vault token or service principal you configure must have ACL policies granting the capabilities listed below. Add these rules to the policy attached to the token or Vault role.

**Token self-lookup (required for all deployments)**

```hcl
path "auth/token/lookup-self" {
  capabilities = ["read"]
}
```

**Mount discovery (required for all deployments)**

```hcl
path "sys/internal/ui/mounts" {
  capabilities = ["read"]
}
```

**Secret engines — one rule per engine you want to ingest (KV v1, KV v2, and Cubbyhole)**

```hcl
# KV v1 example
path "my-kv-engine/*" {
  capabilities = ["list"]
}

# KV v2 example: secrets are listed and their metadata read under the metadata/ sub-path
path "my-kv2-engine/metadata/*" {
  capabilities = ["list", "read"]
}

# Cubbyhole (already granted by Vault's built-in default policy)
path "cubbyhole/*" {
  capabilities = ["list"]
}
```

JupiterOne walks every folder under each engine, and any folder the token cannot list is skipped along with the secrets under it, so the rule should cover the whole engine. Without `read` on a KV v2 engine's `metadata/*` path, secrets are still ingested but without their version, timestamps or custom metadata.

**Userpass auth method users — one pair of rules per userpass mount**

```hcl
path "auth/my-userpass/users" {
  capabilities = ["list"]
}

path "auth/my-userpass/users/*" {
  capabilities = ["read"]
}
```

**OIDC identity entities (required when using the OIDC auth section, or the AppRole section on a cluster that has a JWT/OIDC auth method mounted)**

```hcl
path "identity/entity/id" {
  capabilities = ["list"]
}

path "identity/entity/id/*" {
  capabilities = ["read"]
}
```

> **INFO**
> 
> For more information on HashiCorp Vault ACL policies, see the [Vault policies documentation](https://developer.hashicorp.com/vault/docs/concepts/policies).

### Configuration in HashiCorp Vault

Choose the authentication method that fits your deployment.

#### Option A: API Token

1.  Create or identify a Vault token whose policy includes the capabilities listed above.
2.  If you use Vault Enterprise or HCP Vault, note the **namespace** for your cluster (for example, `admin` or `admin/team-a`). The namespace is optional for standalone Vault.
3.  Note the **hostname** of your Vault cluster, including the `https://` scheme (for example, `https://vault.example.com:8200`).

> **TIP**
> 
> For more information on Vault tokens, see the [Vault tokens guide](https://developer.hashicorp.com/vault/tutorials/get-started/introduction-tokens).

#### Option B: OIDC via Azure Entra ID

This method obtains a short-lived Vault token by exchanging an Azure Entra ID client-credentials JWT for a Vault login token via a Vault JWT/OIDC auth method.

1.  In **Azure Entra ID**, create an app registration for the JupiterOne integration. Note the **Tenant ID**, **Client ID**, and create a **Client Secret**.
2.  In **HashiCorp Vault**, configure a JWT/OIDC auth method (for example, mounted at `jwt` or `oidc`). Create a role with:
    -   `role_type = "jwt"`
    -   `bound_issuer` set to `https://sts.windows.net/<your-tenant-id>/`
    -   `bound_audiences` set to the Entra Client ID (or the custom audience you specify in **Vault Audience**)
    -   The policy grants listed in the prerequisites above
3.  Note the **auth mount path** (for example, `jwt`). If left blank, it defaults to `oidc`.

#### Option C: AppRole (Role ID + Secret ID)

This method exchanges a RoleID and SecretID for a short-lived Vault token at the AppRole login endpoint on each run, so no long-lived token needs to be provisioned for JupiterOne.

1.  In **HashiCorp Vault**, enable the AppRole auth method if it is not already enabled, and note the **mount path** without the `auth/` prefix (for example, `approle`, not `auth/approle`). If left blank in JupiterOne, it defaults to `approle`. On Vault Enterprise or HCP Vault, enable it in the same namespace you configure in JupiterOne: the login is sent to that namespace.
2.  Create a role whose `token_policies` grant the capabilities listed in the prerequisites above. The integration logs in again whenever the token nears expiry, so any `token_ttl` works; a very short TTL only means more logins.
3.  Leave the role's `token_num_uses` at `0` (unlimited, the default). JupiterOne rejects use-limited tokens, because a token that runs out of uses partway through a sync would silently cut ingestion short.
4.  Read the role's **RoleID** and generate a **SecretID** for it.
5.  Note the **hostname** of your Vault cluster, including the `https://` scheme. The SecretID is a bearer credential, so this section requires `https://`.

> **TIP**
> 
> For more information on this auth method, see the [Vault AppRole documentation](https://developer.hashicorp.com/vault/docs/auth/approle).

### Configuration in JupiterOne

Navigate to the **Integrations** tab in JupiterOne and select **HashiCorp Vault**. Click **New Instance** and select an authentication section.

#### API Token

Creating an instance requires:

-   **HashiCorp Vault Hostname** — The full URL of your Vault cluster, including the `https://` scheme (for example, `https://vault.example.com:8200`).
-   **HashiCorp Vault Namespace** — The Vault namespace header value. Required for Vault Enterprise and HCP Vault clusters; leave blank for standalone Vault.
-   **HashiCorp Vault Token** — A static Vault token whose attached policy grants the capabilities listed in the prerequisites.

#### OIDC (Azure Entra ID)

Creating an instance requires:

-   **HashiCorp Vault Hostname** — The full URL of your Vault cluster, including the `https://` scheme.
-   **HashiCorp Vault Namespace** — The Vault namespace header value. Required for Vault Enterprise and HCP Vault; leave blank for standalone Vault.
-   **Entra Tenant ID** — The Azure Entra tenant ID (Directory ID) for your app registration.
-   **Entra Client ID** — The application (client) ID of the Entra app registration.
-   **Entra Client Secret** — A client secret value for the Entra app registration.
-   **Vault JWT/OIDC Role** — The name of the Vault JWT/OIDC role to log in as.
-   **Vault JWT/OIDC Mount Path** _(optional)_ — The auth mount path for the JWT/OIDC method (for example, `jwt` or `oidc`). Defaults to `oidc` when left blank.
-   **Vault Audience** _(optional)_ — The audience value the Vault role expects in the JWT `aud` claim. Falls back to the Entra Client ID when left blank.

#### AppRole (Role ID + Secret ID)

Creating an instance requires:

-   **HashiCorp Vault Hostname** — The full URL of your Vault cluster, including the `https://` scheme.
-   **HashiCorp Vault Namespace** — The Vault namespace header value. Required for Vault Enterprise and HCP Vault; leave blank for standalone Vault. The AppRole login is also sent to this namespace, so the AppRole auth method must be enabled in it.
-   **Vault AppRole Role ID** — The RoleID of the Vault AppRole to log in as.
-   **Vault AppRole Secret ID** — A SecretID issued for that AppRole. Rotate it in Vault and update it here as your SecretID TTL requires.
-   **Vault AppRole Mount Path** _(optional)_ — The auth mount path for the AppRole method, without the `auth/` prefix (for example, `approle`). Defaults to `approle` when left blank.

Click **Create** once all required fields are provided.

## Data Volume Configuration

These optional settings control which secret metadata is ingested and whether secret values are read to fingerprint embedded certificates. They apply to every authentication method.

### Data Filtering Options

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Custom Metadata Keys** | A comma-separated list of KV v2 custom metadata keys to ingest as `customMetadata.<key>` properties on secret entities. Append `:boolean`, `:number`, or `:date` to a key to convert its value (keys without a suffix stay strings). Dates must be ISO 8601 (for example, `2027-10-07` or `2027-10-07T12:00:00Z`) and are read as UTC unless they carry an offset; to also accept another layout, add it in parentheses, such as `DD-MM-YYYY`, `DD/MM/YYYY`, `DD.MM.YYYY`, `MM-DD-YYYY`, or `MM/DD/YYYY`. Values that do not match are omitted. For example: `expires_at:date(DD-MM-YYYY),has_expiry:boolean,owner,type`. | None (no custom metadata ingested) | Any custom metadata key names |
| **Expiry Metadata Key** | A custom metadata key whose value is also ingested as the secret's standard expiration property (for example, `expires_at`). The value is parsed using the date format you declared for that key in **Custom Metadata Keys**, or ISO 8601 if the key is not listed there. | None (no expiration set) | A single custom metadata key name |

> **NOTE**
> 
> Adding a type to a key that is already ingested changes that property's type, so update any queries or rules that compare it as a string.

### Advanced Configuration

| Field | Description | Default |
| --- | --- | --- |
| **Hash Certificates** | When enabled, JupiterOne reads each KV and Cubbyhole secret value to detect embedded PEM X.509 certificates and records their SHA-256 fingerprints on the secret entity. This requires the Vault token to also have `read` on the secret data path: `path "my-kv2-engine/data/*" { capabilities = ["read"] }` for KV v2, or `read` added to the `my-kv-engine/*` rule for KV v1. This is a broader grant than the rest of the integration needs, so leave the option off unless you use it. Reading secret values also increases integration run time. | Disabled |

### Next steps

After creating the instance, it will begin ingesting data on the polling interval you selected. Continue to the [Instance management guide](/integrations/instance-management.md) to learn more about working with integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (10)

-   `# Optional — only required when the hashCertificates option is enabled path "{engine_name}/data/*" { capabilities = ["read"] }`
-   `path "auth/token/lookup-self" { capabilities = ["read"] }`
-   `path "auth/{userpass_mount}/users" { capabilities = ["list"] }`
-   `path "auth/{userpass_mount}/users/*" { capabilities = ["read"] }`
-   `path "identity/entity/id" { capabilities = ["list"] }`
-   `path "identity/entity/id/*" { capabilities = ["read"] }`
-   `path "sys/internal/ui/mounts" { capabilities = ["read"] }`
-   `path "{cubbyhole_name}/*" { capabilities = ["list"] }`
-   `path "{engine_name}/*" { capabilities = ["list"] }`
-   `path "{engine_name}/metadata/*" { capabilities = ["list", "read"] }`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (11)

-   `{hostname}/v1/auth/token/lookup-self`
-   `{hostname}/v1/auth/{userpass_mount}/users`
-   `{hostname}/v1/auth/{userpass_mount}/users/{username}`
-   `{hostname}/v1/identity/entity/id`
-   `{hostname}/v1/identity/entity/id/{id}`
-   `{hostname}/v1/sys/internal/ui/mounts`
-   `{hostname}/v1/{cubbyhole_name}`
-   `{hostname}/v1/{engine_name}`
-   `{hostname}/v1/{engine_name}/data/*`
-   `{hostname}/v1/{engine_name}/metadata`
-   `{hostname}/v1/{engine_name}/metadata/*`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (9)

-   [https://developer.hashicorp.com/vault/api-docs/auth/token#lookup-a-token-self](https://developer.hashicorp.com/vault/api-docs/auth/token#lookup-a-token-self)
-   [https://developer.hashicorp.com/vault/api-docs/auth/userpass](https://developer.hashicorp.com/vault/api-docs/auth/userpass)
-   [https://developer.hashicorp.com/vault/api-docs/secret/cubbyhole](https://developer.hashicorp.com/vault/api-docs/secret/cubbyhole)
-   [https://developer.hashicorp.com/vault/api-docs/secret/identity/entity](https://developer.hashicorp.com/vault/api-docs/secret/identity/entity)
-   [https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v1](https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v1)
-   [https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2](https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2)
-   [https://developer.hashicorp.com/vault/api-docs/system/internal-ui-mounts](https://developer.hashicorp.com/vault/api-docs/system/internal-ui-mounts)
-   [https://developer.hashicorp.com/vault/api-docs/system/mounts](https://developer.hashicorp.com/vault/api-docs/system/mounts)
-   [https://developer.hashicorp.com/vault/docs/concepts/policies](https://developer.hashicorp.com/vault/docs/concepts/policies)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `hashicorp_vault_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Authentication Backend | `hashicorp_vault_auth_backend` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Secret | `hashicorp_vault_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Secret Engine | `hashicorp_vault_engine` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `hashicorp_vault_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `hashicorp_vault_account` | **HAS** | `hashicorp_vault_user` |
| `hashicorp_vault_account` | **HAS** | `hashicorp_vault_engine` |
| `hashicorp_vault_account` | **HAS** | `hashicorp_vault_auth_backend` |
| `hashicorp_vault_auth_backend` | **HAS** | `hashicorp_vault_user` |
| `hashicorp_vault_engine` | **HAS** | `hashicorp_vault_secret` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `hashicorp_vault_user` | **IS** | `User` | FORWARD |

### Hashicorp Vault Secret

`hashicorp_vault_secret` inherits from [Secret](/data-model/schemas/Secret.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `certificateSha256Fingerprints` | `array` of `string`s | SHA-256 fingerprints (of the DER encoding, lowercase hex) of each PEM certificate found in the secret value. |  |
| `currentVersion` | `number` | Current version number of the KV v2 secret. |  |
| `deleteVersionAfter` | `string` | Duration after which KV v2 secret versions are automatically deleted (e.g. "3h25m19s"; "0s" means never). |  |
| `isCasRequired` | `boolean` | Whether Check-And-Set is required for writes to this KV v2 secret. |  |
| `isCertificate` | `boolean` | Whether the secret value contains one or more PEM X.509 certificates. Only populated when the hashCertificates option is enabled. |  |
| `maxVersions` | `number` | Maximum number of versions retained for the KV v2 secret (0 means the mount default). |  |
| 
`pathname` \*

 | `string` | Full path of the secret within its engine, including any nested folders (e.g. app/aiassistant/secrets/openai/OpenAiClientOptions). |  |
| 

`source` \*

 | `string` | The engine type the secret belongs to: one of kv1, kv2, or cubbyhole. |  |

---

### Hashicorp Vault User

`hashicorp_vault_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `policies` | `array` of `string`s |  |  |

---

## Release Notes

-   **2026-10-01** — Added configuration options to type custom metadata keys and map a key to the secret expiration date, enabling structured metadata fields including dates in custom formats.
-   **2026-09-29** — Added AppRole authentication support, allowing the integration to authenticate to HashiCorp Vault using role IDs and secret IDs.
-   **2026-09-28** — Added a configuration option to hash certificate values found in secrets, enabling cross-entity comparison of certificates stored in Vault.
-   **2026-09-23** — HashiCorp Vault KV version 2 secrets are now fully ingested by recursively crawling all paths within each mount, capturing secret metadata including custom metadata fields.
-   **2026-07-07** — Added Azure Entra ID OIDC authentication support, allowing the integration to authenticate using Azure service principal credentials.
-   **2026-05-05** — HashiCorp Vault secrets are now classified as Non-Human Identity, improving visibility into non-human access and credential risk.

---

Source: /integrations/directory/heroku

# Heroku

Visualizes Heroku teams, users, applications, and services, map Heroku users to employees, and monitors changes through queries and alerts.

## Installation

To use this integration, JupiterOne requires an API key configured for read access in your Heroku account. The integration requires a Heroku Enterprise account and the `read` token scope. Optionally, use the `global` token scope to also fetch members of each Heroku team.

The Heroku account that generates the API key determines which permissions are available. For full access to all data (including application add-ons), the account must have the **admin** role. An account with the **member** role can retrieve most data, but add-on information is only accessible to admins.

> **INFO**
> 
> For additional information on creating an API key on Heroku, refer to the [Heroku authentication documentation](https://devcenter.heroku.com/articles/platform-api-quickstart#authentication).

### Configuration in JupiterOne

To install the Heroku integration in JupiterOne, navigate to the **Integrations** tab and select **Heroku**. Click **New Instance** to begin configuring your integration, providing the following:

-   **Account Name** — A label used to identify this integration instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName** toggle is enabled.
    
-   **Description** — An optional description to help distinguish this instance from others.
    
-   **Polling Interval** — How often JupiterOne should collect data from Heroku. You may leave this as `DISABLED` and trigger the integration manually.
    
-   **API Key** — Your Heroku API key, configured for the appropriate token scope (`read` for basic access; `global` if team member data is needed).
    

Click **Create Configuration** after all values are provided.

### Next steps

Once your integration instance is configured, it will begin running on the polling interval you selected. Continue on to our [instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Addon | `heroku_addon` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Application | `heroku_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Enterprise Account | `heroku_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Team | `heroku_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `heroku_account_member` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `heroku_account` | **HAS** | `heroku_account_member` |
| `heroku_account` | **HAS** | `heroku_team` |
| `heroku_application` | **HAS** | `heroku_addon` |
| `heroku_team` | **OWNS** | `heroku_application` |
| `heroku_team` | **HAS** | `heroku_account_member` |

### Heroku Account Member

`heroku_account_member` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`enterpriseAccountId` \*

 | `string` |  |  |

---

---

Source: /integrations/directory/hexnode

# Hexnode

Visualize Hexnode's account, users, and device groups, map Hexnode users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to create an provide a Hexnode API key within JupiterOne.

### Configuration in Hexnode

To create a Hexnode API key for use with JupiterOne:

1.  In the Hexnode dashboard, go to **Admin > API**.
2.  Select **Enable API Access**.
3.  Generate an API key for use within JupiterOne.

> **INFO**
> 
> You can find additional information on API key creation on [Hexnode's documentation here](https://www.hexnode.com/mobile-device-management/developers/setting-up-an-api/authentication/).

### Configuration in JupiterOne

To install the Hexnode integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Hexnode. Click **New Instance** to begin configuring your integration with the following:

-   **Account Name** used to identify the Hexnode account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **Hexnode API key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `hexnode_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `hexnode_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device Group | `hexnode_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `hexnode_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `hexnode_user_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `hexnode_account` | **HAS** | `hexnode_user` |
| `hexnode_account` | **HAS** | `hexnode_user_group` |
| `hexnode_account` | **HAS** | `hexnode_device` |
| `hexnode_account` | **HAS** | `hexnode_device_group` |
| `hexnode_device_group` | **HAS** | `hexnode_device` |
| `hexnode_user` | **OWNS** | `hexnode_device` |
| `hexnode_user_group` | **HAS** | `hexnode_user` |

### Hexnode User

`hexnode_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `domain` | `string` |  |  |
| `phoneno` | `string` |  |  |
| `totalDevices` | `integer` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS type and details for Hexnode device entities, combining OS name and version.

---

Source: /integrations/directory/hibob

# HiBob

Visualize HiBob employees, departments, and time-off data in the JupiterOne graph. Map employees to their managers to build an organization chart, track time-off policies and requests, and monitor changes through custom queries and alerts.

# HiBob Integration Installation in JupiterOne

## Overview

This guide walks you through how to connect your **HiBob** account with **JupiterOne** to ingest and monitor your HR data.

The integration pulls employee profiles, departments, organizational hierarchy, time-off policies, and time-off requests from HiBob using a service user authenticated via the HiBob API.

### Prerequisites

-   A **HiBob** account with admin access.
-   Permission to create service users and permission groups in HiBob.
-   Access to **JupiterOne** with permission to configure integrations.

## Set Up in HiBob

### Step 1: Create a Service User

1.  Log in to your HiBob account as an administrator.
2.  Navigate to **Settings** > **Integrations** > **Service Users**.
3.  Click **Add a New Service User** and provide a name (e.g., "JupiterOne").
4.  Generate an API token for the service user.
5.  Copy the **Service Account ID** and **Token** — save them securely. You will need both when configuring the integration in JupiterOne.

Refer to the [HiBob Service Users documentation](https://apidocs.hibob.com/docs/api-service-users) for more details.

### Step 2: Configure Service User Permissions

By default, HiBob service users have **no access permissions**. You must create a dedicated permission group and assign the appropriate permissions for the integration to work correctly.

1.  In HiBob, go to **Settings** > **Permissions** > **Permission Groups**.
2.  Create a new permission group (e.g., "JupiterOne Integration").
3.  Add the service user you created in Step 1 to this group.
4.  Grant the following permissions:

#### People's Data Permissions (Required)

The integration needs **View** access to employee data categories to read employee profiles, departments, and management hierarchy.

| Permission Category | Access Level | Purpose |
| --- | --- | --- |
| **Basic Info** (`root`) | View | Access employee names and core identity fields |
| **About** | View | Access personal information fields |
| **Employment** | View | Access employment-related data |
| **Work** | View | Access department, job title, site, start date, and manager (reports-to) information |
| **Lifecycle** | View | Access employee status and lifecycle status |
| **Personal > Communication** | View | Access work phone and mobile phone numbers |
| **Time Off > See who's out today** | View | Access time-off requests (select **See who's out**) |

> **NOTE**
> 
> HiBob permissions are assigned at the **category** level, not at the individual field level. Granting View access to a category provides access to all fields within that category.

> **NOTE**
> 
> HiBob returns a 200 OK response even when permissions are incomplete — fields the service user cannot access are silently omitted from the response. Verify that all expected data appears in JupiterOne after the first ingestion.

#### Feature Permissions (Required)

| Feature | Permission | Purpose |
| --- | --- | --- |
| **Time Off > Settings** | Manage company's time off settings | Access time-off policy types and policy definitions |

#### Access Rights

Under **Access Rights**, ensure the service user has access to **Everyone** (all active employees).

> **TIP**
> 
> The integration fetches only active employees (`showInactive: false`). You do not need to grant access to inactive employees.

## Data Volume Configuration

Control how much historical time-off request data is ingested from HiBob.

| Field | Description | Default |
| --- | --- | --- |
| **Time Off Requests Ingest Since Days** | Number of days of historical time-off request data to ingest | 365 |

Increasing this value will ingest more time-off request data, which increases the number of entities stored in JupiterOne.

## Configure Integration in JupiterOne

1.  In JupiterOne, go to the left navigation menu and click **Integrations**.
    
2.  Scroll to the **HiBob** integration tile and click it.
    
3.  Click **Add Configuration** and fill in the fields:
    
    | Field | What to Enter |
    | --- | --- |
    | **Account Name** | A friendly name to identify this HiBob account in JupiterOne (stored in `tag.AccountName`) |
    | **Description** | Optional notes to help identify this integration instance |
    | **Polling Interval** | How often to collect data (or choose `DISABLED` to run manually) |
    | **Service Account ID** | The Service Account ID from your HiBob service user |
    | **Service Account Token** | The API token generated for your HiBob service user |
    | **Time Off Requests Ingest Since Days** | Optional — number of days of time-off request history to ingest (default: 365) |
    
4.  Click **Create Configuration** to save.
    

JupiterOne will begin pulling data from HiBob based on the polling interval you set.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| HiBob Account | `hibob_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| HiBob Department | `hibob_department` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| HiBob Employee | `hibob_employee` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| HiBob Time Off Policy | `hibob_time_off_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| HiBob Time Off Request | `hibob_time_off_request` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `hibob_account` | **HAS** | `hibob_employee` |
| `hibob_account` | **HAS** | `hibob_department` |
| `hibob_account` | **HAS** | `hibob_time_off_policy` |
| `hibob_department` | **HAS** | `hibob_employee` |
| `hibob_employee` | **MANAGES** | `hibob_employee` |
| `hibob_employee` | **HAS** | `hibob_time_off_request` |
| `hibob_time_off_policy` | **HAS** | `hibob_time_off_request` |

## Release Notes

-   **2026-02-25** — New HiBob integration: ingests employees, departments, time-off policies, and time-off requests with manager hierarchy relationships.

---

Source: /integrations/directory/horizon3-nodezero

# Horizon3.ia NodeZero

Visualize Horizon3 Nodezero Attack Paths, Discovered Hosts, Operation Templates, Pentest Operations, Asset Groups, Data Stores, Runner Agents, Client Accounts, and Weaknesses while monitoring changes through advanced queries and automated alerts.

# Horizon3-Nodezero Integration Installation in Jupiterone

## Overview

This guide walks you through how to connect your **Horizon3 Nodezero account** with **JupiterOne** to monitor and manage your security data.

### Prerequisites

-   An active Horizon3 account with user role as **Org Admin** or **User** to Generate API Key.
-   API Key should have Permission Level as **Read-only** or **User**.
-   Access to **JupiterOne** with permission to configure integrations.

## Setup in Horizon3 Nodezero

### Generate API Token in Horizon3

#### Steps:

1.  Login to your Horizon3 account.
    
2.  Click on **Profile** at top right corner.
    
3.  Navigate to the **Settings** tab and open **My Settings** tab.
    
4.  Navigate to **API Keys** section and click **Generate API Key**.
    
5.  Select the Permission level as **Read-only** or **User** and click **Generate**.
    
6.  Copy the generated API key and save it securely for further use.
    
7.  Identify your **account region** based on the URL.
    
    | Account region | Base URL |
    | --- | --- |
    | US | `https://api.horizon3ai.com` |
    | EU | `https://api.horizon3ai.eu` |
    

## Configure Integration in JupiterOne

Now that you have required tokens and Region, let's connect everything in JupiterOne.

#### Steps:

1.  In JupiterOne, go to the left navigation menu and click **Integrations**.
    
2.  Scroll down and click the **Horizon3 Nodezero** integration tile.
    
3.  Click **Add Configuration** and fill in the fields:
    
    | Field | What to Enter |
    | --- | --- |
    | **Nodezero API Key** | Paste your API token generated in Horizon3 Nodezero portal here |
    | **Nodezero Region** | Select the region based on your account region |
    | **Account Name** | A friendly name (e.g., “Nodezero - US Region”) |
    | **Description** | Optional – notes to identify this setup |
    | **Polling Interval** | How often to collect data (or choose `DISABLED` to run manually) |
    
4.  Click **Create Configuration** to save it.
    

That’s it! JupiterOne will now start pulling data from Horizon3 Nodezero based on the schedule you set.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (3)

-   `org_admin`
-   `readonly`
-   `user`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (2)

-   `https://api.horizon3ai.com/v1/graphql`
-   `https://api.horizon3ai.eu/v1/graphql`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://docs.horizon3ai.com/api/getting\_started/authenticate/](https://docs.horizon3ai.com/api/getting_started/authenticate/)
-   [https://docs.horizon3ai.com/portal/settings/client\_management/](https://docs.horizon3ai.com/portal/settings/client_management/)
-   [https://docs.horizon3ai.com/portal/settings/user\_management/](https://docs.horizon3ai.com/portal/settings/user_management/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (8)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Build Attack Path Exploits Weakness | `readonly` | `https://api.horizon3ai.com/v1/graphql`, `https://api.horizon3ai.eu/v1/graphql` |
| Fetch Attack Paths | `readonly` | `https://api.horizon3ai.com/v1/graphql`, `https://api.horizon3ai.eu/v1/graphql` |
| Fetch Data Stores | `readonly` | `https://api.horizon3ai.com/v1/graphql`, `https://api.horizon3ai.eu/v1/graphql` |
| Fetch Discovered Hosts | `readonly` | `https://api.horizon3ai.com/v1/graphql`, `https://api.horizon3ai.eu/v1/graphql` |
| Fetch Git Integrations | `readonly` | \- |
| Fetch Operation Templates | `user` | `https://api.horizon3ai.com/v1/graphql`, `https://api.horizon3ai.eu/v1/graphql` |
| Fetch Pentest Operations | `readonly` | `https://api.horizon3ai.com/v1/graphql`, `https://api.horizon3ai.eu/v1/graphql` |
| Fetch Weaknesses | `readonly` | `https://api.horizon3ai.com/v1/graphql`, `https://api.horizon3ai.eu/v1/graphql` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Nodezero Asset Group | `nodezero_asset_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Nodezero Attack Path | `nodezero_attack_path` | [Risk](https://docs.jupiterone.io/data-model/schemas/Risk) |
| Nodezero Client Account | `nodezero_client_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Nodezero Data Store | `nodezero_data_store` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Nodezero Discovered host | `nodezero_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Nodezero Git Integration | `nodezero_git_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Nodezero Operation template | `nodezero_operation_template` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Nodezero Pentest Operation | `nodezero_operation` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Nodezero Runner Agent | `nodezero_agent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Nodezero User Account | `nodezero_user_account` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Nodezero Weakness | `nodezero_weakness` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `nodezero_agent` | **PERFORMED** | `nodezero_operation` |
| `nodezero_attack_path` | **EXPLOITS** | `nodezero_weakness` |
| `nodezero_client_account` | **HAS** | `nodezero_operation` |
| `nodezero_data_store` | **HAS** | `nodezero_weakness` |
| `nodezero_host` | **HAS** | `nodezero_weakness` |
| `nodezero_operation` | **USES** | `nodezero_git_account` |
| `nodezero_operation` | **IDENTIFIED** | `nodezero_attack_path` |
| `nodezero_operation` | **SCANS** | `nodezero_host` |
| `nodezero_operation` | **SCANS** | `nodezero_data_store` |
| `nodezero_operation` | **IDENTIFIED** | `nodezero_weakness` |
| `nodezero_operation_template` | **DEFINES** | `nodezero_operation` |
| `nodezero_user_account` | **CREATED** | `nodezero_operation_template` |
| `nodezero_user_account` | **CREATED** | `nodezero_operation` |

### Nodezero Agent

`nodezero_agent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `lastCommand` | `string` |  |  |
| `logFile` | `string` |  |  |
| `systemInfo` | `string` |  |  |

---

### Nodezero Asset Group

`nodezero_asset_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetsCount` | `number` |  |  |
| `authorizedAssetsCount` | `number` |  |  |
| `authorizedExternalDomainCount` | `number` |  |  |
| `authorizedIPCount` | `number` |  |  |
| `clientAccountCompanyName` | `string` |  |  |
| `clientAccountUUID` | `string` |  |  |
| `externalDomainCount` | `number` |  |  |
| `inScopeIPCount` | `number` |  |  |
| `lastAssetDiscoveryCompletedAt` | `string` |  |  |
| `pentestSeriesUUID` | `string` |  |  |
| `pentestTemplateUUID` | `string` |  |  |
| `userAccountName` | `string` |  |  |
| `userAccountUUID` | `string` |  |  |

---

### Nodezero Attack Path

`nodezero_attack_path` inherits from [Risk](/data-model/schemas/Risk.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `affectedAssetText` | `string` |  |  |
| `attackPathTitle` | `string` |  |  |
| `baseScore` | `number` |  |  |
| `contextScoreDescription` | `string` |  |  |
| `credentialRefs` | `array` of `string`s |  |  |
| `hostName` | `string` |  |  |
| `hostRefs` | `array` of `string`s |  |  |
| `hostText` | `string` |  |  |
| `id` | `string` |  |  |
| `impactDescription` | `string` |  |  |
| `impactTitle` | `string` |  |  |
| `impactType` | `string` |  |  |
| `ipAddress` | `string` |  |  |
| `pentestId` | `string` |  |  |
| `severity` | `string` |  |  |
| `targetEntityText` | `string` |  |  |
| `timeToFind` | `string` | Time took (in seconds or in HH:MM:SS) from the start of the pentest until this particular attack path was discovered |  |
| `weaknessRefs` | `array` of `string`s |  |  |

---

### Nodezero Client Account

`nodezero_client_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetsCount` | `number` |  |  |
| `childClientAccountsCount` | `number` |  |  |
| `companyLogoUrl` | `string` |  |  |
| `companyShortName` | `string` |  |  |
| `externalAssetsCount` | `number` |  |  |
| `internalAssetsCount` | `number` |  |  |
| `isWhiteLabelReportsCascaded` | `boolean` |  |  |
| `isWhiteLabelReportsEnabled` | `boolean` |  |  |
| `parentUUID` | `string` |  |  |
| `secondaryCompanyLogoUrl` | `string` |  |  |
| `sessionUserRoleId` | `string` |  |  |

---

### Nodezero Data Store

`nodezero_data_store` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `account` | `string` |  |  |
| `address` | `string` |  |  |
| `attackPathsCount` | `number` |  |  |
| `authenticated` | `boolean` |  |  |
| `baseScore` | `number` |  |  |
| `baseSeverity` | `string` |  |  |
| `cloudProvideName` | `string` |  |  |
| `cloudResourceARN` | `string` |  |  |
| `cloudServiceName` | `string` |  |  |
| `contextScore` | `number` |  |  |
| `contextSeverity` | `string` |  |  |
| `dataResourcesCount` | `number` |  |  |
| `dataResourcesLabel` | `string` |  |  |
| `dataStoreType` | `string` |  |  |
| `dnsAddress` | `string` |  |  |
| `downstreamImpactTypes` | `array` of `string`s |  |  |
| `downstreamImpactTypesAndCounts` | `array` of `string`s |  |  |
| `hostname` | `string` |  |  |
| `impactPathsCount` | `number` |  |  |
| `ipAddress` | `string` |  |  |
| `pentestId` | `string` |  |  |
| `permissions` | `array` of `string`s |  |  |
| `port` | `number` |  |  |
| `protocol` | `string` |  |  |
| `score` | `number` |  |  |
| `sensitiveDataItemCount` | `number` |  |  |
| `sensitiveDataItemTitlesAndCounts` | `array` of `string`s |  |  |
| `sensitiveDataItemTypes` | `string` |  |  |
| `sensitiveDataItemTypesAndCounts` | `array` of `string`s |  |  |
| `sensitiveResourcesCount` | `number` |  |  |
| `serviceType` | `string` |  |  |
| `severity` | `string` |  |  |
| `title` | `string` |  |  |
| `weaknessesCount` | `number` |  |  |

---

### Nodezero Git Account

`nodezero_git_account` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `source` | `string` |  |  |

---

### Nodezero Host

`nodezero_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `actionLogsCount` | `number` |  |  |
| `actionLogsCsvUrl` | `string` |  |  |
| `attackPathsCount` | `number` |  |  |
| `cloudARNs` | `array` of `string`s |  |  |
| `cloudProvider` | `string` |  |  |
| `cloudRegion` | `string` |  |  |
| `cNameChains` | `array` of `string`s |  |  |
| `confirmedCredentialsCount` | `number` |  |  |
| `confirmedWeaknessesCount` | `number` |  |  |
| `contextScoreDescription` | `string` |  |  |
| `credentialsCount` | `number` |  |  |
| `dataResourcesCount` | `number` |  |  |
| `dataStoresCount` | `number` |  |  |
| `downstreamImpactTypes` | `array` of `string`s |  |  |
| `firstSeenOn` | `string` |  |  |
| `isDatabaseServer` | `boolean` |  |  |
| `isDomainController` | `boolean` |  |  |
| `isInScope` | `boolean` |  |  |
| `isLoadBalancer` | `boolean` |  |  |
| `isMailServer` | `boolean` |  |  |
| `isPublic` | `boolean` |  |  |
| `isVPN` | `boolean` |  |  |
| `isWebApplicationFirewall` | `boolean` |  |  |
| `ldapHostname` | `string` |  |  |
| `pentestId` | `string` |  |  |
| `score` | `number` |  |  |
| `servicesCount` | `number` |  |  |
| `severity` | `string` |  |  |
| `subnet` | `string` |  |  |
| `subnetSource` | `string` |  |  |
| `weaknessesCount` | `number` |  |  |
| `webSharesCount` | `number` |  |  |

---

### Nodezero Operation

`nodezero_operation` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `attackPathsCount` | `number` |  |  |
| `awsAccountIds` | `array` of `string`s |  |  |
| `cancelledOn` | `number` |  |  |
| `clientName` | `string` |  |  |
| `createdBy` | `string` |  |  |
| `credAccessCount` | `number` |  |  |
| `credentialsCount` | `number` |  |  |
| `dataResourcesCount` | `number` |  |  |
| `dataStoresCount` | `number` |  |  |
| `duration` | `number` | Pentest duration in seconds |  |
| `etCompletedOn` | `number` |  |  |
| `excludeScope` | `array` of `string`s |  |  |
| `externalDomainsCount` | `number` |  |  |
| `hostsCount` | `number` |  |  |
| `impactPathsCount` | `number` |  |  |
| `impactsCount` | `number` |  |  |
| `maxScope` | `array` of `string`s |  |  |
| `minScope` | `array` of `string`s |  |  |
| `nodezeroIP` | `string` |  |  |
| `nodezeroScriptUrl` | `string` |  |  |
| `outOfScopeHostsCount` | `number` |  |  |
| `pentestType` | `string` |  |  |
| `phishedAttackPathsCount` | `number` |  |  |
| `phishedImpactPathsCount` | `number` |  |  |
| `runnerAgentUUID` | `string` |  |  |
| `scheduledOn` | `number` |  |  |
| `servicesCount` | `number` |  |  |
| `state` | `string` |  |  |
| `usersCount` | `number` |  |  |
| `weaknessesCount` | `number` |  |  |
| `weaknessTypesCount` | `number` |  |  |
| `websitesCount` | `number` |  |  |

---

### Nodezero Operation Template

`nodezero_operation_template` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetGroupUUID` | `string` |  |  |
| `autoInjectedCredentialsUUID` | `array` of `string`s |  |  |
| `blacklistedScope` | `string` |  |  |
| `clientAccountUUID` | `string` |  |  |
| `companyNames` | `array` of `string`s |  |  |
| `domainsList` | `array` of `string`s |  |  |
| `maximumRunTime` | `number` |  |  |
| `maximumScope` | `string` |  |  |
| `minimumRunTime` | `number` |  |  |
| `minimumScope` | `string` |  |  |
| `passwordsToSpray` | `array` of `string`s |  |  |
| `pentestName` | `string` |  |  |
| `pentestType` | `string` |  |  |
| `runnerName` | `string` |  |  |
| `runnerUUID` | `string` |  |  |
| `targetedTestId` | `string` |  |  |
| `userAccountUUID` | `string` |  |  |

---

### Nodezero User Account

`nodezero_user_account` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `lastSignInOn` | `number` |  |  |

---

### Nodezero Weakness

`nodezero_weakness` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `affectedAssetShortText` | `string` |  |  |
| `affectedAssetText` | `string` |  |  |
| `attackPathsCount` | `number` |  |  |
| `baseScore` | `number` |  |  |
| `baseSeverity` | `string` |  |  |
| `contextScore` | `number` |  |  |
| `contextScoreDescription` | `string` |  |  |
| `contextSeverity` | `string` |  |  |
| `downstreamImpactTypes` | `array` of `string`s |  |  |
| `downstreamImpactTypesAndCounts` | `array` of `string`s |  |  |
| `hasProof` | `boolean` |  |  |
| `id` | `string` |  |  |
| `impactPathsCount` | `number` |  |  |
| `ip` | `string` |  |  |
| `isCISAKnownExploitedVulnerability` | `boolean` |  |  |
| `isCISAKnownRansomwareCampaignVulnerability` | `boolean` |  |  |
| `pentestId` | `string` |  |  |
| `proofFailureCode` | `string` |  |  |
| `proofFailureReason` | `string` |  |  |
| `score` | `number` |  |  |
| `timeToFinding` | `number` |  |  |
| `vulnerabilityAliases` | `array` of `string`s |  |  |
| `vulnerabilityCategory` | `string` |  |  |
| `vulnerabilityId` | `string` |  |  |
| `vulnerabilityName` | `string` |  |  |
| `vulnerabilityShortName` | `string` |  |  |

---

## Release Notes

-   **2025-11-07** — New Horizon3 NodeZero integration: ingests pentest operations, discovered hosts, attack paths, weaknesses, data stores, and asset groups with full relationship mapping.

---

Source: /integrations/directory/hubspot

# HubSpot

Visualize Hubspot owners, roles, and companies, map Hubspot owners to employees, and monitor changes through queries and alerts.

## Installation

Before you can start using OAuth with HubSpot, you must have an app associated with your developer account and a HubSpot account to install your app in (you can use an existing account or create a test account).

> **INFO**
> 
> Hubspot supports OAuth for this integration, To create an OAuth account, you must have a developer account. See Hubspot's [OAuth Quickstart Guide](https://developers.hubspot.com/docs/api/oauth-quickstart-guide) for reference.

### Configuration in JupiterOne

To install the Hubspot integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Hubspot. Click **New Instance** to begin configuring your integration, providing the following:

-   The **Account Name** used to identify the Hubspot account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration. You will then be prompted to authenticate JupiterOne with Hubspot. Complete the authentication process to finalize the integration.

### Subscription tier requirements

Some HubSpot features ingested by this integration require specific subscription tiers:

-   **Roles (Permission Sets)**: Requires an Enterprise subscription for at least one Hub. If your HubSpot account does not have Enterprise access, the integration will skip ingesting roles and you may see an error message: `Account doesn't have access to roles`. This is expected behavior for accounts below the Enterprise tier. To verify if you have access to roles, navigate to **Settings > Users and Teams > Permission Sets** in your HubSpot portal.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| HubSpot Account | `hubspot_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| HubSpot Company | `hubspot_company` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| HubSpot Role | `hubspot_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| HubSpot User | `hubspot_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `hubspot_account` | **HAS** | `hubspot_role` |
| `hubspot_account` | **HAS** | `hubspot_user` |
| `hubspot_account` | **HAS** | `hubspot_company` |
| `hubspot_user` | **ASSIGNED** | `hubspot_role` |

---

Source: /integrations/directory/illumio-core

# Illumio Core

Visualize your Illumio Core workloads, VEN agents, labels, IP lists, services and active rulesets in JupiterOne. Map workloads to their VENs and labels, find workloads that are not in full enforcement, and monitor policy changes through queries and alerts.

## Installation

This integration connects to an **Illumio Core Policy Compute Engine (PCE)** using the PCE REST API v2 (`https://<pce-fqdn>:<port>/api/v2/...`). It ingests workloads, VENs, labels, label groups, IP lists, service definitions, rulesets and rules, container clusters, and PCE users. Every request is a read-only `GET`, and security policy objects are read from the **active** (provisioned) policy, not the draft.

The integration can run in two ways:

-   **In the JupiterOne cloud.** Use this when your PCE is Illumio-hosted (SaaS) or is reachable from the internet.
-   **On a JupiterOne collector** in your own network. Use this for an on-premises PCE that the JupiterOne cloud cannot reach.

### Prerequisites

-   An **Illumio Core PCE**, on-premises or Illumio-hosted, and its FQDN and API port.
-   The **organization ID** of the PCE organization you want to ingest.
-   An Illumio **API key** (the authentication username and secret) whose role can read the organization. A service account with the **Global Viewer** role is recommended.
-   For an on-premises PCE that uses a certificate from a private or internal certificate authority, the **CA certificate** in PEM format.
-   Access to **JupiterOne** with permission to configure integrations.

### Configuration in Illumio Core

The integration authenticates with **HTTP Basic authentication**: the API key's authentication username is the username and the API key secret is the password. On save and at the start of every run, the integration calls `GET /api/v2/orgs/{org_id}`, which checks the credentials and the organization ID together.

#### Choose the role

The integration only reads, so give the credential a read-only role. We recommend the global **Global Viewer** role. Older PCE versions call this role **Global Read Only**. It can view any resource and organization setting, but it cannot perform any operations.

The integration does not need the **Global Organization Owner** or **Global Administrator** roles, or any provisioning role.

The **Users** data source reads `GET /api/v2/users`, which lists the users of the whole PCE, not only one organization. Illumio does not document which roles can call this endpoint. If the credential's role cannot list users, the **Users** step fails with an authorization error and the other data sources still run. In that case, leave **Users** disabled.

#### Option 1: Create a service account (recommended)

A service account is not tied to a person, so its access does not end when an employee leaves. Creating one requires an organization owner:

1.  In the PCE web console, go to **Access Management > Service Accounts**.
2.  Click **Add** and enter a unique name and, optionally, a description.
3.  Optionally, restrict the API key by IP address. If you do, allow the addresses the integration connects from: your collector's address, or the addresses JupiterOne connects from.
4.  Optionally, change the API key expiration. It cannot be longer than your organization's maximum.
5.  In the **Roles and Scopes** table, assign the **Global Viewer** role.
6.  Click **Save**, then **Download Credentials**. Keep the authentication username and the secret. You will paste them into JupiterOne.

Service account API keys can expire. Note the expiration date: when the key expires, the PCE rejects it and the integration stops ingesting until you add a new key to the instance.

#### Option 2: Create an API key for a user

A user API key has the same access as the user who created it. Sign in as a user who has the **Global Viewer** role, then:

1.  Open the **User** menu and select **My API Keys**.
2.  Click **Add**, enter a **Name** and, optionally, a **Description**, and click **Save**.
3.  In the **API Key Created** window, expand **Show credentials** and copy the **Authentication Username** and the **Secret**, or click **Download Credentials**.

User API keys do not expire. They stay valid until they are deleted.

> **CAUTION**
> 
> The credentials are shown only once. If you lose the secret, create a new API key. Paste the **Authentication Username** (it starts with `api_`) into the **API Key Authentication Username** field in JupiterOne, not the **Key ID**. The PCE uses the authentication username as the Basic-auth username.

#### Find the port and organization ID

-   **Port:** An Illumio-hosted (SaaS) PCE serves the API on `443`. An on-premises PCE uses `8443` by default, but the port can differ between implementations. Confirm the port with your PCE administrator.
-   **Organization ID:** The number in the `/orgs/<org_id>/` part of the PCE's API URLs. The integration uses `1` when the field is left empty. Confirm the ID with your PCE administrator if you are unsure.

### Configuration in JupiterOne

To install the Illumio Core integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Illumio Core**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Illumio Core account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Authentication** fields below.
    

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **PCE URL** | Yes | The PCE FQDN, such as `pce.company.com`, or its URL, such as `https://pce.company.com`. Without a scheme, `https://` is used. Only the scheme and host are used: a path or a port in the URL is ignored, so set the port in **PCE Port**. |
| **PCE Port** | No | The PCE API port. Defaults to `443`, the Illumio SaaS port, when left empty. For an on-premises PCE, enter `8443` or your PCE's configured API port. |
| **Organization ID** | No | The PCE organization ID. Defaults to `1` when left empty. |
| **API Key Authentication Username** | Yes | The API key's **Authentication Username**, which starts with `api_`, for example `api_xxxxxxxxxxxx`. This is not the **Key ID**. |
| **API Key Secret** | Yes | The API key secret. |

When you save the instance, JupiterOne checks that **PCE URL**, **API Key Authentication Username** and **API Key Secret** are set, then requests `GET /api/v2/orgs/{org_id}`. A wrong port, an unknown organization ID, a TLS error or rejected credentials all fail this check and are reported as an authentication error.

> **CAUTION**
> 
> Leave **PCE Port** empty only for an Illumio-hosted (SaaS) PCE, which serves the API on `443`. An on-premises PCE listens on `8443` by default, so set **PCE Port** explicitly, or the integration connects to the wrong port.

#### Filters

This section holds the TLS settings for an on-premises PCE that uses a certificate from a private or internal certificate authority. Both fields are optional, and an Illumio-hosted PCE needs neither. The integration has no fields that filter which objects are ingested; use the data sources below to choose what to collect.

| Field | Default | Description |
| --- | --- | --- |
| **CA Certificate** | Empty | The PEM-encoded certificate of the CA that issued the PCE's TLS certificate. The PCE certificate is then verified against this CA. |
| **Disable TLS Verification** | Off | Skips verification of the PCE's TLS certificate. Not recommended: prefer **CA Certificate**. |

Click **Create** once all values are provided to finalize the integration.

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default**, so enable the ones you want to ingest. The `illumio_account` entity for the PCE organization and the `illumio_service` entity for Illumio Core are always created.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Workloads** | Workloads in the organization, with their hostname, IP addresses, operating system, last heartbeat, online state, enforcement mode and visibility level. | `illumio_workload` |
| **VENs** | Virtual Enforcement Node agents, with their status, version, platform, type and last heartbeat. | `illumio_ven` |
| **Labels** | Segmentation labels, with their key (dimension) and value. | `illumio_label` |
| **Label Groups** | Label groups from the active policy. | `illumio_label_group` |
| **IP Lists** | IP lists from the active policy, with their IP ranges and FQDNs. | `illumio_ip_list` |
| **Service Definitions** | Services from the active policy, with their ports, protocols and Windows services. | `illumio_service_definition` |
| **Rulesets and Rules** | Rulesets from the active policy and the rules listed in each ruleset, with whether each is enabled. | `illumio_rule_set`, `illumio_rule` |
| **Container Clusters** | Kubernetes and OpenShift clusters paired with the PCE, with their manager type, container runtime, Kubelink version and online state. | `illumio_container_cluster` |
| **Users** | Users of the PCE, with their username, name, user type and whether the account is locked. | `illumio_user` |

To ingest everything the integration supports, enable all nine data sources.

Relationships between objects from two data sources are built only when every data source they need is enabled. If a required data source is disabled, the step that builds the relationship does not run.

| Relationship | Requires |
| --- | --- |
| `illumio_account` **PROVIDES** `illumio_service` | Always created |
| `illumio_account` **HAS** `illumio_workload` | **Workloads** |
| `illumio_account` **HAS** `illumio_label` | **Labels** |
| `illumio_account` **HAS** `illumio_label_group` | **Label Groups** |
| `illumio_account` **HAS** `illumio_ip_list` | **IP Lists** |
| `illumio_account` **HAS** `illumio_service_definition` | **Service Definitions** |
| `illumio_account` **HAS** `illumio_rule_set` | **Rulesets and Rules** |
| `illumio_rule_set` **HAS** `illumio_rule` | **Rulesets and Rules** |
| `illumio_account` **HAS** `illumio_container_cluster` | **Container Clusters** |
| `illumio_account` **HAS** `illumio_user` | **Users** |
| `illumio_workload` **HAS** `illumio_ven` | **Workloads** and **VENs** |
| `illumio_workload` **ASSIGNED** `illumio_label` | **Workloads** and **Labels** |
| `illumio_container_cluster` **HAS** `illumio_workload` | **Workloads** and **Container Clusters** |
| `illumio_label_group` **HAS** `illumio_label` | **Label Groups** and **Labels** |
| `illumio_label_group` **HAS** `illumio_label_group` (group to sub-group) | **Label Groups** and **Labels** |
| `illumio_rule` **USES** `illumio_service_definition` | **Rulesets and Rules**, **Service Definitions** and **IP Lists** |
| `illumio_rule` **USES** `illumio_ip_list` | **Rulesets and Rules**, **Service Definitions** and **IP Lists** |

> **CAUTION**
> 
> **VENs on their own are not connected to anything.** A VEN is linked to the graph only through its workload, so enable **Workloads** together with **VENs**. Likewise, both **USES** relationships from rules are built by a single step that needs **Rulesets and Rules**, **Service Definitions** and **IP Lists** all enabled. If any of the three is disabled, no rule is connected to a service definition or an IP list.

A rule is connected to a service definition only when the rule references the service by its HREF. Ports and protocols written directly into a rule do not create a relationship. A rule is connected to an IP list when the IP list is one of the rule's providers or consumers. Rules are not connected to the labels, label groups or workloads in their scopes, providers or consumers.

#### Example queries

Workloads that are not in full enforcement:

```j1ql
FIND illumio_workload WITH enforcementMode != 'full'
```

With the **Labels** data source also enabled, workloads that have no labels:

```j1ql
FIND illumio_workload THAT !ASSIGNED illumio_label
```

With **Rulesets and Rules**, **Service Definitions** and **IP Lists** enabled, the rules that use each IP list:

```j1ql
FIND illumio_rule AS r
  THAT USES illumio_ip_list AS l
RETURN r.displayName, r.isEnabled, l.displayName, l.ipRanges
```

#### What the integration does not collect

-   Draft (unprovisioned) policy. Label groups, IP lists, services and rulesets are read from the active policy only.
-   Enforcement boundaries, traffic flows, events and audit logs, pairing profiles, and virtual services.
-   Container cluster pairing tokens. They are secrets and are never ingested.
-   The last login IP address of PCE users.

#### Rate limits and large organizations

The PCE allows up to 500 API requests per minute per API key. The integration makes one request per collection, plus a few requests to follow each asynchronous job described below. It makes up to three attempts for a request that fails with `429 Too Many Requests`, a `5xx` response or a network error. On a `429` it waits for the time given in the `Retry-After` header, and otherwise it backs off starting at 30 seconds. A request that does not answer within three minutes is timed out and tried again.

A PCE returns at most 500 objects from a regular `GET` of a collection. When a collection is larger, the integration asks the PCE to build the collection as an asynchronous job, waits for the job to finish, and downloads the result. Each job can take up to 60 minutes. If a job fails or does not finish in time, that data source fails for the run.

If the PCE does not offer container clusters and returns `404` for that collection, the **Container Clusters** data source is skipped without an error.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [API keys](https://product-docs-repo.illumio.com/Tech-Docs/Core/25.2/REST-APIs/out/en/rest-apis-25-2-10/authentication-and-api-user-permissions/api-keys.html) — creating user API keys and using them for Basic authentication
-   [Setup for role-based access control](https://product-docs-repo.illumio.com/Tech-Docs/Core/25.4/Admin/out/en/pce-administration/role-based-access-control/setup-for-role-based-access-control.html) — creating service accounts and assigning roles
-   [Roles, scopes, and granted access](https://product-docs-repo.illumio.com/Tech-Docs/Core/25.4/Admin/out/en/pce-administration/role-based-access-control/roles,-scopes,-and-granted-access.html) — what the Global Viewer role can do
-   [REST API URIs](https://product-docs-repo.illumio.com/Tech-Docs/Core/24.2/REST-APIs/out/en/rest-apis/overview-of-the-illumio-rest-api/rest-api-uris.html) — PCE host, port and organization in API URLs
-   [REST API limits](https://product-docs-repo.illumio.com/Tech-Docs/Core/24.2/REST-APIs/out/en/overview-of-the-illumio-rest-api/rest-api-limits.html) — request rate limit and the 500-object limit for collections

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (5)

-   `Admin`
-   `Global Read Only`
-   `Owner`
-   `Ruleset Viewer`
-   `Viewer`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (10)

-   `https://<pce-fqdn>:<port>/api/v2/orgs/{org_id}`
-   `https://<pce-fqdn>:<port>/api/v2/orgs/{org_id}/container_clusters`
-   `https://<pce-fqdn>:<port>/api/v2/orgs/{org_id}/labels`
-   `https://<pce-fqdn>:<port>/api/v2/orgs/{org_id}/sec_policy/active/ip_lists`
-   `https://<pce-fqdn>:<port>/api/v2/orgs/{org_id}/sec_policy/active/label_groups`
-   `https://<pce-fqdn>:<port>/api/v2/orgs/{org_id}/sec_policy/active/rule_sets`
-   `https://<pce-fqdn>:<port>/api/v2/orgs/{org_id}/sec_policy/active/services`
-   `https://<pce-fqdn>:<port>/api/v2/orgs/{org_id}/vens`
-   `https://<pce-fqdn>:<port>/api/v2/orgs/{org_id}/workloads`
-   `https://<pce-fqdn>:<port>/api/v2/users`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (9)

-   [https://github.com/illumio/illumio-py/blob/main/illumio/accessmanagement/user.py](https://github.com/illumio/illumio-py/blob/main/illumio/accessmanagement/user.py)
-   [https://github.com/illumio/illumio-py/blob/main/illumio/infrastructure/containercluster.py](https://github.com/illumio/illumio-py/blob/main/illumio/infrastructure/containercluster.py)
-   [https://github.com/illumio/illumio-py/blob/main/illumio/pce.py](https://github.com/illumio/illumio-py/blob/main/illumio/pce.py)
-   [https://github.com/illumio/illumio-py/blob/main/illumio/policyobjects/iplist.py](https://github.com/illumio/illumio-py/blob/main/illumio/policyobjects/iplist.py)
-   [https://github.com/illumio/illumio-py/blob/main/illumio/policyobjects/label.py](https://github.com/illumio/illumio-py/blob/main/illumio/policyobjects/label.py)
-   [https://github.com/illumio/illumio-py/blob/main/illumio/policyobjects/service.py](https://github.com/illumio/illumio-py/blob/main/illumio/policyobjects/service.py)
-   [https://github.com/illumio/illumio-py/blob/main/illumio/rules/ruleset.py](https://github.com/illumio/illumio-py/blob/main/illumio/rules/ruleset.py)
-   [https://github.com/illumio/illumio-py/blob/main/illumio/workloads/ven.py](https://github.com/illumio/illumio-py/blob/main/illumio/workloads/ven.py)
-   [https://github.com/illumio/illumio-py/blob/main/illumio/workloads/workload.py](https://github.com/illumio/illumio-py/blob/main/illumio/workloads/workload.py)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `illumio_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Container Cluster | `illumio_container_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| IP List | `illumio_ip_list` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Label | `illumio_label` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Label Group | `illumio_label_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Rule | `illumio_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Ruleset | `illumio_rule_set` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Service | `illumio_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Service Definition | `illumio_service_definition` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| User | `illumio_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| VEN | `illumio_ven` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Workload | `illumio_workload` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `illumio_account` | **PROVIDES** | `illumio_service` |
| `illumio_account` | **HAS** | `illumio_workload` |
| `illumio_account` | **HAS** | `illumio_label` |
| `illumio_account` | **HAS** | `illumio_label_group` |
| `illumio_account` | **HAS** | `illumio_ip_list` |
| `illumio_account` | **HAS** | `illumio_service_definition` |
| `illumio_account` | **HAS** | `illumio_rule_set` |
| `illumio_account` | **HAS** | `illumio_container_cluster` |
| `illumio_account` | **HAS** | `illumio_user` |
| `illumio_container_cluster` | **HAS** | `illumio_workload` |
| `illumio_label_group` | **HAS** | `illumio_label` |
| `illumio_label_group` | **HAS** | `illumio_label_group` |
| `illumio_rule` | **USES** | `illumio_service_definition` |
| `illumio_rule` | **USES** | `illumio_ip_list` |
| `illumio_rule_set` | **HAS** | `illumio_rule` |
| `illumio_workload` | **HAS** | `illumio_ven` |
| `illumio_workload` | **ASSIGNED** | `illumio_label` |

### Illumio Account

`illumio_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`orgId` \*

 | `string` | The PCE organization ID this account represents. |  |
| 

`pceUrl` \*

 | `string` | The PCE FQDN or base URL this account is reached at. |  |

---

### Illumio Container Cluster

`illumio_container_cluster` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`containerRuntime` \*

 | `string` **|** `null` | Container runtime reported for the cluster. |  |
| 

`isOnline` \*

 | `boolean` **|** `null` | Whether the cluster is currently connected to the PCE. |  |
| 

`kubelinkVersion` \*

 | `string` **|** `null` | Version of the Kubelink component paired with the PCE. |  |
| 

`managerType` \*

 | `string` **|** `null` | Orchestration manager type (e.g. Kubernetes, OpenShift). |  |

---

### Illumio Ip List

`illumio_ip_list` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`fqdns` \*

 | `array` **|** `null` | FQDN entries associated with the IP list. |  |
| 

`ipRanges` \*

 | `array` **|** `null` | IP ranges/CIDRs in the list, formatted as from\_ip\[-to\_ip\]. |  |

---

### Illumio Label

`illumio_label` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`labelKey` \*

 | `string` **|** `null` | The label dimension key (e.g. role, app, env, loc). |  |
| 

`labelValue` \*

 | `string` **|** `null` | The label value within its dimension. |  |

---

### Illumio Label Group

`illumio_label_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`labelKey` \*

 | `string` **|** `null` | The label dimension key the group applies to. |  |

---

### Illumio Rule

`illumio_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isEnabled` \*

 | `boolean` **|** `null` | Whether the rule is enabled. |  |
| 

`isUnscopedConsumers` \*

 | `boolean` **|** `null` | Whether the rule is an extra-scope rule (consumers outside the ruleset scope). |  |

---

### Illumio Rule Set

`illumio_rule_set` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isEnabled` \*

 | `boolean` **|** `null` | Whether the ruleset is enabled. |  |

---

### Illumio Service

`illumio_service` inherits from [Service](/data-model/schemas/Service.md)

---

### Illumio Service Definition

`illumio_service_definition` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`servicePorts` \*

 | `array` **|** `null` | Port/protocol entries, formatted as port\[-to\_port\]/proto. |  |
| 

`windowsServices` \*

 | `array` **|** `null` | Windows service names defined by this service object. |  |

---

### Illumio User

`illumio_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isLocked` \*

 | `boolean` **|** `null` | Whether the user account is locked on the PCE. |  |
| 

`userType` \*

 | `string` **|** `null` | The PCE user type (e.g. local, external) reported for the user. |  |

---

### Illumio Ven

`illumio_ven` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`activationType` \*

 | `string` **|** `null` | How the VEN was activated (e.g. pairing\_key). |  |
| 

`osPlatform` \*

 | `string` **|** `null` | Operating system platform reported by the VEN. |  |
| 

`venStatus` \*

 | `string` **|** `null` | Operational status of the VEN (e.g. active, suspended). |  |
| 

`venType` \*

 | `string` **|** `null` | The VEN type (e.g. server, endpoint). |  |
| 

`venVersion` \*

 | `string` **|** `null` | Installed VEN software version. |  |

---

### Illumio Workload

`illumio_workload` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`dataCenter` \*

 | `string` **|** `null` | Free-text data center reported for the workload. |  |
| 

`enforcementMode` \*

 | `string` **|** `null` | Policy enforcement mode: idle, visibility\_only, selective, or full. |  |
| 

`isOnline` \*

 | `boolean` **|** `null` | Whether the workload is currently reported online by its VEN. |  |
| 

`numEnforcementBoundaries` \*

 | `number` **|** `null` | Number of enforcement boundaries applied to the workload. |  |
| 

`serviceProvider` \*

 | `string` **|** `null` | Free-text service provider reported for the workload. |  |
| 

`visibilityLevel` \*

 | `string` **|** `null` | Traffic visibility level configured for the workload. |  |

---

## Release Notes

-   **2026-10-14** — The authentication username field now accepts either the full prefixed username or a bare key ID, which the integration will automatically format to produce a valid credential.
-   **2026-10-05** — New Illumio Core integration: ingests workloads, Virtual Enforcement Nodes, labels, label groups, IP lists, service definitions, rulesets, rules, container clusters, and users.

---

Source: /integrations/directory/immersive-labs

# Immersive Labs

Visualize Immersive Labs learners, teams, catalog labs, collections, and scheduled exercises (Cyber Range drills, crisis simulations, screening, and CTF events) in the JupiterOne graph, along with per-learner assignments and completions — including earned CPE credits. Track training completion and CPE credit as compliance evidence, identify learners who have not engaged with assigned training, correlate learners to employee identities, and monitor engagement across teams through queries and alerts.

## Installation

### Prerequisites

-   An **Immersive Labs** organization (tenant) with an **Organization Admin** who can generate an API key.
-   Your **region-specific API base URL** (for example `https://api.immersivelabs.online` or `https://api.us.immersivelabs.com`).
-   Access to **JupiterOne** with permission to configure integrations.

### Generate an API key in Immersive Labs

The integration authenticates with an API key issued as an **Access Key** / **Secret Token** pair.

1.  Sign in to the Immersive Labs platform as an **Organization Admin**.
2.  Go to **Platform Settings → API**.
3.  Select **Generate API key**.
4.  Copy the **Access Key** and the **Secret Token**. The Secret Token is shown only once, so store it securely — you will paste both values into JupiterOne in the next section.

The integration issues read-only requests. It does not request specific scopes when minting its token — the token inherits the API key's own access — so no additional scope provisioning is required. See the [Authorization](/integrations/directory/immersive-labs.md?integration-docs=authorization) tab for details.

### Configure the integration in JupiterOne

To install the Immersive Labs integration in JupiterOne, navigate to the **Integrations** tab and select **Immersive Labs**. Click **New Instance** to begin configuring your integration.

Creating an Immersive Labs instance requires the following:

-   The **Account Name** used to identify the Immersive Labs account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
-   **Description** to assist in identifying the integration instance, if desired.
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **API Base URL** | Yes | Your region-specific Immersive Labs API endpoint (e.g. `https://api.immersivelabs.online` or `https://api.us.immersivelabs.com`). |
| **Access Key** | Yes | The **Access Key** from your Immersive Labs API key (used as the token username). |
| **Secret Token** | Yes | The **Secret Token** paired with the Access Key (used as the token password). |

#### Advanced — Activity Lookback Days

The completion and assignment steps fetch learner activity created within a lookback window, so each sync is bounded rather than pulling the full history.

| Field | Default | Options | Description |
| --- | --- | --- | --- |
| **Activity Lookback Days** | `90` | `14`, `30`, `90`, `180`, `365` | How far back (in days) to fetch completion and attempt activity on each sync. Increase it to capture older activity. |

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `immersive_labs_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Collection | `immersive_labs_collection` | [Training](https://docs.jupiterone.io/data-model/schemas/Training), [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Exercise | `immersive_labs_exercise` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Lab | `immersive_labs_lab` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |
| Team | `immersive_labs_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `immersive_labs_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `immersive_labs_collection` | **CONTAINS** | `immersive_labs_lab` |
| `immersive_labs_team` | **CONTAINS** | `immersive_labs_team` |
| `immersive_labs_team` | **HAS** | `immersive_labs_user` |
| `immersive_labs_team` | **ASSIGNED** | `immersive_labs_exercise` |
| `immersive_labs_user` | **ASSIGNED** | `immersive_labs_lab` |
| `immersive_labs_user` | **ASSIGNED** | `immersive_labs_collection` |
| `immersive_labs_user` | **ASSIGNED** | `immersive_labs_exercise` |
| `immersive_labs_user` | **COMPLETED** | `immersive_labs_lab` |
| `immersive_labs_user` | **COMPLETED** | `immersive_labs_collection` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `immersive_labs_user` | **IS** | `Person` | FORWARD |

### Immersive Labs Account

`immersive_labs_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`organizationId` \*

 | `string` | The Immersive Labs organisation (tenant) identifier returned with the API token. |  |

---

### Immersive Labs Collection

`immersive_labs_collection` inherits from [Training](/data-model/schemas/Training.md), [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The Immersive Labs organisation (tenant) id this collection belongs to (ADR-015 flat account reference). |  |
| 

`categories` \*

 | `array` **|** `null` | The catalog categories the collection is classified under. |  |
| 

`collectionType` \*

 | `string` **|** `null` | The Immersive Labs content type of the collection. |  |
| 

`uuid` \*

 | `string` | The Immersive Labs UUID of the collection. |  |

---

### Immersive Labs Exercise

`immersive_labs_exercise` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The Immersive Labs organisation (tenant) id this exercise belongs to (ADR-015 flat account reference). |  |
| 

`exerciseType` \*

 | `string` **|** `null` | The Immersive Labs exercise type (e.g. cyber range, crisis simulation, screening). |  |
| 

`scheduledEndOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the exercise is scheduled to end. |  |
| 

`uuid` \*

 | `string` | The Immersive Labs UUID of the exercise. |  |

---

### Immersive Labs Lab

`immersive_labs_lab` inherits from [Training](/data-model/schemas/Training.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The Immersive Labs organisation (tenant) id this lab belongs to (ADR-015 flat account reference). |  |
| 

`activityType` \*

 | `string` **|** `null` | The Immersive Labs content type of the activity (e.g. lab). |  |
| 

`tags` \*

 | `array` **|** `null` | The tags applied to the lab in the Immersive Labs catalog. |  |
| 

`uuid` \*

 | `string` | The Immersive Labs UUID of the lab/activity. |  |

---

### Immersive Labs Team

`immersive_labs_team` inherits from [Team](/data-model/schemas/Team.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The Immersive Labs organisation (tenant) id this team belongs to (ADR-015 flat account reference). |  |
| 

`uuid` \*

 | `string` | The Immersive Labs UUID of the team. |  |

---

### Immersive Labs User

`immersive_labs_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | The Immersive Labs organisation (tenant) id this learner belongs to (ADR-015 flat account reference). |  |
| 

`externalId` \*

 | `string` **|** `null` | The customer-supplied external identifier for the learner (e.g. SSO/HRIS id), used to correlate to employee identity. |  |

---

---

Source: /integrations/directory/infoblox-nios

# Infoblox NIOS

Visualize Infoblox NIOS hosts and monitor changes through queries and alerts.

## Installation

For this integration, you will need to create a new user with a custom role in Infoblox NIOS Grid.

### Configuration in Infoblox NIOS

### 1\. Create a Custom Role

1.  In the Infoblox NIOS Grid Console, go to **Administration > Administrators > Roles**.
2.  Click on **Add Role** in the top-left corner.
3.  In the **Role Name** field, enter a name for your role, and optionally add a **Comment**.
4.  Click **Next**.
5.  On the next screen, click **Next** again, then click **Save**.
6.  Select **App Permissions** to set permissions for the role.
7.  Under **Permissions**, click on the **Add Permission** icon.
8.  In the **Select Role Permission** window:
    -   Choose the role you just created.
    -   Assign **Read-only** permission for **All Hosts** for DHCP, DNS and IPAM Services.
9.  Click **Save and Close**.

### 2\. Create a Group with the Custom Role

1.  Go to the **Groups** tab.
2.  Click **Add Group**.
3.  Enter a **Group Name** and optionally a **Comment**, then click **Next**.
4.  For steps 2, 3, and 4, keep the default settings and click **Next** each time.
5.  In step 5, click on the **Add Role** (+) button.
    -   Navigate to the **Custom Role** directory.
    -   Select the role you created in the previous section.
6.  Check allowed interfaces API & GUI checkboxes.
7.  Click **Save and Close**.

### 3\. Create an API User Account

1.  Go to the **Administrators** section.
2.  Click the **+** icon to create a new user.
3.  Set **Auth Type** to **Local**.
4.  Enter a **Login Name**, **Password**, and confirm the password in the **Confirm Password** field.
5.  Under **Admin Group**, select the group created in the previous section.
6.  Click **Save and Close**.

### Configuration in JupiterOne

To install the Infoblox NIOS integration in JupiterOne:

1.  Navigate to the **Integrations** tab in JupiterOne and select **Infoblox NIOS**.
2.  Click **New Instance** to begin configuring your integration.

You will need to provide the following:

In Authentication section:

-   **Infoblox NIOS Username**, **Infoblox NIOS Password**, and **Infoblox NIOS Base URL** for the Infoblox NIOS account.

In General Section

-   **Account Name**: Used to identify Infoblox Nios Instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
-   **Description** (optional): Assists in identifying the integration instance.

In Advance Section configure below (optional):

-   **Polling Interval**: Set this to your desired frequency for data polling, or leave it as `DISABLED` if you prefer manual execution.

Click **Create** once all values are provided to finalize the integration.

### Next Steps

Once your integration instance is configured, it will begin running on the polling interval you provided, populating data within JupiterOne. For more information on working with and managing integration instances, refer to our [Instance Management Guide](/integrations/instance-management.md).

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Infoblox NIOS Account | `infoblox_nios_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Infoblox NIOS Host | `infoblox_nios_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |

### Infoblox Nios Account

`infoblox_nios_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Infoblox Nios Host

`infoblox_nios_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowTelnet` | `boolean` |  |  |
| `comment` | `string` |  |  |
| `configureForDns` | `boolean` |  |  |
| `ddnsProtected` | `boolean` |  |  |
| `disableDiscovery` | `boolean` |  |  |
| `dnsName` | `string` |  |  |
| `location` | `string` |  |  |
| `networkView` | `string` |  |  |
| `rrsetOrder` | `string` |  |  |
| `useCliCredentials` | `boolean` |  |  |
| `useDnsEaInheritance` | `boolean` |  |  |
| `useSnmp3Credential` | `boolean` |  |  |
| `useSnmpCredential` | `boolean` |  |  |
| `useTtl` | `boolean` |  |  |
| `view` | `string` |  |  |
| `zone` | `string` |  |  |

---

---

Source: /integrations/directory/iriusrisk

# IriusRisk

Visualize Projects, Threats, Weaknesses, Countermeasures, and Users, and monitor changes through queries and alerts.

## Installation

### Requirements

-   You need the **IriusRisk Host URL** and an **API Token** generated in your IriusRisk account.
-   You must have the necessary permissions in **JupiterOne** to install new integrations.

### Configuring IriusRisk

#### Creating Global and Project Roles with Required Permissions

1.  Click the **Settings** icon to open the **General Settings** dropdown.
2.  Select **Permissions** from the dropdown.
3.  Under the **Global Roles** tab:
    -   Click **Create Role**.
    -   Provide a **Name** and **Description**.
    -   Enable the following permissions:
        -   **ALL\_USERS\_UPDATE** (User Service). IriusRisk requires this permission to list users through the API, and JupiterOne also uses that call to validate the instance.
        -   **API\_ACCESS** (APIs Service)
        -   **PRODUCTS\_LIST\_ALL**, so the API user can see every project. Without it, the IriusRisk API only returns the projects the user is a member of, and JupiterOne ingests only those.
    -   Click **Create** to finalize the role.
4.  Under the **Project Roles** tab:
    -   Click **Create Role**.
    -   Provide a **Name** and **Description**.
    -   Enable the following permissions:
        -   **THREAT\_VIEW** (Threats Service)
        -   **COUNTERMEASURE\_VIEW** (Countermeasures Service)
    -   Click **Create** to finalize the role.

#### Creating a User

1.  Click the **Settings** icon to open the **General Settings** dropdown.
2.  Select **Users** from the dropdown.
3.  Click **\+ Create User**.
4.  Provide the **First Name** and **Last Name**.
5.  Enter an **Email Address**.
6.  Set a **Password** for the user.
7.  Assign the previously created **Global Role** and **Project Role**.
8.  Click **Create** to finalize the user setup.

### Generating an IriusRisk API Token

Refer to the official IriusRisk documentation on [creating an API token](https://enterprise-support.iriusrisk.com/s/article/How-to-Enable-and-Configure-API-Access-in-IriusRisk).

**Note:** The API token should be generated using the user created above, ensuring the required roles are assigned.

### Configuring JupiterOne

1.  From the top navigation bar of the **J1 Search** homepage, go to **Integrations**.
    
2.  Search for **IriusRisk** and select it.
    
3.  Click the **Add Instance** button and configure the following settings:
    
    -   **Account Name:** Enter a name to identify this IriusRisk instance in JupiterOne. When **Tag with Account Name** is enabled, ingested entities will store this value in `tag.AccountName`.
    -   **Description:** Provide a description to help your team identify this integration instance.
    -   **Polling Interval:** Choose a suitable polling interval for monitoring, or leave it as `DISABLED` for manual execution.
    -   **IriusRisk Host URL:** Enter the host URL of your IriusRisk tenant.
    -   **IriusRisk API Token:** Enter the API token generated for use by JupiterOne.
4.  Click **Create Configuration** to save your settings.
    

### Next Steps

Now that your integration instance is configured, it will begin running based on the polling interval you provided, populating data within JupiterOne.

Refer to our [Instance Management Guide](/integrations/instance-management.md) to learn more about managing and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (4)

-   `ALL_USERS_UPDATE`
-   `COUNTERMEASURE_VIEW`
-   `PRODUCTS_LIST_ALL`
-   `THREAT_VIEW`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `GET /api/v1/products`
-   `GET /api/v1/products/{product-id}`
-   `GET /api/v1/products/{product-id}/controls`
-   `GET /api/v1/products/{product-id}/risks`
-   `GET /api/v1/products/{product-id}/threats`
-   `GET /api/v1/products/{product-id}/weaknesses`
-   `GET /api/v1/users`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://iriusrisk.github.io/iriusrisk-api/v1/latest/](https://iriusrisk.github.io/iriusrisk-api/v1/latest/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (3)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Fetch Controls | `COUNTERMEASURE_VIEW` | `GET /api/v1/products/{product-id}/controls` |
| Fetch Threats | `THREAT_VIEW` | `GET /api/v1/products/{product-id}/threats` |
| Fetch Weaknesses | `THREAT_VIEW` | `GET /api/v1/products/{product-id}/weaknesses` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `iriusrisk_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Countermeasure | `iriusrisk_product_countermeasure` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Product | `iriusrisk_product` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Threat | `iriusrisk_product_threat` | [ThreatIntel](https://docs.jupiterone.io/data-model/schemas/ThreatIntel) |
| User | `iriusrisk_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Weakness | `iriusrisk_product_weakness` | [Weakness](https://docs.jupiterone.io/data-model/schemas/Weakness) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `iriusrisk_account` | **HAS** | `iriusrisk_user` |
| `iriusrisk_account` | **MANAGES** | `iriusrisk_product` |
| `iriusrisk_product` | **HAS** | `iriusrisk_product_countermeasure` |
| `iriusrisk_product` | **HAS** | `iriusrisk_product_weakness` |
| `iriusrisk_product` | **HAS** | `iriusrisk_product_threat` |

### Iriusrisk Account

`iriusrisk_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Iriusrisk Product

`iriusrisk_product` inherits from [Project](/data-model/schemas/Project.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `criticalRiskThreats` | `number` |  |  |
| `groups` | `array` of `string`s |  |  |
| `highRiskThreats` | `number` |  |  |
| `inheritRiskScore` | `number` |  |  |
| `lowRiskThreats` | `number` |  |  |
| `mediumRiskThreats` | `number` |  |  |
| `mitigatedRiskThreats` | `number` |  |  |
| `priority` | `number` |  |  |
| `projectedRiskScore` | `number` |  |  |
| `residualRiskScore` | `number` |  |  |
| `type` | `string` |  |  |
| `users` | `array` of `string`s |  |  |
| `workflowState` | `string` |  |  |

---

### Iriusrisk Product Countermeasure

`iriusrisk_product_countermeasure` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cost` | `number` |  |  |
| `issueId` | `string` |  |  |
| `library` | `string` |  |  |
| `mitigation` | `string` |  |  |
| `owner` | `string` |  |  |
| `platform` | `string` |  |  |
| `risk` | `number` |  |  |
| `source` | `string` |  |  |
| `state` | `string` |  |  |
| `testExpiresOn` | `number` |  |  |
| `testExpiryPeriod` | `number` |  |  |
| `testNotes` | `string` |  |  |
| `testSteps` | `string` |  |  |

---

### Iriusrisk Product Threat

`iriusrisk_product_threat` inherits from [ThreatIntel](/data-model/schemas/ThreatIntel.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availabilityRiskRatting` | `string` |  |  |
| 
`componentReferenceId` \*

 | `string` |  |  |
| `confidentialityRiskRatting` | `string` |  |  |
| `easeOfExploitationRiskRatting` | `string` |  |  |
| `expiresOn` | `number` |  |  |
| `inherentRiskScore` | `number` |  |  |
| `integrityRiskRatting` | `string` |  |  |
| `issueId` | `string` |  |  |
| `issueLink` | `string` |  |  |
| `mitigation` | `number` |  |  |
| `owner` | `string` |  |  |
| `projectedRiskScore` | `number` |  |  |
| `riskScore` | `number` |  |  |
| `source` | `string` |  |  |
| `state` | `string` |  |  |
| 

`useCaseReferenceId` \*

 | `string` |  |  |

---

### Iriusrisk Product Weakness

`iriusrisk_product_weakness` inherits from [Weakness](/data-model/schemas/Weakness.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `impact` | `number` |  |  |
| `issueId` | `string` |  |  |
| `issueLink` | `string` |  |  |
| `state` | `number` |  |  |
| `testExpiesOn` | `number` |  |  |
| `testExpiryPeriod` | `number` |  |  |
| `testLastUpdatedOn` | `number` |  |  |
| `testNotes` | `string` |  |  |
| `testOutput` | `string` |  |  |
| `testSourceArgs` | `string` |  |  |
| `testSourceEnabled` | `boolean` |  |  |
| `testSourceFileName` | `string` |  |  |
| `testSourceResult` | `string` |  |  |
| `testSourceType` | `string` |  |  |
| `testSteps` | `string` |  |  |

---

### Iriusrisk User

`iriusrisk_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `firstName` | `string` |  |  |
| `groups` | `array` of `string`s |  |  |
| `lastName` | `string` |  |  |
| `roles` | `array` of `string`s |  |  |

---

---

Source: /integrations/directory/island

# Island

Visualize Island Enterprise Browser users, their managed devices and compromised-credential findings in JupiterOne. Find users with unresolved breached credentials and devices with an end-of-life OS or no anti-malware, and monitor changes through queries and alerts.

## Installation

This integration connects to the Island Enterprise Browser management REST API (`/api/external/v1`) and ingests browser users, managed devices and compromised-credential findings. Island is a SaaS platform, so the integration runs in JupiterOne's cloud and needs no collector: it calls your tenant's Island Management Console API over HTTPS, authenticating with an API key sent in the `Api-Key` request header.

### Prerequisites

-   An **Island Enterprise Browser** tenant hosted in the **US** or **EU** region, with at least one user.
-   An Island **API key** created in that tenant.
-   Access to **JupiterOne** with permission to configure integrations.

### Configuration in Island

The integration authenticates with a static API key. There is no token exchange.

To create the key, sign in to the Island Management Console as an administrator and go to **Modules > Platform Settings > System Settings > Integrations > API**. Click **\+ Create**, enter a **Name**, select a role for the key, click **Generate API Key**, copy the key, and click **Save**.

The integration only reads data. Island documents its API key roles behind the customer login, so we have not confirmed which role grants every endpoint the integration reads. Public setup guides from other vendors differ: ConductorOne's Island connector, which reads users only, uses a key with the **Read-Only** role, while Elastic's Island integration, which also reads devices, compromised credentials and audit events, uses **Full Admin** or **System Admin**. Choose the least-privileged role that can read every data source you plan to enable.

Whatever data sources you enable, the key must be able to list users. The integration validates the key by reading one user from `/external/v1/users`, and every run reads the tenant ID from the first user to create the `island_account` entity. A run fails if no user is returned.

Once you have the API key, proceed to JupiterOne to finish the integration.

### Configuration in JupiterOne

To install the Island integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Island**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Island account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Authentication** fields below.
    

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **API Key** | Yes | The Island API key created above. It is sent in the `Api-Key` request header. |
| **Region** | No | The Island Management Console region of your tenant. Options are **US (management.island.io)** and **EU (eu.management.island.io)**. Defaults to **US**. |

> **NOTE**
> 
> **Region** selects the API host: `https://management.island.io/api` for the US and `https://eu.management.island.io/api` for the EU. Pick the region whose console you sign in to. Only US and EU tenants are supported. Island also runs consoles in other regions, and the integration cannot connect to a tenant hosted there.

#### Filters and Options

This field is optional and controls how much history each run collects.

| Field | Default | Description |
| --- | --- | --- |
| **Compromised Credentials Since (days)** | 365 days | How many days of compromised-credential findings to collect on each run. Options are 30, 90, 180, 365 and 730 days. Only applies when the **Island Compromised Credentials** data source is enabled. |

> **CAUTION**
> 
> This field is a rolling window that ends at the time of each run. A credential Island reported as compromised before the window starts is removed from JupiterOne on the next run, **even if it is still unresolved**. That is why the default is a wide 365 days. If you need older unresolved findings to stay in JupiterOne, choose **730 days**.

Click **Create** once all values are provided to finalize the integration.

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default**, so enable the ones you want to ingest. The `island_account` entity is always created, whichever sources are enabled.

| Data Source | Default | Description | Entities Created |
| --- | --- | --- | --- |
| **Island Users** | Disabled | Island Enterprise Browser users: status, source, group membership and email verification. A user is `active` when its Island status is `Subscribed`. | `island_user` |
| **Island Devices** | Disabled | Island-managed endpoints: disk encryption, anti-malware products, OS end-of-life, and Island browser, extension and Chromium versions. | `island_device` |
| **Island Compromised Credentials** | Disabled | Breached-credential findings with the breach source, impacted domain and resolution status, bounded by **Compromised Credentials Since (days)**. A finding is `open` unless its status is resolved, remediated or closed. | `island_compromised_credential` |

Each entity is linked to the `island_account` entity with a `HAS` relationship. The relationships between data sources are built only when both sides are enabled:

-   User to device (`OWNS`) requires **Island Users** and **Island Devices**.
-   User to compromised credential (`HAS`) requires **Island Users** and **Island Compromised Credentials**. The breached account is matched against the Island user ID or email address of each user, ignoring case.

The integration does not create mapped relationships to entities from other integrations.

#### What the integration does not collect

-   **Audit events.** Browser activity and audit logs (timeline navigation, screen-recording and login events, admin actions) are not collected. They record your employees' browsing activity, including visited URLs and locations, and JupiterOne does not ingest audit logs. The integration also never calls Island's SIEM Audits API, a queue shared with your SIEM, so events delivered to your SIEM are left untouched.
-   **Breached secrets and accounts.** The password hash of a compromised credential and the breached username or email are never stored. The breached account is used during the run only to link the finding to its user.
-   **Personal details on devices.** Device OS user names, OS domains, user names and emails are not stored.
-   **Island policies.** Island policies and rules are not ingested.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Elastic Island Browser integration](https://www.elastic.co/docs/reference/integrations/island_browser): public walkthrough of creating an Island API key
-   [ConductorOne Island connector](https://www.c1.ai/docs/baton/island): public notes on Island regions, the `Api-Key` header and the Read-Only API key role
-   [Island API reference](https://documentation.island.io/apidocs/get-all-browser-users-that-match-the-specified-simple-filter): requires an Island Management Console login

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (6)

-   `https://eu.management.island.io/api/external/v1/compromised-credentials`
-   `https://eu.management.island.io/api/external/v1/devices`
-   `https://eu.management.island.io/api/external/v1/users`
-   `https://management.island.io/api/external/v1/compromised-credentials`
-   `https://management.island.io/api/external/v1/devices`
-   `https://management.island.io/api/external/v1/users`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://documentation.island.io/apidocs/get-a-list-of-all-compromised-credentials](https://documentation.island.io/apidocs/get-a-list-of-all-compromised-credentials)
-   [https://documentation.island.io/apidocs/get-a-list-of-all-devices-1](https://documentation.island.io/apidocs/get-a-list-of-all-devices-1)
-   [https://documentation.island.io/apidocs/get-all-browser-users-that-match-the-specified-simple-filter](https://documentation.island.io/apidocs/get-all-browser-users-that-match-the-specified-simple-filter)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `island_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Compromised Credential | `island_compromised_credential` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Device | `island_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| User | `island_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `island_account` | **HAS** | `island_user` |
| `island_account` | **HAS** | `island_device` |
| `island_account` | **HAS** | `island_compromised_credential` |
| `island_user` | **OWNS** | `island_device` |
| `island_user` | **HAS** | `island_compromised_credential` |

### Island Account

`island_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`tenantId` \*

 | `string` **|** `null` | The Island tenant identifier this account represents. |  |

---

### Island Compromised Credential

`island_compromised_credential` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`breachSource` \*

 | `string` **|** `null` | The breach source Island attributes the credential to. |  |
| 

`compromisedOn` \*

 | `number` **|** `null` | Timestamp (ms) the credential was reported compromised. |  |
| 

`impactedDomain` \*

 | `string` **|** `null` | The web/application domain the breached credential impacts. |  |
| 

`status` \*

 | `string` **|** `null` | Island resolution status of the compromised credential, used to derive `open`. |  |

---

### Island Device

`island_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `antiMalwareProducts` | `array` **|** `null` | Anti-malware products detected on the device. |  |
| 
`browserName` \*

 | `string` **|** `null` | The Island browser product name on the device. |  |
| 

`browserVersion` \*

 | `string` **|** `null` | The Island browser version installed on the device. |  |
| 

`chromiumVersion` \*

 | `string` **|** `null` | The underlying Chromium version of the Island browser. |  |
| 

`deviceStatus` \*

 | `string` **|** `null` | The raw device status reported by Island. |  |
| 

`extensionVersion` \*

 | `string` **|** `null` | The Island browser extension version on the device. |  |
| 

`isArchived` \*

 | `boolean` **|** `null` | Whether the device is archived in Island. |  |
| 

`isDiskEncrypted` \*

 | `boolean` **|** `null` | Whether the device's disk is reported as encrypted. |  |
| 

`islandPlatform` \*

 | `string` **|** `null` | The Island platform agent flavor reported for the device. |  |
| 

`isMalwareProtected` \*

 | `boolean` **|** `null` | Whether at least one anti-malware product is reported on the device. |  |
| 

`isOsVersionEol` \*

 | `boolean` **|** `null` | Whether the device's OS version is end-of-life. |  |

---

### Island User

`island_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`connectionName` \*

 | `string` **|** `null` | The identity-provider connection the user authenticates through. |  |
| `groups` | `array` **|** `null` | Group names the user belongs to. |  |
| 

`invitedOn` \*

 | `number` **|** `null` | Timestamp (ms) the user was invited. |  |
| 

`isEmailVerified` \*

 | `boolean` **|** `null` | Whether the user's email address has been verified. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | Timestamp (ms) the user last logged in. |  |
| 

`userSource` \*

 | `string` **|** `null` | The source directory/provider the user originates from. |  |
| 

`userStatus` \*

 | `string` **|** `null` | The Island user status (e.g. Subscribed), used to derive `active`. |  |
| 

`userType` \*

 | `string` **|** `null` | The Island user type (e.g. the account/role category). |  |

---

## Release Notes

-   **2026-10-14** — Island audit events including browser timeline events and admin actions are no longer ingested; the integration now focuses on users, devices, and compromised credentials.

---

Source: /integrations/directory/jamf

# Jamf

Visualize Jamf admins, users, groups, devices, and profiles, map Jamf users to employees, and monitor changes through queries and alerts.

## Installation

To use this integration, JupiterOne requires your Jamf hostname to interact with the API as well as authentication credentials. These authentication credentials can either be a Client ID and Client Secret for an API Client, or a user's username and password used to authenticate with Jamf.

The JupiterOne integration uses the [Classic API](https://developer.jamf.com/jamf-pro/docs/getting-started-2) to fetch Jamf data.

The JupiterOne integration uses the [Bearer Authentication token](https://developer.jamf.com/jamf-pro/docs/classic-api-authentication-changes#bearer-token-authentication) to authorize the APIs.

Required Permissions:

-   Read - Jamf Pro User Accounts & Groups
-   Read - Users
-   Read - Mobile Devices
-   Read - Mobile Device Configuration Profile
-   Read - Smart Mobile Device Groups (for smart groups)
-   Read - Static Mobile Device Groups (for static groups)
-   Read - Provisioning Profiles
-   Read - Computers
-   Read - Advanced Computer Searches
-   Read - macOS Configuration Profiles

### Configuration in JupiterOne

To install the Jamf integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Jamf. Click **New Instance** to begin configuring your integration, providing the following:

-   **Account Name** used to identify the Jamf account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName** option is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Authentication method** in which to authenticate with Jamf. OAuth is the new preferred mechanism.
    
-   **Hostname** of your Jamf organization.
    
-   **Client ID** of the API Client you have created within Jamf, should the OAuth authentication method be selected.
    
-   **Client Secret** of the API Client you have created within Jamf, should the OAuth authentication method be selected.
    
-   **Username** used to authenticate with Jamf when having selected Basic for authentication method.
    
-   **Password** associated with the username to authenticate with Jamf via the Basic authentication method.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `jamf_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Admin | `jamf_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Computer | `jamf_computer` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Computer (deprecated entity) | `user_endpoint` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Computer Group | `jamf_computer_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Group | `jamf_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Local Account | `jamf_local_account` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| macOS Application | `macos_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| macOS Configuration Profile | `jamf_osx_configuration_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Mobile Device | `jamf_mobile_device` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Mobile Device (deprecated entity) | `mobile_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Mobile Device Configuration Profile | `jamf_mobile_device_configuration_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Mobile Device Group | `jamf_mobile_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Mobile Device Provisioning Profile | `jamf_mobile_device_provisioning_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| User | `device_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `device_user` | **OWNS** | `jamf_mobile_device` |
| `device_user` | **OWNS** | `mobile_device` |
| `device_user` | **OWNS** | `jamf_computer` |
| `device_user` | **OWNS** | `user_endpoint` |
| `jamf_account` | **HAS** | `jamf_group` |
| `jamf_account` | **HAS** | `jamf_user` |
| `jamf_account` | **HAS** | `device_user` |
| `jamf_account` | **HAS** | `jamf_osx_configuration_profile` |
| `jamf_account` | **MANAGES** | `jamf_mobile_device` |
| `jamf_account` | **HAS** | `mobile_device` |
| `jamf_account` | **HAS** | `jamf_mobile_device_configuration_profile` |
| `jamf_account` | **HAS** | `jamf_mobile_device_provisioning_profile` |
| `jamf_account` | **HAS** | `jamf_mobile_device_group` |
| `jamf_account` | **MANAGES** | `jamf_computer` |
| `jamf_account` | **HAS** | `user_endpoint` |
| `jamf_computer` | **USES** | `jamf_osx_configuration_profile` |
| `jamf_computer` | **INSTALLED** | `macos_app` |
| `jamf_computer_group` | **HAS** | `jamf_computer` |
| `jamf_computer_group` | **HAS** | `user_endpoint` |
| `jamf_group` | **HAS** | `jamf_user` |
| `jamf_local_account` | **USES** | `jamf_computer` |
| `jamf_local_account` | **USES** | `user_endpoint` |
| `jamf_mobile_device` | **USES** | `jamf_mobile_device_configuration_profile` |
| `jamf_mobile_device` | **USES** | `jamf_mobile_device_provisioning_profile` |
| `jamf_mobile_device_group` | **HAS** | `jamf_mobile_device` |
| `user_endpoint` | **USES** | `jamf_osx_configuration_profile` |
| `user_endpoint` | **INSTALLED** | `macos_app` |

### Device User

`device_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `customPhotoUrl` | `string` |  |  |
| `emailAddress` | `string` |  |  |
| `enableCustomPhotoUrl` | `boolean` |  |  |
| `fullName` | `string` |  |  |
| `ldapServer` | `string` |  |  |
| 
`os` \*

 | `array` of `string`s |  |  |
| `phoneNumber` | `string` |  |  |
| `position` | `string` |  |  |
| `totalVppCodeCount` | `number` |  |  |

---

### Jamf Account

`jamf_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` |  |  |

---

### Jamf Computer

`jamf_computer` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetTag` | `string` |  |  |
| `barcode1` | `string` |  |  |
| `barcode2` | `string` |  |  |
| 
`building` \*

 | `string` |  |  |
| 

`department` \*

 | `string` |  |  |
| `deploymentStatus` | `string` **|** `array` |  |  |
| `encrypted` | `boolean` |  |  |
| `enrolledOn` | `number` |  |  |
| `firewallEnabled` | `boolean` |  |  |
| `gatekeeperEnabled` | `boolean` |  |  |
| `jamfVersion` | `string` |  |  |
| `lastCloudBackup` | `number` |  |  |
| `lastReportedOn` | `number` |  |  |
| `locationEmail` | `string` |  |  |
| 

`managed` \*

 | `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |
| `netbootServer` | `string` |  |  |
| `networkAdapterType` | `string` |  |  |
| `realName` | `string` |  |  |
| `siteId` | `null` **|** `string` | ID of the Jamf site the computer is assigned to (-1 when no site is assigned) |  |
| `siteName` | `null` **|** `string` | Name of the Jamf site the computer is assigned to ('None' when no site is assigned) |  |
| `systemIntegrityProtectionEnabled` | `boolean` |  |  |
| `username` | `string` |  |  |

---

### Jamf Computer Group

`jamf_computer_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` |  |  |

---

### Jamf Group

`jamf_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessLevel` | `string` |  |  |
| `privilegeSet` | `string` |  |  |

---

### Jamf Local Account

`jamf_local_account` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`home` \*

 | `string` |  |  |
| 

`realName` \*

 | `string` |  |  |
| 

`uid` \*

 | `string` |  |  |

---

### Jamf Mobile Device

`jamf_mobile_device` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activationLockEnabled` | `boolean` |  |  |
| `blockLevelEncryption` | `boolean` |  |  |
| `capacity` | `number` |  |  |
| `cloudBackupEnabled` | `boolean` |  |  |
| `dataProtectionEnabled` | `boolean` |  |  |
| `email` | `string` |  |  |
| `fileLevelEncryption` | `boolean` |  |  |
| `hasPasscode` | `boolean` |  |  |
| `jailbroken` | `string` |  |  |
| `lastBackupOn` | `number` |  |  |
| `locatorServiceEnabled` | `boolean` |  |  |
| `managed` | `boolean` |  |  |
| `passcodeCompliant` | `boolean` |  |  |
| `passcodeLockGracePeriodEnforced` | `string` |  |  |
| `phoneNumber` | `string` |  |  |
| `profileCompliant` | `boolean` |  |  |
| `siteId` | `null` **|** `string` | ID of the Jamf site the mobile device is assigned to (-1 when no site is assigned) |  |
| `siteName` | `null` **|** `string` | Name of the Jamf site the mobile device is assigned to ('None' when no site is assigned) |  |
| `supervised` | `boolean` |  |  |
| `username` | `string` |  |  |

---

### Jamf Mobile Device Configuration Profile

`jamf_mobile_device_configuration_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`categoryId` \*

 | `null` **|** `string` |  |  |
| 

`categoryName` \*

 | `null` **|** `string` |  |  |
| 

`deploymentMethod` \*

 | `null` **|** `string` |  |  |
| 

`description` \*

 | `null` **|** `string` |  |  |
| 

`isAllJssUsers` \*

 | `null` **|** `boolean` |  |  |
| 

`isAllMobileDevices` \*

 | `null` **|** `boolean` |  |  |
| 

`level` \*

 | `null` **|** `string` |  |  |
| 

`redeployDaysBeforeCertificateExpires` \*

 | `null` **|** `number` |  |  |
| 

`redeployOnUpdate` \*

 | `null` **|** `string` |  |  |
| 

`siteId` \*

 | `null` **|** `string` |  |  |
| 

`siteName` \*

 | `null` **|** `string` |  |  |
| 

`uuid` \*

 | `null` **|** `string` |  |  |

---

### Jamf Mobile Device Group

`jamf_mobile_device_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isSmart` \*

 | `null` **|** `boolean` |  |  |
| 

`siteId` \*

 | `null` **|** `string` |  |  |
| 

`siteName` \*

 | `null` **|** `string` |  |  |

---

### Jamf Mobile Device Provisioning Profile

`jamf_mobile_device_provisioning_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `null` **|** `string` |  |  |
| 

`uuid` \*

 | `null` **|** `string` |  |  |

---

### Jamf Osx Configuration Profile

`jamf_osx_configuration_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allComputers` \*

 | `boolean` |  |  |
| 

`allJSSUsers` \*

 | `boolean` |  |  |
| 

`categoryName` \*

 | `string` |  |  |
| 

`description` \*

 | `string` |  |  |
| 

`distributionMethod` \*

 | `string` |  |  |
| 

`level` \*

 | `string` |  |  |
| 

`redeployOnUpdate` \*

 | `string` |  |  |
| 

`siteName` \*

 | `string` |  |  |
| 

`userRemovable` \*

 | `boolean` |  |  |

---

### Jamf User

`jamf_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessLevel` | `string` |  |  |
| 
`active` \*

 | `boolean` |  |  |
| 

`admin` \*

 | `boolean` |  |  |
| `directoryUser` | `boolean` |  |  |
| `emailAddress` | `string` |  |  |
| `enabled` | `string` |  |  |
| `forcePasswordChange` | `boolean` |  |  |
| `fullName` | `string` |  |  |
| `permissions` | `array` of `string`s |  |  |
| `privilegeSet` | `string` |  |  |

---

### Macos App

`macos_app` inherits from [Application](/data-model/schemas/Application.md)

---

## Release Notes

-   **2026-10-13** — Jamf macOS and mobile configuration profile payload contents are no longer ingested, preventing potentially sensitive MDM configuration data from appearing in profile entities.
    
-   **2026-04-08** — Improved OS name accuracy for Jamf mobile device entities, using human-readable names for iOS, iPadOS, and tvOS.
    
-   **2026-03-17** — Added configuration options to control Jamf extension attribute ingestion, including an option to skip all extension attributes or restrict ingestion to a specified allow list.
    
-   **2025-11-05** — Added ingestion of Jamf mobile device configuration profiles, provisioning profiles, and device groups with device relationships.
    
-   **2025-07-23** — Added additional payload version properties to Jamf macOS configuration profile entities, including firewall, login window, restrictions, and system policy payload versions.

---

Source: /integrations/directory/jenkins

# Jenkins

Visualize Jenkins entities and relationship within JupiterOne to proactively identify changes to users, jobs and repositories.

## Installation

### Configuration in Jenkins

To install this integration, you will need to configure settings both within Jenkins and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your Jenkins's instance.

-   Install Jenkins on the local machine/server and take note of the provided domain
-   Install recommended plugins
-   Create an admin account on this installation
-   Go to Dashboard -> Configure and add a new API Token
-   Go to Dashboard -> Configure -> Manage Plugins and add the [Docker](https://plugins.jenkins.io/docker-plugin) and [Docker Pipeline](https://plugins.jenkins.io/docker-workflow) plugins
-   To push data from your Jenkins instance you must run our Docker container in a pipeline. Here is an example:

```text
pipeline {
    agent {
        docker { image 'jupiterone/graph-jenkins:<version>' }
    }

    environment {
        JUPITERONE_API_KEY = credentials('j1-api-key')
        JUPITERONE_ACCOUNT = credentials('j1-account')
        USER_NAME = credentials('jenkins-username')
        API_KEY   = credentials('jenkins-api-key')
        HOST_NAME = 'https://<your_hostname>'
    }

    stages {
        stage('Collect data') {
            steps {
                sh 'cd /opt/jupiterone/integration && ./scripts/collect.sh'
            }
        }
    }
}
```

### Finalize in JupiterOne

To install the Jenkins integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Jenkins. Click **New Instance** to begin configuring the integration.

Creating an integration instance requires the following:

-   The **Account Name** used to identify the Jenkins account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the **Jenkins API Key** generated for use by JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `jenkins_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Job | `jenkins_job` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Repository | `jenkins_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| User | `jenkins_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `jenkins_account` | **HAS** | `jenkins_job` |
| `jenkins_account` | **HAS** | `jenkins_user` |
| `jenkins_job` | **HAS** | `jenkins_job` |
| `jenkins_job` | **HAS** | `jenkins_repository` |

---

Source: /integrations/directory/jira

# Jira

Visualize Jira projects, users, and issues, map Jira users to employees, and monitor changes through queries and alerts.

The same integration can also ingest your Jira Service Management Assets (CMDB) objects, such as laptops, servers and applications, and link each asset to the Jira user who owns it. If you already use this integration for Jira projects and issues, you do not need a separate integration: upload an Assets mapping file to your existing instance. See [Assets (CMDB) Configuration](#assets-cmdb-configuration).

## Installation

To use this integration, JupiterOne requires the hostname for your Jira organization, credentials for API access, and optionally an Assets mapping configuration for CMDB ingestion.

> **NOTE**
> 
> The integration supports Jira Cloud with Jira API v3 and Jira Data Center with Jira API v2. Other setups may work.

## Configure a Jira User

Create or designate a Jira user for the JupiterOne integration:

**Option 1: Create a New Service Account (Recommended)**

1.  Log in to Jira as an administrator
2.  Navigate to **User Management**
3.  Create a new user (e.g., `jupiterone-integration@yourcompany.com`)
4.  Grant the necessary permissions (see [User Permissions](#user-permissions) below)

**Option 2: Use an Existing User**

Verify the user has the required permissions and that you can log in to generate an API token.

## User Permissions

The Jira user needs the following permissions:

1.  **Browse Users** - Grant the ["Browse Users" global permission](https://confluence.atlassian.com/adminjiraserver/managing-global-permissions-938847142.html) to read groups and users
2.  **Project Access** - Authorize browse access to projects using [Jira permission features](https://support.atlassian.com/jira-core-cloud/docs/how-do-jira-permissions-work/)
3.  **Create Issues** (optional) - Required only if using JupiterOne Alert Rules to create Jira issues
4.  **Assets Access** (optional) - Required for CMDB ingestion. The user must have access to Jira Service Management Assets.

> **TIP**
> 
> For read-only access, see [How to Create a Read Only User](https://confluence.atlassian.com/jirakb/jira-cloud-how-to-create-a-read-only-user-779160729.html).

## Authentication Methods

The integration supports two authentication methods. Choose the one that fits your organization:

-   **API Token (Basic)** — a user email plus an API token (or password). The simplest option.
-   **OAuth 2.0 (Service account)** — an OAuth 2.0 service account credential (Client ID + Client Secret). Recommended when your organization is restricting or disabling API tokens.

## Create an API Token

Follow these steps for the **API Token (Basic)** method.

1.  Log in to Jira as the JupiterOne integration user
2.  Go to [Atlassian Account Settings > API Tokens](https://id.atlassian.com/manage-profile/security/api-tokens)
3.  Click **Create API token**
4.  Give it a descriptive label (e.g., "JupiterOne Integration")
5.  Copy and save the token value

> **WARNING**
> 
> The token is only shown once. Store it securely.

## Create OAuth 2.0 Credentials (Service Account)

Follow these steps for the **OAuth 2.0 (Service account)** method. The integration uses the OAuth 2.0 `client_credentials` grant, so no interactive browser authorization is required.

1.  Log in to [Atlassian administration](https://admin.atlassian.com/) as an organization admin
2.  Go to **Service accounts** and create or select a service account
3.  Create an **OAuth 2.0 credential** for the service account
4.  Grant the credential the following Jira scopes:
    -   `read:jira-user`
    -   `read:jira-work`
    -   For Assets (CMDB) ingestion, also grant: `read:cmdb-object:jira`, `read:cmdb-attribute:jira`, `read:cmdb-schema:jira`, `read:cmdb-type:jira`
5.  Ensure the service account has access to the site and projects you intend to ingest
6.  Copy and save the **Client ID** and **Client Secret**

> **WARNING**
> 
> The Client Secret is only shown once. Store it securely.

> **NOTE**
> 
> OAuth access tokens are valid for 60 minutes. The integration requests and refreshes them automatically. For details, see Atlassian's [Create an OAuth 2.0 credential for service accounts](https://support.atlassian.com/user-management/docs/create-oauth-2-0-credential-for-service-accounts/).

## Assets (CMDB) Requirements

To ingest Jira Assets (CMDB), the integration credentials must have:

-   Access to **Jira Service Management**
-   Permission to view **Assets** in your Jira organization

For **API Token (Basic)**, the token must belong to a user with these permissions. For **OAuth 2.0 (Service account)**, the credential must be granted the `read:cmdb-*:jira` scopes listed above and the service account must have Assets access.

## Configuration in JupiterOne

Navigate to **Integrations** > **Jira** > **New Instance**, select your authentication method, and provide the common fields:

| Field | Description |
| --- | --- |
| **Account Name** | Identifier for this Jira account in JupiterOne |
| **Description** | Optional description |
| **Polling Interval** | How often to sync data |
| **Hostname** | Your Jira hostname (e.g., `yourcompany.atlassian.net`) |
| **Project Keys** | Comma-separated list of project keys to ingest. Keys must match existing projects the integration user can see; see [Invalid project keys](#invalid-project-keys) |
| **User Account Types to Ingest** | Optional. Which Atlassian account types to ingest as `jira_user` entities (see below). All types are selected by default |
| **Assets Mapping** | JSON file for CMDB ingestion (see below) |

For the **API Token (Basic)** method, also provide:

| Field | Description |
| --- | --- |
| **User Email** | Email of the Jira integration user |
| **API Token** | The API token created above |

For the **OAuth 2.0 (Service account)** method, also provide:

| Field | Description |
| --- | --- |
| **Client ID** | The Client ID of the OAuth 2.0 service account credential |
| **Client Secret** | The Client Secret of the OAuth 2.0 service account credential |

## Filtering Users by Account Type

Every Jira user has an Atlassian account type:

| Account type | Who it covers |
| --- | --- |
| **Atlassian** | Licensed users of your Jira site |
| **App** | Bots and integrations |
| **Customer** | Jira Service Management portal accounts, created for anyone who raises a request through a service desk portal |
| **Unknown** | Accounts Jira does not classify |

On a busy service desk, **Customer** accounts can outnumber licensed users many times over. Deselect **Customer** under **User Account Types to Ingest** to skip them and keep them from counting against your entity limit.

Jira's API cannot filter users by account type, so the integration still reads every user and discards the deselected types before ingesting them. This lowers the number of `jira_user` entities but does not shorten the time the job takes. Users of a deselected type that were ingested earlier are removed from JupiterOne after the next successful run.

> **NOTE**
> 
> Skipping an account type also skips the `jira_user` **CREATED**, **REPORTED** and **ASSIGNED** `jira_issue` relationships for those users. For example, deselecting **Customer** means issues raised through a service desk portal have no reporter relationship.

## Assets (CMDB) Configuration

To ingest assets from Jira Service Management Assets, upload a JSON mapping configuration that defines which object types to ingest and how to map their attributes to JupiterOne entities.

### Mapping Structure

```json
{
  "version": "1.0",
  "description": "My organization's asset mappings",
  "objectTypes": [
    {
      "objectTypeId": "15",
      "objectTypeName": "Laptop",
      "_class": "Device",
      "enabled": true,
      "propertyToAttributeMap": {
        "hostname": { "attributeId": "135", "attributeName": "Hostname" },
        "serial": { "attributeId": "136", "attributeName": "Serial Number" },
        "category": { "attributeId": null, "default": "laptop" }
      }
    }
  ]
}
```

### Object Type Configuration

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `objectTypeName` | string | Yes | Jira Object Type name (generates entity `_type` automatically) |
| `objectTypeId` | string | No | Jira Object Type ID (more stable for queries) |
| `_class` | string or string\[\] | Yes | JupiterOne entity class |
| `enabled` | boolean | Yes | Whether to ingest this object type |
| `filter` | string | No | Additional AQL filter (e.g., `Status = Active`) |
| `propertyToAttributeMap` | object | Yes | Maps J1 properties to Jira attributes |
| `ownerEmailProperty` | string | No | **Deprecated** — use `ownerProperties`. Name of a property in `propertyToAttributeMap` containing the owner's email. Builds a generic `jira_user OWNS` mapped relationship. |
| `ownerProperties` | array | No | Owner sources, each with a `role` (`business`, `technical`, or `generic`) that builds a typed `jira_user OWNS` mapped relationship. |
| `referenceRelationships` | array | No | Direct relationships to other Jira Assets objects this object references through an **Object reference** attribute (e.g. Function, Process, Information Category, ICT Supplier). |
| `targetRelationships` | array | No | Relationships built from **attribute values** to any entity in the JupiterOne graph — not only to other Assets objects. Use this for text attributes, multi-value attributes, delimited lists, and JSON blobs. |

### Attribute Mapping

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `attributeId` | string or null | Yes | Jira attribute ID. Use `null` for default-only values |
| `attributeName` | string | No | Human-readable name (documentation only) |
| `type` | string | No | Type conversion: `string`, `number`, `boolean`, `date`, `array` |
| `default` | string, number, boolean, or string\[\] | No | Default value when attribute is missing |
| `transform` | string | No | Transform: `lowercase`, `uppercase`, `trim`, `slug` |
| `pattern` | string | No | Regex pattern to extract value |

> **CAUTION**
> 
> Do not use `"type": "json"` on a property. It parses the attribute into a nested object, which the platform rejects when the entity is uploaded, and the object type fails to ingest. To read values out of a JSON blob attribute, use a [value-based relationship](#value-based-relationships) with `extract.format: "json"`, or map the individual fields you need as separate properties with `pattern`.

### Complete Example: Devices and Servers

This example maps laptops and servers from Jira Assets:

```json
{
  "version": "1.0",
  "description": "IT Asset inventory mapping",
  "objectTypes": [
    {
      "objectTypeId": "15",
      "objectTypeName": "Laptop",
      "_class": "Device",
      "enabled": true,
      "propertyToAttributeMap": {
        "hostname": { "attributeId": "135", "attributeName": "Hostname" },
        "serial": { "attributeId": "136", "attributeName": "Serial Number" },
        "make": { "attributeId": "137", "attributeName": "Manufacturer" },
        "model": { "attributeId": "138", "attributeName": "Model" },
        "macAddress": { "attributeId": "139", "attributeName": "MAC Address" },
        "osName": { "attributeId": "141", "attributeName": "Operating System" },
        "osVersion": { "attributeId": "142", "attributeName": "OS Version" },
        "deviceId": { "attributeId": "144", "attributeName": "Asset Tag" },
        "category": { "attributeId": null, "default": "laptop" }
      }
    },
    {
      "objectTypeId": "17",
      "objectTypeName": "Server",
      "_class": "Host",
      "enabled": true,
      "filter": "Status != Decommissioned",
      "propertyToAttributeMap": {
        "hostname": { "attributeId": "201", "attributeName": "Hostname" },
        "fqdn": { "attributeId": "202", "attributeName": "FQDN" },
        "serial": { "attributeId": "203", "attributeName": "Serial Number" },
        "make": { "attributeId": "204", "attributeName": "Manufacturer" },
        "model": { "attributeId": "205", "attributeName": "Model" },
        "ipAddress": { "attributeId": "207", "attributeName": "IP Address" },
        "osName": { "attributeId": "210", "attributeName": "Operating System" },
        "osVersion": { "attributeId": "211", "attributeName": "OS Version" },
        "category": { "attributeId": null, "default": "server" }
      }
    }
  ]
}
```

### Additional Examples

**Load Balancer (Gateway class with array defaults):**

```json
{
  "objectTypeName": "Load Balancer",
  "_class": "Gateway",
  "enabled": true,
  "propertyToAttributeMap": {
    "category": { "attributeId": null, "default": ["network"] },
    "function": { "attributeId": null, "default": ["load-balancing"] },
    "public": { "attributeId": "301", "attributeName": "Public Facing", "type": "boolean" }
  }
}
```

**Cloud Account (Account class with strictly required `vendor`):**

```json
{
  "objectTypeName": "AWS Account",
  "_class": "Account",
  "enabled": true,
  "propertyToAttributeMap": {
    "vendor": { "attributeId": null, "default": "Amazon Web Services" },
    "accountId": { "attributeId": "501", "attributeName": "Account ID" }
  }
}
```

**Physical Firewall (combined classes):**

```json
{
  "objectTypeName": "Firewall",
  "_class": ["Device", "Firewall"],
  "enabled": true,
  "propertyToAttributeMap": {
    "category": { "attributeId": null, "default": ["network"] },
    "hostname": { "attributeId": "601", "attributeName": "Hostname" },
    "serial": { "attributeId": "602", "attributeName": "Serial Number" },
    "make": { "attributeId": "603", "attributeName": "Vendor" }
  }
}
```

### Asset Ownership Relationships

Ownership relationships answer "who owns this asset?". For each asset, the integration reads the owner attribute you point it at (an email address, a Jira user, or a display name) and links the matching Jira user to the asset, so a query like `FIND jira_user THAT OWNS jira_assets_laptop` returns each laptop with its owner.

You can build these `jira_user OWNS jira_assets_*` relationships by specifying which mapped property contains the asset owner's email. Add `ownerEmailProperty` to an object type, pointing to the property name in `propertyToAttributeMap`:

```json
{
  "objectTypeId": "15",
  "objectTypeName": "Laptop",
  "_class": "Device",
  "enabled": true,
  "ownerEmailProperty": "ownerEmail",
  "propertyToAttributeMap": {
    "hostname": { "attributeId": "135", "attributeName": "Hostname" },
    "serial": { "attributeId": "136", "attributeName": "Serial Number" },
    "ownerEmail": { "attributeId": "157", "attributeName": "Owner" },
    "category": { "attributeId": null, "default": "laptop" }
  }
}
```

The integration matches the email value against existing `jira_user` entities. For Jira **User-type** attributes (where the value is a reference to a Jira user), the integration automatically extracts the email address.

> **NOTE**
> 
> This ingestion source is disabled by default. Enable the `user-owns-asset` ingestion source in the integration configuration. The `jira_user` entity must already exist — no placeholder is created.

#### Multiple Owners (Business Owner / Technical Owner)

When an object type has more than one owner role — for example a "System" with both a Business Owner and a Technical Owner — use `ownerProperties` instead of the singular `ownerEmailProperty`:

```json
{
  "objectTypeId": "5",
  "objectTypeName": "Systems",
  "_class": "Application",
  "enabled": true,
  "ownerProperties": [
    { "property": "businessOwner", "role": "business" },
    { "property": "technicalOwner", "role": "technical" }
  ],
  "propertyToAttributeMap": {
    "businessOwner": { "attributeId": "301", "attributeName": "Business Owner" },
    "technicalOwner": { "attributeId": "302", "attributeName": "Technical Owner" }
  }
}
```

| `role` | Relationship `_type` |
| --- | --- |
| `business` | `jira_user_business_owns_asset` |
| `technical` | `jira_user_technical_owns_asset` |
| `generic` (default) | `jira_user_owns_asset` |

`ownerProperties` and `ownerEmailProperty` can be combined — the singular field is treated as an additional `generic` owner.

#### Owner Property Fields

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `property` | string | Yes\* | Key of `propertyToAttributeMap` holding the owner value. Mutually exclusive with `attributeId`. |
| `attributeId` | string | Yes\* | Jira attribute ID to read the owner from directly, bypassing `propertyToAttributeMap`. Recommended for User-type attributes. Mutually exclusive with `property`. |
| `role` | string | No | `business`, `technical`, or `generic` (default) |
| `valueField` | string | No | Which part of a raw attribute value to use: `userEmail`, `userDisplayName`, `userName`, `displayValue`, `value`. Defaults to `auto`. Only meaningful with `attributeId`. |
| `matchProperty` | string | No | The `jira_user` property to match against: `email` (default), `name`, or `displayName` |

\* Exactly one of `property` or `attributeId` is required.

#### Matching Owners by Display Name

If your owner fields hold **display names** rather than email addresses, match on `jira_user.name` instead. Read the attribute directly so the display name is used even when Atlassian hides the user's email address:

```json
"ownerProperties": [
  {
    "attributeId": "301",
    "role": "business",
    "valueField": "userDisplayName",
    "matchProperty": "name"
  }
]
```

`jira_user.name` is `user.name || user.displayName`, so on Jira Cloud it is the display name. Values matched against `email` are lowercased automatically; values matched against `name` or `displayName` are **not**, because those properties preserve the casing of the source system.

> **NOTE**
> 
> Relationship keys include the ownership role and the matched value, so the same person appearing in two owner fields on one asset is supported. If you previously reduced an object type to a single owner to avoid a duplicate-key error, you can configure all the roles you need again.

### Asset Reference Relationships

Jira Assets objects often reference **other objects** — for example a _System_ that references its _Function_, _Process_, _Information Category_, and _ICT Supplier_. Configure `referenceRelationships` to turn these references into direct relationships between the asset entities:

```json
{
  "objectTypeId": "5",
  "objectTypeName": "Systems",
  "_class": "Application",
  "enabled": true,
  "referenceRelationships": [
    { "attributeId": "310", "attributeName": "Function", "targetObjectType": "Function", "_class": "USES" },
    { "attributeId": "311", "attributeName": "Process", "targetObjectType": "Process", "_class": "USES" },
    { "attributeId": "312", "attributeName": "Information Category", "targetObjectType": "Information Category", "_class": "HAS" },
    { "attributeId": "313", "attributeName": "ICT Supplier", "targetObjectType": "Supplier", "_class": "HAS" }
  ],
  "propertyToAttributeMap": { }
}
```

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `attributeId` | string | Yes | Jira attribute ID holding the reference to the target object |
| `attributeName` | string | No | Human-readable name (documentation only) |
| `targetObjectType` | string | Yes | Jira Assets Object Type **Name** of the referenced object (e.g. `"Supplier"`) |
| `_class` | string | Yes | JupiterOne relationship class (e.g. `HAS`, `USES`, `ASSIGNED`) |

> **CAUTION**
> 
> `referenceRelationships` only works with Jira **Object reference** attributes — attributes whose value is a link to another Assets object. Pointed at a **text** attribute it produces no relationships at all.
> 
> This is a common surprise when your CMDB is synced from another system: tools such as Device42 or ServiceNow typically write foreign keys and object names into plain text attributes (`device_fk`, `Device Name`, `App`), which look like references but are not. To build relationships from those, use [value-based relationships](#value-based-relationships) instead, which match on the attribute's **value**.
> 
> To check an attribute's type, open the Object Type in Jira, click **Attributes**, and look at the attribute's **Type** column — it must read `Object`, not `Text`.

> **NOTE**
> 
> The referenced object type (e.g. `Supplier`) **must also be configured and enabled** in `objectTypes` — otherwise the target entity doesn't exist and the relationship is skipped. If a reference attribute holds multiple values (e.g. multiple suppliers), a relationship is created for each referenced object.

### Value-Based Relationships

`referenceRelationships` links Assets objects to **other Assets objects**, and only through Object reference attributes. `targetRelationships` is more general: it reads an attribute's **value** and builds a relationship to any entity in the JupiterOne graph — a GitHub repository, a host from your EDR, a cloud account — by matching that value against a property of the target.

This is what you want when an attribute holds a name, an identifier, a comma-separated list, or a JSON document rather than a Jira object reference.

```json
{
  "objectTypeId": "314",
  "objectTypeName": "BusinessApplication",
  "_class": "Application",
  "enabled": true,
  "targetRelationships": [
    {
      "id": "repositories",
      "attributeId": "2710",
      "attributeName": "Repositories",
      "_class": "USES",
      "extract": { "format": "array" },
      "transform": ["trim", "lowercase"],
      "targetFilter": { "_type": "github_repo", "matchProperty": "fullName" },
      "onNoMatch": "skip"
    }
  ],
  "propertyToAttributeMap": { }
}
```

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `attributeId` | string | Yes\* | Jira attribute ID to read raw values from. Mutually exclusive with `property`. |
| `property` | string | Yes\* | Key of `propertyToAttributeMap` to read the already-converted value from. Mutually exclusive with `attributeId`. |
| `_class` | string | Yes | JupiterOne relationship class (e.g. `USES`, `HAS`, `CONNECTS`) |
| `targetFilter` | object | Yes | Which entities to match, and on which property |
| `extract` | object | No | How to expand the attribute into values. Defaults to `{ "format": "array" }`. |
| `transform` | string or string\[\] | No | `lowercase`, `uppercase`, `trim`, `slug`, applied in order to every value |
| `direction` | string | No | `FORWARD` (default, asset → target) or `REVERSE` (target → asset) |
| `id` | string | No | Stable identifier for this definition. Defaults to `attributeId`/`property`. Changing it rebuilds the relationships. |
| `relationshipType` | string | No | Explicit relationship `_type`. Must begin with `jira_`. |
| `attributeName` | string | No | Human-readable name (documentation only) |
| `onNoMatch` | string | No | Only `"skip"` is supported |

\* Exactly one of `attributeId` or `property` is required.

#### Extract Formats

| `format` | Behaviour |
| --- | --- |
| `array` (default) | One relationship per value on a multi-value attribute |
| `value` | The first value only |
| `delimited` | Splits the value on `delimiter` (e.g. `","` for a comma-separated list) |
| `json` | Parses the value as JSON and reads `jsonPath` (e.g. `"$.interfaces[*].fqdn"`) |

`extract.pattern` optionally applies a regular expression to each extracted value, using the first capture group when one is present.

#### Target Filter

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `_type` | string | Yes\*\* | Target entity `_type` (e.g. `github_repo`). Prefer this where you know it — it bounds how many entities can match. |
| `_class` | string | Yes\*\* | Target entity `_class` (e.g. `Device`). Use when the target may come from several integrations. |
| `matchProperty` | string | Yes | The target property each extracted value is matched against |

\*\* At least one of `_type` or `_class` is required.

```json
"targetFilter": { "_type": "github_repo", "matchProperty": "fullName" }
"targetFilter": { "_class": "Device", "matchProperty": "name" }
```

#### Matching Behaviour

Values are matched **exactly and case-sensitively**. Use `transform` only where you know the target property is stored in lower case:

| Target property | Casing | Use `transform: "lowercase"` |
| --- | --- | --- |
| `github_repo.fullName` | stored lower case | Yes |
| Any `User.email` | stored lower case | Yes |
| `Device.name`, `Host.hostname`, `Host.fqdn` | source casing | No |
| `jira_user.name`, `jira_user.displayName` | source casing | No |

When a value matches no entity, no relationship is created and no placeholder entity is invented. Definitions that produce values but no relationships are reported as warning events on the integration job, so a mapping that silently yields nothing is visible rather than invisible.

> **NOTE**
> 
> This ingestion source is disabled by default. Enable the `asset-target-relationships` ingestion source in the integration configuration.

### Supported JupiterOne Classes

| Class | Use For | Key Properties |
| --- | --- | --- |
| `Device` | Laptops, desktops, phones, printers, cameras | `hostname`, `serial`, `make`, `model`, `macAddress`, `category` |
| `Host` | Servers, VMs, VDI | `hostname`, `fqdn`, `ipAddress`, `osName`, `osVersion`, `category` |
| `Application` | Software applications, licenses | `name`, `version` |
| `Service` | Business services | `category` (array), `function` (array) |
| `Person` | Employees, contractors | `firstName`, `lastName`, `email` |
| `Site` | Physical locations, offices | `name` |
| `Vendor` | Third-party vendors | `name` |
| `Network` | Network segments, VLANs, subnets | `CIDR`, `public`, `internal` |
| `Certificate` | SSL/TLS certificates | `domainName`, `expiresOn` |
| `Account` | Cloud accounts (AWS, Azure, GCP) | `vendor` |
| `IpAddress` | IP address resources (IPAM) | `ipAddress` |
| `Gateway` | Load balancers, NAT gateways, proxies | `category` (array), `function` (array), `public` |
| `Firewall` | Firewall appliances, security groups | `category` (array) |
| `Disk` | Storage devices, volumes | `name` |
| `CryptoKey` | Encryption keys, HSM devices | `name` |

You can combine multiple classes: `"_class": ["Device", "Firewall"]`

> **NOTE**
> 
> Some classes have strictly required properties that **must** be mapped (e.g., `vendor` for Account, `ipAddress` for IpAddress). Other classes like Device and Host have nullable required properties that will default to `null` if not mapped. The integration validates your mapping against the JupiterOne data model and will report errors for missing required properties.

### Finding Object Type and Attribute IDs

To find the IDs needed for your mapping configuration:

**Finding Object Type ID:**

1.  Go to **Jira Service Management** > **Assets**
2.  Click on an **Object Schema**
3.  Click on an **Object Type** (e.g., "Laptop")
4.  The Object Type ID is in the URL: `.../object-type/{objectTypeId}`

**Finding Attribute IDs:**

1.  From the Object Type page, click **Attributes**
2.  Click on an attribute to see its details
3.  The Attribute ID is in the URL or settings panel

> **TIP**
> 
> Use your browser's network inspector when viewing an asset to see the API responses with all IDs.

### Auto-Generated Properties

These properties are automatically set by the integration and don't need mapping:

-   `_key`, `_type`, `_class` - Entity identifiers
-   `name`, `displayName` - From Jira object label
-   `id` - Jira object ID
-   `webLink` - Link to asset in Jira
-   `createdOn`, `updatedOn` - Timestamps
-   `objectKey`, `objectTypeName`, `objectTypeId` - Jira metadata

### Entities Created

Assets ingestion creates:

| Entity | `_type` | `_class` |
| --- | --- | --- |
| Assets Workspace | `jira_assets_workspace` | `Repository` |
| Asset Objects | `jira_assets_{objectTypeName}` | As configured |

For example, `objectTypeName: "Laptop"` creates entities with `_type: jira_assets_laptop`.

The **Assets Workspace** entity stands for the Assets workspace of your Jira site. It uses the `Repository` class because it is a container: it holds no asset data itself. Its `workspaceId` property is the workspace ID Jira assigns to your site, and every Asset object the integration ingests is linked to it with a **HAS** relationship. You do not need to configure it; it appears automatically once an Assets mapping is uploaded.

### Relationships Created

| Source | Relationship | Target |
| --- | --- | --- |
| `jira_account` | **HAS** | `jira_assets_workspace` |
| `jira_assets_workspace` | **HAS** | `jira_assets_*` |
| `jira_user` | **OWNS** | `jira_assets_*` (generic, via `ownerEmailProperty` or a `generic` entry in `ownerProperties`) |
| `jira_user` | **OWNS** | `jira_assets_*` (Business Owner, via `ownerProperties` with `role: "business"`) |
| `jira_user` | **OWNS** | `jira_assets_*` (Technical Owner, via `ownerProperties` with `role: "technical"`) |
| `jira_assets_*` | as configured | `jira_assets_*` (via `referenceRelationships`, e.g. Function, Process, Information Category, ICT Supplier) |
| `jira_assets_*` | as configured | Any entity `_type` or `_class` (via `targetRelationships`, e.g. `github_repo`, `Device`, `Host`) |

Relationships built from `targetRelationships` depend on your mapping, so they do not appear in the integration's published data model. Where the target is another Assets object type you have configured and enabled, a direct relationship is created; otherwise the relationship is matched against the wider JupiterOne graph.

## Troubleshooting

### Invalid project keys

If a run fails with `There is a problem with the Jira configuration, the project key(s) are invalid: ["KEY"]`, one or more keys in the **Project Keys** field do not match a project the integration can see. The error names the key(s) at fault.

1.  In Jira, open **Projects** > **View all projects** and check whether each named key still exists. Projects that were deleted, moved to trash, or renamed to a new key no longer match.
2.  If the project is gone or you no longer want to ingest it, edit the integration instance in JupiterOne and remove that key from **Project Keys**. If the project was renamed, replace the old key with the new one.
3.  If the project exists and the key is correct, the integration user (or OAuth service account) cannot see it. Grant that account **Browse Projects** permission on the project, then run the integration again.

Project keys are matched without regard to case, so `secops` and `SECOPS` refer to the same project.

### Ownership or value-based relationships are not created

The **Build User Owns Asset Relationships** and **Build Asset Target Relationships** data sources are disabled by default, even when your Assets mapping sets `ownerProperties`, `ownerEmailProperty` or `targetRelationships`. Enable them in the instance's [Data Sources](/integrations/data-sources.md) settings, then run the integration again. Owner matches also require the owning `jira_user` to be ingested; no placeholder user is created.

## Next Steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `jira_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Assets Workspace | `jira_assets_workspace` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Jira Issue | `jira_issue` | [Record](https://docs.jupiterone.io/data-model/schemas/Record), [Issue](https://docs.jupiterone.io/data-model/schemas/Issue) |
| Jira Project | `jira_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Jira User | `jira_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `jira_account` | **HAS** | `jira_project` |
| `jira_account` | **HAS** | `jira_user` |
| `jira_account` | **HAS** | `jira_assets_workspace` |
| `jira_issue` | **LINKS** | `jira_issue` |
| `jira_project` | **HAS** | `jira_issue` |
| `jira_user` | **CREATED** | `jira_issue` |
| `jira_user` | **REPORTED** | `jira_issue` |
| `jira_user` | **ASSIGNED** | `jira_issue` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `jira_assets_` | **USES** | `CodeRepo` | FORWARD |
| `jira_assets_` | **USES** | `Host` | FORWARD |
| `jira_assets_` | **USES** | `Device` | FORWARD |
| `jira_user` | **OWNS** | `jira_assets_` | REVERSE |

### Jira Assets Workspace

`jira_assets_workspace` inherits from [Repository](/data-model/schemas/Repository.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `webLink` | `string` | Link to the Assets workspace in Jira. |  |
| 
`workspaceId` \*

 | `string` | The Assets workspace ID that Jira assigns to your site. Every Assets object ingested by this integration belongs to this workspace. |  |

---

## Release Notes

-   **2026-09-16** — Added a configuration option to filter Jira users by account type, allowing Jira Service Management tenants to exclude customer portal accounts from ingestion.
-   **2026-09-16** — Jira Assets now supports value-based relationship mapping, enabling assets to create relationships to related entities by matching attribute values.
-   **2026-07-29** — Issue link relationships now include the link type, allowing two issues linked by multiple relationship types to be correctly represented.
-   **2026-07-07** — Jira Service Management Assets can now be linked to multiple owners and their ICT supplier organizations.
-   **2026-06-16** — Added OAuth 2.0 (service account) authentication using the client credentials grant, allowing the integration to connect without a user API token.
-   **2026-03-03** — Added relationships linking Jira users to the assets they own in Jira Assets, enabling ownership queries across asset workspaces.
-   **2026-01-27** — Added Jira Assets ingestion, bringing asset workspace objects into JupiterOne as queryable entities with configurable type mappings.
-   **2025-12-18** — Added relationships between related Jira issues using issue link types, enabling traversal of issue dependencies and relationships.
-   **2025-05-27** — Added relationships tracking which Jira user is assigned to each Jira issue.
-   **2025-05-16** — Added guest user indicator to Jira user entities, identifying customer portal accounts versus internal Atlassian users.

---

Source: /integrations/directory/jumpcloud

# JumpCloud

Visualize JumpCloud users, groups, and applications, map JumpCloud users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> JupiterOne requires a Read Only Admin API key used to authenticate with the JumpCloud account.
> 
> Each JupiterOne integration instance ingests a single JumpCloud organization. If your API key is a multi-tenant (MTP) admin key that can see more than one organization, you must also provide an **Organization ID**, and you need one integration instance per organization.

> **WARNING**
> 
> JumpCloud Service Account keys are not supported. They cannot reach the multi-tenant endpoints this integration uses, and JumpCloud rejects them with `403 Forbidden`. Use an Admin API key instead.

### Configuration in JumpCloud

1.  Log into the Admin [portal](https://console.jumpcloud.com/login/admin)
2.  Create a new Administrator user with the Read Only role:
    -   Press the profile circle in the top right
    -   Press `Administrators`
    -   Press `Add Administrator`
    -   Press `Create New Admin`
    -   Enter required fields
    -   Set role to `Read Only`
    -   Check `Enable API access`
    -   Press `Save`
3.  Log into the Admin portal with new Read Only Admin
4.  Once logged in, press the profile circle
    -   Press My API Key
    -   Copy API Key for use in the next section

### Finding your Organization ID

Only required if your API key is a multi-tenant (MTP) admin key that can see more than one JumpCloud organization. Single-tenant admin keys can skip this section.

1.  Log into the Admin [portal](https://console.jumpcloud.com/login/admin)
2.  Select the organization you want this integration instance to ingest
3.  Press the profile circle in the top right, then press `Settings`
4.  Copy the value of the `Organization ID` field for use in the next section

Repeat for each organization you want to ingest. Each one needs its own JupiterOne integration instance.

### Configuration in JupiterOne

To install the JumpCloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select JumpCloud. Click **New Instance** to begin configuring your integration, providing the following:

-   **Account Name** used to identify the JumpCloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` option is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **API Key** from an Admin with the Read Only role.
    
-   **Organization ID** of the single JumpCloud organization this instance ingests. Required if your API key is a multi-tenant (MTP) admin key, which JumpCloud rejects with `401 Unauthorized` unless the organization is named. Leave blank for single-tenant admin keys, where JumpCloud resolves the organization automatically.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Application | `jumpcloud_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Configuration | `jumpcloud_apple_mdm` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Device | `jumpcloud_apple_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Group | `jumpcloud_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Organization | `jumpcloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account), [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| System | `jumpcloud_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| User | `jumpcloud_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `jumpcloud_account` | **HAS** | `jumpcloud_user` |
| `jumpcloud_account` | **HAS** | `jumpcloud_group` |
| `jumpcloud_account` | **HAS** | `jumpcloud_application` |
| `jumpcloud_account` | **HAS** | `jumpcloud_apple_mdm` |
| `jumpcloud_account` | **PROTECTS** | `jumpcloud_device` |
| `jumpcloud_apple_device` | **HAS** | `jumpcloud_apple_mdm` |
| `jumpcloud_group` | **HAS** | `jumpcloud_user` |
| `jumpcloud_group` | **ASSIGNED** | `jumpcloud_application` |
| `jumpcloud_user` | **ASSIGNED** | `jumpcloud_application` |

### Jumpcloud Account

`jumpcloud_account` inherits from [Account](/data-model/schemas/Account.md), [Organization](/data-model/schemas/Organization.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `logoUrl` | `string` |  |  |

---

### Jumpcloud Apple Device

`jumpcloud_apple_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` | Please use createdOn instead | **deprecated**: true |
| 
`depRegistered` \*

 | `boolean` | Please use isDepRegistered instead | **deprecated**: true |
| `deviceCapacity` | `number` |  |  |
| 

`enrolled` \*

 | `boolean` | Please use isEnrolled instead | **deprecated**: true |
| 

`hasActivationLockBypassCodes` \*

 | `boolean` |  |  |
| 

`isDepRegistered` \*

 | `boolean` |  |  |
| 

`isEnrolled` \*

 | `boolean` |  |  |
| 

`isSupervised` \*

 | `boolean` |  |  |
| 

`lastSeenOn` \*

 | `null` |  |  |
| `macAddress` | `string` |  |  |
| 

`make` \*

 | `string` |  | **const**: Apple |

---

### Jumpcloud Apple Mdm

`jumpcloud_apple_mdm` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apnsCertExpiry` | `string` |  |  |
| `appleCertSerialNumber` | `string` |  |  |
| `depServerTokenState` | `string` |  |  |

---

### Jumpcloud Application

`jumpcloud_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`beta` \*

 | `boolean` **|** `null` |  |  |
| 

`displayLabel` \*

 | `string` **|** `null` |  |  |
| 

`organization` \*

 | `string` **|** `null` |  |  |
| `ssoUrl` | `string` **|** `null` |  |  |

---

### Jumpcloud Device

`jumpcloud_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentVersion` | `string` |  |  |
| `encrypted` | `boolean` | Indicates if the Full Disk Encryption is active in the system |  |
| `fileSystem` | `string` |  |  |
| `isDesktopCapable` | `boolean` |  |  |
| `isEncryptionKeyPresent` | `boolean` |  |  |
| 
`isMultiFactorAuthenticationEnabled` \*

 | `boolean` |  |  |
| `isPolicyBound` | `boolean` |  |  |
| 

`isPublicKeyAuthenticationEnabled` \*

 | `boolean` |  |  |
| `isSecureLoginEnabled` | `boolean` |  |  |
| `isSecureLoginSupported` | `boolean` |  |  |
| 

`isSshPasswordAuthenticationEnabled` \*

 | `boolean` |  |  |
| 

`isSshRootEnabled` \*

 | `boolean` | Also refer to property isSshRootLoginEnabled. |  |
| 

`isSshRootLoginEnabled` \*

 | `boolean` | Also refer to property isSshRootEnabled. |  |
| 

`lastSeenOn` \*

 | `number` **|** `null` | Value originates from the "lastContact" property on the System resource. |  |
| `platform` | `string` |  |  |
| `systemTimezone` | `number` |  |  |
| `templateName` | `string` |  |  |

---

### Jumpcloud Group

`jumpcloud_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `attributes` | `string` | Stringified object |  |

---

### Jumpcloud User

`jumpcloud_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `company` | `string` |  |  |
| `department` | `string` |  |  |
| `employeeId` | `string` |  |  |
| `employeeType` | `string` |  |  |
| 
`externallyManaged` \*

 | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| `isPasswordExpired` | `boolean` |  |  |
| 

`isPasswordFederated` \*

 | `boolean` | True when the user password is managed by a federated identity provider (restrictedFields entry with field="password"). |  |
| `isPasswordSetToNeverExpire` | `boolean` |  |  |
| `jobTitle` | `string` |  |  |
| 

`ldapBindingUser` \*

 | `boolean` |  |  |
| `login` | `string` | Derived from username |  |
| 

`mfaConfigured` \*

 | `boolean` |  |  |
| 

`mfaExclusion` \*

 | `boolean` |  |  |
| `mfaExclusionEndOn` | `number` |  |  |
| `mfaExclusionUntil` | `number` | Use mfaExclusionEndOn instead | **deprecated**: true |
| `passwordExpiresOn` | `number` |  |  |
| `passwordFederationType` | `string` | The federation type for the password entry in restrictedFields (e.g. "federated\_identity\_provider"), if present. |  |
| 

`sambaServiceUser` \*

 | `boolean` |  |  |
| `state` | `string` |  | **Any of**:

-   `staged`

-   `activated`

-   `suspended`

 |
| 

`sudo` \*

 | `boolean` |  |  |
| 

`suspended` \*

 | `boolean` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name accuracy for JumpCloud device entities, deriving human-readable OS names from Apple device model names and system platform.
-   **2025-12-19** — Added beta status, display label, and organization ID properties to JumpCloud application entities.
-   **2025-05-06** — Added password expiration status, password expiration date, and never-expires indicator properties to JumpCloud user entities.

---

Source: /integrations/directory/justworks

# Justworks 2.0

Visualize your Justworks company and workforce in the JupiterOne graph. Ingest the Justworks company/organization and its members — employees and contractors — mapping each member to the company and to their manager, and enriching members with job title, department, office, and employment details. Monitor your identity and org structure through queries and alerts.

## Installation

The Justworks integration ingests your Justworks company and workforce using the Justworks Partner API (`https://public-api.justworks.com/v1`). It reads your company/organization (`/company`) and members (`/members`) to build a graph of the company, its employees and contractors, and the manager relationships between them. Because JupiterOne is not a Justworks partner, this integration uses a **customer-provided credentials** model: you obtain your own OAuth application from Justworks and supply its credentials to JupiterOne.

### Prerequisites

-   A **Justworks** account with administrator access.
-   A Justworks **OAuth application** (`client_id` and `client_secret`). Creating an OAuth application for the Partner API is **not self-service** — you must request one from Justworks. See the [Justworks Partner API documentation](https://public-api.justworks.com/v1/docs) for details.
-   A **refresh token** obtained by completing the one-time OAuth authorization (see below). Justworks refresh tokens are valid for 30 days.
-   Access to JupiterOne with permission to configure integrations.

### Obtaining Justworks credentials

1.  Request an OAuth application from Justworks for your company and note the issued **Client ID** and **Client Secret**.
2.  Grant the application the read scopes this integration uses:
    -   `company.basic:read` and `company.detail:read` — company profile, including the company legal name.
    -   `member.basic:read`, `member.detail:read`, and `member.employment:read` — members, including their emails, manager, member type, and employment details.
3.  Complete the one-time authorization at `https://payroll.justworks.com/oauth/authorize` (OAuth 2.0 Authorization Code flow) to obtain an initial **refresh token**. JupiterOne exchanges this refresh token for short-lived access tokens at `https://public-api.justworks.com/oauth/token`.

> **NOTE**
> 
> Justworks refresh tokens expire after 30 days. If an integration instance is idle for more than 30 days, the refresh token expires and you must re-authorize to generate a new one and update the instance configuration.

### Configuration in JupiterOne

To install the Justworks integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Justworks**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Justworks account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Justworks **Client ID** — the OAuth client ID issued by Justworks. This field is required.
    
-   Your Justworks **Client Secret** — the OAuth client secret issued by Justworks. This field is required.
    
-   Your Justworks **Refresh Token** — the refresh token obtained from the authorization flow above. This field is required.
    
-   Optionally, an **API Base URL** to override the default Justworks API endpoint (`https://public-api.justworks.com/v1`). Leave this blank unless instructed otherwise by Justworks or JupiterOne support.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (5)

-   `company.basic:read`
-   `company.detail:read`
-   `member.basic:read`
-   `member.detail:read`
-   `member.employment:read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (2)

-   `https://public-api.justworks.com/v1/company`
-   `https://public-api.justworks.com/v1/members`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://public-api.justworks.com/v1/docs](https://public-api.justworks.com/v1/docs)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (1)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Fetch Members | `member.basic:read`, `member.detail:read`, `member.employment:read` | `https://public-api.justworks.com/v1/members` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `justworks_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Company | `justworks_company` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Member | `justworks_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `justworks_account` | **HAS** | `justworks_company` |
| `justworks_company` | **HAS** | `justworks_user` |
| `justworks_user` | **MANAGES** | `justworks_user` |

### Justworks Account

`justworks_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Justworks Company

`justworks_company` inherits from [Organization](/data-model/schemas/Organization.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`countryCodes` \*

 | `array` **|** `null` | ISO 3166-1 alpha-2 country codes of the company's addresses. |  |
| 

`departmentNames` \*

 | `array` **|** `null` | Names of the departments defined within the company. |  |
| 

`legalName` \*

 | `string` **|** `null` | The registered legal name of the company. |  |
| 

`officeNames` \*

 | `array` **|** `null` | Names of the offices defined within the company. |  |

---

### Justworks User

`justworks_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`companyId` \*

 | `string` **|** `null` | The identifier of the company the member belongs to. |  |
| 

`dateAddedToJustworksOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when the member was added to Justworks. |  |
| 

`departmentName` \*

 | `string` **|** `null` | Name of the department the member belongs to. |  |
| 

`employmentLocationType` \*

 | `string` **|** `null` | Location type where the member works (office or remote). |  |
| 

`employmentStartOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when the member's employment started. |  |
| 

`employmentTerminationOn` \*

 | `number` **|** `null` | Timestamp (epoch ms) when the member's employment was terminated. |  |
| 

`jobTitle` \*

 | `string` **|** `null` | The member's job title. |  |
| 

`managerName` \*

 | `string` **|** `null` | Full preferred name of the member's manager. The link to the manager is modeled by the justworks\_user\_manages\_user relationship. |  |
| 

`memberType` \*

 | `string` **|** `null` | The Justworks member type (e.g. full\_time\_employee, contractor). |  |
| 

`officeName` \*

 | `string` **|** `null` | Name of the office the member belongs to. |  |
| 

`phoneNumbers` \*

 | `array` **|** `null` | The member's phone numbers in E.164 format. |  |
| 

`workId` \*

 | `string` **|** `null` | The employer-assigned work identifier of the member. |  |

---

## Release Notes

-   **2026-07-15** — Added initial Justworks integration, ingesting accounts, companies, and users with their relationships.

---

Source: /integrations/directory/kandji

# Iru

Visualize Iru (formerly Kandji) devices and apps, and monitor changes through queries and alerts.

## Installation

JupiterOne requires an API access token and the organization API URL for this integration. You need admin access to Iru (formerly Kandji) to generate an API token.

### Configuration in Iru

1.  Log in to your Iru tenant. Existing Kandji tenants use `https://{subdomain}.kandji.io/`; new Iru tenants use their assigned Iru URL.
    
2.  Go to **Settings**, then click the **Access** tab.
    
3.  Click **Add API Token**.
    
4.  Enter a **Name** for the token (required). A description is optional.
    
5.  Click **Create**. Copy the API token shown and store it securely — you will not be able to view it again.
    
6.  Click **Next**, then click **Configure** to assign endpoint permissions to the token.
    
7.  Enable the following permissions:
    
    | Permission | Endpoint |
    | --- | --- |
    | Device list | `GET /api/v1/devices` |
    | Device details | `GET /api/v1/devices/{device_id}/details` |
    | Application list | `GET /api/v1/devices/{device_id}/apps` |
    | List custom profiles | `GET /api/v1/library/custom-profiles` |
    | List blueprints | `GET /api/v1/blueprints` |
    | Vulnerability management — vulnerabilities | `GET /api/v1/vulnerability-management/vulnerabilities` |
    | Vulnerability management — detections | `GET /api/v1/vulnerability-management/detections` |
    | Threat details | `GET /api/v1/threat-details` |
    
8.  Click **Save**.
    
9.  Your tenant-specific **API URL** is shown on the API tokens page. Copy it for use in JupiterOne.
    

## Data Volume Configuration

Control how much data is ingested from Iru to manage storage and processing.

### Ingestion Windows

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Threat Ingest Since Days** | How many days back to look when ingesting threat data. Increasing this value ingests more threats. | 90 | 90, 180, 275, 365 |

### Data Filtering Options

| Field | Description | Default |
| --- | --- | --- |
| **Threat Status** | Filters threat ingestion to the selected quarantine status. When unset, all statuses are ingested. | All statuses |

**Available options for Threat Status:**

-   **Quarantined** — Only ingest threats that are quarantined.
-   **Not Quarantined** — Only ingest threats that are not quarantined.
-   **Released** — Only ingest threats that have been released from quarantine.

## Configuration in JupiterOne

To install the integration in JupiterOne, navigate to the **Integrations** tab, select **Kandji**, and click **New Instance**. Provide the following:

-   **Account Name** — A label to identify this account in JupiterOne. Ingested entities store this value in `tag.AccountName`.
    
-   **Description** — Optional. Helps distinguish multiple integration instances.
    
-   **Polling Interval** — How often JupiterOne collects data from Iru. Set to `DISABLED` to run manually.
    
-   **Kandji API Url** — The organization API URL from your Iru tenant, in the format `https://{yourApiUrl}/api/v1/`. Include `https://` at the start and `/api/v1/` at the end.
    
-   **Kandji Access Token** — The API token generated in the steps above.
    

Click **Create** to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (8)

-   `Device applications`
-   `Device details`
-   `Device list`
-   `List blueprints`
-   `List custom profiles`
-   `Threat details`
-   `Vulnerability management - detections`
-   `Vulnerability management - vulnerabilities`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (8)

-   `GET {apiUrl}/blueprints`
-   `GET {apiUrl}/devices`
-   `GET {apiUrl}/devices/{device_id}/apps`
-   `GET {apiUrl}/devices/{device_id}/details`
-   `GET {apiUrl}/library/custom-profiles`
-   `GET {apiUrl}/threat-details`
-   `GET {apiUrl}/vulnerability-management/detections`
-   `GET {apiUrl}/vulnerability-management/vulnerabilities`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (2)

-   [https://api-docs.kandji.io/](https://api-docs.kandji.io/)
-   [https://support.kandji.io/kb/kandji-api](https://support.kandji.io/kb/kandji-api)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (6)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Build Device Blueprint Relationships | \- | \- |
| Build Device Profile Relationships | \- | \- |
| Build Vulnerability Relationships | `Vulnerability management - detections` | `GET {apiUrl}/vulnerability-management/detections` |
| Fetch Device Apps | `Device applications` | `GET {apiUrl}/devices/{device_id}/apps` |
| Fetch Device Users | \- | \- |
| Fetch File Threats | `Threat details` | `GET {apiUrl}/threat-details` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `kandji_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Account | `iru_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| App | `kandji_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| App | `iru_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Blueprint | `kandji_blueprint` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Blueprint | `iru_blueprint` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Custom\_Profile | `kandji_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Custom\_Profile | `iru_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Device | `kandji_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device | `iru_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| File Threat | `kandji_file_threat` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| File Threat | `iru_file_threat` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| User | `kandji_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User | `iru_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `kandji_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Vulnerability | `iru_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Vulnerability | `kandji_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Vulnerability | `iru_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `iru_account` | **HAS** | `iru_device` |
| `iru_app` | **HAS** | `iru_vulnerability` |
| `iru_device` | **INSTALLED** | `iru_app` |
| `iru_device` | **HAS** | `iru_vulnerability` |
| `iru_device` | **HAS** | `iru_file_threat` |
| `iru_device` | **ASSIGNED** | `iru_blueprint` |
| `iru_device` | **ASSIGNED** | `iru_profile` |
| `iru_user` | **OWNS** | `iru_device` |
| `kandji_account` | **HAS** | `kandji_device` |
| `kandji_app` | **HAS** | `kandji_vulnerability` |
| `kandji_device` | **INSTALLED** | `kandji_app` |
| `kandji_device` | **HAS** | `kandji_vulnerability` |
| `kandji_device` | **HAS** | `kandji_file_threat` |
| `kandji_device` | **ASSIGNED** | `kandji_blueprint` |
| `kandji_device` | **ASSIGNED** | `kandji_profile` |
| `kandji_user` | **OWNS** | `kandji_device` |

### Iru Account

`iru_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` |  |  |

---

### Iru App

`iru_app` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appStoreVendable` | `string` |  |  |
| 
`bundleId` \*

 | `string` |  |  |
| `deviceBasedVpp` | `string` |  |  |
| `process` | `string` |  |  |
| `source` | `string` |  |  |

---

### Iru Blueprint

`iru_blueprint` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`computersCount` \*

 | `string` |  |  |
| 

`description` \*

 | `string` |  |  |
| 

`enrollmentCodeActive` \*

 | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Iru Device

`iru_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activationLock.activationLockAllowedWhileSupervised` | `boolean` **|** `null` |  |  |
| `activationLock.activationLockSupported` | `boolean` |  |  |
| `activationLock.bypassCodeFailed` | `boolean` |  |  |
| `activationLock.deviceActivationLockEnabled` | `boolean` |  |  |
| `activationLock.userActivationLockEnabled` | `boolean` |  |  |
| `agentInstalled` | `boolean` |  |  |
| `agentVersion` | `string` |  |  |
| `blueprintId` | `string` |  |  |
| `blueprintName` | `string` |  |  |
| `filevault.filevaultEnabled` | `boolean` |  |  |
| `filevault.filevaultNextRotation` | `string` |  |  |
| `filevault.filevaultPrkEscrowed` | `boolean` |  |  |
| `filevault.filevaultRecoverykeyType` | `string` |  |  |
| `filevault.filevaultRegenRequired` | `boolean` |  |  |
| `firstEnrollmentOn` | `number` |  |  |
| `general.assignedUserEmail` | `string` |  |  |
| `general.assignedUserId` | `number` |  |  |
| `general.assignedUserIsArchived` | `boolean` |  |  |
| `general.assignedUserName` | `string` |  |  |
| `general.blueprintName` | `string` |  |  |
| `general.blueprintUuid` | `string` |  |  |
| `general.bootVolume` | `string` |  |  |
| `general.lastUser` | `string` |  |  |
| `general.systemVersion` | `string` |  |  |
| `general.timeSinceBoot` | `string` |  |  |
| `hardwareOverview.memory` | `string` |  |  |
| `hardwareOverview.modelIdentifier` | `string` |  |  |
| `hardwareOverview.modelName` | `string` |  |  |
| `hardwareOverview.numberOfProcessors` | `string` |  |  |
| `hardwareOverview.processorName` | `string` |  |  |
| `hardwareOverview.processorSpeed` | `string` |  |  |
| `hardwareOverview.totalNumberOfCores` | `string` |  |  |
| `installedProfiles` | `array` of `string`s |  |  |
| `isMissing` | `boolean` |  |  |
| `isRemoved` | `boolean` |  |  |
| `kandjiAgent.agentInstalled` | `string` |  |  |
| `kandjiAgent.agentVersion` | `string` |  |  |
| `kandjiAgent.installDate` | `string` |  |  |
| `kandjiAgent.lastCheckIn` | `string` |  |  |
| `lastCheckinOn` | `number` **|** `null` |  |  |
| `lastEnrollmentOn` | `number` |  |  |
| `macAddress` | `string` |  |  |
| `mdm.installDate` | `string` |  |  |
| `mdm.lastCheckIn` | `string` |  |  |
| `mdm.mdmEnabled` | `string` |  |  |
| `mdm.mdmEnabledUser` | `array` of `string`s |  |  |
| `mdmEnabled` | `boolean` |  |  |
| `network.ipAddress` | `string` |  |  |
| `network.localHostname` | `string` |  |  |
| `network.macAddress` | `string` | This property is deprecated and will be removed in future versions. Please use the macAddress property instead. |  |
| `network.publicIp` | `string` |  |  |
| `platform` | `string` |  |  |
| `serialNumber` | `string` **|** `null` |  |  |
| `user.email` | `string` **|** `null` |  |  |
| `user.id` | `number` **|** `null` |  |  |
| `user.isArchived` | `boolean` **|** `null` |  |  |
| `user.name` | `string` **|** `null` |  |  |
| `users.regularUsers` | `array` of `string`s |  |  |
| `users.systemUsers` | `array` of `string`s |  |  |
| `volumes` | `array` of `string`s |  |  |

---

### Iru File Threat

`iru_file_threat` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `classification` | `string` |  |  |
| `fileHash` | `string` |  |  |
| `filePath` | `string` |  |  |
| `status` | `string` |  |  |

---

### Iru Profile

`iru_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `mdmIdentifier` | `string` |  |  |

---

### Iru User

`iru_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isArchived` | `boolean` |  |  |

---

### Iru Vulnerability

`iru_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `devicesImpacted` | `number` | Number of devices in the fleet affected by the CVE. |  |
| `firstDetectedOn` | `number` | Timestamp of the first time the CVE was detected in the fleet. |  |
| `kevScore` | `number` | Iru KEV (Known Exploited Vulnerability) score for the CVE. |  |
| `lastDetectedOn` | `number` | Timestamp of the most recent time the CVE was detected in the fleet. |  |
| `software` | `array` **|** `null` | Names of the software titles affected by the CVE across the fleet. |  |

---

### Iru Vulnerability

`iru_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `devicesImpacted` | `number` | Number of devices in the fleet affected by the CVE. |  |
| `firstDetectedOn` | `number` | Timestamp of the first time the CVE was detected in the fleet. |  |
| `kevScore` | `number` | Iru KEV (Known Exploited Vulnerability) score for the CVE. |  |
| `lastDetectedOn` | `number` | Timestamp of the most recent time the CVE was detected in the fleet. |  |
| `software` | `array` **|** `null` | Names of the software titles affected by the CVE across the fleet. |  |

---

### Kandji Account

`kandji_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`name` \*

 | `string` |  |  |

---

### Kandji App

`kandji_app` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appStoreVendable` | `string` |  |  |
| 
`bundleId` \*

 | `string` |  |  |
| `deviceBasedVpp` | `string` |  |  |
| `process` | `string` |  |  |
| `source` | `string` |  |  |

---

### Kandji Blueprint

`kandji_blueprint` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`computersCount` \*

 | `string` |  |  |
| 

`description` \*

 | `string` |  |  |
| 

`enrollmentCodeActive` \*

 | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Kandji Device

`kandji_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activationLock.activationLockAllowedWhileSupervised` | `boolean` **|** `null` |  |  |
| `activationLock.activationLockSupported` | `boolean` |  |  |
| `activationLock.bypassCodeFailed` | `boolean` |  |  |
| `activationLock.deviceActivationLockEnabled` | `boolean` |  |  |
| `activationLock.userActivationLockEnabled` | `boolean` |  |  |
| `agentInstalled` | `boolean` |  |  |
| `agentVersion` | `string` |  |  |
| `blueprintId` | `string` |  |  |
| `blueprintName` | `string` |  |  |
| `filevault.filevaultEnabled` | `boolean` |  |  |
| `filevault.filevaultNextRotation` | `string` |  |  |
| `filevault.filevaultPrkEscrowed` | `boolean` |  |  |
| `filevault.filevaultRecoverykeyType` | `string` |  |  |
| `filevault.filevaultRegenRequired` | `boolean` |  |  |
| `firstEnrollmentOn` | `number` |  |  |
| `general.assignedUserEmail` | `string` |  |  |
| `general.assignedUserId` | `number` |  |  |
| `general.assignedUserIsArchived` | `boolean` |  |  |
| `general.assignedUserName` | `string` |  |  |
| `general.blueprintName` | `string` |  |  |
| `general.blueprintUuid` | `string` |  |  |
| `general.bootVolume` | `string` |  |  |
| `general.lastUser` | `string` |  |  |
| `general.systemVersion` | `string` |  |  |
| `general.timeSinceBoot` | `string` |  |  |
| `hardwareOverview.memory` | `string` |  |  |
| `hardwareOverview.modelIdentifier` | `string` |  |  |
| `hardwareOverview.modelName` | `string` |  |  |
| `hardwareOverview.numberOfProcessors` | `string` |  |  |
| `hardwareOverview.processorName` | `string` |  |  |
| `hardwareOverview.processorSpeed` | `string` |  |  |
| `hardwareOverview.totalNumberOfCores` | `string` |  |  |
| `installedProfiles` | `array` of `string`s |  |  |
| `isMissing` | `boolean` |  |  |
| `isRemoved` | `boolean` |  |  |
| `kandjiAgent.agentInstalled` | `string` |  |  |
| `kandjiAgent.agentVersion` | `string` |  |  |
| `kandjiAgent.installDate` | `string` |  |  |
| `kandjiAgent.lastCheckIn` | `string` |  |  |
| `lastCheckinOn` | `number` **|** `null` |  |  |
| `lastEnrollmentOn` | `number` |  |  |
| `macAddress` | `string` |  |  |
| `mdm.installDate` | `string` |  |  |
| `mdm.lastCheckIn` | `string` |  |  |
| `mdm.mdmEnabled` | `string` |  |  |
| `mdm.mdmEnabledUser` | `array` of `string`s |  |  |
| `mdmEnabled` | `boolean` |  |  |
| `network.ipAddress` | `string` |  |  |
| `network.localHostname` | `string` |  |  |
| `network.macAddress` | `string` | This property is deprecated and will be removed in future versions. Please use the macAddress property instead. |  |
| `network.publicIp` | `string` |  |  |
| `platform` | `string` |  |  |
| `serialNumber` | `string` **|** `null` |  |  |
| `user.email` | `string` **|** `null` |  |  |
| `user.id` | `number` **|** `null` |  |  |
| `user.isArchived` | `boolean` **|** `null` |  |  |
| `user.name` | `string` **|** `null` |  |  |
| `users.regularUsers` | `array` of `string`s |  |  |
| `users.systemUsers` | `array` of `string`s |  |  |
| `volumes` | `array` of `string`s |  |  |

---

### Kandji File Threat

`kandji_file_threat` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `classification` | `string` |  |  |
| `fileHash` | `string` |  |  |
| `filePath` | `string` |  |  |
| `status` | `string` |  |  |

---

### Kandji Profile

`kandji_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `mdmIdentifier` | `string` |  |  |

---

### Kandji User

`kandji_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isArchived` | `boolean` |  |  |

---

### Kandji Vulnerability

`kandji_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `devicesImpacted` | `number` | Number of devices in the fleet affected by the CVE. |  |
| `firstDetectedOn` | `number` | Timestamp of the first time the CVE was detected in the fleet. |  |
| `kevScore` | `number` | Iru KEV (Known Exploited Vulnerability) score for the CVE. |  |
| `lastDetectedOn` | `number` | Timestamp of the most recent time the CVE was detected in the fleet. |  |
| `software` | `array` **|** `null` | Names of the software titles affected by the CVE across the fleet. |  |

---

### Kandji Vulnerability

`kandji_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `devicesImpacted` | `number` | Number of devices in the fleet affected by the CVE. |  |
| `firstDetectedOn` | `number` | Timestamp of the first time the CVE was detected in the fleet. |  |
| `kevScore` | `number` | Iru KEV (Known Exploited Vulnerability) score for the CVE. |  |
| `lastDetectedOn` | `number` | Timestamp of the most recent time the CVE was detected in the fleet. |  |
| `software` | `array` **|** `null` | Names of the software titles affected by the CVE across the fleet. |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name accuracy for Kandji device entities, using human-readable names for macOS and iOS devices.
-   **2025-06-04** — Added CVE ID to Kandji vulnerability entities and enabled the Vulnerability entity class for unified vulnerability querying.
-   **2025-04-28** — Added Kandji vulnerability and file threat ingestion, exposing device vulnerabilities and detected file threats as new entity types.

---

Source: /integrations/directory/knowbe4

# KnowBe4

Visualize Knowbe4 users, groups, training campaigns, and modules, and monitor changes through queries and alerts.

## Installation

For you to use this integration, JupiterOne requires the regional site for where your account is located and a Knowbe4 API key configured for use in JupiterOne.

### Configuration in Knowbe4

You can generate a new key in your KnowBe4 account settings under the API section. Be sure to request a key for the Reporting API, not for the User Event API. Select the Enabled Reporting API Access option, and click **Save Changes**. Refresh the page to ensure that the changes were saved. Then, copy the API Token to use in JupiterOne.

> **INFO**
> 
> KnowBe4 APIs are available to Platinum and Diamond customers only. See the [KnowBe4 API Reference Guide](https://developer.knowbe4.com/rest/reporting/) for more information.

### Configuration in JupiterOne

To install the Knowbe4 integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Knowbe4. Click **New Instance** to begin configuring your integration, providing the following:

-   **Account Name** used to identify the Knowbe4 account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` option is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Site of your KnowBe4 account**, either `US` or `EU`.
    
-   **API Key** configured in your KnowBe4 account.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| KnowBe4 Account | `knowbe4_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| KnowBe4 Group | `knowbe4_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| KnowBe4 Phishing Campaign | `knowbe4_phishing_campaign` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |
| KnowBe4 Phishing Security Test | `knowbe4_phishing_security_test` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| KnowBe4 Phishing Security Test Results | `knowbe4_phishing_security_test_result` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| KnowBe4 Training Campaign | `training_campaign` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |
| KnowBe4 Training Module | `training_module` | [Training](https://docs.jupiterone.io/data-model/schemas/Training), [Module](https://docs.jupiterone.io/data-model/schemas/Module) |
| KnowBe4 User | `knowbe4_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `knowbe4_account` | **HAS** | `knowbe4_user_group` |
| `knowbe4_account` | **HAS** | `knowbe4_user` |
| `knowbe4_account` | **HAS** | `training_campaign` |
| `knowbe4_account` | **HAS** | `knowbe4_phishing_campaign` |
| `knowbe4_phishing_campaign` | **CONTAINS** | `knowbe4_phishing_security_test` |
| `knowbe4_phishing_security_test` | **CONTAINS** | `knowbe4_phishing_security_test_result` |
| `knowbe4_user` | **COMPLETED** | `training_module` |
| `knowbe4_user` | **HAS** | `knowbe4_phishing_security_test_result` |
| `knowbe4_user_group` | **HAS** | `knowbe4_user` |
| `training_campaign` | **ASSIGNED** | `knowbe4_user_group` |
| `training_campaign` | **HAS** | `training_module` |
| `training_module` | **ASSIGNED** | `knowbe4_user` |

### Knowbe4 User

`knowbe4_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `adiGuid` | `string` |  |  |
| `adiManageable` | `boolean` |  |  |
| `aliases` | `array` of `string`s |  |  |
| `archivedAt` | `string` | This property is deprecated. Please use archivedOn instead. | **deprecated**: true |
| `archivedOn` | `integer` |  |  |
| `comment` | `string` |  |  |
| `department` | `string` |  |  |
| `division` | `string` |  |  |
| `employeeNumber` | `string` |  |  |
| `employeeStartDate` | `integer` |  |  |
| `extension` | `string` |  |  |
| `groups` | `array` of `integer`s |  |  |
| `jobTitle` | `string` |  |  |
| `joinedOn` | `integer` |  |  |
| `language` | `string` |  |  |
| `lastSignIn` | `integer` |  |  |
| `location` | `string` |  |  |
| `managerEmail` | `string` |  |  |
| `managerName` | `string` |  |  |
| `mobilePhoneNumber` | `string` |  |  |
| `organization` | `string` |  |  |
| `phishPronePercentage` | `number` |  |  |
| `phoneNumber` | `string` |  |  |

---

## Release Notes

-   **2026-03-23** — Added QR code scanned tracking to KnowBe4 phishing security test result entities.
-   **2026-03-18** — Added parsed timestamp properties for phishing campaign and test result events, enabling date-based queries on scheduled, delivered, opened, clicked, and reported activity times.

---

Source: /integrations/directory/kong-konnect

# Kong Konnect

Visualize your Kong Konnect control planes and their Gateway services, routes, consumers and plugins in JupiterOne. See which APIs are protected by an auth plugin and which are exposed without one, and monitor configuration changes through queries and alerts.

## Installation

This integration reads your Kong Konnect organization through the [Konnect Control Planes](https://developer.konghq.com/api/konnect/control-planes/v2/) and [Control Planes Config](https://developer.konghq.com/api/konnect/control-planes-config/v2/) v2 APIs — the Control Planes in your organization, and the Gateway configuration each one owns: Services, Routes, Consumers, Consumer Groups, Plugins and Certificates. It is read-only, issuing only `GET` requests, and never modifies your Gateway configuration.

Plugins are attached to the Service, Route or Consumer they are scoped to, and Routes to the Service they proxy to, so gateway policy coverage is queryable directly from the graph.

### Prerequisites

-   A **Kong Konnect** organization.
-   The **geographic region** your organization is hosted in. Konnect data is geo-scoped, so this determines which API host the integration reads from — see **Choosing a region** below.
-   A Konnect **access token** with read access to your Control Planes — see **Creating an access token** below.
-   Access to JupiterOne with permission to configure integrations.

### Choosing a region

Konnect runs in six geographic regions, and each one is served from its own API host:

| Region | API host |
| --- | --- |
| United States (`us`) | `https://us.api.konghq.com` |
| Europe (`eu`) | `https://eu.api.konghq.com` |
| Australia (`au`) | `https://au.api.konghq.com` |
| India (`in`) | `https://in.api.konghq.com` |
| Middle East (`me`) | `https://me.api.konghq.com` |
| Singapore (`sg`) | `https://sg.api.konghq.com` |

> **NOTE**
> 
> Konnect objects such as Control Planes, Services and Consumers are **geo-specific** — an object created in one region does not exist in another, and only authentication, billing and usage are shared between regions. An integration instance therefore sees exactly one region. If your organization operates in more than one, create one instance per region.
> 
> The Singapore region must be opted into by a Konnect org admin in the region picker before it can be used. See [Geographic regions](https://developer.konghq.com/konnect-platform/geos/) for the current list.

### Creating an access token

The integration authenticates with a bearer token, and accepts either kind of Konnect access token:

-   A **Personal Access Token (PAT)**, prefixed `kpat_`, tied to a user account.
-   A **System Account Access Token (SPAT)**, prefixed `spat_`, tied to a system account.

A system account is the better choice for an integration: it is not tied to a person, so the integration keeps working when that person's access changes or they leave the organization. System accounts cannot sign in to the Konnect UI and exist only for API use.

To create a personal access token, select your user icon in Konnect to open the context menu, click **Personal access tokens**, then click **Generate token**.

> **CAUTION**
> 
> The token is displayed only once, when it is generated. Record it before leaving the page — if you lose it, you must generate a new one.

#### Granting read access

A Konnect token carries exactly the access of the identity it belongs to — Konnect has no separate scopes or permission strings for tokens, only the RBAC roles assigned to that user or system account.

Assign the **Control Planes → Viewer** role, which grants "read only access to all entities within a control plane" and covers everything this integration reads. Roles can be scoped to one Control Plane or to all Control Planes.

> **NOTE**
> 
> Scope the role to **all Control Planes**. `GET /control-planes` returns only the Control Planes the identity has a role on, so a token scoped to a subset silently ingests only that subset rather than reporting an error. If you intend to cover the whole organization, grant the role organization-wide — or use the predefined **Organization Admin (Read Only)** team, which can view all entities and configuration in the organization.

See [Teams and roles](https://developer.konghq.com/konnect-platform/teams-and-roles/) for how roles are assigned to users, teams and system accounts.

Personal access tokens have a maximum lifetime of 12 months, are limited to 10 per user, and are revoked after 12 months of inactivity. Plan a rotation before the token expires, or the integration will begin failing authentication.

### Configuration in JupiterOne

To install the Kong Konnect integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Kong Konnect**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Kong Konnect account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **Personal Access Token** — the `kpat_` or `spat_` token you created above.
    
-   Your **Region** — the geographic region your Konnect organization is hosted in, selected from the list.
    

Click **Create** once all values are provided to finalize the integration.

#### Data sources

You can narrow what the integration collects from the instance's ingestion source settings. All sources are enabled by default.

| Ingestion source | Default | Data collected |
| --- | --- | --- |
| **Fetch Control Planes** | Enabled | The Control Planes in your organization, with cluster type, data-plane auth type, and the Control Plane and telemetry endpoints. |
| **Fetch Services** | Enabled | Gateway Services — the upstreams Kong proxies to — with the upstream address, protocol, timeouts, retries and TLS verification setting. |
| **Fetch Routes** | Enabled | Routes and their matching rules (protocols, methods, hosts, paths, SNIs or router expression), and the Service each one proxies to. |
| **Fetch Consumers** | Enabled | Consumers — the clients of your proxied Services — with their username and custom ID. |
| **Fetch Consumer Groups** | Enabled | Consumer Groups used to apply shared policy, and which Consumers belong to each. |
| **Fetch Plugins** | Enabled | Plugins, the policy they represent, whether they are enabled, and the Service, Route or Consumer each one is scoped to. |
| **Fetch Certificates** | Enabled | TLS Certificate metadata and the SNI hostnames associated with each. |

Sources build on one another, and disabling one also disables the sources that depend on it:

-   **Fetch Control Planes** underpins every other source — Gateway configuration is read per Control Plane, so disabling it disables all of them.
-   **Fetch Routes** depends on **Fetch Services**, so that each Route can be linked to the Service it proxies to.
-   **Fetch Consumer Groups** depends on **Fetch Consumers**, so that group membership can be resolved.
-   **Fetch Plugins** depends on **Fetch Services**, **Fetch Routes** and **Fetch Consumers**, so that each Plugin can be attached to what it protects. Because Plugins carry your authentication and rate-limiting policy, check this before turning any of those three off.

> **NOTE**
> 
> Certificate private keys are never ingested. The Konnect API returns the PEM `cert` and `key` material on every Certificate, and the integration discards it before anything is written to the graph — only the certificate ID, SNIs, tags and timestamps are kept. Plugin `config` blocks are discarded the same way, since they hold credentials for several plugin types.

> **NOTE**
> 
> **Control Plane groups** are ingested as Control Planes but their Gateway configuration is not read separately. A group is a read-only Control Plane that combines the configuration of its member Control Planes under the same entity IDs, so reading both would duplicate every Service, Route, Consumer, Plugin and Certificate. The members are ingested directly instead, and each skipped group is recorded in the job log.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Konnect API authentication](https://developer.konghq.com/konnect-api/) — personal access tokens, system accounts and the regional API hosts
-   [Geographic regions](https://developer.konghq.com/konnect-platform/geos/) — the Konnect regions and what is scoped to each
-   [Teams and roles](https://developer.konghq.com/konnect-platform/teams-and-roles/) — the Control Planes roles and how they are assigned
-   [Control plane groups](https://developer.konghq.com/gateway/control-plane-groups/) — how a group combines its members' configuration
-   [Konnect Control Planes Config API](https://developer.konghq.com/api/konnect/control-planes-config/v2/) — the Gateway configuration endpoints this integration reads

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `Control Planes: Viewer`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (8)

-   `GET /control-planes`
-   `GET /control-planes/{controlPlaneId}/core-entities/certificates`
-   `GET /control-planes/{controlPlaneId}/core-entities/consumer_groups`
-   `GET /control-planes/{controlPlaneId}/core-entities/consumer_groups/{ConsumerGroupId}/consumers`
-   `GET /control-planes/{controlPlaneId}/core-entities/consumers`
-   `GET /control-planes/{controlPlaneId}/core-entities/plugins`
-   `GET /control-planes/{controlPlaneId}/core-entities/routes`
-   `GET /control-planes/{controlPlaneId}/core-entities/services`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://developer.konghq.com/api/konnect/control-planes-config/v2/](https://developer.konghq.com/api/konnect/control-planes-config/v2/)
-   [https://developer.konghq.com/api/konnect/control-planes/v2/](https://developer.konghq.com/api/konnect/control-planes/v2/)
-   [https://developer.konghq.com/konnect/org-management/roles-and-permissions/](https://developer.konghq.com/konnect/org-management/roles-and-permissions/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (6)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Fetch Certificates | `Control Planes: Viewer` | `GET /control-planes/{controlPlaneId}/core-entities/certificates` |
| Fetch Consumer Groups | `Control Planes: Viewer` | `GET /control-planes/{controlPlaneId}/core-entities/consumer_groups`, `GET /control-planes/{controlPlaneId}/core-entities/consumer_groups/{ConsumerGroupId}/consumers` |
| Fetch Consumers | `Control Planes: Viewer` | `GET /control-planes/{controlPlaneId}/core-entities/consumers` |
| Fetch Plugins | `Control Planes: Viewer` | `GET /control-planes/{controlPlaneId}/core-entities/plugins` |
| Fetch Routes | `Control Planes: Viewer` | `GET /control-planes/{controlPlaneId}/core-entities/routes` |
| Fetch Services | `Control Planes: Viewer` | `GET /control-planes/{controlPlaneId}/core-entities/services` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `kong_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Certificate | `kong_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Consumer | `kong_consumer` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| ConsumerGroup | `kong_consumer_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| ControlPlane | `kong_control_plane` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Plugin | `kong_plugin` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Route | `kong_route` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Service | `kong_service` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `kong_account` | **HAS** | `kong_control_plane` |
| `kong_consumer_group` | **HAS** | `kong_consumer` |
| `kong_control_plane` | **HAS** | `kong_service` |
| `kong_control_plane` | **HAS** | `kong_route` |
| `kong_control_plane` | **HAS** | `kong_consumer` |
| `kong_control_plane` | **HAS** | `kong_consumer_group` |
| `kong_control_plane` | **HAS** | `kong_plugin` |
| `kong_control_plane` | **HAS** | `kong_certificate` |
| `kong_plugin` | **PROTECTS** | `kong_service` |
| `kong_plugin` | **PROTECTS** | `kong_route` |
| `kong_plugin` | **PROTECTS** | `kong_consumer` |
| `kong_route` | **CONNECTS** | `kong_service` |

### Kong Account

`kong_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`region` \*

 | `string` | The Kong Konnect geographic region hosting the organization ('us', 'eu', 'au', 'in', 'me' or 'sg'). |  |

---

### Kong Certificate

`kong_certificate` inherits from [Certificate](/data-model/schemas/Certificate.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`snis` \*

 | `array` **|** `null` | Server Name Indication hostnames associated with the Certificate. |  |

---

### Kong Consumer

`kong_consumer` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`customId` \*

 | `string` **|** `null` | An existing unique ID for the Consumer, for mapping to an external datastore. |  |

---

### Kong Consumer Group

`kong_consumer_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

---

### Kong Control Plane

`kong_control_plane` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authType` \*

 | `string` **|** `null` | The data-plane auth type ('pinned\_client\_certs' or 'pki\_client\_certs'). |  |
| 

`clusterType` \*

 | `string` **|** `null` | The cluster type of the Control Plane (e.g. 'CLUSTER\_TYPE\_CONTROL\_PLANE'). |  |
| 

`controlPlaneEndpoint` \*

 | `string` **|** `null` | The Control Plane endpoint URL for data planes. |  |
| 

`isCloudGateway` \*

 | `boolean` **|** `null` | Whether the Control Plane can be used for cloud gateways. |  |
| 

`telemetryEndpoint` \*

 | `string` **|** `null` | The telemetry endpoint URL for data planes. |  |

---

### Kong Plugin

`kong_plugin` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`consumerGroupId` \*

 | `string` **|** `null` | The id of the Consumer Group the Plugin is scoped to, if any. |  |
| 

`instanceName` \*

 | `string` **|** `null` | An optional unique instance name for the Plugin. |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` | Whether the Plugin is enabled. |  |
| 

`pluginName` \*

 | `string` | The Kong plugin type name (e.g. 'rate-limiting', 'key-auth', 'cors'). |  |
| 

`protocols` \*

 | `array` **|** `null` | Protocols the Plugin applies to. |  |

---

### Kong Route

`kong_route` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`expression` \*

 | `string` **|** `null` | Router Expression used to match the Route (expressions router flavor). |  |
| 

`hosts` \*

 | `array` **|** `null` | Domain names that match this Route. |  |
| 

`httpsRedirectStatusCode` \*

 | `number` **|** `null` | Status code Kong responds with to redirect HTTP requests to HTTPS. |  |
| 

`isPreserveHostEnabled` \*

 | `boolean` **|** `null` | Whether the request Host header is used in the upstream request. |  |
| 

`isStripPathEnabled` \*

 | `boolean` **|** `null` | Whether the matching path prefix is stripped from the upstream request URL. |  |
| 

`methods` \*

 | `array` **|** `null` | HTTP methods that match this Route. |  |
| 

`pathHandling` \*

 | `string` **|** `null` | How Service and Route paths are combined ('v0' or 'v1'). |  |
| 

`paths` \*

 | `array` **|** `null` | Paths that match this Route. |  |
| 

`protocols` \*

 | `array` **|** `null` | Protocols this Route allows (e.g. http, https, grpc). |  |
| 

`snis` \*

 | `array` **|** `null` | SNIs that match this Route (for tls/tls\_passthrough). |  |

---

### Kong Service

`kong_service` inherits from [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`connectTimeout` \*

 | `number` **|** `null` | Timeout in milliseconds for establishing a connection to the upstream. |  |
| 

`host` \*

 | `string` | The host of the upstream server. |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` | Whether the Service is active. |  |
| 

`isTlsVerificationEnabled` \*

 | `boolean` **|** `null` | Whether verification of the upstream TLS certificate is enabled. |  |
| 

`path` \*

 | `string` **|** `null` | The path used in requests to the upstream server. |  |
| 

`port` \*

 | `number` **|** `null` | The upstream server port. |  |
| 

`protocol` \*

 | `string` **|** `null` | The protocol used to communicate with the upstream (e.g. 'http', 'https', 'grpc'). |  |
| 

`readTimeout` \*

 | `number` **|** `null` | Timeout in milliseconds between two successive read operations. |  |
| 

`retries` \*

 | `number` **|** `null` | The number of retries to execute upon proxy failure. |  |
| 

`writeTimeout` \*

 | `number` **|** `null` | Timeout in milliseconds between two successive write operations. |  |

---

---

Source: /integrations/directory/kubernetes

# Kubernetes Native

Visualize Kubernetes resources and monitor changes through queries and alerts.

> **WARNING**
> 
> The Kubernetes Native integration is deprecated and no longer receives new development. Use the [Kubernetes Managed integration](/integrations/directory/kubernetes-managed.md) instead, which runs on a [Kubernetes collector](/integrations/development/collector/kubernetes.md), is scheduled and monitored by JupiterOne, collects more entities and relationships, supports Custom Resource Definitions, and does not require a per-instance integration API key.
> 
> If you are already running this integration, see the [Migration](/integrations/directory/kubernetes-managed.md?integration-docs=migration) tab on the Kubernetes Managed page.

## Installation

> **INFO**
> 
> To use this integration, you must have a running Kubernetes cluster. This integration with JupiterOne is deployed as a pod and interacts with a Kubernetes API server.

### Configuration in JupiterOne

1.  Navigate to the **Integrations** tab in JupiterOne and select **Kubernetes**.
    
2.  Click **New Instance** to begin configuring your integration and provide the following:
    
    -   **Account Name** — used to identify the Kubernetes account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName** toggle is enabled.
    -   **Description** (optional) — helps identify the integration instance.
3.  Click **Create**. Your instance appears in the list of Kubernetes instances.
    
4.  Click the name of the new instance and go to the **API Keys** tab.
    
5.  Follow the prompts to create an integration API key.
    
6.  Click **Reveal** and copy the API key.
    

For the Kubernetes configuration you will need:

-   The Integration API Key you just created
-   The Integration Instance ID (listed as **ID** in Configuration Settings)
-   Your Account ID (listed under **Account Management** after clicking the gear icon)

### Configuration in Kubernetes using Helm (recommended)

The easiest way to install and keep the integration up to date is through the published Helm chart. See the [JupiterOne Helm repository](https://github.com/JupiterOne/helm-charts/tree/main/charts/graph-kubernetes) for full chart documentation.

#### Quickstart

```bash
helm repo add jupiterone https://jupiterone.github.io/helm-charts
helm repo update
helm install [RELEASE_NAME] jupiterone/graph-kubernetes \
  --set secrets.jupiteroneAccountId="<account-id>" \
  --set secrets.jupiteroneApiKey="<api-key>" \
  --set secrets.jupiteroneIntegrationInstanceId="<integration-instance-id>"
```

The Helm chart automatically creates the service account, the required RBAC Role/ClusterRole, and the RoleBinding/ClusterRoleBinding for the integration.

### Configuration in Kubernetes using standard YAML

#### Authentication — RBAC

The integration runs as a Kubernetes service account that must be granted **read** access to the resources it ingests. It dynamically skips any resource type the service account cannot access, so you can tune permissions to match what your cluster allows.

> **NOTE**
> 
> The built-in `view` ClusterRole is **not sufficient**. It omits `secrets`, cluster-scoped RBAC resources (`clusterroles`, `clusterrolebindings`), `nodes`, and `certificatesigningrequests`, which the integration collects. Use a custom Role or ClusterRole as shown below.

**Namespace-scoped access** (limits ingestion to a single namespace):

1.  Create a service account:
    
    ```bash
    kubectl create sa jupiterone-integration -n <namespace>
    ```
    
2.  Apply a custom Role granting read access to the required resources, then bind it:
    
    ```bash
    kubectl apply -f role.yml
    kubectl apply -f roleBinding.yml
    ```
    

**Cluster-wide access** (ingests all namespaces and cluster-scoped resources):

1.  Create a service account:
    
    ```bash
    kubectl create sa jupiterone-integration-cluster
    ```
    
2.  Apply a custom ClusterRole and ClusterRoleBinding:
    
    ```bash
    kubectl apply -f clusterRole.yml
    kubectl apply -f clusterRoleBinding.yml
    ```
    

See the [Helm chart RBAC templates](https://github.com/JupiterOne/helm-charts/tree/main/charts/graph-kubernetes) for reference Role and ClusterRole definitions that match the integration's full resource requirements.

> **NOTE**
> 
> If you use a different service account name or namespace, update the names consistently across all YAML files and `kubectl` commands.

#### Secrets

The integration reads your JupiterOne credentials from Kubernetes Secrets. Create the secret with base64-encoded values:

```bash
kubectl apply -f createSecret.yml
```

#### Deploying

Deploy the integration as a Kubernetes CronJob:

-   **Namespace-scoped access:**
    
    ```bash
    kubectl apply -f cronjobNamespace.yml
    ```
    
-   **Cluster-wide access:**
    
    ```bash
    kubectl apply -f cronjobCluster.yml
    ```
    

#### Debugging

-   Check whether the CronJob was created:
    
    ```bash
    kubectl get cronjob
    ```
    
-   Check whether the CronJob has spawned jobs:
    
    ```bash
    kubectl get job
    ```
    
-   View pod logs:
    
    ```bash
    kubectl logs --selector job-name=<job-name>
    ```
    

#### Uninstall

```bash
kubectl delete cronjob <name>
kubectl delete serviceaccount <serviceaccount> -n <namespace>
kubectl delete clusterrolebinding <clusterrolebinding>
kubectl delete clusterrole <clusterrole>
```

#### Upgrading

Reapply any changed resource manifest:

```bash
kubectl apply -f resourceFile.yaml
```

### Telemetry and Diagnostics

The Helm chart and vanilla Kubernetes YAML manifests include the OpenTelemetry Collector and FluentBit, with FluentBit forwarding container logs into the OpenTelemetry Collector. To forward telemetry to your own systems (CloudWatch, Prometheus, etc.), configure the collector to point to them and update the manifests.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Kubernetes Certificate Signing Request | `kube_certificate_signing_request` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Kubernetes Cluster | `kube_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Kubernetes Cluster Role | `kube_cluster_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Kubernetes Cluster Role Binding | `kube_cluster_role_binding` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Kubernetes ConfigMap | `kube_config_map` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Kubernetes Container | `kube_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| Kubernetes Container Spec | `kube_container_spec` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Kubernetes CronJob | `kube_cron_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Kubernetes Custom Resource | `kube_custom_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Kubernetes Custom Resource Definition | `kube_custom_resource_definition` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Kubernetes DaemonSet | `kube_daemon_set` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes Deployment | `kube_deployment` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes Image | `kube_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Kubernetes Job | `kube_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Kubernetes Namespace | `kube_namespace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Kubernetes Network Policy | `kube_network_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Kubernetes Node | `kube_node` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Kubernetes Pod | `kube_pod` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Kubernetes ReplicaSet | `kube_replica_set` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes Role | `kube_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Kubernetes Role Binding | `kube_role_binding` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Kubernetes Role Rule | `kube_role_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Kubernetes Secret | `kube_secret` | [Vault](https://docs.jupiterone.io/data-model/schemas/Vault), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Kubernetes Service | `kube_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Kubernetes Service Account | `kube_service_account` | [User](https://docs.jupiterone.io/data-model/schemas/User), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Kubernetes StatefulSet | `kube_stateful_set` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes User | `kube_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Kubernetes Volume | `kube_volume` | [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `kube_cluster` | **CONTAINS** | `kube_cluster_role` |
| `kube_cluster` | **CONTAINS** | `kube_cluster_role_binding` |
| `kube_cluster` | **CONTAINS** | `kube_namespace` |
| `kube_cluster_role` | **ENFORCES** | `kube_role_rule` |
| `kube_cluster_role` | **ASSIGNED** | `kube_role_binding` |
| `kube_cluster_role_binding` | **ASSIGNED** | `kube_service_account` |
| `kube_container` | **USES** | `kube_image` |
| `kube_container_spec` | **USES** | `kube_volume` |
| `kube_cron_job` | **MANAGES** | `kube_job` |
| `kube_cron_job` | **USES** | `kube_container_spec` |
| `kube_custom_resource` | **IMPLEMENTS** | `kube_custom_resource_definition` |
| `kube_daemon_set` | **USES** | `kube_container_spec` |
| `kube_deployment` | **USES** | `kube_container_spec` |
| `kube_deployment` | **MANAGES** | `kube_replica_set` |
| `kube_job` | **USES** | `kube_container_spec` |
| `kube_job` | **MANAGES** | `kube_pod` |
| `kube_namespace` | **CONTAINS** | `kube_network_policy` |
| `kube_namespace` | **CONTAINS** | `kube_service_account` |
| `kube_namespace` | **CONTAINS** | `kube_role` |
| `kube_namespace` | **CONTAINS** | `kube_role_binding` |
| `kube_namespace` | **CONTAINS** | `kube_service` |
| `kube_namespace` | **CONTAINS** | `kube_deployment` |
| `kube_namespace` | **CONTAINS** | `kube_replica_set` |
| `kube_namespace` | **CONTAINS** | `kube_stateful_set` |
| `kube_namespace` | **CONTAINS** | `kube_daemon_set` |
| `kube_namespace` | **CONTAINS** | `kube_job` |
| `kube_namespace` | **CONTAINS** | `kube_cron_job` |
| `kube_namespace` | **CONTAINS** | `kube_config_map` |
| `kube_namespace` | **CONTAINS** | `kube_secret` |
| `kube_node` | **HAS** | `kube_image` |
| `kube_node` | **RUNS** | `kube_pod` |
| `kube_pod` | **CONTAINS** | `kube_container` |
| `kube_pod` | **USES** | `kube_secret` |
| `kube_pod` | **USES** | `kube_container_spec` |
| `kube_pod` | **USES** | `kube_service_account` |
| `kube_pod` | **HAS** | `kube_certificate_signing_request` |
| `kube_replica_set` | **USES** | `kube_image` |
| `kube_replica_set` | **USES** | `kube_container_spec` |
| `kube_replica_set` | **MANAGES** | `kube_pod` |
| `kube_role` | **ENFORCES** | `kube_role_rule` |
| `kube_role` | **ASSIGNED** | `kube_cluster_role_binding` |
| `kube_role` | **ASSIGNED** | `kube_role_binding` |
| `kube_service_account` | **USES** | `kube_secret` |
| `kube_service_account` | **ASSIGNED** | `kube_role_binding` |
| `kube_stateful_set` | **MANAGES** | `kube_pod` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `kube_cluster` | **IS** | `azure_kubernetes_cluster` | FORWARD |
| `kube_cluster` | **IS** | `google_container_cluster` | FORWARD |

### Kube Service Account

`kube_service_account` inherits from [User](/data-model/schemas/User.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deletionGracePeriodSeconds` | `integer` |  |  |
| `generation` | `integer` |  |  |
| `namespace` | `string` |  |  |
| `resourceVersion` | `string` |  |  |
| `secretIds` | `array` of `string`s |  |  |
| `secretNames` | `array` of `string`s |  |  |

---

### Kube User

`kube_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `certFile` | `string` |  |  |
| `keyFile` | `string` |  |  |

---

## Release Notes

-   **2026-10-13** — Kubernetes Secret values and container environment variable values are no longer ingested, preventing sensitive credential data from appearing in the asset graph.
    
-   **2026-03-31** — Added OS kernel version to Kubernetes node entities.
    
-   **2025-10-03** — Added relationships linking Kubernetes role bindings to their assigned cluster roles.
    
-   **2025-09-25** — Added relationships linking Kubernetes pods to their assigned service accounts.
    
-   **2025-08-06** — Added namespace property to all Kubernetes resource entities for easier namespace-scoped queries.
    
-   **2025-06-03** — Added security context properties to Kubernetes pods and container specs, including seccomp profile type and privilege escalation settings.
    
-   **2025-05-21** — Added Kubernetes role rule ingestion as individual rule entities linked to their parent roles and cluster roles, exposing role permission details.
    
-   **2025-05-12** — Added ingestion of Kubernetes Certificate Signing Requests as certificate entities, with relationships linking pods to their certificate requests.
    
-   **2025-04-15** — Added support for Kubernetes Custom Resource Definitions and custom resources as queryable entities.

---

Source: /integrations/directory/kubernetes-managed

# Kubernetes Managed

Visualize Kubernetes resources and monitor changes through queries and alerts.

## Installation

### Prerequisites

> **TIP**
> 
> See the [Migration](/integrations/directory/kubernetes-managed.md?integration-docs=migration) tab for the full cutover sequence, data model differences, and answers to common migration questions.

Before installing the Kubernetes Managed integration, you must have a Kubernetes collector running. For instructions on setting up the Kubernetes collector, see the [Kubernetes collector documentation](/integrations/development/collector/kubernetes.md).

### Configuration in JupiterOne

1.  Navigate to the **Integrations** tab in JupiterOne and select **Kubernetes Managed**.
    
2.  Click **New Instance** to begin configuring your integration and provide the following:
    
    -   The **Account Name** used to identify the Kubernetes account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
        
    -   **Description** to assist in identifying the integration instance, if desired.
        
    -   When prompted about **where should this run**, select the Kubernetes collector you created in the prerequisites.
        
    -   **Use Default Kubernetes Configuration** (optional): Enable when running the integration outside of a Kubernetes cluster, such as on a local machine. When disabled, the integration uses the cluster's built-in in-cluster authentication. Disabled by default.
        
    -   **Ingest All Node Images** (optional): Enable to ingest every image cached on each node, instead of only the images in use by a running container. Required to ingest images at all if you are not ingesting pods. Disabled by default. See [Image ingestion](#image-ingestion).
        
3.  Click **Create** after all values are provided and your instance appears in the list of all your Kubernetes Managed instances.
    

### Helm

The Helm-based install is for users that would like their integrations managed via Kubernetes resources.

1.  **Ensure you have the repository set up and updated**

```shell
helm repo add jupiterone https://jupiterone.github.io/helm-charts
helm repo update
```

2.  **Find the name of your runner**. The integration needs to know the name of the runner.

```shell
kubectl get integrationrunner -n jupiterone
```

##### Output

```shell
NAME     STATE     DETAIL   REGISTRATION   AGE
runner   running            registered     162m
```

3.  **Configuration Options**

Values:

`includeNamespaces`, `excludeNamespaces`, `loadKubernetesConfigFromDefault`, `ingestAllNodeImages` and `crdMappingConfig` require kubernetes-managed chart 1.0.11 or later. Like `pollingInterval`, `pollingIntervalCron` and `resourceGroupId`, they apply only when the instance is created; change them in JupiterOne afterward. `ingestionSources` and the label and annotation values apply on every upgrade or run.

-   `collectorName` - (Default "runner"). This is the name of the Runner/Collector you installed as part of the Kubernetes Operator installation.
    
-   `includeNamespaces` - Namespaces to include, as a JSON list in one string, for example `includeNamespaces: '["default","production"]'` in a values file or `--set 'includeNamespaces=["default"\,"production"]'`. If specified, only these namespaces will be ingested.
    
-   `excludeNamespaces` - Namespaces to exclude from ingestion, in the same format as `includeNamespaces`.
    
-   `loadKubernetesConfigFromDefault` - (Default false). Set to `true` when running the integration outside of a Kubernetes cluster (for example, on your local machine). When `false`, the integration uses the cluster's built-in in-cluster authentication.
    
-   `crdMappingConfig` - The CRD mapping configuration (see [Managing the Configuration](#managing-the-configuration)). Pass the file with `--set-file crdMappingConfig=path/to/file.yaml`, or put it in a values file as a block:
    
    ```yaml
    crdMappingConfig: |
      resources:
        - name: applications.argoproj.io
          # rest of the mapping file, every line indented two spaces
    ```
    
-   `ingestAllNodeImages` - (Default false). Set to `true` to ingest every image cached on each node, instead of only the images in use by a running container. Required to ingest images at all if you are not ingesting pods. See [Image ingestion](#image-ingestion).
    
-   `pollingInterval` - (Default ONE\_WEEK). Specifies how often the integration runs to collect data. Options:
    
    -   DISABLED
    -   THIRTY\_MINUTES
    -   ONE\_HOUR
    -   FOUR\_HOURS
    -   EIGHT\_HOURS
    -   TWELVE\_HOURS
    -   ONE\_DAY
    -   ONE\_WEEK
-   `pollingIntervalCron` - (Default disabled). If setting this field, set **pollingInterval** to DISABLED. This option has two fields: `hour` and `dayOfWeek`. Example:
    
    ```shell
    --set pollingInterval=DISABLED --set pollingIntervalCron.hour=2 --set pollingIntervalCron.dayOfWeek=0
    ```
    
-   `ingestionSources` - (Default: integration defaults). Enables (`true`) or disables (`false`) individual resource types by ingestion source ID. Unlisted sources keep their default; **Container Specs** (`container-specs`) is the only source disabled by default. Run `helm show values jupiterone/kubernetes-managed` for the full list of IDs. Set it in a values file:
    
    ```yaml
    ingestionSources:
      secrets: false
      container-specs: true
    ```
    
    Pass the file on every install and upgrade (`-f values.yaml`). A `helm upgrade` that passes other values (`-f` or `--set`) but not this one resets it, which returns every source to its default, unless the upgrade uses `--reuse-values`. `--set ingestionSources.secrets=false` also works, but every later upgrade that passes values must repeat it.
    
    -   **Dependencies**: some sources feed others. Disabling `pods` also stops containers and volumes, and the images used by containers. Disabling `containers` stops those images too. Disabling `nodes` stops all image ingestion. With `ingestAllNodeImages` set to `true`, images cached on nodes are still ingested while `pods` or `containers` is disabled.
    -   **Ownership**: when set, this value owns the instance's ingestion source settings. Changes made in the JupiterOne UI are replaced the next time you change it. Account-level defaults configured for the integration are applied only when the instance is created, and the first change to this value replaces them, so list every non-default setting you want to keep. Removing the value returns every source to the integration's default.
    -   **Validation**: the operator applies only valid entries. An ID that is not one of the integration's ingestion sources, or a disable of a source that cannot be disabled, is not applied and is reported in the `IngestionSourcesApplied` condition, as is an entry JupiterOne did not store.
    -   **Versions**: requires Integration Operator v0.5.0 or later (operator chart 1.5.0 or later), and kubernetes-managed chart 1.0.9 or later (`helm show values jupiterone/kubernetes-managed` lists `ingestionSources`). Older operators and older kubernetes-managed charts silently ignore it. After upgrading, run `helm repo update`, then `helm upgrade` this chart again: an older CRD dropped `ingestionSources` when the resource was stored, so the value takes effect only once the chart is applied again.
-   `commonLabels`, `commonAnnotations` - (Default none). Labels and annotations for the `IntegrationInstance`, its Secret, and every object the operator creates for this integration's runs, including the job pod.
    
-   `jobLabels`, `jobAnnotations`, `podLabels`, `podAnnotations` - (Default none). Extra labels and annotations for this integration's runs only: `jobLabels` and `jobAnnotations` go on the run's Secrets, `IntegrationInstanceJob` and `Job`, and `podLabels` and `podAnnotations` go on the job pod. Changes apply to the next run.
    
    ```yaml
    commonLabels:
      team: security
    podAnnotations:
      sidecar.istio.io/inject: "false"
    ```
    
    These override the operator and runner charts' values on the same key. Quote numbers (`"1234"`). Node selectors, tolerations and other scheduling settings are set on the operator chart. They require kubernetes-managed chart 1.0.10 or later and Integration Operator v0.6.0 or later (operator chart 1.6.0 or later); upgrade the operator chart first. See [Labels, Annotations and Scheduling](/integrations/development/collector/kubernetes.md#labels-annotations-and-scheduling).
    

For a complete list of configuration options, run:

```shell
helm show values jupiterone/kubernetes-managed
```

4.  **Install the Managed Kubernetes Helm chart** Add in your configuration options from above into this command:

```shell
helm install kubernetes jupiterone/kubernetes-managed -n jupiterone --set collectorName=<runnerName>
```

5.  **Verify Installation** Check that the integration was successfully installed and registered with JupiterOne:

```shell
kubectl get integrationinstance -n jupiterone
```

##### Output

```shell
NAME         READY   REASON    AGE
kubernetes   True    Success   176m
```

## Data Volume Configuration

By default, the integration ingests all namespaces in your cluster. Use the options below to limit which namespaces are included.

### Data Filtering Options

| Field | Description | Default |
| --- | --- | --- |
| **Include Specific Namespaces** | Restrict ingestion to the listed namespaces only. In JupiterOne, separate names with commas; with Helm, see `includeNamespaces` above. If left empty, all namespaces are ingested (unless exclusions are specified). | All namespaces |
| **Exclude Specific Namespaces** | Skip the listed namespaces during ingestion. Useful for omitting system namespaces such as `kube-system`. In JupiterOne, separate names with commas; with Helm, see `excludeNamespaces` above. | None |

### Image ingestion

By default, `kube_image` entities are created only for images in use by a running container, and each container is linked to its image with a `kube_container` **USES** `kube_image` relationship. Images are derived from pods, so a cluster that does not ingest pods produces no images.

Enable **Ingest All Node Images** (`ingestAllNodeImages`) to also ingest the images cached on each node, whether or not a container is running them, and to relate each node to the images it holds with `kube_node` **HAS** `kube_image`. This is the option to use if you are not ingesting pods and still want image inventory.

| Field | Description | Default |
| --- | --- | --- |
| **Ingest All Node Images** | Ingest every image in each node's local image cache in addition to the images in use by a running container. | Disabled |

> **NOTE**
> 
> A node reports its cached images through `Node.status.images`, which kubelet truncates at `--node-status-max-images` (default 50, `-1` disables the limit) and which only covers images present in that node's local cache. Enabling this option therefore gives a best-effort inventory per node rather than a guaranteed complete one. Set `--node-status-max-images=-1` on your kubelets if you need the full list.

### RBAC

The Kubernetes collector installs with a ClusterRole that provides read-only access to Kubernetes resources. The collector has permissions to get, list, and watch the following:

**Core Resources:**

-   Pods, namespaces, service accounts, config maps, nodes, services, secrets, and events

**Application Workloads:**

-   Deployments, replica sets, stateful sets, daemon sets, jobs, and cron jobs

**Networking:**

-   Ingresses and network policies

**RBAC and Security:**

-   Cluster roles, cluster role bindings, roles, and role bindings
-   Self-subject access reviews and subject access reviews
-   Token reviews

**Extensions:**

-   All resources in the extensions API group

**Integration Management:**

-   Integration instance jobs, integration runners, and their status and finalizers (for managing integration workloads)
-   Listing custom resource definitions and certificate signing requests

The collector can't read other custom resources, including IntegrationInstances. To ingest them, grant access as described in [Permissions for custom resources](#permissions-for-custom-resources).

All permissions are read-only (get, list, watch) and do not allow modification of any cluster resources.

### Advanced: Configuring Custom Resource Definitions (CRDs)

By default, the Kubernetes Managed integration ingests standard Kubernetes resources. However, you can extend the integration to also collect and map Custom Resource Definitions (CRDs) that exist in your cluster. This is particularly useful for capturing custom resources created by operators, such as IntegrationRunners and IntegrationInstanceJobs from the JupiterOne Kubernetes Operator.

#### Overview

The CRD configuration allows you to:

-   **Define which custom resources to ingest**: Specify the CRD resources you want to collect from your cluster
-   **Map resource properties**: Transform CRD fields into JupiterOne entity properties
-   **Create relationships**: Define how custom resources relate to other entities in your JupiterOne graph

#### Configuration File Structure

The CRD configuration is defined in a YAML file with two main sections: `resources` and `relationships`. Both are optional: a file with only `resources` ingests entities without relationships. This configuration file can be provided when setting up your integration instance.

#### Managing the Configuration

Upload the file in the **CRD Mapping Configuration** field when you create the integration instance, or later from the instance's settings in JupiterOne.

-   **Validation**: JupiterOne checks the file when you upload it and shows the first problem with its line number, for example `line 4, resources[0]._type: "argocd_app" must start with "kube_cr_"`. The instance can't be saved until the file is valid. Each job checks the file again. If it's invalid, the job fails before collecting anything, and the job log lists the problems with their line numbers (up to 10).
-   **Removing the mapping**: remove the file from the field and save. The next job skips the custom resource steps, and the custom resource entities and relationships from earlier jobs are removed from your graph.
-   **Pausing the mapping**: to stop ingesting custom resources without deleting the file, disable the **Custom Resources** data source on the instance. As with removing the file, the custom resource entities and relationships are removed from your graph until you enable it again. If you set `ingestionSources` with Helm, set `custom-resources: false` there instead, because the Helm value replaces changes made in JupiterOne.
-   **Size**: a mapping can be up to about 900 KB (roughly 30,000 lines). Mappings over 128 KiB (about 4,000 lines) require Integration Operator v0.7.0 or later (operator chart 1.7.0 or later) and `graph-kubernetes-managed` 3.2.85 or later; if you mirror JupiterOne integration images to a private registry, update your copy first. Such a job can leave one failed pod with `argument list too long` before the operator runs it again with the mapping passed as a file; this is expected. If you apply the `IntegrationInstance` resource with `kubectl apply`, add `--server-side`.
-   **Instances created with Helm or the Integration Operator**: the operator applies the instance configuration, including the mapping, only when it creates the instance. After that, change or remove the mapping in JupiterOne; changing the Helm value doesn't update an existing instance. A mapping set any way other than the JupiterOne UI is first checked when a job starts.

#### Permissions for custom resources

The collector can read only the JupiterOne operator's IntegrationRunners and IntegrationInstanceJobs. For any other custom resource in your mapping, grant `get` and `list` on it to the integration's service account (`jupiterone` in the `jupiterone` namespace by default). Without this, the job still succeeds but ingests none of those resources. For example, for the Argo CD example below:

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: jupiterone-argocd-read
rules:
  - apiGroups: [argoproj.io]
    resources: [applications, appprojects]
    verbs: [get, list]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: jupiterone-argocd-read
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: jupiterone-argocd-read
subjects:
  - kind: ServiceAccount
    name: jupiterone
    namespace: jupiterone
```

#### Resources Section

The `resources` section defines which custom resources to ingest and how to map their properties to JupiterOne entities.

Each resource entry contains:

-   **`name`** (required): The fully qualified name of the CRD resource type, following the format `<plural>.<group>`. For example, `integrationrunners.integrations.jupiterone.io` refers to the `IntegrationRunner` CRD in the `integrations.jupiterone.io` API group.
    
-   **`version`** (optional): The API version of the resource. For example, `v1` indicates the resource uses version 1 of the API. If not provided, all versions will be ingested.
    
-   **`_type`** (required): The entity type that will be assigned to ingested resources in JupiterOne. This is a custom identifier that you'll use to query and reference these entities. It must start with `kube_cr_` (e.g., `kube_cr_integration_runner`).
    
-   **`_class`** (required): The entity class that categorizes the resource in JupiterOne's data model. All supported entity classes can be found in the [JupiterOne Data Model documentation](/data-model/jupiterone-data-model.md#defined-entities).
    
-   **`propertyToFieldMap`** (required): A mapping that defines how fields from the Kubernetes resource are transformed into JupiterOne entity properties. This is where you specify which Kubernetes resource fields map to which JupiterOne properties.
    
    -   **`_key`** (required): Maps to the unique identifier for the entity in JupiterOne. It's recommended to use `metadata.uid` to ensure uniqueness.
    -   **Standard properties**: Common mappings include:
        -   `name`: Usually maps to `metadata.name`
        -   `namespace`: Usually maps to `metadata.namespace`
        -   `createdOn`: Usually maps to `metadata.creationTimestamp`
    -   **Custom properties**: You can map any field from the resource's `spec` or `status` sections to custom properties. For example, `accountId: spec.accountId` maps the `accountId` field from the resource's spec to a property called `accountId` on the JupiterOne entity.

#### Relationships Section

The `relationships` section defines how custom resources relate to other entities in your JupiterOne graph. This allows you to create meaningful connections between resources, such as showing which secrets an IntegrationRunner uses or which runner an IntegrationInstanceJob runs on.

Each relationship entry contains:

-   **`_class`** (required): The type of relationship. All supported relationship classes can be found in the [JupiterOne Data Model documentation](/data-model/jupiterone-data-model.md#relationships).
    
-   **`sourceType`** (required): The entity type of the source entity in the relationship. This should match the `_type` you defined in the resources section (e.g., `kube_cr_integration_runner`).
    
-   **`targetType`** (required): The entity type of the target entity in the relationship. This can be:
    
    -   Another custom resource type you've defined (e.g., `kube_cr_integration_instance_job`)
    -   A standard Kubernetes resource type (e.g., `kube_secret`, `kube_pod`, `kube_namespace`)
-   **`matchBy`** (required): Defines how to match the source and target entities to create the relationship. This is a key-value mapping where:
    
    -   The **key** is a property name on the source entity (e.g., `secretName`)
    -   The **value** is a property name on the target entity (e.g., `name`)
    
    The relationship is created when the source entity's property value matches the target entity's property value. You can specify multiple match conditions, and all must be satisfied (AND logic). For example:
    
    ```yaml
    matchBy:
      secretName: name
      namespace: namespace
    ```
    
    This creates a relationship when both the `secretName` on the source matches the `name` on the target, AND the `namespace` on the source matches the `namespace` on the target.
    
    > **NOTE**
    > 
    > If a property is not defined for either the source or the target, the relationship won't be created. Undefined doesn't match with undefined.
    

#### Validation Rules

A file is rejected when it breaks any of these rules:

-   `resources` and `relationships` must be lists (or left blank).
-   Each resource needs `name`, `_type`, `_class`, and `propertyToFieldMap` with a `_key`.
-   `_type` must start with `kube_cr_`; `sourceType` and `targetType` must start with `kube_`.
-   `_class` must be a JupiterOne entity class for a resource, or a relationship class for a relationship.
-   Every value in `propertyToFieldMap` and `matchBy` must be text (a field path or a property name) or left blank, not a number or a list. `_key` can't be blank. A blank `propertyToFieldMap` value maps nothing, and a blank `matchBy` value means that relationship is never created.
-   `propertyToFieldMap` keys can't start with `_` (other than `_key`) or be `constructor` or `prototype`. Keys are limited to 256 characters and paths to 512.
-   `matchBy` needs at least one entry.

Unrecognized keys are ignored rather than rejected, so check the spelling of keys such as `relationships` and `version`.

Mapped values are stored as text. A field that holds a list, such as `spec.dnsNames`, is stored as its items joined with commas. A field that holds an object, or a list of objects such as `status.conditions`, is stored as `[object Object]`, once for each list item; map a single value inside it instead, using an index for list items (for example `spec.sources.0.repoURL`).

#### Example Configuration

Here's a complete example configuration that ingests IntegrationRunners and IntegrationInstanceJobs and creates relationships between them and their associated secrets:

```yaml
resources:
  - name: integrationrunners.integrations.jupiterone.io
    version: v1
    _type: kube_cr_integration_runner
    _class: Process
    propertyToFieldMap:
      _key: metadata.uid
      name: metadata.name
      namespace: metadata.namespace
      createdOn: metadata.creationTimestamp
      accountId: spec.accountId
      collectorId: spec.collectorId
      collectorPoolId: spec.collectorPoolId
      jupiterOneEnvironment: spec.jupiterOneEnvironment
      secretAPITokenName: spec.secretAPITokenName
      secretName: spec.secretName
      syncIntervalSeconds: spec.syncIntervalSeconds

  - name: integrationinstancejobs.integrations.jupiterone.io
    _type: kube_cr_integration_instance_job
    _class: Task
    propertyToFieldMap:
      _key: metadata.uid
      name: metadata.name
      namespace: metadata.namespace
      createdOn: metadata.creationTimestamp
      accountId: spec.accountId
      certificateIdentity: spec.certificateIdentity
      image: spec.image
      integrationDefinitionName: spec.integrationDefinitionName
      integrationInstanceId: spec.integrationInstanceId
      integrationInstanceJobId: spec.integrationInstanceJobId
      integrationRunnerName: spec.integrationRunnerName
      secretName: spec.secretName

relationships:
  - _class: HAS
    sourceType: kube_cr_integration_runner
    targetType: kube_secret
    matchBy:
      secretName: name
      namespace: namespace

  - _class: HAS
    sourceType: kube_cr_integration_instance_job
    targetType: kube_secret
    matchBy:
      secretName: name
      namespace: namespace

  - _class: HAS
    sourceType: kube_cr_integration_instance_job
    targetType: kube_cr_integration_runner
    matchBy:
      integrationRunnerName: name
      namespace: namespace
```

#### Understanding the Example

**Resources Explained:**

1.  **IntegrationRunner Resource**:
    
    -   Ingested as `kube_cr_integration_runner` entities with class `Process`
    -   Maps standard Kubernetes metadata (uid, name, namespace, creationTimestamp)
    -   Maps custom spec fields like `accountId`, `collectorId`, and `syncIntervalSeconds` to entity properties
    -   The `secretName` property is used later to create relationships with secrets
2.  **IntegrationInstanceJob Resource**:
    
    -   Ingested as `kube_cr_integration_instance_job` entities with class `Task`
    -   Similar metadata mapping
    -   Maps job-specific fields like `integrationInstanceId`, `image`, and `integrationRunnerName`
    -   The `integrationRunnerName` property links jobs to their runners

**Relationships Explained:**

1.  **IntegrationRunner → Secret**:
    
    -   Creates a `HAS` relationship from each IntegrationRunner to the secret it uses
    -   Matches when the runner's `secretName` equals the secret's `name` AND they're in the same `namespace`
2.  **IntegrationInstanceJob → Secret**:
    
    -   Creates a `HAS` relationship from each IntegrationInstanceJob to its associated secret
    -   Uses the same matching logic as above
3.  **IntegrationInstanceJob → IntegrationRunner**:
    
    -   Creates a `HAS` relationship showing which runner executes each job
    -   Matches when the job's `integrationRunnerName` equals the runner's `name` AND they're in the same `namespace`

#### More Examples

**Argo CD applications and projects**

Ingests Argo CD `Application` and `AppProject` resources, and relates each project to the applications that belong to it:

```yaml
resources:
  - name: applications.argoproj.io
    _type: kube_cr_argocd_application
    _class: Application
    propertyToFieldMap:
      _key: metadata.uid
      name: metadata.name
      namespace: metadata.namespace
      createdOn: metadata.creationTimestamp
      project: spec.project
      repoURL: spec.source.repoURL
      path: spec.source.path
      targetRevision: spec.source.targetRevision
      destinationServer: spec.destination.server
      destinationNamespace: spec.destination.namespace
      syncStatus: status.sync.status
      healthStatus: status.health.status

  - name: appprojects.argoproj.io
    _type: kube_cr_argocd_project
    _class: Project
    propertyToFieldMap:
      _key: metadata.uid
      name: metadata.name
      namespace: metadata.namespace
      createdOn: metadata.creationTimestamp
      description: spec.description

relationships:
  - _class: HAS
    sourceType: kube_cr_argocd_project
    targetType: kube_cr_argocd_application
    matchBy:
      name: project
      namespace: namespace
```

This needs the `argoproj.io` permissions shown in [Permissions for custom resources](#permissions-for-custom-resources). If your Applications live outside the Argo CD namespace, remove `namespace: namespace` from `matchBy`. Applications with multiple sources use `spec.sources` instead of `spec.source`, so map `spec.sources.0.repoURL` and similar for those.

**cert-manager certificates**

Ingests cert-manager `Certificate` resources and relates each certificate to the secret that holds it:

```yaml
resources:
  - name: certificates.cert-manager.io
    version: v1
    _type: kube_cr_certmanager_certificate
    _class: Certificate
    propertyToFieldMap:
      _key: metadata.uid
      name: metadata.name
      namespace: metadata.namespace
      createdOn: metadata.creationTimestamp
      commonName: spec.commonName
      dnsNames: spec.dnsNames
      secretName: spec.secretName
      issuerName: spec.issuerRef.name
      issuerKind: spec.issuerRef.kind
      notAfter: status.notAfter
      renewalTime: status.renewalTime

relationships:
  - _class: HAS
    sourceType: kube_cr_certmanager_certificate
    targetType: kube_secret
    matchBy:
      secretName: name
      namespace: namespace
```

This needs `get` and `list` on `certificates` in the `cert-manager.io` group (see [Permissions for custom resources](#permissions-for-custom-resources)), and the relationship needs the **Secrets** data source enabled.

To find the `name` of any other custom resource, run `kubectl get crds`. To see which fields a resource has, run `kubectl get <name> -A -o yaml`.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

## Migrating from Kubernetes Native

The [Kubernetes Native](/integrations/directory/kubernetes.md) integration is deprecated. It is deployed as a CronJob from the `graph-kubernetes` Helm chart, and its job lifecycle is controlled by that chart rather than by JupiterOne, so JupiterOne has no visibility into its job logs or failures. No further development is planned for it.

This section covers moving an existing Native instance to this integration.

### Migration overview

The migration is additive: you stand up the new integration alongside the old one, confirm the new data, and only then remove the old one.

1.  Install the [Kubernetes collector](/integrations/development/collector/kubernetes.md) in the cluster.
2.  Create a Kubernetes Managed instance and assign it to that collector.
3.  Verify that the Managed instance completes a job and ingests the expected data.
4.  Decommission the Native integration.

Each cluster has its own collector and its own integration instance, as with Native. That does not mean migrating one cluster at a time by hand — both Helm charts are designed to be templated across clusters, so a GitOps tool can roll the whole fleet out from a single source. See [Migrating many clusters at once](#migrating-many-clusters-at-once).

> **CAUTION**
> 
> Between steps 2 and 4, both integrations are ingesting the same cluster, and their entities are not merged. See [Will I see duplicate entities during the migration?](#will-i-see-duplicate-entities-during-the-migration). Keep this window short.

### Before you begin

Meet the [collector prerequisites](/integrations/development/collector/kubernetes.md#prerequisites) — Kubernetes and Helm versions, and an account API token with Collector and Graph Data access. Integration create/update permission is needed only if you create the Managed instance with the Helm chart rather than the UI.

One requirement is specific to migrating: the collector runner pods are a different set of pods from the Native CronJob, so confirm that any NetworkPolicy, egress proxy, or firewall rule that allowed the CronJob to reach your JupiterOne API endpoint also applies to them.

#### Record your current Native configuration

Four Native settings have no equivalent that carries over automatically, so capture them before you start:

-   **Namespace scope.** Native limits ingestion through RBAC — a namespace-scoped `Role` ingests one namespace, a `ClusterRole` ingests the whole cluster. Managed instead uses the `includeNamespaces` and `excludeNamespaces` configuration options, so translate your scope deliberately.
-   **Schedule.** Native runs on the CronJob schedule defined in your chart values. Managed uses `pollingInterval`, which defaults to `ONE_WEEK` — set it explicitly, or the integration can appear to have stopped running. The interval must be one your account includes; otherwise creating the instance fails with `Invalid or unauthorized polling interval`.
-   **Resource types you skip.** If you removed permissions from the Native ClusterRole to stop collecting a resource type, do not carry that over. Managed treats a permission error the same as an empty result, so a missing permission and a temporary API failure both look like "no resources" and can remove those entities from your graph. Use [ingestion sources](#choosing-what-to-ingest) instead.
-   **Labels, annotations and scheduling.** Native's `jobLabels`, `jobAnnotations`, `podLabels` and `podAnnotations` have the same names in the `kubernetes-managed` chart. `nodeSelector`, `tolerations` and `affinity` (`antiAffinity` becomes part of `affinity`), `securityContext` and `containerSecurityContext` move to the operator chart's `controllerManager.job` values, as `podSecurityContext` and `containerSecurityContext`. Native's `resources` move to `controllerManager.jobResources`. To label everything the collector creates, use `commonLabels` on each chart. See [Labels, Annotations and Scheduling](/integrations/development/collector/kubernetes.md#labels-annotations-and-scheduling).

Namespace scope and schedule are documented under **Configuration Options** on the [Installation](/integrations/directory/kubernetes-managed.md?integration-docs=installation) tab.

Note the Native instance ID and name as well, so you can find it again when it is time to delete it.

#### Inventory what depends on your Kubernetes data

The Managed integration does not produce an identical graph. Review the [changes to the data model](#changes-to-the-data-model) below, then check your account for content that will be affected:

-   Saved questions, queries, and alert rules that filter on `_integrationInstanceId` or `_source`, or that reference the Native instance by name.
-   Dashboards, compliance mappings, and tags built on Kubernetes entities.
-   Anything that selects Kubernetes secrets by the `Vault` class, or that relies on the `kube_custom_resource` or `kube_custom_resource_definition` entity types.
-   Anything that references `kube_container_spec` or `kube_volume` entities by `_key`. Both are keyed differently in Managed.

Update these after cutover.

### Step 1: Install the Kubernetes collector

Follow the [Kubernetes collector installation guide](/integrations/development/collector/kubernetes.md) to install the JupiterOne Integration Operator and Integration Runner, then confirm the runner registered using [Verification](/integrations/development/collector/kubernetes.md#verification). Note the runner's name — you will need it in step 2. If you are migrating a fleet, see [Migrating many clusters at once](#migrating-many-clusters-at-once) before doing this by hand.

Two things to watch for when the cluster already ran the Native integration:

-   **Do not reuse the Native ServiceAccount or RBAC objects.** The Managed collector requires a different permission set, including read access to the operator's own CRDs and to resources such as `ingresses` that Native did not collect. It installs its own, all read-only.
-   **Remove any previous operator installation first.** If the operator or runner was installed in this cluster before and left in place, remove it before reinstalling. A stale installation can cause every backlogged job to be scheduled at once when it resumes, creating thousands of job pods and exhausting cluster resources. Make sure `jobResources` is set in your values so job pods have explicit resource requests and limits.

### Step 2: Create the Kubernetes Managed instance

Create one instance per cluster and assign it to the collector from step 1, using either the JupiterOne UI or the Helm chart. The commands, values, and verification step are on the [Installation](/integrations/directory/kubernetes-managed.md?integration-docs=installation) tab — set `collectorName` to the runner from step 1, and apply the namespace scope and polling interval you recorded earlier.

Unlike Native, the Managed integration authenticates through the collector. There is no per-instance integration API key to create, store in a Kubernetes Secret, or rotate.

> **NOTE**
> 
> The operator sends instance settings only when it first creates the instance. The exception is `ingestionSources`: changes to it are applied to the existing instance. When it is set, it owns the instance's ingestion source settings: changes made in the UI, and account-level defaults applied at creation, are replaced the next time you change the value. Removing it returns every source to the integration's default. Changing `pollingInterval` or other values on an existing `IntegrationInstance` resource has no effect. Change them in the JupiterOne UI or API instead. Deleting and re-applying the resource creates a new instance, and its entities are ingested again as new entities.

### Step 3: Verify the Managed instance

Wait for the first job to complete, then confirm the data before removing anything.

1.  In JupiterOne, open **Integrations > Kubernetes Managed > _your instance_** and confirm the most recent job status is successful. If a job fails, JupiterOne can access the job logs to help troubleshoot.
    
2.  Compare entity counts between the two instances in a single query, substituting both instance IDs:
    
    ```j1ql
    FIND * WITH _integrationInstanceId = ("<native-instance-id>" OR "<managed-instance-id>") AS e
    RETURN e._integrationInstanceId, e._type, count(e) ORDER BY e._type
    ```
    
3.  Confirm the namespaces you expect are present, and that excluded namespaces are absent:
    
    ```j1ql
    FIND kube_namespace WITH _integrationInstanceId = "<managed-instance-id>" AS n
    RETURN n.name
    ```
    

Expect differences in the type-by-type comparison — see [changes to the data model](#changes-to-the-data-model). What matters is that the resources you rely on are present with the counts you expect.

### Step 4: Decommission the Native integration

Do this only after the Managed instance is verified.

**In the cluster**, remove the Native deployment. If you installed it with Helm, `helm uninstall` the release; if you deployed it with raw YAML manifests, remove each object as described under [Uninstall](/integrations/directory/kubernetes.md#uninstall) in the Native installation guide. Then delete the Kubernetes Secret holding the JupiterOne API key, and revoke that integration API key in JupiterOne. The uninstall steps do not do either.

**In JupiterOne**, [delete the Native integration instance](/integrations/instance-management.md#remove-an-instance). This deletes all data tied to that instance, which is what removes the duplicate entities.

Finally, update the saved questions, alert rules, dashboards, and mappings you inventoried earlier.

### Choosing what to ingest

Native had no way to turn off a resource type other than removing RBAC permissions. Managed has **ingestion sources**: one per Kubernetes resource type, toggled on the instance in the JupiterOne UI or API, or with the chart's `ingestionSources` value (Integration Operator v0.5.0 or later, operator chart 1.5.0 or later, kubernetes-managed chart 1.0.9 or later). After upgrading the operator, run `helm repo update` and `helm upgrade` the integration chart again for the value to take effect; kubernetes-managed charts older than 1.0.9 do not have the value. See [Configuration Options](/integrations/directory/kubernetes-managed.md?integration-docs=installation) on the Installation tab.

-   **Container Specs** is disabled by default. Every other source is enabled.
-   **Clusters** and **Namespaces** cannot be disabled.
-   Some sources feed others. Disabling **Pods** also stops containers, volumes, the images derived from running containers, and the relationships between pods and other resources. Disabling **Nodes** also stops all image ingestion. Disabling a source such as **Secrets** or **ConfigMaps** removes the relationships that point at it.

Ingestion sources require a recent Integration Operator and runner image. Older versions ignore these settings.

### Changes to the data model

The Managed integration collects more overall, but it is not a superset of Native. Review these differences before cutover.

#### Entity classes that changed

One entity class differs: `kube_secret` is classed `Vault`, `NHI` in Native and `Secret`, `NHI` in Managed. A query, rule, or compliance mapping that selects Kubernetes secrets by the [`Vault` class](/data-model/jupiterone-data-model.md#defined-entities) will stop matching them — select by `Secret` instead.

#### Entity types only in Native

| Entity `_type` | Notes |
| --- | --- |
| `kube_custom_resource` | Replaced by configurable CRD ingestion. |
| `kube_custom_resource_definition` | Replaced by configurable CRD ingestion. |

Managed ingests custom resources through the `crdMappingConfig` option instead, which lets you choose which CRDs to collect and define their own `_type`, `_class`, property mappings, and relationships. See **Advanced: Configuring Custom Resource Definitions** on the [Installation](/integrations/directory/kubernetes-managed.md?integration-docs=installation) tab.

#### Entity types only in Managed

Managed adds `kube_ingress` (class `Gateway`), and a mapped `kube_cluster` **IS** `aws_eks_cluster` relationship alongside the existing Azure and Google Cloud cluster mappings.

#### Where images come from

Native derives `kube_image` from each node's cached image list (`Node.status.images`). Managed derives it from running containers by default, so after cutover `kube_image` reflects what is in use rather than what is pulled: images cached on a node but not running are no longer present, and images that Native missed because kubelet truncated a node's list now appear.

If you relied on Native's behavior, or you are not ingesting pods, enable **Ingest All Node Images** (`ingestAllNodeImages`) on the Managed instance. That restores the node-cached inventory alongside the in-use images, and adds `kube_node` **HAS** `kube_image`. See [Image ingestion](/integrations/directory/kubernetes-managed.md?integration-docs=installation) on the Installation tab.

#### Container specs

Managed produces `kube_container_spec` only when the **Container Specs** ingestion source is enabled, and it is disabled by default. Specs are built from workload pod templates — Deployments, DaemonSets, StatefulSets, Jobs, CronJobs and ReplicaSets — so they do not require pods to be ingested. The `<workload>` **USES** `kube_container_spec` relationships and the spec property names match Native.

Differences from Native:

-   `_key` is `container-spec:<namespace>/<containerName>`, using the namespace name. Native used the namespace UID, so queries that select specs by `_key` need updating.
-   Specs are deduplicated per namespace and container name. When two workloads in one namespace declare a container with the same name, one spec is kept and the other workload's image, resource and security settings are not recorded.
-   Pods not owned by a workload produce no spec, and there is no `kube_pod` **USES** `kube_container_spec` relationship.

#### Volumes

Native created `kube_volume` only for Deployments, one per Deployment and volume name. Managed creates volumes for every pod, keyed by the workload that owns the pod: `<namespace>/<ownerKind>/<ownerName>/<volumeName>`, for example `default/Deployment/web/config`. Replicas of a workload share one volume entity, and pods of a Deployment are attributed to the Deployment rather than to its ReplicaSet.

Some volumes are not shared across replicas:

-   Volumes backed by a PersistentVolumeClaim are keyed by claim, `<namespace>/pvc/<claimName>`, so each StatefulSet replica keeps its own volume.
-   The service-account token volume Kubernetes adds to each pod has a generated name (`kube-api-access-…`), so it remains one entity per pod.
-   Pods created by a Job are keyed on that Job; runs of a CronJob are not grouped under the CronJob.
-   A pod with no owner is keyed on itself. A pod missing the `pod-template-hash` label is attributed to its ReplicaSet instead of its Deployment.

Because Native covered Deployments only, expect more volumes than Native, but far fewer than one per pod.

With Container Specs enabled, volumes are also created from workload pod templates using the same keys, so they appear without ingesting pods, and `kube_container_spec` **USES** `kube_volume` is added, as in Native.

#### Relationships

Relationship coverage differs as well. Notably, `kube_node` **RUNS** `kube_pod` in Native is `kube_node` **CONTAINS** `kube_pod` in Managed, and Managed adds `kube_ingress` **CONNECTS** `kube_service` and `kube_service` **CONNECTS** `kube_pod`. Rules of both Roles and ClusterRoles produce `kube_role_rule`, with `kube_role` and `kube_cluster_role` **ENFORCES** `kube_role_rule`, as in Native. Compare the full lists in the Data Model tab of this page and of the [Kubernetes Native](/integrations/directory/kubernetes.md) integration.

### Migrating many clusters at once

You do not have to migrate cluster by cluster. Both the collector and the integration instance are installed from Helm charts, so they can be templated and delivered by a GitOps tool such as Argo CD or Flux, and a fleet-wide migration becomes a single change to your source of truth.

With Argo CD, the usual shape is an `ApplicationSet` that generates one `Application` per destination cluster, each deploying the same three charts — `jupiterone-integration-operator`, the Integration Runner, and `kubernetes-managed` — with sync waves ordering the operator and runner ahead of the instance. The per-cluster values are typically just the cluster name and the collector name.

Two things make this work across a fleet:

-   **One shared token.** Every runner authenticates with the same account API token, so you can reference one existing Kubernetes Secret, or pull it into each cluster with the External Secrets Operator, instead of minting a credential per cluster.
-   **`pollingInterval` and namespace filters are chart values.** Every cluster's instance starts with the same schedule and scope, without per-instance UI edits. They apply only when the instance is created; later changes to the values don't reach existing instances, so make those in JupiterOne.

CRD mapping is also a chart value (kubernetes-managed chart 1.0.11 or later), so new instances get the same `crdMappingConfig` without uploading it to each one. Like the other values it applies only at creation; change the mapping of an existing instance in JupiterOne.

> **NOTE**
> 
> Argo CD applies with server-side apply. Omit the `config:` block entirely when you have no configuration sub-values to set — an empty `config: {}` is serialized as `null` and rejected by the CRD when it merges over an existing instance.

### Frequently asked questions

#### Will I see duplicate entities during the migration?

Yes. Every entity in JupiterOne belongs to the integration instance that ingested it. While both instances are active, each Kubernetes resource is ingested twice — once by each instance — and the two copies are independent entities. They are not merged or deduplicated, so entity counts and query results that span both instances will be roughly doubled for the overlap period.

Plan for this if you have alert rules that trigger on entity counts, and keep the overlap to the time needed to verify the new data.

#### Do I have to clean up the duplicate data manually?

No. Deleting the Native integration instance deletes all data in JupiterOne tied to it, the same as for any other integration, and that removes the duplicates. The entities stop appearing in queries, dashboards, and alert rule evaluations. There is no separate deduplication or cleanup step. See [Instance management](/integrations/instance-management.md#remove-an-instance).

#### Will my Kubernetes entities keep their history?

No. Managed entities are ingested by a new integration instance, so they are new entities in the graph. Properties such as `_createdOn` reflect when the Managed integration first ingested them, not the age of the underlying Kubernetes resource. Anything that trends on entity age resets at cutover.

#### Can one instance cover more than one cluster?

No. Each cluster has its own collector and its own Kubernetes Managed instance, the same as with Native. Unlike Native, though, a single account API token serves the runners in every cluster, so there is no per-cluster integration API key to create or rotate — which is what makes a templated, fleet-wide rollout practical. See [Migrating many clusters at once](#migrating-many-clusters-at-once).

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (20)

-   `list certificatesigningrequests`
-   `list clusterrolebindings`
-   `list clusterroles`
-   `list configmaps`
-   `list cronjobs`
-   `list daemonsets`
-   `list deployments`
-   `list ingresses`
-   `list jobs`
-   `list namespaces`
-   `list networkpolicies`
-   `list nodes`
-   `list pods`
-   `list replicasets`
-   `list rolebindings`
-   `list roles`
-   `list secrets`
-   `list serviceaccounts`
-   `list services`
-   `list statefulsets`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (26)

-   `/api/v1/namespaces`
-   `/api/v1/namespaces/{namespace}/configmaps`
-   `/api/v1/namespaces/{namespace}/pods`
-   `/api/v1/namespaces/{namespace}/secrets`
-   `/api/v1/namespaces/{namespace}/serviceaccounts`
-   `/api/v1/namespaces/{namespace}/services`
-   `/api/v1/nodes`
-   `/apis/apiextensions.k8s.io/v1/customresourcedefinitions`
-   `/apis/apps/v1/namespaces/{namespace}/daemonsets`
-   `/apis/apps/v1/namespaces/{namespace}/deployments`
-   `/apis/apps/v1/namespaces/{namespace}/replicasets`
-   `/apis/apps/v1/namespaces/{namespace}/statefulsets`
-   `/apis/batch/v1/namespaces/{namespace}/cronjobs`
-   `/apis/batch/v1/namespaces/{namespace}/jobs`
-   `/apis/certificates.k8s.io/v1/certificatesigningrequests`
-   `/apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses`
-   `/apis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies`
-   `/apis/rbac.authorization.k8s.io/v1/clusterrolebindings`
-   `/apis/rbac.authorization.k8s.io/v1/clusterroles`
-   `/apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings`
-   `/apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles`
-   `/apis/{group}/{version}/namespaces/{namespace}/{plural}`
-   `/apis/{group}/{version}/{plural}`
-   `http://169.254.169.254/latest/meta-data/placement/region`
-   `http://169.254.169.254/latest/meta-data/services/eks`
-   `http://metadata.google.internal/computeMetadata/v1/instance/attributes/cluster-uid`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (27)

-   [https://cloud.google.com/compute/docs/metadata/default-metadata-values](https://cloud.google.com/compute/docs/metadata/default-metadata-values)
-   [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
-   [https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/)
-   [https://kubernetes.io/docs/concepts/workloads/pods/#pod-templates](https://kubernetes.io/docs/concepts/workloads/pods/#pod-templates)
-   [https://kubernetes.io/docs/reference/access-authn-authz/rbac/](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/certificate-signing-request-v1/](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/certificate-signing-request-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/service-account-v1/](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/service-account-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/cluster-role-binding-v1/](https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/cluster-role-binding-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1/](https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/role-binding-v1/](https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/role-binding-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/role-v1/](https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/role-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/cluster-resources/node-v1/](https://kubernetes.io/docs/reference/kubernetes-api/cluster-resources/node-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/config-map-v1/](https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/config-map-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/secret-v1/](https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/secret-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/core/namespace-v1/](https://kubernetes.io/docs/reference/kubernetes-api/core/namespace-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/core/node-v1/](https://kubernetes.io/docs/reference/kubernetes-api/core/node-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/extend-resources/custom-resource-definition-v1/](https://kubernetes.io/docs/reference/kubernetes-api/extend-resources/custom-resource-definition-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/policy-resources/network-policy-v1/](https://kubernetes.io/docs/reference/kubernetes-api/policy-resources/network-policy-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/cron-job-v1/](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/cron-job-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/deployment-v1/](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/deployment-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/job-v1/](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/job-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/replica-set-v1/](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/replica-set-v1/)
-   [https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/stateful-set-v1/](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/stateful-set-v1/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (53)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Build Certificate Signing Request Relationships | \- | \- |
| Build Cluster AKS Relationships | \- | \- |
| Build Cluster EKS Relationships | \- | `http://169.254.169.254/latest/meta-data/services/eks`, `http://169.254.169.254/latest/meta-data/placement/region` |
| Build Cluster GKE Relationships | \- | `http://metadata.google.internal/computeMetadata/v1/instance/attributes/cluster-uid` |
| Build Cluster Role Binding Assigned Service Account Relationships | \- | \- |
| Build Cluster Role Binding Relationships | \- | \- |
| Build Container ConfigMap Relationships | \- | \- |
| Build Container Secret Relationships | \- | \- |
| Build Container Uses Volume Relationships | \- | \- |
| Build CronJob MANAGES Job relationship | \- | \- |
| Build DaemonSet-Pod Relationships | \- | \- |
| Build Deployment-ReplicaSet Relationships | \- | \- |
| Build Ingress-Service Relationships | \- | \- |
| Build Job MANAGES Pod relationship | \- | \- |
| Build Node Contains Pod Relationships | \- | \- |
| Build Pod Service Account Relationships | \- | \- |
| Build Pod-Secret Relationships | \- | \- |
| Build ReplicaSet-Pod Relationships | \- | \- |
| Build Role Binding Assigned Service Account Relationships | \- | \- |
| Build Role Binding Cluster Role Relationships | \- | \- |
| Build Role Binding Role Relationships | \- | \- |
| Build Service Account-Secret Relationships | \- | \- |
| Build Service-Pod Relationships | \- | \- |
| Build StatefulSet MANAGES Pod relationship | \- | \- |
| Build Volume to ConfigMap Relationships | \- | \- |
| Fetch Certificate Signing Requests | `list certificatesigningrequests` | `/apis/certificates.k8s.io/v1/certificatesigningrequests` |
| Fetch Cluster Role Bindings | `list clusterrolebindings` | `/apis/rbac.authorization.k8s.io/v1/clusterrolebindings` |
| Fetch Cluster Role Rules | \- | \- |
| Fetch Cluster Roles | `list clusterroles` | `/apis/rbac.authorization.k8s.io/v1/clusterroles` |
| Fetch ConfigMaps | `list configmaps` | `/api/v1/namespaces/{namespace}/configmaps` |
| Fetch Containers | \- | \- |
| Fetch CronJobs | `list cronjobs` | `/apis/batch/v1/namespaces/{namespace}/cronjobs` |
| Fetch Custom Resource Entities | \- | `/apis/apiextensions.k8s.io/v1/customresourcedefinitions`, `/apis/{group}/{version}/namespaces/{namespace}/{plural}`, `/apis/{group}/{version}/{plural}` |
| Fetch DaemonSets | `list daemonsets` | `/apis/apps/v1/namespaces/{namespace}/daemonsets` |
| Fetch Deployments | `list deployments` | `/apis/apps/v1/namespaces/{namespace}/deployments` |
| Fetch Images | \- | \- |
| Fetch Ingress | `list ingresses` | `/apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses` |
| Fetch Jobs | `list jobs` | `/apis/batch/v1/namespaces/{namespace}/jobs` |
| Fetch Namespaces | `list namespaces` | `/api/v1/namespaces` |
| Fetch Network Policies | `list networkpolicies` | `/apis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies` |
| Fetch Node Images | \- | \- |
| Fetch Nodes | `list nodes` | `/api/v1/nodes` |
| Fetch Pods | `list pods` | `/api/v1/namespaces/{namespace}/pods` |
| Fetch ReplicaSets | `list replicasets` | `/apis/apps/v1/namespaces/{namespace}/replicasets` |
| Fetch Role Bindings | `list rolebindings` | `/apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings` |
| Fetch Role Rules | \- | \- |
| Fetch Roles | `list roles` | `/apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles` |
| Fetch Secrets | `list secrets` | `/api/v1/namespaces/{namespace}/secrets` |
| Fetch Service Accounts | `list serviceaccounts` | `/api/v1/namespaces/{namespace}/serviceaccounts` |
| Fetch Services | `list services` | `/api/v1/namespaces/{namespace}/services` |
| Fetch StatefulSets | `list statefulsets` | `/apis/apps/v1/namespaces/{namespace}/statefulsets` |
| Fetch Users | \- | \- |
| Fetch Volumes | \- | \- |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Kubernetes Certificate Signing Request | `kube_certificate_signing_request` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Kubernetes Cluster | `kube_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Kubernetes Cluster Role | `kube_cluster_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Kubernetes Cluster Role Binding | `kube_cluster_role_binding` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Kubernetes ConfigMap | `kube_config_map` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Kubernetes Container | `kube_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| Kubernetes Container Spec | `kube_container_spec` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Kubernetes CronJob | `kube_cron_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Kubernetes DaemonSet | `kube_daemon_set` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes Deployment | `kube_deployment` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes Image | `kube_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Kubernetes Ingress | `kube_ingress` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Kubernetes Job | `kube_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Kubernetes Namespace | `kube_namespace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Kubernetes Network Policy | `kube_network_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Kubernetes Node | `kube_node` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Kubernetes Pod | `kube_pod` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Kubernetes ReplicaSet | `kube_replica_set` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes Role | `kube_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Kubernetes Role Binding | `kube_role_binding` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Kubernetes Role Rule | `kube_role_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Kubernetes Secret | `kube_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Kubernetes Service | `kube_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Kubernetes Service Account | `kube_service_account` | [User](https://docs.jupiterone.io/data-model/schemas/User), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Kubernetes StatefulSet | `kube_stateful_set` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes User | `kube_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Kubernetes Volume | `kube_volume` | [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `kube_cluster` | **CONTAINS** | `kube_node` |
| `kube_cluster` | **CONTAINS** | `kube_namespace` |
| `kube_cluster` | **CONTAINS** | `kube_cluster_role` |
| `kube_cluster` | **CONTAINS** | `kube_cluster_role_binding` |
| `kube_cluster` | **CONTAINS** | `kube_user` |
| `kube_cluster` | **CONTAINS** | `kube_certificate_signing_request` |
| `kube_cluster` | **CONTAINS** | `ANY_RESOURCE` |
| `kube_cluster_role` | **ENFORCES** | `kube_role_rule` |
| `kube_cluster_role` | **ASSIGNED** | `kube_role_binding` |
| `kube_cluster_role` | **ASSIGNED** | `kube_cluster_role_binding` |
| `kube_cluster_role_binding` | **ASSIGNED** | `kube_service_account` |
| `kube_container` | **USES** | `kube_secret` |
| `kube_container` | **USES** | `kube_config_map` |
| `kube_container` | **USES** | `kube_volume` |
| `kube_container` | **USES** | `kube_image` |
| `kube_container_spec` | **USES** | `kube_volume` |
| `kube_cron_job` | **MANAGES** | `kube_job` |
| `kube_cron_job` | **USES** | `kube_container_spec` |
| `kube_daemon_set` | **MANAGES** | `kube_pod` |
| `kube_daemon_set` | **USES** | `kube_container_spec` |
| `kube_deployment` | **USES** | `kube_container_spec` |
| `kube_deployment` | **MANAGES** | `kube_replica_set` |
| `kube_ingress` | **CONNECTS** | `kube_service` |
| `kube_job` | **USES** | `kube_container_spec` |
| `kube_job` | **CONTAINS** | `kube_namespace` |
| `kube_job` | **MANAGES** | `kube_pod` |
| `kube_namespace` | **CONTAINS** | `kube_role` |
| `kube_namespace` | **CONTAINS** | `kube_role_binding` |
| `kube_namespace` | **CONTAINS** | `kube_cron_job` |
| `kube_namespace` | **CONTAINS** | `kube_pod` |
| `kube_namespace` | **CONTAINS** | `kube_daemon_set` |
| `kube_namespace` | **CONTAINS** | `kube_config_map` |
| `kube_namespace` | **CONTAINS** | `kube_secret` |
| `kube_namespace` | **CONTAINS** | `kube_deployment` |
| `kube_namespace` | **CONTAINS** | `kube_replica_set` |
| `kube_namespace` | **CONTAINS** | `kube_network_policy` |
| `kube_namespace` | **CONTAINS** | `kube_ingress` |
| `kube_namespace` | **CONTAINS** | `kube_service` |
| `kube_namespace` | **CONTAINS** | `ANY_RESOURCE` |
| `kube_node` | **CONTAINS** | `kube_pod` |
| `kube_node` | **HAS** | `kube_image` |
| `kube_pod` | **USES** | `kube_service_account` |
| `kube_pod` | **USES** | `kube_secret` |
| `kube_pod` | **CONTAINS** | `kube_container` |
| `kube_pod` | **USES** | `kube_volume` |
| `kube_pod` | **HAS** | `kube_certificate_signing_request` |
| `kube_replica_set` | **USES** | `kube_container_spec` |
| `kube_replica_set` | **MANAGES** | `kube_pod` |
| `kube_role` | **ENFORCES** | `kube_role_rule` |
| `kube_role` | **ASSIGNED** | `kube_role_binding` |
| `kube_role_binding` | **ASSIGNED** | `kube_service_account` |
| `kube_service` | **CONNECTS** | `kube_pod` |
| `kube_service_account` | **CONTAINS** | `kube_namespace` |
| `kube_service_account` | **USES** | `kube_secret` |
| `kube_stateful_set` | **USES** | `kube_container_spec` |
| `kube_stateful_set` | **CONTAINS** | `kube_namespace` |
| `kube_stateful_set` | **MANAGES** | `kube_pod` |
| `kube_volume` | **USES** | `kube_config_map` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `kube_cluster` | **IS** | `azure_kubernetes_cluster` | FORWARD |
| `kube_cluster` | **IS** | `google_container_cluster` | FORWARD |
| `kube_cluster` | **IS** | `aws_eks_cluster` | FORWARD |

### Kube Certificate Signing Request

`kube_certificate_signing_request` inherits from [Certificate](/data-model/schemas/Certificate.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `groups` | `array` of `string`s |  |  |
| `signerName` | `string` |  |  |
| `status.lastUpdatedOn` | `number` |  |  |
| `status.message` | `string` |  |  |
| `status.reason` | `string` |  |  |
| `status.type` | `string` |  |  |
| `subject.commonName` | `string` |  |  |
| `subject.dnsSAN` | `array` of `string`s |  |  |
| `subject.organization` | `string` |  |  |
| 
`uid` \*

 | `string` |  |  |
| `usages` | `array` of `string`s |  |  |
| `userId` | `string` |  |  |
| `username` | `string` |  |  |

---

### Kube Cluster

`kube_cluster` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`server` \*

 | `string` |  |  |
| 

`skipTlsVerify` \*

 | `boolean` |  |  |

---

### Kube Cluster Role

`kube_cluster_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `kind` | `string` |  |  |
| `namespace` | `string` |  |  |
| `resourceVersion` | `string` |  |  |

---

### Kube Cluster Role Binding

`kube_cluster_role_binding` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `kind` | `string` |  |  |
| `namespace` | `string` |  |  |
| `resourceVersion` | `string` |  |  |

---

### Kube Config Map

`kube_config_map` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `immutable` | `boolean` |  |  |
| `kind` | `string` |  |  |
| `namespace` | `string` |  |  |
| `resourceVersion` | `string` |  |  |

---

### Kube Container

`kube_container` inherits from [Container](/data-model/schemas/Container.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowPrivilegeEscalation` | `boolean` |  |  |
| `appArmorProfile.localhostProfile` | `string` |  |  |
| `appArmorProfile.type` | `string` |  |  |
| `containerId` | `string` |  |  |
| `cpuLimit` | `string` |  |  |
| `cpuRequest` | `string` |  |  |
| `finishedAt` | `number` |  |  |
| `hasStarted` | `boolean` |  |  |
| `image` | `string` |  |  |
| `imagePullPolicy` | `string` |  |  |
| `isReady` | `boolean` |  |  |
| `isUsingEnvironmentVariableSecrets` | `boolean` |  |  |
| `memoryLimit` | `string` |  |  |
| `memoryRequest` | `string` |  |  |
| `namespace` | `string` |  |  |
| `normalizedCpuLimit` | `number` |  |  |
| `normalizedCpuRequest` | `number` |  |  |
| `normalizedMemoryLimit` | `number` |  |  |
| `normalizedMemoryRequest` | `number` |  |  |
| `podUid` | `string` |  |  |
| `privileged` | `boolean` |  |  |
| `procMount` | `string` |  |  |
| `readOnlyRoolFilesystem` | `boolean` |  |  |
| `restartCount` | `number` |  |  |
| `runAsGroup` | `number` |  |  |
| `runAsNonRoot` | `boolean` |  |  |
| `runAsUser` | `number` |  |  |
| `running` | `boolean` |  |  |
| `seccompProfile.localhostProfile` | `string` |  |  |
| `seccompProfile.type` | `string` |  |  |
| `seLinuxOptions.level` | `string` |  |  |
| `seLinuxOptions.role` | `string` |  |  |
| `seLinuxOptions.type` | `string` |  |  |
| `seLinuxOptions.user` | `string` |  |  |
| `startedAt` | `number` |  |  |
| `terminated` | `boolean` |  |  |
| `terminatedExitCode` | `number` |  |  |
| `terminationMessagePath` | `string` |  |  |
| `terminationMessagePolicy` | `string` |  |  |
| `type` | `string` |  |  |
| `waiting` | `boolean` |  |  |
| `waitingMessage` | `string` |  |  |
| `waitingReason` | `string` |  |  |
| `windowsOptions.gmsaCredentialSpec` | `string` |  |  |
| `windowsOptions.gmsaCredentialSpecName` | `string` |  |  |
| `windowsOptions.hostProcess` | `boolean` |  |  |
| `windowsOptions.runAsUserName` | `string` |  |  |

---

### Kube Container Spec

`kube_container_spec` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `containerPorts` | `array` of `number`s |  |  |
| `hasSecurityContext` | `boolean` |  |  |
| `hostPorts` | `array` of `number`s |  |  |
| `image` | `string` |  |  |
| `imagePullPolicy` | `string` |  |  |
| `namespace` | `string` |  |  |
| `portProtocols` | `array` of `string`s |  |  |
| `securityContext.allowPrivilegeEscalation` | `boolean` |  |  |
| `securityContext.capabilities.add` | `array` of `string`s |  |  |
| `securityContext.capabilities.drop` | `array` of `string`s |  |  |
| `securityContext.privileged` | `boolean` |  |  |
| `securityContext.procMount` | `string` |  |  |
| `securityContext.readOnlyRootFilesystem` | `boolean` |  |  |
| `securityContext.runAsGroup` | `number` |  |  |
| `securityContext.runAsNonRoot` | `boolean` |  |  |
| `securityContext.runAsUser` | `number` |  |  |
| `securityContext.seccompProfile.localhostProfile` | `string` |  |  |
| `securityContext.seccompProfile.type` | `string` |  |  |
| `securityContext.seLinuxOptions.level` | `string` |  |  |
| `securityContext.seLinuxOptions.role` | `string` |  |  |
| `securityContext.seLinuxOptions.type` | `string` |  |  |
| `securityContext.seLinuxOptions.user` | `string` |  |  |
| `securityContext.windowsOptions.gmsaCredentialSpec` | `string` |  |  |
| `securityContext.windowsOptions.gmsaCredentialSpecName` | `string` |  |  |
| `securityContext.windowsOptions.hostProcess` | `boolean` |  |  |
| `securityContext.windowsOptions.runAsUserName` | `string` |  |  |

---

### Kube Cron Job

`kube_cron_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `concurrencyPolicy` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `failedJobsHistoryLimit` | `number` |  |  |
| `kind` | `string` |  |  |
| `lastScheduledOn` | `number` |  |  |
| `lastSuccessfulOn` | `number` |  |  |
| `namespace` | `string` |  |  |
| `resourceVersion` | `string` |  |  |
| `schedule` | `string` |  |  |
| `startingDeadlineSeconds` | `number` |  |  |
| `successfulJobsHistoryLimit` | `number` |  |  |
| `suspend` | `boolean` |  |  |
| `timeZone` | `string` |  |  |

---

### Kube Daemon Set

`kube_daemon_set` inherits from [Deployment](/data-model/schemas/Deployment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `collisionCount` | `number` |  |  |
| `currentNumberScheduled` | `number` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `desiredNumberScheduled` | `number` |  |  |
| `kind` | `string` |  |  |
| `minReadySeconds` | `number` |  |  |
| `namespace` | `string` |  |  |
| `numberAvailable` | `number` |  |  |
| `numberMisscheduled` | `number` |  |  |
| `numberReady` | `number` |  |  |
| `numberUnavailable` | `number` |  |  |
| `observedGeneration` | `number` |  |  |
| `resourceVersion` | `string` |  |  |
| `revisionHistoryLimit` | `number` |  |  |
| `updatedNumberScheduled` | `number` |  |  |
| `updateStrategyType` | `string` |  |  |

---

### Kube Deployment

`kube_deployment` inherits from [Deployment](/data-model/schemas/Deployment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `availableReplicas` | `number` |  |  |
| `collisionCount` | `number` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `kind` | `string` |  |  |
| `minReadySeconds` | `number` |  |  |
| `namespace` | `string` |  |  |
| `observedGeneration` | `number` |  |  |
| `paused` | `boolean` |  |  |
| `progressDeadlineSeconds` | `number` |  |  |
| `readyReplicas` | `number` |  |  |
| `replicas` | `number` |  |  |
| `resourceVersion` | `string` |  |  |
| `revisionHistoryLimit` | `number` |  |  |
| `statusReplicas` | `number` |  |  |
| `strategyType` | `string` |  |  |
| `unavailableReplicas` | `number` |  |  |
| `updatedReplicas` | `number` |  |  |

---

### Kube Image

`kube_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `digest` | `string` |  |  |
| `imageId` | `string` |  |  |
| `names` | `array` of `string`s |  |  |
| `sizeInBytes` | `number` |  |  |

---

### Kube Ingress

`kube_ingress` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s |  |  |
| `deletionOn` | `number` |  |  |
| `finalizers` | `array` of `string`s |  |  |
| 

`function` \*

 | `array` of `string`s |  |  |
| `generation` | `number` |  |  |
| `hasDefaultBackend` | `boolean` |  |  |
| `hosts` | `array` of `string`s |  |  |
| `ingressClassName` | `string` |  |  |
| `namespace` | `string` |  |  |
| `paths` | `array` of `string`s |  |  |
| 

`public` \*

 | `boolean` |  |  |
| `resourceVersion` | `string` |  |  |
| `status.loadBalancer.ingress` | `array` of `string`s |  |  |
| `tlsEnabled` | `boolean` |  |  |
| `tlsHosts` | `array` of `string`s |  |  |
| `tlsSecretNames` | `array` of `string`s |  |  |

---

### Kube Job

`kube_job` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeDeadlineSeconds` | `number` |  |  |
| `backoffLimit` | `number` |  |  |
| `completions` | `number` |  |  |
| `createdOn` | `number` |  |  |
| `deletedOn` | `number` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `generation` | `number` |  |  |
| `manualSelector` | `boolean` |  |  |
| `namespace` | `string` |  |  |
| `parallelism` | `number` |  |  |
| `resourceVersion` | `string` |  |  |
| `status.active` | `number` |  |  |
| `status.completionTime` | `number` |  |  |
| `status.failed` | `number` |  |  |
| `status.startTime` | `number` |  |  |
| `status.succeeded` | `number` |  |  |
| `ttlSecondsAfterFinished` | `number` |  |  |

---

### Kube Namespace

`kube_namespace` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `finalizers` | `array` of `string`s |  |  |
| `generation` | `number` |  |  |
| `ownerNames` | `array` of `string`s |  |  |
| `resourceVersion` | `string` |  |  |
| `status.phase` | `string` |  |  |

---

### Kube Network Policy

`kube_network_policy` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `kind` | `string` |  |  |
| `namespace` | `string` |  |  |
| `podSelectorMatchExpressions` | `string` |  |  |
| `policyTypes` | `array` of `string`s |  |  |
| `resourceVersion` | `string` |  |  |

---

### Kube Node

`kube_node` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `architecture` | `string` |  |  |
| `capacity.cpu` | `string` |  |  |
| `capacity.memory` | `string` |  |  |
| `capacity.pods` | `string` |  |  |
| `containerRuntimeVersion` | `string` |  |  |
| `kernelVersion` | `string` |  |  |
| `kubeletVersion` | `string` |  |  |
| `operatingSystem` | `string` |  |  |
| `osImage` | `string` |  |  |
| `osKernel` | `string` |  |  |
| `providerID` | `string` |  |  |
| 
`unschedulable` \*

 | `boolean` |  |  |

---

### Kube Pod

`kube_pod` inherits from [Task](/data-model/schemas/Task.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeDeadlineSeconds` | `number` |  |  |
| `automountServiceAccountToken` | `boolean` |  |  |
| `cpuLimit` | `string` |  |  |
| `cpuRequest` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `dnsPolicy` | `string` |  |  |
| `enableServiceLinks` | `boolean` |  |  |
| `finalizers` | `array` of `string`s |  |  |
| `generation` | `number` |  |  |
| `hasSecurityContext` | `boolean` |  |  |
| `hostIPC` | `boolean` |  |  |
| `hostname` | `string` |  |  |
| `hostNetwork` | `boolean` |  |  |
| `hostPID` | `boolean` |  |  |
| `imagePullSecrets` | `array` of `string`s |  |  |
| `memoryLimit` | `string` |  |  |
| `memoryRequest` | `string` |  |  |
| `namespace` | `string` |  |  |
| `nodeName` | `string` |  |  |
| `normalizedCpuLimit` | `number` |  |  |
| `normalizedCpuRequest` | `number` |  |  |
| `normalizedMemoryLimit` | `number` |  |  |
| `normalizedMemoryRequest` | `number` |  |  |
| `podAnnotations` | `array` of `string`s |  |  |
| `preemptionPolicy` | `string` |  |  |
| `priority` | `number` |  |  |
| `priorityClassName` | `string` |  |  |
| `resourceVersion` | `string` |  |  |
| `restartPolicy` | `string` |  |  |
| `runtimeClassName` | `string` |  |  |
| `schedulerName` | `string` |  |  |
| `securityContext.apparmorProfile.localhostProfile` | `string` |  |  |
| `securityContext.apparmorProfile.type` | `string` |  |  |
| `securityContext.fsGroup` | `number` |  |  |
| `securityContext.fsGroupChangePolicy` | `string` |  |  |
| `securityContext.runAsGroup` | `number` |  |  |
| `securityContext.runAsNonRoot` | `boolean` |  |  |
| `securityContext.runAsUser` | `number` |  |  |
| `securityContext.seccompProfile.localhostProfile` | `string` |  |  |
| `securityContext.seccompProfile.type` | `string` |  |  |
| `securityContext.seLinuxChangePolicy` | `string` |  |  |
| `securityContext.seLinuxOptions.level` | `string` |  |  |
| `securityContext.seLinuxOptions.role` | `string` |  |  |
| `securityContext.seLinuxOptions.type` | `string` |  |  |
| `securityContext.seLinuxOptions.user` | `string` |  |  |
| `securityContext.supplementalGroups` | `array` of `number`s |  |  |
| `securityContext.supplementalGroupsPolicy` | `string` |  |  |
| `securityContext.sysctls` | `array` of `string`s |  |  |
| `securityContext.windowsOptions.gmsaCredentialSpec` | `string` |  |  |
| `securityContext.windowsOptions.gmsaCredentialSpecName` | `string` |  |  |
| `securityContext.windowsOptions.hostProcess` | `boolean` |  |  |
| `securityContext.windowsOptions.runAsUserName` | `string` |  |  |
| `serviceAccount` | `string` |  |  |
| `serviceAccountName` | `string` |  |  |
| `setHostnameAsFQDN` | `boolean` |  |  |
| `shareProcessNamespace` | `boolean` |  |  |
| `status.hostIP` | `string` |  |  |
| `status.hostIPs` | `array` of `string`s |  |  |
| `status.message` | `string` |  |  |
| `status.nominatedNodeName` | `string` |  |  |
| `status.phase` | `string` |  |  |
| `status.podIP` | `string` |  |  |
| `status.podIPs` | `array` of `string`s |  |  |
| `status.qosClass` | `string` |  |  |
| `status.reason` | `string` |  |  |
| `status.startTime` | `number` |  |  |
| `subdomain` | `string` |  |  |
| `terminationGracePeriodSeconds` | `number` |  |  |

---

### Kube Replica Set

`kube_replica_set` inherits from [Deployment](/data-model/schemas/Deployment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `annotations` | `array` of `string`s |  |  |
| `apiVersion` | `string` |  |  |
| `currentSize` | `number` |  |  |
| `desiredSize` | `number` |  |  |
| `generation` | `number` |  |  |
| `kind` | `string` |  |  |
| `labels` | `array` of `string`s |  |  |
| `minReadySeconds` | `number` |  |  |
| `namespace` | `string` |  |  |
| `ownerReferences` | `array` of `string`s |  |  |
| `resourceVersion` | `string` |  |  |
| `selector` | `string` |  |  |
| `status.availableReplicas` | `number` |  |  |
| `status.fullyLabeledReplicas` | `number` |  |  |
| `status.observedGeneration` | `number` |  |  |
| `status.readyReplicas` | `number` |  |  |

---

### Kube Role

`kube_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `kind` | `string` |  |  |
| 
`namespace` \*

 | `string` |  |  |
| `resourceVersion` | `string` |  |  |

---

### Kube Role Binding

`kube_role_binding` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `apiVersion` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `kind` | `string` |  |  |
| 
`namespace` \*

 | `string` |  |  |
| `resourceVersion` | `string` |  |  |
| `roleRefApiGroup` | `string` |  |  |
| `roleRefKind` | `string` |  |  |
| `roleRefName` | `string` |  |  |
| `subjectCount` | `number` |  |  |
| `subjects` | `array` of `string`s |  |  |

---

### Kube Role Rule

`kube_role_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiGroups` | `array` of `string`s |  |  |
| `namespace` | `string` |  |  |
| `resourceNames` | `array` of `string`s |  |  |
| `resources` | `array` of `string`s |  |  |
| 
`verbs` \*

 | `array` of `string`s |  |  |

---

### Kube Secret

`kube_secret` inherits from [Secret](/data-model/schemas/Secret.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiVersion` | `string` |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `deletionOn` | `number` |  |  |
| `immutable` | `boolean` |  |  |
| `kind` | `string` |  |  |
| `namespace` | `string` |  |  |
| `resourceVersion` | `string` |  |  |
| `type` | `string` |  |  |

---

### Kube Service

`kube_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allocateLoadBalancerNodePorts` | `boolean` |  |  |
| 
`category` \*

 | `array` of `string`s |  |  |
| `clusterIP` | `string` |  |  |
| `clusterIPs` | `array` of `string`s |  |  |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `endpoints` | `array` of `string`s |  |  |
| `externalIPs` | `array` of `string`s |  |  |
| `externalName` | `string` |  |  |
| `externalTrafficPolicy` | `string` |  |  |
| 

`function` \*

 | `array` of `string`s |  |  |
| `healthCheckNodePort` | `number` |  |  |
| `ipFamilies` | `array` of `string`s |  |  |
| `ipFamilyPolicy` | `string` |  |  |
| `loadBalancerIP` | `string` |  |  |
| `loadBalancerSourceRanges` | `array` of `string`s |  |  |
| `namespace` | `string` |  |  |
| `portName` | `array` of `string`s |  |  |
| `portNumber` | `array` of `number`s |  |  |
| `protocol` | `array` of `string`s |  |  |
| `publishNotReadyAddresses` | `boolean` |  |  |
| `resourceVersion` | `string` |  |  |
| `selectors` | `array` of `string`s |  |  |
| `sessionAffinity` | `string` |  |  |
| `targetPort` | `array` of `string`s |  |  |
| `type` | `string` |  |  |

---

### Kube Service Account

`kube_service_account` inherits from [User](/data-model/schemas/User.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deletionGracePeriodSeconds` | `integer` |  |  |
| `generation` | `integer` |  |  |
| `namespace` | `string` |  |  |
| `resourceVersion` | `string` |  |  |
| `secretIds` | `array` of `string`s |  |  |
| `secretNames` | `array` of `string`s |  |  |

---

### Kube Stateful Set

`kube_stateful_set` inherits from [Deployment](/data-model/schemas/Deployment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deletionGracePeriodSeconds` | `number` |  |  |
| `generation` | `number` |  |  |
| `namespace` | `string` |  |  |
| `podManagementPolicy` | `string` |  |  |
| `replicas` | `number` |  |  |
| `resourceVersion` | `string` |  |  |
| `revisionHistoryLimit` | `number` |  |  |
| `serviceName` | `string` |  |  |
| `status.collisionCount` | `number` |  |  |
| `status.currentReplicas` | `number` |  |  |
| `status.currentRevision` | `string` |  |  |
| `status.observedGeneration` | `number` |  |  |
| `status.readyReplicas` | `number` |  |  |
| `status.replicas` | `number` |  |  |
| `status.updatedReplicas` | `number` |  |  |
| `status.updateRevision` | `string` |  |  |
| `strategy.partition` | `number` |  |  |
| `strategy.type` | `string` |  |  |

---

### Kube User

`kube_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `certFile` | `string` |  |  |
| `keyFile` | `string` |  |  |

---

### Kube Volume

`kube_volume` inherits from [Disk](/data-model/schemas/Disk.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `awsVolumeID` | `string` |  |  |
| `azureDiskName` | `string` |  |  |
| `azureDiskURI` | `string` |  |  |
| `claimName` | `string` |  |  |
| `configMapName` | `string` |  |  |
| `csiDriver` | `string` |  |  |
| `csiFsType` | `string` |  |  |
| `csiReadOnly` | `boolean` |  |  |
| `emptyDirMedium` | `string` |  |  |
| `emptyDirSizeLimit` | `string` |  |  |
| `gcePdName` | `string` |  |  |
| `hostPath` | `string` |  |  |
| `hostPathType` | `string` |  |  |
| `namespace` | `string` |  |  |
| `nfsPath` | `string` |  |  |
| `nfsServer` | `string` |  |  |
| `readOnly` | `boolean` |  |  |
| `secretName` | `string` |  |  |
| 
`volumeName` \*

 | `string` |  |  |
| 

`volumeType` \*

 | `string` |  |  |

---

## Release Notes

-   **2026-09-22** — Container specifications from workload templates including Deployments, DaemonSets, StatefulSets, and Jobs are now ingested and linked to their owning workloads.
-   **2026-09-21** — Added support for ingesting all images in each Kubernetes node's local image cache, with relationships from nodes to images, controlled by a configuration flag.
-   **2026-09-21** — Kubernetes ClusterRole rules are now ingested as queryable entities, linked to their parent ClusterRoles.
-   **2026-09-21** — Added the **Ingest All Node Images** option, which ingests every image cached on each node and relates nodes to the images they hold. Images can now be collected without ingesting pods.
-   **2026-03-31** — Added OS kernel version to managed Kubernetes node entities.
-   **2025-12-01** — Added support for Custom Resource Definitions (CRDs), enabling ingestion of custom Kubernetes resource types.
-   **2025-11-20** — Added mapped relationships linking Kubernetes clusters to their underlying cloud provider resources in Azure AKS, Google GKE, and AWS EKS.
-   **2025-11-20** — Added Kubernetes role rules ingestion as individual rule entities, each linked to their parent role.
-   **2025-11-20** — Added relationships linking Kubernetes pods to their assigned service accounts and nodes, containers to their referenced secrets, config maps, and volumes, and deployments to their replica sets.
-   **2025-11-19** — Added ingestion of Kubernetes Services with namespace and selector relationships.
-   **2025-11-19** — Added ingestion of Kubernetes Secrets (metadata only, data fields are not ingested).
-   **2025-11-12** — Added ingestion of Kubernetes Role Bindings and Cluster Role Bindings with subject relationships.
-   **2025-11-11** — Added Kubernetes container image ingestion with configuration options for image scanning.
-   **2025-11-10** — Added ingestion of Kubernetes Replica Sets with pod template relationships.
-   **2025-11-10** — Added ingestion of Kubernetes StatefulSets as new entity types.
-   **2025-11-07** — Added ingestion of container images, Jobs, and Service Accounts.
-   **2025-11-07** — Added ingestion of Kubernetes Volumes with pod relationships.
-   **2025-11-07** — Added ingestion of Kubernetes Ingress resources as new entity types.
-   **2025-11-06** — Added ingestion of Kubernetes Roles as new entity types.
-   **2025-11-06** — Added ingestion of Kubernetes Containers within pods as new entity types.
-   **2025-11-06** — Added ingestion of Kubernetes Network Policies as new entity types.
-   **2025-11-05** — Added ingestion of Kubernetes Users with RBAC relationships.
-   **2025-11-05** — Added ingestion of Kubernetes Deployments with replica set relationships.
-   **2025-11-05** — Added ingestion of Kubernetes Nodes as new entity types.
-   **2025-11-05** — Added ingestion of Kubernetes Cluster Role Bindings.
-   **2025-11-04** — Added ingestion of Kubernetes ConfigMaps as new entity types.
-   **2025-11-04** — Added ingestion of Kubernetes Daemon Sets as new entity types.
-   **2025-11-03** — Added ingestion of Kubernetes Pods with container relationships.
-   **2025-10-31** — Added ingestion of Kubernetes CronJobs as new entity types.
-   **2025-10-31** — Added ingestion of Kubernetes Namespaces as new entity types.
-   **2025-10-30** — Added Kubernetes Cluster Roles ingestion.
-   **2025-10-29** — Added Kubernetes Cluster ingestion as the foundation entity for all Kubernetes-managed resources.

---

Source: /integrations/directory/lacework

# Lacework

Visualize Lacework services, teams, and users in the JupiterOne graph. Map Lacework users to employees in your JupiterOne account. Monitor changes to Lacework users using JupiterOne alerts.

## Installation

> **INFO**
> 
> You will need to create an API key on Lacework and get the "key ID" and "generated secret". See [their documentation](https://docs.lacework.net/console/api-access-keys#api-keys) for more information.

To install the Lacework integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Lacework. Click **New Instance** to begin configuring the integration.

Creating a Lacework instance requires the following:

-   The **Account Name** used to identify the Lacework account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Lacework Organization URL, Secret Key, Access Key Id.
    

## Data Volume Configuration

Control how much data is ingested from Lacework to manage entity counts and job duration.

### Data Filtering Options

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **Included Host Vulnerability Severities** | Multi-select | Select host vulnerability severities to ingest | Critical, High, Medium |
| **Included Container Vulnerability Severities** | Multi-select | Select container vulnerability severities to ingest | Critical, High, Medium |

**Available severity options:**

-   Critical
-   High
-   Medium
-   Low
-   Info (host vulnerabilities only)

**How it affects data volume:** Filtering by severity reduces the number of vulnerability entities ingested. By default, only Critical, High, and Medium severity vulnerabilities are imported for both hosts and containers. Enabling Low and Info severities will significantly increase data volume.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Alert Finding | `lacework_alert_finding` | [Alert](https://docs.jupiterone.io/data-model/schemas/Alert) |
| Application | `lacework_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Assessment | `lacework_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Cloud Account | `lacework_cloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Container | `lacework_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| Container Finding | `lacework_container_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Machine | `lacework_machine` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Organization | `lacework_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Package | `lacework_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Service | `lacework_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Team User | `lacework_team_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `lacework_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `lacework_application` | **HAS** | `lacework_alert_finding` |
| `lacework_assessment` | **IDENTIFIED** | `lacework_finding` |
| `lacework_container` | **HAS** | `lacework_container_finding` |
| `lacework_machine` | **HAS** | `lacework_alert_finding` |
| `lacework_machine` | **HAS** | `lacework_application` |
| `lacework_machine` | **HAS** | `lacework_package` |
| `lacework_machine` | **HAS** | `lacework_finding` |
| `lacework_machine` | **HAS** | `lacework_container` |
| `lacework_organization` | **HAS** | `lacework_cloud_account` |
| `lacework_organization` | **HAS** | `lacework_service` |
| `lacework_organization` | **HAS** | `lacework_team_user` |
| `lacework_organization` | **HAS** | `lacework_machine` |
| `lacework_service` | **PERFORMED** | `lacework_assessment` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `lacework_finding` | **HAS** | `aws_instance` | REVERSE |
| `lacework_finding` | **IS** | `cve` | FORWARD |

---

Source: /integrations/directory/lansweeper

# Lansweeper

Visualize Lansweeper computers, users, groups, and software in the JupiterOne graph. Our guide provides step-by-step instructions on setting up the integration and utilizing its data model to gain visibility into your environment.

## Installation

### Configuration in JupiterOne

To install the Lansweeper integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Lansweeper. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Lansweeper account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration. You will then be prompted to authenticate JupiterOne with Lansweeper. Complete the authentication process to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Host | `lansweeper_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Site | `lansweeper_site` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `lansweeper_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `lansweeper_site` | **CONTAINS** | `lansweeper_host` |
| `lansweeper_user` | **USES** | `lansweeper_host` |

### Lansweeper Host

`lansweeper_host` inherits from [Host](/data-model/schemas/Host.md)

---

### Lansweeper Site

`lansweeper_site` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetTypes` \*

 | `array` of `string`s |  |  |

---

### Lansweeper User

`lansweeper_user` inherits from [User](/data-model/schemas/User.md)

---

---

Source: /integrations/directory/lastpass

# LastPass

Visualize LastPass users, map Lastpass users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> Before configuring this integration in JupiterOne, you need to obtain API credentials from LastPass:
> 
> **Required in LastPass:**
> 
> -   Admin access to your LastPass Enterprise account
> -   Company ID (also called Account Number)
> -   Provisioning Hash generated through the Enterprise API
> 
> **Authentication:** This integration uses the LastPass Enterprise API with Company ID and Provisioning Hash for authentication.
> 
> **Permissions:** The Provisioning Hash grants access to user data and account information. Keep this value secure as it provides access to sensitive account data.
> 
> To obtain these credentials, log in to your LastPass admin console at `admin.lastpass.com` and navigate to **Advanced > Enterprise API**.

To use this integration, JupiterOne requires a LastPass Company ID and Provisioning Hash, created by a LastPass admin user.

### Configuration in LastPass

1.  Locate your **Company ID**:

-   Log in to `admin.lastpass.com` and go to the **Dashboard** tab. The **Company ID** (sometimes labeled Account number) is displayed at the top of the page.

2.  Generate a Provisioning Hash.

-   Go to **Advanced > Enterprise API** and create a provisioning hash. This value grants access to your data so it is important to keep it safe.

### Configuration in JupiterOne

To install the LastPass integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select LastPass. Click **New Instance** to begin configuring your integration and provide the following:

-   The **Account Name** used to identify the LastPass account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the **Company ID** and **Provisioning Hash** acquired in LastPass.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `lastpass_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Lastpass User | `lastpass_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `lastpass_account` | **HAS** | `lastpass_user` |

### Lastpass User

`lastpass_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `admin` | `boolean` |  |  |
| `applicationCount` | `number` |  |  |
| `attachmentsCount` | `number` |  |  |
| `createdOn` | `number` |  |  |
| `duoUsername` | `string` |  |  |
| `formFillsCount` | `number` |  |  |
| `isActive` | `boolean` |  |  |
| `lastLogin` | `number` |  |  |
| `linkedAccount` | `string` |  |  |
| `masterPasswordStrength` | `number` |  |  |
| `mfaEnabled` | `boolean` |  |  |
| `mfaType` | `string` |  |  |
| `neverLoggedIn` | `boolean` |  |  |
| `notesCount` | `number` |  |  |
| `passwordChangedOn` | `number` |  |  |
| `passwordResetRequired` | `boolean` |  |  |
| `securityScore` | `number` |  |  |
| `sitesCount` | `number` |  |  |
| `webLink` | `string` |  |  |

---

---

Source: /integrations/directory/lema

# Lema

Visualize the third parties you manage in Lema, their risk assessments and their monitoring alerts. Map assessments and alerts to each vendor, and monitor vendor risk changes through queries and alerts.

## Installation

This integration connects to the **Lema Public API** (`https://api.lema.ai`) and ingests the third parties (vendors) you manage in Lema, their risk assessments, and the monitoring alerts raised on them. Every request is a read-only `GET`. The integration is managed by JupiterOne and runs in the JupiterOne cloud, so no collector is needed.

### Prerequisites

-   A **Lema** organization with your third-party inventory.
-   A Lema **Public API key** for that organization.
-   Access to **JupiterOne** with permission to configure integrations.

### Configuration in Lema

The integration authenticates with a Lema Public API key, sent as `Authorization: Bearer <key>` on every request. The key grants read access to your organization's third parties, assessments and monitoring signals, so treat it as a credential.

API keys and their permissions are managed on the Lema side. Ask your Lema administrator or your Lema contact for a Public API key with read access to:

-   Third parties (`GET /api/v1/third-parties`)
-   Assessments (`GET /api/v1/assessments`)
-   Signals (`GET /api/v1/signals`)

Copy the key and store it somewhere safe; you will paste it into JupiterOne.

### Configuration in JupiterOne

To install the Lema integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Lema**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Lema account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **API Key** authentication fields below.
    

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **API Key** | Yes | The Lema Public API key. It is sent as `Authorization: Bearer <key>`. |
| **API Base URL** | No | The Lema API host. Defaults to `https://api.lema.ai`. Only `https` Lema hosts are accepted. |

When you save the instance, JupiterOne checks the key by requesting one third party from the Lema API. An invalid or revoked key is reported as an authentication error.

Click **Create** once all values are provided to finalize the integration.

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default**, so enable the ones you want to ingest. The `lema_account` entity is always created.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Vendors** | Third parties managed in Lema, with lifecycle (in evaluation, onboarded, unsanctioned, archived, offboarded), approval status, assessment score, inherent risk level, tags, linked sources, assessment counts and re-assessment due date. | `lema_vendor` |
| **Assessments** | Finalized and ongoing third-party risk assessments, with status, decision, score, inherent risk level, project, assessors, control counts by verification status, and start, completion and due dates. | `lema_assessment` |
| **Alerts** | Continuous-monitoring signals that a Lema alert rule promoted to an alert, with severity, status, type, alert rule, linked control, CVE identifier and references. | `lema_alert` |

> **CAUTION**
> 
> **Assessments and Alerts require Vendors.** Both run after the Vendors data source and attach to the vendor they belong to. If **Vendors** is disabled, **Assessments** and **Alerts** are not ingested either. To ingest everything the integration supports, enable all three data sources.

Relationships are built only when every data source they need is enabled:

| Relationship | Requires |
| --- | --- |
| `lema_account` **HAS** `lema_vendor` | **Vendors** |
| `lema_vendor` **HAS** `lema_assessment` | **Vendors** and **Assessments** |
| `lema_vendor` **HAS** `lema_alert` | **Vendors** and **Alerts** |

#### Example queries

Find onboarded vendors with no completed assessment:

```text
FIND lema_vendor WITH lifecycle = 'onboarded'
  THAT !HAS lema_assessment WITH status = 'completed'
```

Find unsanctioned third parties:

```text
FIND lema_vendor WITH lifecycle = 'unsanctioned'
```

Find onboarded vendors with an open critical alert:

```text
FIND lema_vendor WITH lifecycle = 'onboarded'
  THAT HAS lema_alert WITH severity = 'critical' AND open = true
```

Find vendors whose re-assessment is overdue:

```text
FIND lema_vendor WITH reAssessmentDueOn < date.now
```

#### Notes

-   **Every run is a full sync.** Each run reads every third party, assessment and alert. Items that Lema no longer returns are removed from the graph on the next run.
-   **Only alerts are ingested.** Monitoring signals that no alert rule promoted to an alert are not collected. Signals Lema marks as false positives are excluded by the Lema API.
-   **Contact details are not ingested.** Third-party contacts and business-owner names and e-mail addresses are not stored in JupiterOne. Assessments carry the names of their assessors and assignees, not their e-mail addresses.
-   **Alert counts per vendor** come from the related `lema_alert` entities, so they can be filtered by severity and status in queries.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Lema](https://www.lema.ai/) — for API keys and API access questions, contact your Lema team

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (3)

-   `https://api.lema.ai/api/v1/assessments`
-   `https://api.lema.ai/api/v1/signals`
-   `https://api.lema.ai/api/v1/third-parties`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://docs.jupiterone.io/integrations/directory/lema](https://docs.jupiterone.io/integrations/directory/lema)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | Endpoints |
| --- | --- |
| Fetch Alerts | `https://api.lema.ai/api/v1/signals` |
| Fetch Assessments | `https://api.lema.ai/api/v1/assessments` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `lema_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `lema_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Assessment | `lema_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Vendor | `lema_vendor` | [Vendor](https://docs.jupiterone.io/data-model/schemas/Vendor) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `lema_account` | **HAS** | `lema_vendor` |
| `lema_vendor` | **HAS** | `lema_assessment` |
| `lema_vendor` | **HAS** | `lema_alert` |

### Lema Account

`lema_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Lema Alert

`lema_alert` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alertRuleName` | `string` **|** `null` | Name of the alert rule that promoted the signal to an alert. |  |
| `alertType` | `string` **|** `null` | Signal type, e.g. data\_breach, security\_vulnerability\_disclosure, service\_outage\_disclosure. |  |
| `controlName` | `string` **|** `null` | Name of the Lema control the signal is linked to, if any. |  |
| `cveId` | `string` **|** `null` | CVE identifier from the alert evidence (e.g. CVE-2025-12345), when the evidence is a CVE. |  |
| `detectedOn` | `number` **|** `null` | When Lema first detected the signal (epoch ms). |  |
| `evidenceType` | `string` **|** `null` | Evidence kind: cve, news or none. |  |
| 
`id` \*

 | `string` | Lema signal ID. |  |
| `mitigationSteps` | `array` **|** `null` | Suggested remediation steps. |  |
| `subtitle` | `string` **|** `null` | Short secondary headline of the alert. |  |

---

### Lema Assessment

`lema_assessment` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assessmentScore` | `string` **|** `null` | Assessment score: acceptable, concerning, unacceptable or not\_assessed. |  |
| `assessmentType` | `string` **|** `null` | finalized (concluded) or ongoing (in progress). |  |
| `assignees` | `array` **|** `null` | Names of the users assigned to an ongoing assessment. |  |
| `decision` | `string` **|** `null` | Final decision: approved, conditionally\_approved or rejected. Null while ongoing. |  |
| `dueOn` | `number` **|** `null` | When the assessment is due (epoch ms). |  |
| `gapControlCount` | `number` **|** `null` | Number of the assessment controls with verification status gap. |  |
| `inherentRiskLevel` | `string` **|** `null` | The assessed third party's current effective inherent risk level: critical, high, medium or low. |  |
| `isInherentRiskManuallyAssigned` | `boolean` **|** `null` | Whether inherentRiskLevel came from a manual assignment rather than the system-computed score. |  |
| `noEvidenceControlCount` | `number` **|** `null` | Number of the assessment controls with verification status no\_evidence. |  |
| `notApplicableControlCount` | `number` **|** `null` | Number of the assessment controls with verification status not\_applicable. |  |
| `notEvaluatedControlCount` | `number` **|** `null` | Number of the assessment controls with verification status not\_evaluated. |  |
| `projectName` | `string` **|** `null` | Assessment project (scope domain) name. |  |
| `sentToReviewOn` | `number` **|** `null` | When the assessment was submitted for approval (epoch ms). |  |
| `validatedControlCount` | `number` **|** `null` | Number of the assessment controls with verification status validated. |  |

---

### Lema Vendor

`lema_vendor` inherits from [Vendor](/data-model/schemas/Vendor.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assessmentScore` | `string` **|** `null` | Overall assessment score (worst score across the latest finalized assessment of each project): acceptable, concerning, unacceptable or not\_assessed. |  |
| `companySize` | `string` **|** `null` | Company size band of the third party. |  |
| `engagementNames` | `array` **|** `null` | Names of the engagements this third party belongs to. |  |
| `foundingYear` | `number` **|** `null` | Year the third party was founded. |  |
| `industrySector` | `string` **|** `null` | Industry sector of the third party. |  |
| `inherentRiskLevel` | `string` **|** `null` | Effective inherent risk level (manual override if set, else system-computed): critical, high, medium or low. |  |
| `inherentRiskUpdatedOn` | `number` **|** `null` | When the inherent risk level was last updated (epoch ms). |  |
| `isInherentRiskManuallyAssigned` | `boolean` **|** `null` | Whether inherentRiskLevel came from a manual assignment rather than the system-computed score. |  |
| `lifecycle` | `string` **|** `null` | Lifecycle state: in\_evaluation, onboarded, unsanctioned, archived or offboarded. |  |
| `lifecycleChangedOn` | `number` **|** `null` | When the lifecycle state last changed (epoch ms). |  |
| `ongoingAssessments` | `number` **|** `null` | Number of in-flight assessments. |  |
| `parentId` | `string` **|** `null` | Lema ID of the parent company (group affiliation), when the third party belongs to a group. |  |
| `reAssessmentDueOn` | `number` **|** `null` | When the next re-assessment is due (epoch ms). Null when no cadence is set. |  |
| `sources` | `array` **|** `null` | Display names of the data sources linked to this third party. |  |
| `statusChangedOn` | `number` **|** `null` | When the approval status last changed (epoch ms). |  |
| `totalAssessments` | `number` **|** `null` | Number of concluded assessments. |  |

---

---

Source: /integrations/directory/linear

# Linear

Visualize your Linear organization, projects, teams, and users in the JupiterOne graph and monitor changes to Linear entities by leveraging JupiterOne alerts.

## Installation

To use this integration, JupiterOne requires an API key created by a user that has permissions to generate a new API key.

### Configuration in Linear

1.  Generate an API key via the [settings page](https://linear.app/settings/api).
2.  Copy the API key and save it for use within JupiterOne.

### Configuration in JupiterOne

1.  From the top-bar menu, select **Integrations**.
    
2.  Scroll to, or search for, the **Linear** integration tile and click it.
    
3.  Click the **New Instance** button and configure the settings:
    
    -   Enter the **API Key** generated in Linear in the **Access Token** field.
    -   Enter the **Account Name** by which you'd like to identify this Linear account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
4.  Click the **Create** button to complete the integration.
    

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data about your Linear environment within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Issue | `linear_issue` | [Record](https://docs.jupiterone.io/data-model/schemas/Record), [Issue](https://docs.jupiterone.io/data-model/schemas/Issue) |
| Organization | `linear_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Project | `linear_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Team | `linear_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team), [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| User | `linear_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `linear_issue` | **ASSIGNED** | `linear_user` |
| `linear_issue` | **CONTAINS** | `linear_issue` |
| `linear_organization` | **HAS** | `linear_team` |
| `linear_project` | **HAS** | `linear_user` |
| `linear_project` | **HAS** | `linear_issue` |
| `linear_team` | **HAS** | `linear_project` |
| `linear_team` | **HAS** | `linear_user` |
| `linear_team` | **HAS** | `linear_issue` |
| `linear_user` | **CREATED** | `linear_issue` |

### Linear User

`linear_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `guest` | `boolean` |  |  |
| `lastSeen` | `integer` |  |  |
| `organization` | `string` |  |  |
| `picture` | `string` |  |  |

---

---

Source: /integrations/directory/linkedin-learning

# LinkedIn Learning

Visualize LinkedIn Learning courses, learning paths, videos, content taxonomy, learners, and per-learner engagement (completions, views, progress) in the JupiterOne graph. Track training completion as compliance evidence, identify gaps in skill coverage, and map learners to the content they engage with through queries and alerts.

## Installation

> **INFO**
> 
> LinkedIn Learning credentials are scoped to two **key types** — `Content` (`learningAssets` + `learningClassifications`) and `Report` (`learningActivityReports`). The integration accepts up to two credential pairs, one per scope, but **only one pair is required**. See the [Authorization](/integrations/directory/linkedin-learning.md?integration-docs=authorization) tab for the full breakdown of how credential combinations behave.

### Prerequisites

-   A **LinkedIn Learning Enterprise** account.
-   An administrator with permission to **Generate LinkedIn Learning REST API Applications** from the LinkedIn Learning admin console.
-   Access to **JupiterOne** with permission to configure integrations.

### Generate API credentials in LinkedIn Learning

LinkedIn provisions credentials at the **application** level. You can either create one application with both key types selected (recommended for new installs) or create two separate applications, one per scope.

1.  Sign in to LinkedIn Learning as an administrator. If you are not already in the Admin area, click **Go to Admin**.
    
2.  In the side navigation, open **Access content and reports via API** and expand **Generate LinkedIn Learning REST API Application**.
    
3.  Click **Add application**.
    
4.  Enter an **Application Name** (e.g. _JupiterOne Integration_) and an **Application description** (e.g. _Reads LinkedIn Learning content and activity into JupiterOne for compliance reporting_).
    
5.  Under **Choose keys**, select **Content**, **Report**, or both depending on which data surface you want to ingest:
    
    -   **Content** authorizes the asset catalog: courses, learning paths, videos, and the content taxonomy.
    -   **Report** authorizes per-learner engagement: completions, views, progress, and seconds-viewed.
6.  Click **Next** and accept the **Terms and Conditions**.
    
7.  Copy the generated **Client ID** and **Client Secret** — save them securely. You will paste these values into JupiterOne in the next section.
    
    > **TIP**
    > 
    > If you create one application with **both** Content and Report keys selected, you only have to copy a single pair. The same `Client ID` / `Client Secret` authorizes every endpoint and you only need to fill one of the two pairs in JupiterOne.
    
8.  (Optional) Repeat the steps above if your organization requires separate applications for the two scopes (e.g. because Content and Report access are owned by different teams). You will end up with two distinct credential pairs, one per scope.
    

### Configure the integration in JupiterOne

To install the LinkedIn Learning integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **LinkedIn Learning**. Click **New Instance** to begin configuring your integration.

Creating a LinkedIn Learning instance requires the following:

-   The **Account Name** used to identify the LinkedIn Learning account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
-   **Description** to assist in identifying the integration instance, if desired.
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.

#### Authentication fields

Fill in **at least one** of the credential pairs below. For full guidance on which combination matches your application setup, see the [Authorization](/integrations/directory/linkedin-learning.md?integration-docs=authorization) tab.

| Field | Required | Description |
| --- | --- | --- |
| **Content Client ID** | Conditional — at least one pair is required. | OAuth Client ID for the LinkedIn Learning application authorized for the **Content** scope. If your application has both Content and Report keys selected, filling this pair alone authorizes every endpoint. |
| **Content Client Secret** | Required when **Content Client ID** is provided. | OAuth Client Secret paired with **Content Client ID**. |
| **Report Client ID** | Conditional — at least one pair is required. | OAuth Client ID for the LinkedIn Learning application authorized for the **Report** scope. Only set this when you generated a separate application for the Report keys. |
| **Report Client Secret** | Required when **Report Client ID** is provided. | OAuth Client Secret paired with **Report Client ID**. |

#### Advanced — Activity Lookback Days

The integration's user-activity steps query LinkedIn's `learningActivityReports` endpoint, which **caps each request at a 14-day window**. The integration transparently chunks longer lookback windows into multiple ≤14-day requests on each sync.

| Field | Default | Options | Description |
| --- | --- | --- | --- |
| **Activity Lookback Days** | `14` | `14`, `30`, `90`, `180`, `365` | How far back to fetch learning activity on each sync. Larger values increase the number of API calls per run: 14 days → 1 window per activity step; 365 days → 27 windows per activity step. |

**How it affects data volume:** Larger lookback windows ingest more historical engagement, which produces a denser `User -[:ASSIGNED]-> Training` relationship graph but multiplies the request count per sync. For day-to-day compliance reporting, `14` is sufficient on a daily polling cadence. Choose `90` or longer only when you need a historical backfill or when your polling cadence is weekly/monthly.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `linkedin_learning_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Classification | `linkedin_learning_classification` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Course | `linkedin_learning_course` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |
| LearningPath | `linkedin_learning_learning_path` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |
| User | `linkedin_learning_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Video | `linkedin_learning_video` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `linkedin_learning_account` | **HAS** | `linkedin_learning_classification` |
| `linkedin_learning_account` | **HAS** | `linkedin_learning_course` |
| `linkedin_learning_account` | **HAS** | `linkedin_learning_learning_path` |
| `linkedin_learning_account` | **HAS** | `linkedin_learning_video` |
| `linkedin_learning_account` | **HAS** | `linkedin_learning_user` |
| `linkedin_learning_course` | **HAS** | `linkedin_learning_classification` |
| `linkedin_learning_learning_path` | **HAS** | `linkedin_learning_classification` |
| `linkedin_learning_user` | **ASSIGNED** | `linkedin_learning_course` |
| `linkedin_learning_user` | **ASSIGNED** | `linkedin_learning_learning_path` |
| `linkedin_learning_user` | **ASSIGNED** | `linkedin_learning_video` |
| `linkedin_learning_video` | **HAS** | `linkedin_learning_classification` |

### Linkedin Learning Account

`linkedin_learning_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountKeyRef` \*

 | `string` | The credential identifier (content or report client id) used to scope this account entity to its integration instance. |  |

---

### Linkedin Learning Classification

`linkedin_learning_classification` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`classificationType` \*

 | `string` **|** `null` | The taxonomy level of the classification (LIBRARY, SUBJECT, TOPIC, SKILL, CREDENTIALING\_PROGRAM). |  |
| 

`locale` \*

 | `string` **|** `null` | The locale of the classification name as language\_country (e.g. en\_US). |  |
| 

`ownerName` \*

 | `string` **|** `null` | The localized display name of the classification owner. |  |
| 

`ownerUrn` \*

 | `string` **|** `null` | The URN of the person or organization that owns/originally created this classification. |  |
| 

`urn` \*

 | `string` | The opaque LinkedIn URN identifying the classification (e.g. urn:li:lyndaCategory:7220 or urn:li:skill:1234). |  |

---

### Linkedin Learning Course

`linkedin_learning_course` inherits from [Training](/data-model/schemas/Training.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` | The LinkedIn-reported asset type (COURSE, LEARNING\_PATH, or VIDEO). |  |
| 

`availability` \*

 | `string` **|** `null` | The availability status of the asset (AVAILABLE, RETIRED). |  |
| 

`availableLanguages` \*

 | `array` **|** `null` | The list of language codes the asset is available in (e.g. en, de, es). |  |
| 

`contributorNames` \*

 | `array` **|** `null` | The names of contributors involved in producing the asset (authors and publishers). |  |
| 

`contributorUrns` \*

 | `array` **|** `null` | The URNs of contributors involved in producing the asset. |  |
| 

`durationSeconds` \*

 | `number` **|** `null` | The duration of the asset in seconds (computed from timeToComplete). |  |
| 

`isCuratedForLms` \*

 | `boolean` **|** `null` | Whether the asset was curated for Learning Management System consumption by an account administrator. |  |
| 

`isRetired` \*

 | `boolean` **|** `null` | Whether the asset has been retired from the LinkedIn catalog. |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was last updated. |  |
| 

`level` \*

 | `string` **|** `null` | The difficulty level of the asset (BEGINNER, INTERMEDIATE, ADVANCED). |  |
| 

`primaryImageUrl` \*

 | `string` **|** `null` | The primary image URL used to represent the asset. |  |
| 

`publishedOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was published in LinkedIn Learning. |  |
| 

`retiredOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was retired, if applicable. |  |
| 

`shortDescription` \*

 | `string` **|** `null` | The plain-text short description of the asset, localized when available. |  |
| 

`ssoLaunchUrl` \*

 | `string` **|** `null` | The SSO launch URL of the asset, populated when an SSO connection is configured. |  |
| 

`titleLocale` \*

 | `string` **|** `null` | The locale of the asset title as language\_country (e.g. en\_US). |  |
| 

`urn` \*

 | `string` | The opaque LinkedIn URN identifying the learning asset (e.g. urn:li:lyndaCourse:563322). |  |
| 

`webLaunchUrl` \*

 | `string` **|** `null` | The LinkedIn Learning web URL used to launch the asset for an authenticated learner. |  |

---

### Linkedin Learning Learning Path

`linkedin_learning_learning_path` inherits from [Training](/data-model/schemas/Training.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` | The LinkedIn-reported asset type (COURSE, LEARNING\_PATH, or VIDEO). |  |
| 

`availability` \*

 | `string` **|** `null` | The availability status of the asset (AVAILABLE, RETIRED). |  |
| 

`availableLanguages` \*

 | `array` **|** `null` | The list of language codes the asset is available in (e.g. en, de, es). |  |
| 

`contributorNames` \*

 | `array` **|** `null` | The names of contributors involved in producing the asset (authors and publishers). |  |
| 

`contributorUrns` \*

 | `array` **|** `null` | The URNs of contributors involved in producing the asset. |  |
| 

`durationSeconds` \*

 | `number` **|** `null` | The duration of the asset in seconds (computed from timeToComplete). |  |
| 

`isCuratedForLms` \*

 | `boolean` **|** `null` | Whether the asset was curated for Learning Management System consumption by an account administrator. |  |
| 

`isRetired` \*

 | `boolean` **|** `null` | Whether the asset has been retired from the LinkedIn catalog. |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was last updated. |  |
| 

`level` \*

 | `string` **|** `null` | The difficulty level of the asset (BEGINNER, INTERMEDIATE, ADVANCED). |  |
| 

`primaryImageUrl` \*

 | `string` **|** `null` | The primary image URL used to represent the asset. |  |
| 

`publishedOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was published in LinkedIn Learning. |  |
| 

`retiredOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was retired, if applicable. |  |
| 

`shortDescription` \*

 | `string` **|** `null` | The plain-text short description of the asset, localized when available. |  |
| 

`ssoLaunchUrl` \*

 | `string` **|** `null` | The SSO launch URL of the asset, populated when an SSO connection is configured. |  |
| 

`titleLocale` \*

 | `string` **|** `null` | The locale of the asset title as language\_country (e.g. en\_US). |  |
| 

`urn` \*

 | `string` | The opaque LinkedIn URN identifying the learning asset (e.g. urn:li:lyndaCourse:563322). |  |
| 

`webLaunchUrl` \*

 | `string` **|** `null` | The LinkedIn Learning web URL used to launch the asset for an authenticated learner. |  |

---

### Linkedin Learning User

`linkedin_learning_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`enterpriseGroupNames` \*

 | `array` **|** `null` | The enterprise group names the learner belongs to in LinkedIn Learning. |  |
| 

`profileUrn` \*

 | `string` **|** `null` | The enterprise profile URN of the learner (e.g. urn:li:enterpriseProfile:(urn:li:enterpriseAccount:99,12345)). |  |
| 

`uniqueUserId` \*

 | `string` **|** `null` | The customer-supplied unique identifier for the learner provisioned in LinkedIn Learning. |  |

---

### Linkedin Learning Video

`linkedin_learning_video` inherits from [Training](/data-model/schemas/Training.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` | The LinkedIn-reported asset type (COURSE, LEARNING\_PATH, or VIDEO). |  |
| 

`availability` \*

 | `string` **|** `null` | The availability status of the asset (AVAILABLE, RETIRED). |  |
| 

`availableLanguages` \*

 | `array` **|** `null` | The list of language codes the asset is available in (e.g. en, de, es). |  |
| 

`contributorNames` \*

 | `array` **|** `null` | The names of contributors involved in producing the asset (authors and publishers). |  |
| 

`contributorUrns` \*

 | `array` **|** `null` | The URNs of contributors involved in producing the asset. |  |
| 

`durationSeconds` \*

 | `number` **|** `null` | The duration of the asset in seconds (computed from timeToComplete). |  |
| 

`isCuratedForLms` \*

 | `boolean` **|** `null` | Whether the asset was curated for Learning Management System consumption by an account administrator. |  |
| 

`isRetired` \*

 | `boolean` **|** `null` | Whether the asset has been retired from the LinkedIn catalog. |  |
| 

`lastUpdatedOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was last updated. |  |
| 

`level` \*

 | `string` **|** `null` | The difficulty level of the asset (BEGINNER, INTERMEDIATE, ADVANCED). |  |
| 

`primaryImageUrl` \*

 | `string` **|** `null` | The primary image URL used to represent the asset. |  |
| 

`publishedOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was published in LinkedIn Learning. |  |
| 

`retiredOn` \*

 | `number` **|** `null` | Epoch milliseconds at which the asset was retired, if applicable. |  |
| 

`shortDescription` \*

 | `string` **|** `null` | The plain-text short description of the asset, localized when available. |  |
| 

`ssoLaunchUrl` \*

 | `string` **|** `null` | The SSO launch URL of the asset, populated when an SSO connection is configured. |  |
| 

`titleLocale` \*

 | `string` **|** `null` | The locale of the asset title as language\_country (e.g. en\_US). |  |
| 

`urn` \*

 | `string` | The opaque LinkedIn URN identifying the learning asset (e.g. urn:li:lyndaCourse:563322). |  |
| 

`webLaunchUrl` \*

 | `string` **|** `null` | The LinkedIn Learning web URL used to launch the asset for an authenticated learner. |  |

---

## Release Notes

-   **2026-06-26** — Added initial LinkedIn Learning integration, ingesting courses, learning asset classifications, and their relationships.

---

Source: /integrations/directory/logicmonitor

# LogicMonitor

Visualize LogicMonitor devices in the JupiterOne graph. Use this integration as part of a Unified Device use case.

## Installation

### Requirements

-   User requires Bearer token generated in LogicMonitor Account.
-   You must have permission in JupiterOne to install new integrations.

### Configuration in LogicMonitor

#### Create Bearer Token

1.  Follow the instructions found [here](https://www.logicmonitor.com/support/adding-a-bearer-token) to create a Bearer Token.
2.  Save the token in a secure location, following your organization's security policies.

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**
2.  Search for the **LogicMonitor** and select it.
3.  Click on the **Add Instance** button and configure the following settings:

-   Enter the **Account Name** by which you'd like to identify this LogicMonitor instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
-   Enter a **Description** that will further assist your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
-   Enter the **Company Subdomain**. If you log in in at `https://<company>.logicmonitor.com`, then `<company>` is the company subdomain.
-   Enter the **LogicMonitor Bearer Token** generated for use by JupiterOne.

4.  Click **Create Configuration** once all values are provided.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `logicmonitor_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `logicmonitor_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |

### Logicmonitor Account

`logicmonitor_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Logicmonitor Device

`logicmonitor_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`autoBalancedCollectorGroupId` \*

 | `number` | The Auto Balanced Collector Group id. 0 means not monitored by ABCG |  |
| 

`autoPropsAssignedOn` \*

 | `number` |  |  |
| `autoPropsUpdatedOn` | `number` | The time, in epoch seconds, that auto properties last ran and updated the properties table for this device |  |
| `awsDeviceDiedOn` | `number` | The timestamp when the AWS device went dead, or the AWS device was filtered out |  |
| 

`category` \*

 | `string` **|** `null` | Derived from the system property namee: "system.systemtype" |  |
| `cmdbUrl` | `string` | Included if found at sn.cmdb\_url in response |  |
| 

`collectorDescription` \*

 | `string` | The description/name of the collector for this device |  |
| 

`currentCollectorId` \*

 | `number` | The id of the collector currently monitoring the device and discovering instances |  |
| 

`currentLogCollectorId` \*

 | `number` | The id of the Log collector currently collecting logs. |  |
| 

`deviceType` \*

 | `string` | The type of device: Regular device, APPGROUP device, AWS device, Service device, Azure device, Biz Service device, GCP device, K8S device |  |
| `deviceWillBeDeletedOn` | `number` | The number of milliseconds until the device will be automatically deleted from your LogicMonitor account (if value is not present, this indicates that a future delete time/date has not been scheduled) |  |
| 

`disableAlerting` \*

 | `boolean` | Indicates whether alerting is disabled (true) or enabled (false) for this device |  |
| 

`displayName` \*

 | `string` | The display name of the device |  |
| 

`enableNetflow` \*

 | `boolean` | Indicates whether Netflow is enabled (true) or disabled (false) for the device |  |
| `endpointCaption` | `string` | Derived from the auto property named: "auto.endpoint.caption" |  |
| `externalResourceId` | `string` | Included if found at prefdef.externalResourceID in response |  |
| `hostGroupIds` | `array` of `string`s |  |  |
| 

`hostStatus` \*

 | `string` | The status of this device, where possible statuses are: normal, dead and dead-collector | **Any of**:

-   `normal`

-   `dead`

-   `dead-collector`

 |
| `instanceState` | `string` | The CSP (GCP, Azure, or AWS) instance state (if applicable): running, stopped and terminated. |  |
| 

`isPreferredLogCollectorConfigured` \*

 | `boolean` | Indicates whether Preferred Log Collector is configured (true) or not (false) for the device |  |
| `lastReportedNewflowDataOn` | `number` | The last time, in epoch seconds, that raw Netflow data was reported |  |
| 

`lastSeenOn` \*

 | `number` **|** `null` | The last time, in epoch seconds, that the device received Netflow data |  |
| 

`logCollectorDescription` \*

 | `string` | The description/name of the log collector for this device |  |
| 

`logCollectorGroupId` \*

 | `number` | The id of the Collector Group associated with the device's log collection |  |
| 

`logCollectorGroupName` \*

 | `string` | The name of the Collector Group associated with the device's. |  |
| 

`logCollectorId` \*

 | `number` | The Id of the netflow collector associated with the device |  |
| 

`netflowCollectorDescription` \*

 | `string` | The description/name of the netflow collector for this device |  |
| 

`netflowCollectorGroupId` \*

 | `number` | The id of the Collector Group associated with the device's netflow collector |  |
| 

`netflowCollectorGroupName` \*

 | `string` | The name of the Collector Group associated with the device's netflow collector |  |
| 

`netflowCollectorId` \*

 | `number` | The Id of the netflow collector associated with the device |  |
| `osArchitecture` | `string` | Derived from the auto property named: "auto.os.architecture" |  |
| `osComputerName` | `string` | Derived from the auto property named: "auto.os.computer\_name" |  |
| `osKernel` | `string` | Derived from "auto.linux.kernel.release" on Linux devices, or "auto.os.version" on Windows devices (NT kernel version format) |  |
| `osPrimaryOwnerName` | `string` | Derived from the auto property named: "auto.os.primary\_owner\_name" |  |
| 

`preferredCollectorGroupId` \*

 | `number` | The id of the Collector Group associated with the device's preferred collector |  |
| 

`preferredCollectorGroupName` \*

 | `string` | The name of the Collector Group associated with the device's preferred collector |  |
| 

`preferredCollectorId` \*

 | `number` | The Id of the preferred collector assigned to monitor the device |  |
| `relatedAwsEc2InstanceDeviceId` | `number` | The Id of the AWS EC2 instance related to this device, if one exists in the LogicMonitor account. This value defaults to -1, which indicates that there are no related devices |  |
| 

`rolePrivileges` \*

 | `array` of `string`s |  |  |
| `scanConfigId` | `number` | The Id of the netscan configuration which was used to discover this device. 0 indicates that the device was not discovered by a scan |  |
| `systemGroups` | `array` of `string`s |  |  |
| 

`userPermission` \*

 | `string` | The read and/or write permissions for this device that are granted to the user who made the API request |  |

---

## Release Notes

-   **2026-03-31** — Added OS kernel version property to LogicMonitor device entities.
-   **2025-04-17** — Added ServiceNow system ID as a device identifier on LogicMonitor device entities.

---

Source: /integrations/directory/malwarebytes

# Malwarebytes

Visualize Malwarebytes configurations and findings, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> JupiterOne requires a Malwarebytes account ID, API client ID and client secret to interact with the API. For more information on obtaining API credentials, refer to [Malwarebyte's API documentation](https://api.malwarebytes.com/nebula/v1/docs).

### Configuration in JupiterOne

To install the Malwarebytes integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Malwarebytes. Click **New Instance** to begin configuring your integration, providing the requires the following:

-   **Account Name** used to identify the Malwarebytes account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Account ID** of your Malwarebytes account.
    
-   Your MalwareBytes **Client ID** and **Client Seecret** configured for this integration.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `malwarebytes_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Configuration | `malwarebytes_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Finding | `malwarebytes_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Group | `malwarebytes_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| HostAgent | `malwarebytes_agent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `malwarebytes_account` | **HAS** | `malwarebytes_group` |
| `malwarebytes_account` | **HAS** | `malwarebytes_agent` |
| `malwarebytes_agent` | **PROTECTS** | `USER_ENDPOINT` |
| `malwarebytes_agent` | **IDENTIFIED** | `malwarebytes_finding` |
| `malwarebytes_group` | **HAS** | `malwarebytes_configuration` |
| `malwarebytes_group` | **HAS** | `malwarebytes_agent` |

---

Source: /integrations/directory/manage-engine-ec

# ManageEngine Endpoint Central

Visualize Manage Engine computers, patches and remote offices in the JupiterOne graph. Our guide provides step-by-step instructions on setting up the integration gaining visibility to your ManageEngine Endpoint Central environment.

## Installation

To install this integration, you will need to configure settings both within ManageEngine Endpoint Central and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your ManageEngine Endpoint Central's account.

### Configuration on ManageEngine Endpoint Central

First, follow the table in the [ManageEngine Endpoint Central documentation](https://www.manageengine.com/products/desktop-central/api/cloud_index.html#api-structure) to get correct Zoho Account and Endpoint Central API URLs, as well link to the Zoho Developer Console necessary to the next steps.

# ManageEngine Integration Setup Guide

This guide provides detailed, step-by-step instructions to set up an integration with ManageEngine Desktop Central. There are two integration options available: **On-Premises** and **Cloud**. Follow the instructions below to ensure your integration is configured correctly.

## Table of Contents

1.  [Prerequisites](#prerequisites)
2.  [On-Premises Integration Setup](#on-premises-integration-setup)
    -   [API Token Authentication](#api-token-authentication)
    -   [Username/Password Authentication (No Two-Factor)](#usernamepassword-authentication-no-two-factor)
3.  [Cloud Integration Setup](#cloud-integration-setup)
4.  [Support](#support)

## Prerequisites

Before you begin, ensure you have:

-   An active ManageEngine Desktop Central subscription.
-   API access enabled and necessary credentials obtained.
-   Basic knowledge of REST APIs and your current environment setup.
-   Network/firewall settings that allow outbound API requests.

## On-Premises Integration Setup

ManageEngine offers two methods for on-premises integration depending on your authentication method:

### API Token Authentication

1.  **Access the On-Premises API Documentation**  
    Familiarize yourself with the available endpoints and guidelines in the [ManageEngine On-Premises API Documentation](https://www.manageengine.com/products/desktop-central/api/).
    
2.  **Generate an API Token**
    
    -   Log in to your Desktop Central instance.
    -   Navigate to **Admin** → **Integrations** → **API Key Management**.
    -   Create or regenerate your API token.
    -   If two factor is enabled make sure to complete the steps providing the OTP.
    -   **Note:** Ensure that this token remains confidential.
3.  **Configure Your Integration**
    
    -   Update your JupiterOne integration settings. Select _On-Premise Token Authentication_.
    -   Input your Server URL and API Token.

### Username/Password Authentication (No Two-Factor)

If you are **not** using two-factor authentication, you can also integrate using your username and password.

1.  **Review Authentication Requirements**
    
    -   If two-factor authentication is disabled, you can use your ManageEngine username and password for integration.
    -   Consult the [ManageEngine On-Premises API Documentation](https://www.manageengine.com/products/desktop-central/api/) for details on the authentication endpoint.
2.  **Configure Your Integration**
    
    -   Update your JupiterOne integration settings. Select _On-Premise AD Authentication_ or _On-Premise Local Authentication_ depending on your setup.
    -   Input your Server URL, username, password and domain if needed.

## Cloud Integration Setup

Familiarize yourself with the cloud API by referring to the [ManageEngine Cloud API Documentation](https://www.manageengine.com/products/desktop-central/api/cloud_index.html).

**Steps:**

1.  **Log in to Zoho Developer Console**  
    Access the Zoho Developer Console with your credentials.
    
2.  **Create a "Self Client" Client Type**  
    Create a new client of type "Self Client".
    
3.  **Retrieve Client Credentials**
    
    -   Navigate to the "Client Secret" tab.
    -   Copy the "Client ID" and "Client Secret" and save them somewhere secure.
4.  **Generate an Authorization Code**
    
    -   Go to the "Generate Code" tab within your "Self Client" application.
    -   Set the **Scope** to:  
        `DesktopCentralCloud.Common.READ,DesktopCentralCloud.SOM.READ,DesktopCentralCloud.Inventory.READ,DesktopCentralCloud.PatchMgmt.READ`
    -   Optionally, set the **Time Duration** to 10 minutes.
    -   Provide a **Scope Description** (e.g., "JupiterOne Integration").
    -   Click **Create** to generate an authorization code.
5.  **Obtain the Refresh Token**
    
    -   Exchange the authorization code from the previous step for a refresh token using the following `curl` command. Replace `<code>`, `<client_id>`, and `<client_secret>` with your actual values, and `<region>` with the top-level domain of your Zoho data center (for example `com`, `eu`, `in`, `com.au`, `cn`, `jp`, `ca`, or `uk`) as listed in the [ManageEngine Cloud API region table](https://www.manageengine.com/products/desktop-central/api/cloud_index.html#api-structure):
        
        ```bash
        curl -X POST -H "Content-Type: application/x-www-form-urlencoded" \
        -d "grant_type=authorization_code&client_id=<client_id>&client_secret=<client_secret>&redirect_uri=https://api-console.zoho.<region>&code=<code>" \
        https://accounts.zoho.<region>/oauth/v2/token
        ```
        
    -   The response will include a JSON payload containing the `refresh_token`.
        
6.  **Save the Credentials**  
    Store the "refresh token", along with your "Client ID" and "Client Secret", securely. These credentials will be needed later when configuring JupiterOne.
    

## Support

For more details and assistance, refer to the official documentation:

-   [ManageEngine On-Premises API Documentation](https://www.manageengine.com/products/desktop-central/api/)
-   [ManageEngine Cloud API Documentation](https://www.manageengine.com/products/desktop-central/api/cloud_index.html)

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Computer | `manageengine_computer` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Patch | `manageengine_patch` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| RemoteOffice | `manageengine_remote_office` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `manageengine_computer` | **HAS** | `manageengine_patch` |
| `manageengine_remote_office` | **MANAGES** | `manageengine_computer` |
| `manageengine_remote_office` | **ENFORCES** | `manageengine_patch` |

### Manageengine Computer

`manageengine_computer` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentLoggedOnUsers` | `string` | Users currently logged on, as reported by the agent. |  |
| `agentVersion` | `string` | Endpoint Central agent version. |  |
| `customerName` | `string` | Endpoint Central customer name. |  |
| `deviceName` | `string` | Resource name of the computer in Endpoint Central. |  |
| `ipAddresses` | `array` of `string`s | IP addresses reported by the agent. |  |
| `macAddress` | `array` of `string`s | MAC addresses reported by the Endpoint Central agent. |  |
| `officeName` | `string` | Name of the remote (branch) office the computer belongs to. |  |
| `ownerEmailId` | `string` | Email address of the computer owner, as imported in Endpoint Central. |  |
| `platform` | `string` | Operating system platform (windows, darwin, linux). |  |
| `systemVersion` | `string` | Operating system service pack. |  |
| `vendor` | `string` | Vendor of the device. |  |

---

## Release Notes

-   **2026-04-08** — Improved OS details for ManageEngine Endpoint Central device entities to include both OS name and version.
-   **2025-06-03** — Added customer name, owner, owner email, and logged-on user properties to ManageEngine Endpoint Central device entities.

---

Source: /integrations/directory/mandiant-asm

# Mandiant ASM

Visualize Mandiant Attack Surface Management assets, monitor external-facing hosts, domains, certificates, and security issues, and track changes through queries and alerts.

## Installation

This integration ingests Attack Surface Management (ASM) projects, collections, entities (hosts, domains, DNS records, network services, certificates, application endpoints, networks, data stores, and code repositories), issues, and technologies.

Two authentication methods are available, matching how your ASM tenant was provisioned:

-   **Mandiant Advantage Access Key** — for tenants using the original Mandiant Advantage ASM API.
-   **Google Threat Intelligence API Key** — for tenants provisioned in Google Threat Intelligence (GTI).

> **INFO**
> 
> Mandiant was acquired by Google, and Mandiant Advantage products have been consolidated into Google Threat Intelligence. Service accounts are not carried over during this migration, so a tenant provisioned in GTI holds a GTI service-account API key rather than an ASM Access Key and Secret Key pair. Choose the authentication section that matches the credentials you hold.

### Prerequisites

1.  An Attack Surface Management license on your Mandiant Advantage or Google Threat Intelligence account. On GTI, ASM entitlement is managed separately from general GTI access.
2.  At least one ASM project configured in the platform. The integration enumerates projects first, then ingests collections, entities, issues, and technologies for each one.

### Configuration in Mandiant ASM or Google Threat Intelligence

Choose the option that matches your tenant.

#### Option A: Mandiant Advantage Access Key

1.  Sign in to the Mandiant Advantage ASM portal.
2.  Under your account settings, generate an ASM API key pair.
3.  Note both the **Access Key** and the **Secret Key**. The secret is shown only once.

#### Option B: Google Threat Intelligence API Key

1.  Sign in to Google Threat Intelligence.
2.  Open the user menu and select **My Group**, then **Members**, then **Service accounts**.
3.  Create a service account if one does not already exist, and copy its **API key**.

> **TIP**
> 
> For more information on obtaining GTI API keys, see [How to get GTI API keys](https://gtidocs.virustotal.com/docs/how-get-gti-api-keys). If you are moving from Mandiant Advantage, see the [Mandiant to Google Threat Intelligence migration guide](https://gtidocs.virustotal.com/docs/mati-migration-guide).

### Configuration in JupiterOne

Navigate to the **Integrations** tab in JupiterOne and select **Mandiant ASM**. Click **New Instance** and select the authentication section matching your credentials.

All instances require:

-   The **Account Name** used to identify the Mandiant ASM account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

#### Mandiant Advantage Access Key

-   **Access Key** — the ASM API access key generated from your Mandiant Advantage account settings.
-   **Secret Key** — the ASM API secret key paired with that access key.

#### Google Threat Intelligence API Key

-   **GTI API Key** — the API key belonging to a Google Threat Intelligence service account with ASM access.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `mandiant_asm_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| ApplicationEndpoint | `mandiant_asm_application_endpoint` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| Certificate | `mandiant_asm_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| CodeRepo | `mandiant_asm_code_repo` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Collection | `mandiant_asm_collection` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| DataStore | `mandiant_asm_data_store` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| DnsRecord | `mandiant_asm_dns_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| Domain | `mandiant_asm_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| Host | `mandiant_asm_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Issue | `mandiant_asm_issue` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Network | `mandiant_asm_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| NetworkService | `mandiant_asm_network_service` | [NetworkInterface](https://docs.jupiterone.io/data-model/schemas/NetworkInterface) |
| Project | `mandiant_asm_project` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Resource | `mandiant_asm_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Technology | `mandiant_asm_technology` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Vulnerability | `mandiant_asm_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `mandiant_asm_account` | **HAS** | `mandiant_asm_project` |
| `mandiant_asm_application_endpoint` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_application_endpoint` | **USES** | `mandiant_asm_technology` |
| `mandiant_asm_certificate` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_code_repo` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_host` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_domain` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_dns_record` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_network_service` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_certificate` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_application_endpoint` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_network` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_data_store` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_code_repo` |
| `mandiant_asm_collection` | **HAS** | `mandiant_asm_resource` |
| `mandiant_asm_data_store` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_dns_record` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_domain` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_domain` | **USES** | `mandiant_asm_technology` |
| `mandiant_asm_host` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_host` | **USES** | `mandiant_asm_technology` |
| `mandiant_asm_network` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_network_service` | **HAS** | `mandiant_asm_issue` |
| `mandiant_asm_network_service` | **USES** | `mandiant_asm_technology` |
| `mandiant_asm_project` | **HAS** | `mandiant_asm_collection` |
| `mandiant_asm_resource` | **HAS** | `mandiant_asm_issue` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `mandiant_asm_code_repo` | **IS** | `github_repo` | FORWARD |
| `mandiant_asm_data_store` | **IS** | `aws_s3_bucket` | FORWARD |
| `mandiant_asm_data_store` | **IS** | `azure_storage_account` | FORWARD |
| `mandiant_asm_data_store` | **IS** | `google_storage_bucket` | FORWARD |
| `mandiant_asm_host` | **IS** | `aws_instance` | FORWARD |
| `mandiant_asm_host` | **IS** | `azure_vm` | FORWARD |
| `mandiant_asm_host` | **IS** | `google_compute_instance` | FORWARD |

### Mandiant Asm Account

`mandiant_asm_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`vendor` \*

 | `string` | The vendor name for the account |  |

---

### Mandiant Asm Application Endpoint

`mandiant_asm_application_endpoint` inherits from [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`address` \*

 | `string` **|** `null` | The address of the application endpoint |  |
| 

`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |

---

### Mandiant Asm Certificate

`mandiant_asm_certificate` inherits from [Certificate](/data-model/schemas/Certificate.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |

---

### Mandiant Asm Code Repo

`mandiant_asm_code_repo` inherits from [CodeRepo](/data-model/schemas/CodeRepo.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |

---

### Mandiant Asm Collection

`mandiant_asm_collection` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` | The workflow category of the collection |  |
| 

`entityCount` \*

 | `number` **|** `null` | The number of entities in the collection |  |
| 

`internal` \*

 | `boolean` | Whether this is an internal collection |  |
| 

`summary` \*

 | `string` | A summary description of the collection |  |

---

### Mandiant Asm Data Store

`mandiant_asm_data_store` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`classification` \*

 | `string` **|** `null` | The data classification level |  |
| 

`encrypted` \*

 | `boolean` **|** `null` | Whether the data store is encrypted |  |
| 

`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |

---

### Mandiant Asm Dns Record

`mandiant_asm_dns_record` inherits from [DomainRecord](/data-model/schemas/DomainRecord.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |
| 

`TTL` \*

 | `number` | Time-to-live of the DNS record (defaults to 0 when not provided by API) |  |
| 

`type` \*

 | `string` | The DNS record type (defaults to A when not provided by API) |  |

---

### Mandiant Asm Domain

`mandiant_asm_domain` inherits from [Domain](/data-model/schemas/Domain.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainName` \*

 | `string` | The domain name |  |
| 

`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |

---

### Mandiant Asm Host

`mandiant_asm_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` | The Mandiant ASM category of the host |  |
| 

`deviceId` \*

 | `array` **|** `null` | Device identifiers for the host |  |
| 

`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`fqdn` \*

 | `array` **|** `null` | Fully qualified domain names for the host |  |
| 

`hostname` \*

 | `string` **|** `null` | The hostname of the host |  |
| 

`ipv4Addresses` \*

 | `array` **|** `null` | IPv4 addresses of the host |  |
| 

`ipv6Addresses` \*

 | `array` **|** `null` | IPv6 addresses of the host |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |
| 

`lastSeenOn` \*

 | `integer` **|** `null` | Timestamp when the host was last seen |  |
| 

`macAddresses` \*

 | `array` **|** `null` | MAC addresses of the host |  |
| 

`make` \*

 | `string` **|** `null` | The manufacturer of the host |  |
| 

`model` \*

 | `string` **|** `null` | The model of the host |  |
| 

`osDetails` \*

 | `string` **|** `null` | Detailed OS information |  |
| 

`osName` \*

 | `string` **|** `null` | The OS name |  |
| 

`osType` \*

 | `string` **|** `null` | The OS type |  |
| 

`osVersion` \*

 | `string` **|** `null` | The OS version |  |
| 

`platform` \*

 | `string` **|** `null` | The cloud platform (AWS, Azure, GCP) |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses of the host |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses of the host |  |
| 

`serial` \*

 | `string` **|** `null` | The serial number of the host |  |

---

### Mandiant Asm Issue

`mandiant_asm_issue` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` | The category of the issue |  |
| 

`entityUid` \*

 | `string` **|** `null` | The UID of the parent entity this issue belongs to |  |
| 

`isConfidence` \*

 | `string` **|** `null` | The confidence level of the finding |  |
| 

`numericSeverity` \*

 | `number` **|** `null` | Numeric severity on a 0-10 scale |  |
| 

`open` \*

 | `boolean` **|** `null` | Whether the issue is currently open |  |
| 

`severity` \*

 | `string` **|** `null` | Severity level (critical, high, medium, low, informational) |  |
| 

`source` \*

 | `string` **|** `null` | The collection source of the issue |  |
| 

`upstream` \*

 | `string` **|** `null` | The upstream source of the issue |  |

---

### Mandiant Asm Network

`mandiant_asm_network` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`CIDR` \*

 | `string` **|** `null` | The CIDR notation for the network block |  |
| 

`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`internal` \*

 | `boolean` **|** `null` | Whether this is an internal network |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |
| 

`public` \*

 | `boolean` **|** `null` | Whether this is a public network |  |

---

### Mandiant Asm Network Service

`mandiant_asm_network_service` inherits from [NetworkInterface](/data-model/schemas/NetworkInterface.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |

---

### Mandiant Asm Project

`mandiant_asm_project` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`organizationUuid` \*

 | `string` **|** `null` | The UUID of the organization this project belongs to |  |

---

### Mandiant Asm Resource

`mandiant_asm_resource` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`entityType` \*

 | `string` **|** `null` | The Mandiant ASM entity type |  |
| 

`isScoped` \*

 | `boolean` **|** `null` | Whether the entity is in scope for scanning |  |

---

### Mandiant Asm Technology

`mandiant_asm_technology` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`entityUid` \*

 | `string` **|** `null` | The UID of the parent entity this technology belongs to |  |

---

### Mandiant Asm Vulnerability

`mandiant_asm_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cisaDueOn` \*

 | `null` **|** `number` | The CISA-mandated remediation deadline in milliseconds since epoch |  |
| 

`cvssV2BaseScore` \*

 | `null` **|** `number` | The CVSS v2.0 base score of the vulnerability (fallback when v3 absent) |  |
| 

`cvssV3BaseScore` \*

 | `null` **|** `number` | The CVSS v3.x base score of the vulnerability |  |
| 

`cvssV3Vector` \*

 | `null` **|** `string` | The CVSS v3.x attack-vector string |  |
| 

`cweId` \*

 | `null` **|** `string` | The associated CWE weakness-class identifier |  |
| 

`disclosedOn` \*

 | `null` **|** `number` | The date the vulnerability was disclosed, in milliseconds since epoch |  |
| 

`epssPercentile` \*

 | `null` **|** `number` | The relative EPSS ranking percentile |  |
| 

`epssScore` \*

 | `null` **|** `number` | The EPSS probability of exploitation in the next 30 days |  |
| 

`exploitationState` \*

 | `null` **|** `string` | Observed exploitation state (e.g. No Known, Suspected, Reported, Confirmed, Wide) |  |
| 

`exploitAvailability` \*

 | `null` **|** `string` | Exploit availability (e.g. Known, None, Publicly Available, Trivial) |  |
| 

`isCisaKnownExploited` \*

 | `null` **|** `boolean` | Whether the vulnerability is on the CISA Known Exploited Vulnerabilities (KEV) catalog |  |
| 

`lastModifiedOn` \*

 | `null` **|** `number` | The date the intel was last modified, in milliseconds since epoch |  |
| 

`predictedRiskRating` \*

 | `null` **|** `string` | The model-predicted risk rating tier when the analyst rating is empty |  |
| 

`riskRating` \*

 | `null` **|** `string` | The Mandiant analyst risk rating tier |  |
| 

`vulnerableCpeCount` \*

 | `null` **|** `number` | The number of distinct affected-product CPE URIs GTI lists for the vulnerability, including any beyond the 100 kept in vulnerableCpes |  |
| 

`vulnerableCpes` \*

 | `null` **|** `array` | The distinct affected-product CPE URIs, capped at the first 100 (see vulnerableCpeCount for the full count) |  |
| 

`vulnerableProductCount` \*

 | `null` **|** `number` | The number of distinct affected product names, including any beyond the 100 kept in vulnerableProducts |  |
| 

`vulnerableProducts` \*

 | `null` **|** `array` | The distinct affected product names, capped at the first 100 (see vulnerableProductCount for the full count) |  |
| 

`vulnerableVendorCount` \*

 | `null` **|** `number` | The number of distinct affected vendor names, including any beyond the 100 kept in vulnerableVendors |  |
| 

`vulnerableVendors` \*

 | `null` **|** `array` | The distinct affected vendor names, capped at the first 100 (see vulnerableVendorCount for the full count) |  |

---

## Release Notes

-   **2026-10-14** — Added ingestion of Google Threat Intelligence vulnerability records, including CVE identifiers, CVSS scores, exploitation state, exploit availability, EPSS score, CISA Known Exploited Vulnerabilities status, and affected product and vendor information.
-   **2026-04-09** — New Mandiant ASM integration: ingests projects, collections, assets including hosts, domains, DNS records, network services, certificates, application endpoints, and networks, plus issues and technology inventory.

---

Source: /integrations/directory/markmonitor

# MarkMonitor

Visualize MarkMonitor domains, DNS zones, DNS records, contacts, and domain groups, and monitor changes through queries and alerts including domain audit logs for compliance tracking.

## Installation

### Prerequisites in MarkMonitor

To use this integration, you need API credentials from MarkMonitor. These credentials are not self-service and must be obtained through your MarkMonitor account representative or Designated Partner Administrator (DPA).

#### Required Credentials

You will need the following credentials from your MarkMonitor account:

1.  **API Key** - Used for the `X-API-KEY` header in all API requests
2.  **Username** - Your MarkMonitor API username (typically an email or service account)
3.  **Password** - Your MarkMonitor API password

#### Obtaining API Credentials

1.  Log in to the [MarkMonitor Customer Portal](https://corp.markmonitor.com)
2.  Contact your MarkMonitor account representative or DPA to request API access
3.  Once approved, you will receive:
    -   An API key for authentication
    -   API username and password credentials
4.  Ensure your account has appropriate permissions to access the Domain API

For more information about the MarkMonitor APIs, refer to the [MarkMonitor API Documentation](https://api.markmonitor.com/).

#### Optional: DNS API Access

The integration can also ingest DNS records if your account has access to the MarkMonitor DNS API. This requires separate authentication and may not be available for all customers. Contact your MarkMonitor representative to verify DNS API access.

### Configuration in JupiterOne

To install the MarkMonitor integration in JupiterOne, navigate to the **Integrations** tab and select MarkMonitor. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Account Name** used to identify the MarkMonitor account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **Tag with Account Name** option is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **API Key** - Your MarkMonitor API key for X-API-KEY header authentication.
    
-   **Username** - Your MarkMonitor API username.
    
-   **Password** - Your MarkMonitor API password.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `markmonitor_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AuditLog | `markmonitor_audit_log` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Contact | `markmonitor_contact` | [Person](https://docs.jupiterone.io/data-model/schemas/Person) |
| DnsRecord | `markmonitor_dns_record` | [DomainRecord](https://docs.jupiterone.io/data-model/schemas/DomainRecord) |
| Domain | `markmonitor_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| DomainZone | `markmonitor_domain_zone` | [DomainZone](https://docs.jupiterone.io/data-model/schemas/DomainZone) |
| Group | `markmonitor_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Nameserver | `markmonitor_nameserver` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `markmonitor_account` | **HAS** | `markmonitor_group` |
| `markmonitor_account` | **HAS** | `markmonitor_domain` |
| `markmonitor_account` | **HAS** | `markmonitor_contact` |
| `markmonitor_domain` | **HAS** | `markmonitor_domain_zone` |
| `markmonitor_domain` | **HAS** | `markmonitor_audit_log` |
| `markmonitor_domain_zone` | **USES** | `markmonitor_nameserver` |
| `markmonitor_domain_zone` | **HAS** | `markmonitor_dns_record` |
| `markmonitor_group` | **HAS** | `markmonitor_domain` |

### Markmonitor Account

`markmonitor_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |

---

### Markmonitor Audit Log

`markmonitor_audit_log` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainName` \*

 | `string` |  |  |
| 

`userName` \*

 | `string` **|** `null` |  |  |

---

### Markmonitor Contact

`markmonitor_contact` inherits from [Person](/data-model/schemas/Person.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`contactId` \*

 | `string` |  |  |
| 

`contactType` \*

 | `string` **|** `null` |  |  |
| 

`organization` \*

 | `string` **|** `null` |  |  |

---

### Markmonitor Dns Record

`markmonitor_dns_record` inherits from [DomainRecord](/data-model/schemas/DomainRecord.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`comment` \*

 | `string` **|** `null` |  |  |
| 

`port` \*

 | `number` **|** `null` |  |  |
| 

`priority` \*

 | `number` **|** `null` |  |  |
| 

`recordId` \*

 | `number` |  |  |
| 

`weight` \*

 | `number` **|** `null` |  |  |
| 

`zoneId` \*

 | `string` |  |  |
| 

`zoneName` \*

 | `string` **|** `null` |  |  |

---

### Markmonitor Domain

`markmonitor_domain` inherits from [Domain](/data-model/schemas/Domain.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`adminId` \*

 | `string` **|** `null` |  |  |
| 

`billingId` \*

 | `string` **|** `null` |  |  |
| 

`group` \*

 | `string` **|** `null` |  |  |
| 

`paidThroughDate` \*

 | `number` **|** `null` |  |  |
| 

`registrantId` \*

 | `string` **|** `null` |  |  |
| 

`renewalStatus` \*

 | `string` **|** `null` |  |  |
| 

`techId` \*

 | `string` **|** `null` |  |  |

---

### Markmonitor Domain Zone

`markmonitor_domain_zone` inherits from [DomainZone](/data-model/schemas/DomainZone.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`dnssecAlgorithm` \*

 | `string` **|** `null` |  |  |
| 

`dnssecDigest` \*

 | `string` **|** `null` |  |  |
| 

`dnssecDigestType` \*

 | `number` **|** `null` |  |  |
| `dnssecEnabled` | `boolean` |  |  |
| 

`dnssecKeyTag` \*

 | `number` **|** `null` |  |  |
| `dnssecRecords` | `array` of `undefined`s |  |  |
| `nameservers` | `array` of `string`s |  |  |

---

### Markmonitor Group

`markmonitor_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainCount` \*

 | `number` **|** `null` |  |  |
| 

`groupId` \*

 | `string` |  |  |

---

### Markmonitor Nameserver

`markmonitor_nameserver` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`fqdn` \*

 | `string` |  |  |

---

## Release Notes

-   **2026-01-29** — New MarkMonitor integration: ingests domains, DNS records, contacts, domain zones, nameservers, and audit logs with full relationship mapping.

---

Source: /integrations/directory/microsoft-365

# Microsoft 365

Visualize Microsoft 365 services, groups, and users, and monitor changes through queries and alerts.

## Installation

To use this integration, you must have:

-   An organizational Active Directory tenant to target for ingestion. The integration does not support the use of other tenant types.
-   An account in the tenant you want to target for ingestion that has global administrator access. You will log in with this account to grant the JupiterOne application API permissions that can read data across all users (admin consent).

### Configuration in JupiterOne

To install the Microsoft 365 integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Microsoft 365. Click **New Instance** to begin configuring your integration, providing the following:

-   The **Account Name** used to identify the Microsoft 365 account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

After completing the authorization flow, the **Tenant ID** is automatically populated with the identifier for the Microsoft Active Directory tenant you authorized. This field is read-only.

## Data Volume Configuration

Control how much data is ingested from Microsoft 365 to manage storage and processing.

### Data Filtering Options

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Included Vulnerability Severities** | Vulnerability severity levels to ingest. Filtering out lower severities reduces the volume of noncompliance findings. | Low, Medium, High, Critical | Unknown, Informational, Low, Medium, High, Critical |

### Advanced Configuration

| Field | Description | Default |
| --- | --- | --- |
| **Include Advanced Device Details** | When enabled, ingests additional device properties: `physicalMemoryInBytes`, `iccid`, and `ethernetMacAddress`. Additional API requests may extend ingestion duration. | Disabled |

### SharePoint Scope

These fields apply only when the **SharePoint Sites, Document Libraries and Folders** ingestion source is enabled. That source is off by default.

| Field | Description | Default |
| --- | --- | --- |
| **SharePoint Include Paths** | Comma-separated SharePoint paths to ingest. Leave empty to ingest every site. | Empty (everything) |
| **SharePoint Exclude Paths** | Comma-separated SharePoint paths to skip, along with everything below them. | Empty (nothing) |
| **SharePoint Folder Depth** | How many folder levels below each document library root are ingested: 1, 2, 3, 5 or 10. Deeper levels take more API calls. | 3 levels |

A path is the part of a SharePoint URL after the host name, decoded, for example `/sites/Finance` for a site, `/sites/Finance/Shared Documents` for its default document library, or `/sites/Finance/Shared Documents/Audit/2024` for a folder. The root site's path is `/`. Paths are matched this way:

-   A path matches itself and everything below it. `/sites/Finance/Shared Documents/Audit` matches `.../Audit/2024` but not `.../Audit2`. Matching is case-insensitive and works on whole path segments. Wildcards are not supported.
-   You can paste a URL copied from the browser instead of a path. The host is ignored, a library view such as `/Forms/AllItems.aspx` is dropped, and for a folder view URL (`...AllItems.aspx?id=/sites/...`) the folder in `id` is used.
-   Separate paths with commas. To match a name that contains a comma, write the comma as `%2C`.
-   With include paths set, a site, library or folder is ingested when it is at or below an include path, or when it is on the way to one, so the graph stays connected. This means the root site (`/`) is ingested whenever include paths are set, but its libraries are not unless they are included.
-   Exclusions win over inclusions. Nothing below an excluded path is read from Microsoft 365, even if an include path points inside it.
-   Folder depth is applied on top of the paths. An included folder deeper than the folder depth setting is not ingested.
-   A path that does not start with `/` (and is not a URL), or that contains `*` or `?`, fails Test Credentials and integration runs with an error naming the path.

Excluding a path that was already ingested, narrowing the include paths, or lowering the folder depth removes the sites, libraries and folders that no longer match from JupiterOne on the next run, together with their relationships.

Site collections and their subsites are ingested as sites. OneDrive personal sites are never ingested, and files are not ingested; only sites, document libraries and folders are.

Click **Create** after you have provided all the values.

When prompted, click **Begin Authorization**.

You are then directed to the Microsoft identity platform where you must log in as a global administrator of the organizational Active Directory tenant you intend to integrate with.

You must select an account belonging to an organizational tenant. When you are already logged into an account, the badge icons indicate the nature of the tenant the account belongs to. Do not select a personal account.

Review the requested permissions (described below) and grant consent. Once you proceed through the authorization, you will have successfully completed the integration setup process.

#### Granted permissions

1.  `DeviceManagementApps.Read.All`
    -   Read Microsoft Intune apps
    -   Needed for creating `Application` entities
2.  `DeviceManagementConfiguration.Read.All`
    -   Read Microsoft Intune device configuration and policies
    -   Needed for creating `Configuration` and `ControlPolicy` entities
3.  `DeviceManagementManagedDevices.Read.All`
    -   Read Microsoft Intune devices
    -   Needed for creating `Device` and `HostAgent` entities
4.  `Organization.Read.All`
    -   Read organization information
    -   Needed for creating the `Account` entity
5.  `DeviceManagementServiceConfig.Read.All`
    -   Read Microsoft Intune configuration
    -   Needed for enriching the `Account` entity with Intune subscription information and ingesting Windows Autopilot device identities
6.  `DeviceManagementScripts.Read.All`
    -   Read Microsoft Intune device health scripts and their assignments
    -   Needed for creating `intune_device_health_script` entities
7.  `User.Read.All`
    -   Read all users' full profiles
    -   Needed for creating `User` entities
8.  `Group.Read.All`
    -   Read all groups
    -   Needed for creating `Group` entities
9.  `GroupMember.Read.All`
    -   Read the members of all groups
    -   Needed for creating group membership relationships and resolving Intune policy assignments to devices
10.  `Team.ReadBasic.All`
     -   Read the names and descriptions of Teams
     -   Needed for creating `microsoft_teams_team` entities
11.  `TeamsAppInstallation.ReadForTeam.All`
     -   Read the apps installed in all Teams
     -   Needed for creating `microsoft_teams_app_installation` entities
12.  `AuditLog.Read.All`
     -   Read audit log data
     -   Always requested; on tenants with a Microsoft Entra ID P1 or P2 license, the integration will include `signInActivity` in the `User` entity.
13.  `Sites.Read.All`
     -   Read items in all site collections
     -   Needed for creating `microsoft_365_sharepoint_site`, `microsoft_365_sharepoint_document_library` and `microsoft_365_sharepoint_folder` entities when the SharePoint ingestion source is enabled. Instances authorized before this permission was added must be re-authorized to grant it.
14.  `SecurityEvents.Read.All`
     -   Read your organization's security events
     -   Needed only for the **Microsoft Secure Score** ingestion source, which creates the `microsoft_365_secure_score` and `microsoft_365_secure_score_control` entities. If the permission is missing while that source is enabled, its steps fail with an error that names the permission.

### Microsoft Secure Score and Defender for Office 365

The **Microsoft Secure Score** ingestion source is disabled by default. Enable it in the instance's ingestion settings after granting `SecurityEvents.Read.All`.

When enabled, the integration ingests the tenant's latest Microsoft Secure Score and every Secure Score control (recommended action), including the Microsoft Defender for Office 365 controls for Safe Links, Safe Attachments and anti-phishing. Each control records the score the tenant achieves on it (`score`, `maxScore`, `isFullyImplemented`), the state an administrator set on it (`controlState`), and the Microsoft service that owns it (`service`). For example, to list the Safe Links and Safe Attachments controls that aren't fully implemented:

```j1ql
FIND microsoft_365_secure_score_control
  WITH (name ~= 'Safe Links' OR name ~= 'Safe Attachments')
  AND isFullyImplemented = false
```

`isFullyImplemented` is based on Secure Score points. Microsoft also awards the full points when an administrator marks a control as resolved through a third party or through alternate mitigation, so check `controlState` as well.

Microsoft Graph doesn't expose the Defender for Office 365 policy objects themselves (Safe Links, Safe Attachments and anti-phishing policies and their settings). Microsoft only makes them available through Exchange Online PowerShell, so this integration doesn't ingest them.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (15)

-   `AuditLog.Read.All`
-   `CopilotPackages.Read.All`
-   `DeviceManagementApps.Read.All`
-   `DeviceManagementConfiguration.Read.All`
-   `DeviceManagementManagedDevices.Read.All`
-   `DeviceManagementScripts.Read.All`
-   `DeviceManagementServiceConfig.Read.All`
-   `Group.Read.All`
-   `GroupMember.Read.All`
-   `Organization.Read.All`
-   `SecurityEvents.Read.All`
-   `Sites.Read.All`
-   `Team.ReadBasic.All`
-   `TeamsAppInstallation.ReadForTeam.All`
-   `User.Read.All`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (38)

-   `https://graph.microsoft.com/beta/deviceAppManagement/mobileApps`
-   `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies`
-   `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies/{policyId}/deviceStatuses`
-   `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies/{policyId}/settings`
-   `https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies/{policyId}/deviceStatuses`
-   `https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts`
-   `https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts/{scriptId}/assignments`
-   `https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations`
-   `https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/{policyId}/assignments`
-   `https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/{policyId}/definitionValues`
-   `https://graph.microsoft.com/beta/deviceManagement/manageddevices/{deviceId}`
-   `https://graph.microsoft.com/beta/deviceManagement/subscriptionState`
-   `https://graph.microsoft.com/v1.0/copilot/admin/catalog/packages`
-   `https://graph.microsoft.com/v1.0/copilot/admin/catalog/packages/{id}`
-   `https://graph.microsoft.com/v1.0/deviceManagement`
-   `https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies`
-   `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations`
-   `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations/{configurationId}/deviceStatuses`
-   `https://graph.microsoft.com/v1.0/deviceManagement/managedDevices`
-   `https://graph.microsoft.com/v1.0/deviceManagement/reports/microsoft.graph.retrieveDeviceAppInstallationStatusReport`
-   `https://graph.microsoft.com/v1.0/deviceManagement/windowsAutopilotDeviceIdentities`
-   `https://graph.microsoft.com/v1.0/drives/{driveId}/items/{itemId}/children`
-   `https://graph.microsoft.com/v1.0/drives/{driveId}/root/children`
-   `https://graph.microsoft.com/v1.0/groups`
-   `https://graph.microsoft.com/v1.0/groups/{groupId}/members`
-   `https://graph.microsoft.com/v1.0/groups/{groupId}/transitiveMembers`
-   `https://graph.microsoft.com/v1.0/organization`
-   `https://graph.microsoft.com/v1.0/organization/{organizationId}`
-   `https://graph.microsoft.com/v1.0/security/secureScoreControlProfiles`
-   `https://graph.microsoft.com/v1.0/security/secureScores`
-   `https://graph.microsoft.com/v1.0/sites/getAllSites`
-   `https://graph.microsoft.com/v1.0/sites/{siteId}/drives`
-   `https://graph.microsoft.com/v1.0/sites/{siteId}/sites`
-   `https://graph.microsoft.com/v1.0/subscribedSkus`
-   `https://graph.microsoft.com/v1.0/teams`
-   `https://graph.microsoft.com/v1.0/teams/{teamId}/installedApps`
-   `https://graph.microsoft.com/v1.0/users`
-   `https://graph.microsoft.com/v1.0/users?$filter=assignedLicenses/any(x:x/skuId eq {skuId})`

### Licenses

Product licenses or SKUs required in the target environment.

Show Licenses (1)

-   `Microsoft Agent 365`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (30)

-   [https://learn.microsoft.com/en-us/graph/api/drive-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/drive-list?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/driveitem-list-children?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/driveitem-list-children?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/group-list-members?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-list-members?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/group-list-transitivemembers?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-list-transitivemembers?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/group-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/group-list?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/intune-deviceconfig-devicecompliancedevicestatus-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-deviceconfig-devicecompliancedevicestatus-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-deviceconfig-deviceconfigurationdevicestatus-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-deviceconfig-deviceconfigurationdevicestatus-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-deviceconfigv2-devicemanagementconfigurationpolicy-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-deviceconfigv2-devicemanagementconfigurationpolicy-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-devices-devicehealthscript-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-devices-devicehealthscript-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-devices-devicehealthscriptassignment-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-devices-devicehealthscriptassignment-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-devices-manageddevice-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/intune-devices-manageddevice-list?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/intune-enrollment-windowsautopilotdeviceidentity-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-enrollment-windowsautopilotdeviceidentity-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-grouppolicy-grouppolicyconfiguration-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-grouppolicy-grouppolicyconfiguration-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-grouppolicy-grouppolicyconfigurationassignment-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-grouppolicy-grouppolicyconfigurationassignment-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-grouppolicy-grouppolicydefinitionvalue-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-grouppolicy-grouppolicydefinitionvalue-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-shared-devicecompliancepolicy-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-shared-devicecompliancepolicy-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-shared-deviceconfiguration-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-shared-deviceconfiguration-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/intune-shared-mobileapp-list?view=graph-rest-beta](https://learn.microsoft.com/en-us/graph/api/intune-shared-mobileapp-list?view=graph-rest-beta)
-   [https://learn.microsoft.com/en-us/graph/api/organization-get?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/organization-get?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/resources/intune-reporting-devicemanagementreports?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/resources/intune-reporting-devicemanagementreports?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/security-list-securescorecontrolprofiles?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-list-securescorecontrolprofiles?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/security-list-securescores?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/security-list-securescores?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/site-getallsites?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/site-getallsites?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/site-list-subsites?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/site-list-subsites?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/subscribedsku-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/subscribedsku-list?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/team-list-installedapps?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/team-list-installedapps?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/teams-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/teams-list?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0](https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0)
-   [https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/api/admin-settings/package/copilotpackagedetail-get](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/api/admin-settings/package/copilotpackagedetail-get)
-   [https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/api/admin-settings/package/copilotpackages-list](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/api/admin-settings/package/copilotpackages-list)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (14)

| Step | OAuth Scopes | Endpoints | Licenses |
| --- | --- | --- | --- |
| Active Directory Group Members | `GroupMember.Read.All` | `https://graph.microsoft.com/v1.0/groups/{groupId}/members` | \- |
| Compliance Policies and Related Findings | `DeviceManagementConfiguration.Read.All` | `https://graph.microsoft.com/v1.0/deviceManagement/deviceCompliancePolicies`, `https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies/{policyId}/deviceStatuses` | \- |
| Detected Applications | `DeviceManagementManagedDevices.Read.All` | `https://graph.microsoft.com/beta/deviceManagement/manageddevices/{deviceId}` | \- |
| Device Configurations and Related Findings | `DeviceManagementConfiguration.Read.All` | `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations`, `https://graph.microsoft.com/v1.0/deviceManagement/deviceConfigurations/{configurationId}/deviceStatuses` | \- |
| Device Health Scripts | `DeviceManagementScripts.Read.All`, `GroupMember.Read.All` | `https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts`, `https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts/{scriptId}/assignments`, `https://graph.microsoft.com/v1.0/groups/{groupId}/transitiveMembers` | \- |
| Group Policy Configurations | `DeviceManagementConfiguration.Read.All`, `GroupMember.Read.All` | `https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations`, `https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/{policyId}/definitionValues`, `https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/{policyId}/assignments`, `https://graph.microsoft.com/v1.0/groups/{groupId}/transitiveMembers` | \- |
| Managed Applications | `DeviceManagementApps.Read.All` | `https://graph.microsoft.com/beta/deviceAppManagement/mobileApps`, `https://graph.microsoft.com/v1.0/deviceManagement/reports/microsoft.graph.retrieveDeviceAppInstallationStatusReport` | \- |
| Microsoft 365 Copilot License Assignments | `User.Read.All` | `https://graph.microsoft.com/v1.0/users?$filter=assignedLicenses/any(x:x/skuId eq {skuId})` | \- |
| Microsoft 365 Copilot Package User Access | `CopilotPackages.Read.All` | `https://graph.microsoft.com/v1.0/copilot/admin/catalog/packages/{id}` | `Microsoft Agent 365` |
| Microsoft 365 Secure Score Controls | `SecurityEvents.Read.All` | `https://graph.microsoft.com/v1.0/security/secureScoreControlProfiles` | \- |
| Microsoft 365 SharePoint Document Libraries | `Sites.Read.All` | `https://graph.microsoft.com/v1.0/sites/{siteId}/drives` | \- |
| Microsoft 365 SharePoint Folders | `Sites.Read.All` | `https://graph.microsoft.com/v1.0/drives/{driveId}/root/children`, `https://graph.microsoft.com/v1.0/drives/{driveId}/items/{itemId}/children` | \- |
| Microsoft 365 Teams App Installations | `TeamsAppInstallation.ReadForTeam.All` | `https://graph.microsoft.com/v1.0/teams/{teamId}/installedApps` | \- |
| Settings Catalog Policies | `DeviceManagementConfiguration.Read.All` | `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies`, `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies/{policyId}/settings`, `https://graph.microsoft.com/beta/deviceManagement/configurationPolicies/{policyId}/deviceStatuses` | \- |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| \[AD\] Account | `microsoft_365_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| \[AD\] Group | `azure_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| \[AD\] User | `azure_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| \[Copilot\] License | `microsoft_365_copilot_license` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| \[Copilot\] Package | `microsoft_365_copilot_package` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| \[Security\] Secure Score | `microsoft_365_secure_score` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| \[Security\] Secure Score Control | `microsoft_365_secure_score_control` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| \[SharePoint\] Document Library | `microsoft_365_sharepoint_document_library` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[SharePoint\] Folder | `microsoft_365_sharepoint_folder` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[SharePoint\] Site | `microsoft_365_sharepoint_site` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| \[Teams\] App Installation | `microsoft_365_teams_app_installation` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| \[Teams\] Team | `microsoft_365_team` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Autopilot Device Identity | `intune_autopilot_device_identity` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Compliance Policy | `intune_compliance_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Detected Application | `intune_detected_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device Configuration | `intune_device_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Device Health Script | `intune_device_health_script` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Group Policy Configuration | `intune_group_policy_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Intune Host Agent | `intune_host_agent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Managed Application | `intune_managed_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Managed Device | `user_endpoint` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Managed Device | `workstation` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Managed Device | `laptop` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Managed Device | `desktop` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Managed Device | `server` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Managed Device | `server` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Managed Device | `smartphone` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Noncompliance Finding | `intune_noncompliance_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Settings Catalog Policy | `intune_settings_catalog_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration), [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `azure_user` | **HAS** | `user_endpoint` |
| `azure_user` | **HAS** | `workstation` |
| `azure_user` | **HAS** | `laptop` |
| `azure_user` | **HAS** | `desktop` |
| `azure_user` | **HAS** | `computer` |
| `azure_user` | **HAS** | `server` |
| `azure_user` | **HAS** | `smartphone` |
| `azure_user` | **USES** | `user_endpoint` |
| `azure_user` | **USES** | `workstation` |
| `azure_user` | **USES** | `laptop` |
| `azure_user` | **USES** | `desktop` |
| `azure_user` | **USES** | `computer` |
| `azure_user` | **USES** | `server` |
| `azure_user` | **USES** | `smartphone` |
| `azure_user` | **INSTALLED** | `microsoft_365_copilot_package` |
| `azure_user` | **ASSIGNED** | `microsoft_365_copilot_license` |
| `azure_user_group` | **HAS** | `azure_user` |
| `azure_user_group` | **HAS** | `azure_user_group` |
| `azure_user_group` | **HAS** | `user_endpoint` |
| `azure_user_group` | **HAS** | `workstation` |
| `azure_user_group` | **HAS** | `laptop` |
| `azure_user_group` | **HAS** | `desktop` |
| `azure_user_group` | **HAS** | `computer` |
| `azure_user_group` | **HAS** | `server` |
| `azure_user_group` | **HAS** | `smartphone` |
| `azure_user_group` | **INSTALLED** | `microsoft_365_copilot_package` |
| `computer` | **HAS** | `intune_noncompliance_finding` |
| `computer` | **ASSIGNED** | `intune_managed_application` |
| `computer` | **INSTALLED** | `intune_detected_application` |
| `desktop` | **HAS** | `intune_noncompliance_finding` |
| `desktop` | **ASSIGNED** | `intune_managed_application` |
| `desktop` | **INSTALLED** | `intune_detected_application` |
| `intune_autopilot_device_identity` | **ASSIGNED** | `azure_user` |
| `intune_compliance_policy` | **IDENTIFIED** | `intune_noncompliance_finding` |
| `intune_device_configuration` | **IDENTIFIED** | `intune_noncompliance_finding` |
| `intune_host_agent` | **MANAGES** | `user_endpoint` |
| `intune_host_agent` | **MANAGES** | `workstation` |
| `intune_host_agent` | **MANAGES** | `laptop` |
| `intune_host_agent` | **MANAGES** | `desktop` |
| `intune_host_agent` | **MANAGES** | `computer` |
| `intune_host_agent` | **MANAGES** | `server` |
| `intune_host_agent` | **MANAGES** | `smartphone` |
| `intune_host_agent` | **ASSIGNED** | `intune_compliance_policy` |
| `intune_host_agent` | **ASSIGNED** | `intune_device_configuration` |
| `intune_host_agent` | **ASSIGNED** | `intune_settings_catalog_policy` |
| `intune_host_agent` | **ASSIGNED** | `intune_group_policy_configuration` |
| `intune_host_agent` | **ASSIGNED** | `intune_device_health_script` |
| `laptop` | **HAS** | `intune_noncompliance_finding` |
| `laptop` | **ASSIGNED** | `intune_managed_application` |
| `laptop` | **INSTALLED** | `intune_detected_application` |
| `microsoft_365_account` | **HAS** | `azure_user` |
| `microsoft_365_account` | **HAS** | `azure_user_group` |
| `microsoft_365_account` | **HAS** | `microsoft_365_team` |
| `microsoft_365_account` | **HAS** | `microsoft_365_copilot_package` |
| `microsoft_365_account` | **HAS** | `microsoft_365_copilot_license` |
| `microsoft_365_account` | **HAS** | `microsoft_365_secure_score` |
| `microsoft_365_copilot_package` | **ALLOWS** | `azure_user` |
| `microsoft_365_copilot_package` | **SHARED** | `azure_user` |
| `microsoft_365_copilot_package` | **ALLOWS** | `azure_user_group` |
| `microsoft_365_copilot_package` | **SHARED** | `azure_user_group` |
| `microsoft_365_secure_score` | **HAS** | `microsoft_365_secure_score_control` |
| `microsoft_365_sharepoint_document_library` | **HAS** | `microsoft_365_sharepoint_folder` |
| `microsoft_365_sharepoint_folder` | **HAS** | `microsoft_365_sharepoint_folder` |
| `microsoft_365_sharepoint_site` | **HAS** | `microsoft_365_sharepoint_document_library` |
| `microsoft_365_team` | **HAS** | `microsoft_365_teams_app_installation` |
| `server` | **HAS** | `intune_noncompliance_finding` |
| `server` | **ASSIGNED** | `intune_managed_application` |
| `server` | **INSTALLED** | `intune_detected_application` |
| `smartphone` | **HAS** | `intune_noncompliance_finding` |
| `smartphone` | **ASSIGNED** | `intune_managed_application` |
| `smartphone` | **INSTALLED** | `intune_detected_application` |
| `user_endpoint` | **HAS** | `intune_noncompliance_finding` |
| `user_endpoint` | **ASSIGNED** | `intune_managed_application` |
| `user_endpoint` | **INSTALLED** | `intune_detected_application` |
| `workstation` | **HAS** | `intune_noncompliance_finding` |
| `workstation` | **ASSIGNED** | `intune_managed_application` |
| `workstation` | **INSTALLED** | `intune_detected_application` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `microsoft_365_copilot_package` | **USES** | `azure_service_principal` | FORWARD |
| `microsoft_365_copilot_package` | **IS** | `azure_service_principal` | FORWARD |

### Azure User

`azure_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountEnabled` \*

 | `boolean` |  |  |
| `defaultMfaMethod` | `string` **|** `null` | The user's default MFA method. |  |
| `givenName` | `string` **|** `null` |  |  |
| `isMfaCapable` | `boolean` **|** `null` | Whether the user has registered a strong MFA method that is allowed by the authentication methods policy. |  |
| `isPasswordlessCapable` | `boolean` **|** `null` | Whether the user has registered a passwordless method (FIDO2, Windows Hello for Business, Authenticator passwordless) allowed by policy. |  |
| `isSsprCapable` | `boolean` **|** `null` | Whether the user is both registered for and allowed to perform self-service password reset. |  |
| `isSsprEnabled` | `boolean` **|** `null` | Whether the user is allowed to perform self-service password reset by policy. |  |
| `isSsprRegistered` | `boolean` **|** `null` | Whether the user has registered the required number of methods for self-service password reset. |  |
| `isSystemPreferredAuthMethodEnabled` | `boolean` **|** `null` | Whether system-preferred authentication is enabled for the user. |  |
| `jobTitle` | `string` **|** `null` |  |  |
| `lastNonInteractiveSignInOn` | `number` **|** `null` | Last non-interactive sign-in time for the user (from Microsoft Graph signInActivity.lastNonInteractiveSignInDateTime). |  |
| `lastSignInOn` | `number` **|** `null` | Last interactive sign-in time for the user (from Microsoft Graph signInActivity.lastSignInDateTime), successful or not. |  |
| `lastSuccessfulSignInOn` | `number` **|** `null` | Last successful interactive or non-interactive sign-in time for the user (from Microsoft Graph signInActivity.lastSuccessfulSignInDateTime). |  |
| `mail` | `string` | The SMTP address for the user |  |
| `mfaMethods` | `array` **|** `null` | Authentication methods registered by the user (e.g. email, mobilePhone, microsoftAuthenticatorPush). |  |
| `mfaRegistrationLastUpdatedOn` | `number` **|** `null` | When the Entra ID registration details report for this user was last updated. |  |
| `mobilePhone` | `string` **|** `null` |  |  |
| `officeLocation` | `string` **|** `null` |  |  |
| `preferredLanguage` | `string` **|** `null` |  |  |
| `proxyAddresses` | `array` **|** `null` | Raw proxy addresses from Azure AD including SMTP aliases (smtp:/SMTP: prefixed), X500 legacy addresses, and SIP addresses. |  |
| `surname` | `string` **|** `null` |  |  |
| `systemPreferredAuthMethods` | `array` **|** `null` | Methods Entra ID determined to be the most secure second factors among those the user registered (e.g. push, oath, sms). |  |
| `usageLocation` | `string` **|** `null` |  |  |
| `userPrincipalName` | `string` **|** `null` |  |  |
| `userType` | `string` **|** `null` |  |  |

---

### Azure User Group

`azure_user_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isMailEnabled` \*

 | `boolean` |  |  |
| 

`isSecurityEnabled` \*

 | `boolean` |  |  |
| `mail` | `string` **|** `null` |  |  |
| 

`mailEnabled` \*

 | `boolean` | Please use `isMailEnabled` instead | **deprecated**: true |
| `mailNickname` | `string` **|** `null` |  |  |
| `renewedOn` | `number` |  |  |
| 

`securityEnabled` \*

 | `boolean` | Please use `isSecurityEnabled` instead | **deprecated**: true |

---

### Desktop

`desktop` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

---

### Intune Autopilot Device Identity

`intune_autopilot_device_identity` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `addressableUserName` | `string` **|** `null` |  |  |
| `azureAdDeviceId` | `string` **|** `null` |  |  |
| `deploymentProfileAssignedDateTime` | `number` |  |  |
| `deploymentProfileAssignmentDetailedStatus` | `string` |  | **Any of**:
-   `none`

-   `hardwareRequirementsNotMet`

-   `surfaceHubProfileNotSupported`

-   `holoLensProfileNotSupported`

-   `windowsPcProfileNotSupported`

-   `surfaceHub2SProfileNotSupported`

-   `unknownFutureValue`

 |
| `deploymentProfileAssignmentStatus` | `string` |  | **Any of**:

-   `unknown`

-   `assignedInSync`

-   `assignedOutOfSync`

-   `assignedUnkownSyncState`

-   `notAssigned`

-   `pending`

-   `failed`

 |
| `deviceFriendlyName` | `string` **|** `null` |  |  |
| `enrollmentState` | `string` |  | **Any of**:

-   `unknown`

-   `enrolled`

-   `pendingReset`

-   `failed`

-   `notContacted`

-   `blocked`

 |
| `groupTag` | `string` **|** `null` |  |  |
| `lastContactedDateTime` | `number` |  |  |
| `managedDeviceId` | `string` **|** `null` |  |  |
| `productKey` | `string` **|** `null` |  |  |
| `purchaseOrderIdentifier` | `string` **|** `null` |  |  |
| `skuNumber` | `string` **|** `null` |  |  |
| `userPrincipalName` | `string` **|** `null` |  |  |

---

### Intune Compliance Policy

`intune_compliance_policy` inherits from [Configuration](/data-model/schemas/Configuration.md), [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appLockerApplicationControl` | `string` **|** `null` | AppLocker application control mode. Example values: `notConfigured`, `enforceComponentsAndStoreApps`, `auditComponentsAndStoreApps`, `enforceComponentsStoreAppsAndSmartlocker`, `auditComponentsStoreAppsAndSmartlocker`. |  |
| `bitlockerRemovableDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to removable drives. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| `bitlockerSystemDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to the operating-system drive. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| 
`category` \*

 | `string` |  | **const**: compliance |
| `defenderCloudBlockLevel` | `string` **|** `null` | Microsoft Defender cloud-block level. Example values: `notConfigured`, `high`, `highPlus`, `zeroTolerance`. |  |
| `diagnosticsDataSubmissionMode` | `string` **|** `null` | Telemetry/diagnostics data submission level. Example values: `userDefined`, `none`, `basic`, `enhanced`, `full`. |  |
| `firewallDomainFirewallState` | `string` **|** `null` | Domain-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPrivateFirewallState` | `string` **|** `null` | Private-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPublicFirewallState` | `string` **|** `null` | Public-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| 

`function` \*

 | `string` |  | **const**: endpoint-compliance |
| `isActiveFirewallRequired` | `boolean` **|** `null` | Whether an active firewall (any profile) is required for compliance. |  |
| `isAntiSpywareRequired` | `boolean` **|** `null` | Whether an anti-spyware product must be installed and active for compliance. |  |
| `isAntivirusRequired` | `boolean` **|** `null` | Whether an antivirus product (any vendor) must be installed and active for compliance. |  |
| `isApplicationGuardEnabled` | `boolean` **|** `null` | Whether Windows Defender Application Guard is enabled. |  |
| `isAppStoreBlocked` | `boolean` **|** `null` | Whether the platform App Store is blocked entirely (no app install/update from the store). |  |
| `isAppStoreRequirePassword` | `boolean` **|** `null` | Whether the App Store is required to prompt for a password before every purchase / install. |  |
| `isBitlockerEncryptDevice` | `boolean` **|** `null` | Whether BitLocker disk encryption is required on the device. |  |
| `isBitlockerRemovableDriveBlockCrossOrganizationWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to BitLocker-encrypted drives that were encrypted by another organization. |  |
| `isBitlockerRemovableDriveRequireEncryptionForWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to removable drives that are not BitLocker-encrypted. |  |
| `isBluetoothBlocked` | `boolean` **|** `null` | Whether Bluetooth is blocked. |  |
| `isCameraBlocked` | `boolean` **|** `null` | Whether the device camera is blocked. |  |
| `isCertificatesBlockUntrustedTlsCertificates` | `boolean` **|** `null` | Whether the device is blocked from accepting untrusted TLS certificates. |  |
| `isCodeIntegrityEnabled` | `boolean` **|** `null` | Whether Windows code integrity (HVCI) is required. |  |
| `isCommercialDataSharingDisabled` | `boolean` **|** `null` | Whether sharing of commercial telemetry data with Microsoft is disabled. |  |
| `isDefenderEnabled` | `boolean` **|** `null` | Whether Microsoft Defender must be enabled (compliance gate). |  |
| `isDefenderRequireBehaviorMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender behavior monitoring is required. |  |
| `isDefenderRequireCloudProtection` | `boolean` **|** `null` | Whether Microsoft Defender cloud-delivered protection is required. |  |
| `isDefenderRequireRealTimeMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender real-time monitoring is required. |  |
| `isDefenderSecurityCenterBlockExploitProtectionOverride` | `boolean` **|** `null` | Whether users are blocked from overriding the configured exploit-protection settings via the Defender Security Center. |  |
| `isEdgeRequireSmartScreen` | `boolean` **|** `null` | Whether Microsoft Edge is required to have SmartScreen enabled. |  |
| `isFileVaultEnabled` | `boolean` **|** `null` | Whether FileVault disk encryption is required on macOS. |  |
| `isFirewallDomainInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Domain firewall profile. |  |
| `isFirewallDomainOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Domain firewall profile. |  |
| `isFirewallPrivateInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Private firewall profile. |  |
| `isFirewallPrivateOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Private firewall profile. |  |
| `isFirewallPublicInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Public firewall profile. |  |
| `isFirewallPublicOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Public firewall profile. |  |
| `isHealthyDeviceReportRequired` | `boolean` **|** `null` | Whether a recent Windows Health Attestation report is required for compliance. |  |
| `isICloudRequireEncryptedBackup` | `boolean` **|** `null` | Whether iCloud backups must be encrypted (iOS). |  |
| `isLocationServicesBlocked` | `boolean` **|** `null` | Whether device location services are blocked. |  |
| `isMicrophoneBlocked` | `boolean` **|** `null` | Whether the device microphone (or voice recording) is blocked. |  |
| `isMicrosoftAccountBlocked` | `boolean` **|** `null` | Whether sign-in with personal Microsoft accounts is blocked on the device. |  |
| `isOneDriveDisableFileSync` | `boolean` **|** `null` | Whether OneDrive file-sync is disabled on the device. |  |
| `isPasswordBlockFingerprint` | `boolean` **|** `null` | Whether fingerprint unlock (biometric) is blocked. |  |
| `isPasswordBlockSimple` | `boolean` **|** `null` | Whether simple passwords (e.g. repeating or sequential characters such as `1234`, `aaaa`) are blocked. |  |
| `isPasswordBlockSmartCard` | `boolean` **|** `null` | Whether smart-card sign-in is blocked. |  |
| `isPasswordRequired` | `boolean` **|** `null` | Whether the device or user must set a password/passcode to unlock the device. |  |
| `isSafariRequireFraudWarning` | `boolean` **|** `null` | Whether Safari is required to show fraudulent-website warnings (iOS). |  |
| `isScreenCaptureBlocked` | `boolean` **|** `null` | Whether screen capture / screenshots are blocked. |  |
| `isSecureBootEnabled` | `boolean` **|** `null` | Whether UEFI Secure Boot is required to be enabled. |  |
| `isSignatureOutOfDateRequired` | `boolean` **|** `null` | Whether the policy requires AV signatures to be up to date for the device to be considered compliant. |  |
| `isSiriBlockedWhenLocked` | `boolean` **|** `null` | Whether Siri is blocked from being invoked while the device is locked (iOS). |  |
| `isSmartScreenBlockOverrideForFiles` | `boolean` **|** `null` | Whether users are blocked from overriding SmartScreen warnings for files. |  |
| `isSmartScreenEnableInShell` | `boolean` **|** `null` | Whether Windows SmartScreen is enabled in the shell (file open / download warnings). |  |
| `isStorageRequireDeviceEncryption` | `boolean` **|** `null` | Whether device storage (full-disk) encryption is required, regardless of provider (BitLocker on Windows, FileVault on macOS, native on mobile). |  |
| `isTpmRequired` | `boolean` **|** `null` | Whether a Trusted Platform Module (TPM) is required for compliance. |  |
| `isUsbBlocked` | `boolean` **|** `null` | Whether USB connections / mass-storage are blocked. |  |
| `omaSettingCount` | `number` **|** `null` | Number of OMA-URI custom settings present on the policy (Windows custom configurations only). |  |
| `omaUris` | `array` **|** `null` | List of OMA-URI paths configured by the policy (e.g. `./Vendor/MSFT/BitLocker/...`). Useful for grepping which OMA-URIs are managed without inspecting the per-setting values. |  |
| `osMaximumVersion` | `string` **|** `null` | Maximum operating-system version the device may run to be considered compliant. |  |
| `osMinimumVersion` | `string` **|** `null` | Minimum operating-system version the device must run to be considered compliant. |  |
| `passwordExpirationDays` | `number` **|** `null` | Number of days after which the password must be changed. A value of 0 typically means no expiration. |  |
| `passwordMinimumCharacterSetCount` | `number` **|** `null` | Minimum number of distinct character sets (uppercase, lowercase, digits, symbols) the password must include. |  |
| `passwordMinimumLength` | `number` **|** `null` | Minimum number of characters required in the password/passcode. |  |
| `passwordMinutesOfInactivityBeforeLock` | `number` **|** `null` | Minutes of idle time before the device locks automatically. |  |
| `passwordMinutesOfInactivityBeforeScreenTimeout` | `number` **|** `null` | Minutes of idle time before the screen times out (display sleep). |  |
| `passwordPreviousPasswordBlockCount` | `number` **|** `null` | Number of previous passwords the user is blocked from reusing. |  |
| `passwordRequiredType` | `string` **|** `null` | The complexity class the password must satisfy. Example values: `deviceDefault`, `alphanumeric`, `numeric`, `alphabetic`, `alphanumericWithSymbols`. |  |
| `passwordSignInFailureCountBeforeFactoryReset` | `number` **|** `null` | Number of consecutive failed sign-in attempts that triggers an automatic factory reset of the device. |  |
| `policyType` | `string` | **Examples**: iosCompliancePolicy |  |
| `version` | `number` |  |  |

---

### Intune Detected Application

`intune_detected_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `sizeInByte` | `number` |  |  |
| `version` | `string` **|** `null` |  |  |

---

### Intune Device Configuration

`intune_device_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md), [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appLockerApplicationControl` | `string` **|** `null` | AppLocker application control mode. Example values: `notConfigured`, `enforceComponentsAndStoreApps`, `auditComponentsAndStoreApps`, `enforceComponentsStoreAppsAndSmartlocker`, `auditComponentsStoreAppsAndSmartlocker`. |  |
| `bitlockerRemovableDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to removable drives. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| `bitlockerSystemDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to the operating-system drive. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| 
`category` \*

 | `string` |  | **const**: config |
| `configurationType` | `string` | **Examples**: iosCustomConfiguration, windows10GeneralConfiguration, iosWiFiConfiguration |  |
| `defenderCloudBlockLevel` | `string` **|** `null` | Microsoft Defender cloud-block level. Example values: `notConfigured`, `high`, `highPlus`, `zeroTolerance`. |  |
| `diagnosticsDataSubmissionMode` | `string` **|** `null` | Telemetry/diagnostics data submission level. Example values: `userDefined`, `none`, `basic`, `enhanced`, `full`. |  |
| `firewallDomainFirewallState` | `string` **|** `null` | Domain-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPrivateFirewallState` | `string` **|** `null` | Private-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPublicFirewallState` | `string` **|** `null` | Public-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| 

`function` \*

 | `string` |  | **const**: endpoint-configuration |
| `isActiveFirewallRequired` | `boolean` **|** `null` | Whether an active firewall (any profile) is required for compliance. |  |
| `isAntiSpywareRequired` | `boolean` **|** `null` | Whether an anti-spyware product must be installed and active for compliance. |  |
| `isAntivirusRequired` | `boolean` **|** `null` | Whether an antivirus product (any vendor) must be installed and active for compliance. |  |
| `isApplicationGuardEnabled` | `boolean` **|** `null` | Whether Windows Defender Application Guard is enabled. |  |
| `isAppStoreBlocked` | `boolean` **|** `null` | Whether the platform App Store is blocked entirely (no app install/update from the store). |  |
| `isAppStoreRequirePassword` | `boolean` **|** `null` | Whether the App Store is required to prompt for a password before every purchase / install. |  |
| `isBitlockerEncryptDevice` | `boolean` **|** `null` | Whether BitLocker disk encryption is required on the device. |  |
| `isBitlockerRemovableDriveBlockCrossOrganizationWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to BitLocker-encrypted drives that were encrypted by another organization. |  |
| `isBitlockerRemovableDriveRequireEncryptionForWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to removable drives that are not BitLocker-encrypted. |  |
| `isBluetoothBlocked` | `boolean` **|** `null` | Whether Bluetooth is blocked. |  |
| `isCameraBlocked` | `boolean` **|** `null` | Whether the device camera is blocked. |  |
| `isCertificatesBlockUntrustedTlsCertificates` | `boolean` **|** `null` | Whether the device is blocked from accepting untrusted TLS certificates. |  |
| `isCodeIntegrityEnabled` | `boolean` **|** `null` | Whether Windows code integrity (HVCI) is required. |  |
| `isCommercialDataSharingDisabled` | `boolean` **|** `null` | Whether sharing of commercial telemetry data with Microsoft is disabled. |  |
| `isDefenderEnabled` | `boolean` **|** `null` | Whether Microsoft Defender must be enabled (compliance gate). |  |
| `isDefenderRequireBehaviorMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender behavior monitoring is required. |  |
| `isDefenderRequireCloudProtection` | `boolean` **|** `null` | Whether Microsoft Defender cloud-delivered protection is required. |  |
| `isDefenderRequireRealTimeMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender real-time monitoring is required. |  |
| `isDefenderSecurityCenterBlockExploitProtectionOverride` | `boolean` **|** `null` | Whether users are blocked from overriding the configured exploit-protection settings via the Defender Security Center. |  |
| `isEdgeRequireSmartScreen` | `boolean` **|** `null` | Whether Microsoft Edge is required to have SmartScreen enabled. |  |
| `isFileVaultEnabled` | `boolean` **|** `null` | Whether FileVault disk encryption is required on macOS. |  |
| `isFirewallDomainInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Domain firewall profile. |  |
| `isFirewallDomainOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Domain firewall profile. |  |
| `isFirewallPrivateInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Private firewall profile. |  |
| `isFirewallPrivateOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Private firewall profile. |  |
| `isFirewallPublicInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Public firewall profile. |  |
| `isFirewallPublicOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Public firewall profile. |  |
| `isHealthyDeviceReportRequired` | `boolean` **|** `null` | Whether a recent Windows Health Attestation report is required for compliance. |  |
| `isICloudRequireEncryptedBackup` | `boolean` **|** `null` | Whether iCloud backups must be encrypted (iOS). |  |
| `isLocationServicesBlocked` | `boolean` **|** `null` | Whether device location services are blocked. |  |
| `isMicrophoneBlocked` | `boolean` **|** `null` | Whether the device microphone (or voice recording) is blocked. |  |
| `isMicrosoftAccountBlocked` | `boolean` **|** `null` | Whether sign-in with personal Microsoft accounts is blocked on the device. |  |
| `isOneDriveDisableFileSync` | `boolean` **|** `null` | Whether OneDrive file-sync is disabled on the device. |  |
| `isPasswordBlockFingerprint` | `boolean` **|** `null` | Whether fingerprint unlock (biometric) is blocked. |  |
| `isPasswordBlockSimple` | `boolean` **|** `null` | Whether simple passwords (e.g. repeating or sequential characters such as `1234`, `aaaa`) are blocked. |  |
| `isPasswordBlockSmartCard` | `boolean` **|** `null` | Whether smart-card sign-in is blocked. |  |
| `isPasswordRequired` | `boolean` **|** `null` | Whether the device or user must set a password/passcode to unlock the device. |  |
| `isSafariRequireFraudWarning` | `boolean` **|** `null` | Whether Safari is required to show fraudulent-website warnings (iOS). |  |
| `isScreenCaptureBlocked` | `boolean` **|** `null` | Whether screen capture / screenshots are blocked. |  |
| `isSecureBootEnabled` | `boolean` **|** `null` | Whether UEFI Secure Boot is required to be enabled. |  |
| `isSignatureOutOfDateRequired` | `boolean` **|** `null` | Whether the policy requires AV signatures to be up to date for the device to be considered compliant. |  |
| `isSiriBlockedWhenLocked` | `boolean` **|** `null` | Whether Siri is blocked from being invoked while the device is locked (iOS). |  |
| `isSmartScreenBlockOverrideForFiles` | `boolean` **|** `null` | Whether users are blocked from overriding SmartScreen warnings for files. |  |
| `isSmartScreenEnableInShell` | `boolean` **|** `null` | Whether Windows SmartScreen is enabled in the shell (file open / download warnings). |  |
| `isStorageRequireDeviceEncryption` | `boolean` **|** `null` | Whether device storage (full-disk) encryption is required, regardless of provider (BitLocker on Windows, FileVault on macOS, native on mobile). |  |
| `isTpmRequired` | `boolean` **|** `null` | Whether a Trusted Platform Module (TPM) is required for compliance. |  |
| `isUsbBlocked` | `boolean` **|** `null` | Whether USB connections / mass-storage are blocked. |  |
| `omaSettingCount` | `number` **|** `null` | Number of OMA-URI custom settings present on the policy (Windows custom configurations only). |  |
| `omaUris` | `array` **|** `null` | List of OMA-URI paths configured by the policy (e.g. `./Vendor/MSFT/BitLocker/...`). Useful for grepping which OMA-URIs are managed without inspecting the per-setting values. |  |
| `osMaximumVersion` | `string` **|** `null` | Maximum operating-system version the device may run to be considered compliant. |  |
| `osMinimumVersion` | `string` **|** `null` | Minimum operating-system version the device must run to be considered compliant. |  |
| `passwordExpirationDays` | `number` **|** `null` | Number of days after which the password must be changed. A value of 0 typically means no expiration. |  |
| `passwordMinimumCharacterSetCount` | `number` **|** `null` | Minimum number of distinct character sets (uppercase, lowercase, digits, symbols) the password must include. |  |
| `passwordMinimumLength` | `number` **|** `null` | Minimum number of characters required in the password/passcode. |  |
| `passwordMinutesOfInactivityBeforeLock` | `number` **|** `null` | Minutes of idle time before the device locks automatically. |  |
| `passwordMinutesOfInactivityBeforeScreenTimeout` | `number` **|** `null` | Minutes of idle time before the screen times out (display sleep). |  |
| `passwordPreviousPasswordBlockCount` | `number` **|** `null` | Number of previous passwords the user is blocked from reusing. |  |
| `passwordRequiredType` | `string` **|** `null` | The complexity class the password must satisfy. Example values: `deviceDefault`, `alphanumeric`, `numeric`, `alphabetic`, `alphanumericWithSymbols`. |  |
| `passwordSignInFailureCountBeforeFactoryReset` | `number` **|** `null` | Number of consecutive failed sign-in attempts that triggers an automatic factory reset of the device. |  |
| `version` | `number` |  |  |

---

### Intune Device Health Script

`intune_device_health_script` inherits from [Configuration](/data-model/schemas/Configuration.md), [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` |  | **const**: config |
| `detectionScriptParameterCount` | `number` **|** `null` | Number of parameters defined on the detection script. The parameter values themselves are intentionally not surfaced. |  |
| `deviceHealthScriptType` | `string` **|** `null` | Microsoft-assigned type discriminator for the health script. Example values: `deviceHealthScript`, `managedInstallerScript`. |  |
| 

`function` \*

 | `string` |  | **const**: endpoint-configuration |
| `isGlobalScript` | `boolean` **|** `null` | Whether this is a Microsoft-published global script (visible to all tenants) vs a tenant-authored script. |  |
| `isRunAs32Bit` | `boolean` **|** `null` | Whether the script is executed as a 32-bit process (vs the native 64-bit PowerShell host) on 64-bit Windows. |  |
| `isSignatureCheckEnforced` | `boolean` **|** `null` | Whether the script must be code-signed and validated against an Intune-configured signing certificate before the device will execute it. |  |
| `publisher` | `string` **|** `null` | Publisher of the Device Health Script (Proactive Remediation). For Microsoft-shipped scripts, this is typically `Microsoft`; for custom scripts, the org that authored them. |  |
| `remediationScriptParameterCount` | `number` **|** `null` | Number of parameters defined on the remediation script. The parameter values themselves are intentionally not surfaced. |  |
| `roleScopeTagIds` | `array` **|** `null` | Intune RBAC scope tag IDs associated with this Device Health Script. Used to limit which administrators can view/edit the script. |  |
| `runAsAccount` | `string` **|** `null` | Account context the script runs under on the endpoint. Example values: `system`, `user`. |  |
| `version` | `string` **|** `null` | Version string declared by the script author for this Device Health Script. |  |

---

### Intune Group Policy Configuration

`intune_group_policy_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md), [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appLockerApplicationControl` | `string` **|** `null` | AppLocker application control mode. Example values: `notConfigured`, `enforceComponentsAndStoreApps`, `auditComponentsAndStoreApps`, `enforceComponentsStoreAppsAndSmartlocker`, `auditComponentsStoreAppsAndSmartlocker`. |  |
| `bitlockerRemovableDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to removable drives. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| `bitlockerSystemDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to the operating-system drive. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| 
`category` \*

 | `string` |  | **const**: config |
| `defenderCloudBlockLevel` | `string` **|** `null` | Microsoft Defender cloud-block level. Example values: `notConfigured`, `high`, `highPlus`, `zeroTolerance`. |  |
| `definitionValueCount` | `number` **|** `null` | Number of ADMX `definitionValue` settings configured by this Group Policy configuration. Each `definitionValue` corresponds to one Group Policy setting that has been set. |  |
| `diagnosticsDataSubmissionMode` | `string` **|** `null` | Telemetry/diagnostics data submission level. Example values: `userDefined`, `none`, `basic`, `enhanced`, `full`. |  |
| `firewallDomainFirewallState` | `string` **|** `null` | Domain-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPrivateFirewallState` | `string` **|** `null` | Private-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPublicFirewallState` | `string` **|** `null` | Public-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| 

`function` \*

 | `string` |  | **const**: endpoint-configuration |
| `isActiveFirewallRequired` | `boolean` **|** `null` | Whether an active firewall (any profile) is required for compliance. |  |
| `isAntiSpywareRequired` | `boolean` **|** `null` | Whether an anti-spyware product must be installed and active for compliance. |  |
| `isAntivirusRequired` | `boolean` **|** `null` | Whether an antivirus product (any vendor) must be installed and active for compliance. |  |
| `isApplicationGuardEnabled` | `boolean` **|** `null` | Whether Windows Defender Application Guard is enabled. |  |
| `isAppStoreBlocked` | `boolean` **|** `null` | Whether the platform App Store is blocked entirely (no app install/update from the store). |  |
| `isAppStoreRequirePassword` | `boolean` **|** `null` | Whether the App Store is required to prompt for a password before every purchase / install. |  |
| `isBitlockerEncryptDevice` | `boolean` **|** `null` | Whether BitLocker disk encryption is required on the device. |  |
| `isBitlockerRemovableDriveBlockCrossOrganizationWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to BitLocker-encrypted drives that were encrypted by another organization. |  |
| `isBitlockerRemovableDriveRequireEncryptionForWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to removable drives that are not BitLocker-encrypted. |  |
| `isBluetoothBlocked` | `boolean` **|** `null` | Whether Bluetooth is blocked. |  |
| `isCameraBlocked` | `boolean` **|** `null` | Whether the device camera is blocked. |  |
| `isCertificatesBlockUntrustedTlsCertificates` | `boolean` **|** `null` | Whether the device is blocked from accepting untrusted TLS certificates. |  |
| `isCodeIntegrityEnabled` | `boolean` **|** `null` | Whether Windows code integrity (HVCI) is required. |  |
| `isCommercialDataSharingDisabled` | `boolean` **|** `null` | Whether sharing of commercial telemetry data with Microsoft is disabled. |  |
| `isDefenderEnabled` | `boolean` **|** `null` | Whether Microsoft Defender must be enabled (compliance gate). |  |
| `isDefenderRequireBehaviorMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender behavior monitoring is required. |  |
| `isDefenderRequireCloudProtection` | `boolean` **|** `null` | Whether Microsoft Defender cloud-delivered protection is required. |  |
| `isDefenderRequireRealTimeMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender real-time monitoring is required. |  |
| `isDefenderSecurityCenterBlockExploitProtectionOverride` | `boolean` **|** `null` | Whether users are blocked from overriding the configured exploit-protection settings via the Defender Security Center. |  |
| `isEdgeRequireSmartScreen` | `boolean` **|** `null` | Whether Microsoft Edge is required to have SmartScreen enabled. |  |
| `isFileVaultEnabled` | `boolean` **|** `null` | Whether FileVault disk encryption is required on macOS. |  |
| `isFirewallDomainInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Domain firewall profile. |  |
| `isFirewallDomainOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Domain firewall profile. |  |
| `isFirewallPrivateInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Private firewall profile. |  |
| `isFirewallPrivateOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Private firewall profile. |  |
| `isFirewallPublicInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Public firewall profile. |  |
| `isFirewallPublicOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Public firewall profile. |  |
| `isHealthyDeviceReportRequired` | `boolean` **|** `null` | Whether a recent Windows Health Attestation report is required for compliance. |  |
| `isICloudRequireEncryptedBackup` | `boolean` **|** `null` | Whether iCloud backups must be encrypted (iOS). |  |
| `isLocationServicesBlocked` | `boolean` **|** `null` | Whether device location services are blocked. |  |
| `isMicrophoneBlocked` | `boolean` **|** `null` | Whether the device microphone (or voice recording) is blocked. |  |
| `isMicrosoftAccountBlocked` | `boolean` **|** `null` | Whether sign-in with personal Microsoft accounts is blocked on the device. |  |
| `isOneDriveDisableFileSync` | `boolean` **|** `null` | Whether OneDrive file-sync is disabled on the device. |  |
| `isPasswordBlockFingerprint` | `boolean` **|** `null` | Whether fingerprint unlock (biometric) is blocked. |  |
| `isPasswordBlockSimple` | `boolean` **|** `null` | Whether simple passwords (e.g. repeating or sequential characters such as `1234`, `aaaa`) are blocked. |  |
| `isPasswordBlockSmartCard` | `boolean` **|** `null` | Whether smart-card sign-in is blocked. |  |
| `isPasswordRequired` | `boolean` **|** `null` | Whether the device or user must set a password/passcode to unlock the device. |  |
| `isSafariRequireFraudWarning` | `boolean` **|** `null` | Whether Safari is required to show fraudulent-website warnings (iOS). |  |
| `isScreenCaptureBlocked` | `boolean` **|** `null` | Whether screen capture / screenshots are blocked. |  |
| `isSecureBootEnabled` | `boolean` **|** `null` | Whether UEFI Secure Boot is required to be enabled. |  |
| `isSignatureOutOfDateRequired` | `boolean` **|** `null` | Whether the policy requires AV signatures to be up to date for the device to be considered compliant. |  |
| `isSiriBlockedWhenLocked` | `boolean` **|** `null` | Whether Siri is blocked from being invoked while the device is locked (iOS). |  |
| `isSmartScreenBlockOverrideForFiles` | `boolean` **|** `null` | Whether users are blocked from overriding SmartScreen warnings for files. |  |
| `isSmartScreenEnableInShell` | `boolean` **|** `null` | Whether Windows SmartScreen is enabled in the shell (file open / download warnings). |  |
| `isStorageRequireDeviceEncryption` | `boolean` **|** `null` | Whether device storage (full-disk) encryption is required, regardless of provider (BitLocker on Windows, FileVault on macOS, native on mobile). |  |
| `isTpmRequired` | `boolean` **|** `null` | Whether a Trusted Platform Module (TPM) is required for compliance. |  |
| `isUsbBlocked` | `boolean` **|** `null` | Whether USB connections / mass-storage are blocked. |  |
| `omaSettingCount` | `number` **|** `null` | Number of OMA-URI custom settings present on the policy (Windows custom configurations only). |  |
| `omaUris` | `array` **|** `null` | List of OMA-URI paths configured by the policy (e.g. `./Vendor/MSFT/BitLocker/...`). Useful for grepping which OMA-URIs are managed without inspecting the per-setting values. |  |
| `osMaximumVersion` | `string` **|** `null` | Maximum operating-system version the device may run to be considered compliant. |  |
| `osMinimumVersion` | `string` **|** `null` | Minimum operating-system version the device must run to be considered compliant. |  |
| `passwordExpirationDays` | `number` **|** `null` | Number of days after which the password must be changed. A value of 0 typically means no expiration. |  |
| `passwordMinimumCharacterSetCount` | `number` **|** `null` | Minimum number of distinct character sets (uppercase, lowercase, digits, symbols) the password must include. |  |
| `passwordMinimumLength` | `number` **|** `null` | Minimum number of characters required in the password/passcode. |  |
| `passwordMinutesOfInactivityBeforeLock` | `number` **|** `null` | Minutes of idle time before the device locks automatically. |  |
| `passwordMinutesOfInactivityBeforeScreenTimeout` | `number` **|** `null` | Minutes of idle time before the screen times out (display sleep). |  |
| `passwordPreviousPasswordBlockCount` | `number` **|** `null` | Number of previous passwords the user is blocked from reusing. |  |
| `passwordRequiredType` | `string` **|** `null` | The complexity class the password must satisfy. Example values: `deviceDefault`, `alphanumeric`, `numeric`, `alphabetic`, `alphanumericWithSymbols`. |  |
| `passwordSignInFailureCountBeforeFactoryReset` | `number` **|** `null` | Number of consecutive failed sign-in attempts that triggers an automatic factory reset of the device. |  |
| `policyConfigurationIngestionType` | `string` **|** `null` | How the Group Policy configuration was authored or imported. Example values: `unknown`, `builtIn`, `custom`, `mixed`. |  |
| `roleScopeTagIds` | `array` **|** `null` | Intune RBAC scope tag IDs associated with this Group Policy configuration. Used to limit which administrators can view/edit the policy. |  |

---

### Intune Host Agent

`intune_host_agent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `complianceState` | `string` |  | **Any of**:
-   `unknown`

-   `compliant`

-   `noncompliant`

-   `conflict`

-   `error`

-   `inGracePeriod`

-   `configManager`

 |
| `compliant` | `boolean` | Please use `isCompliant` instead | **deprecated**: true |
| `isCompliant` | `boolean` |  |  |
| `managementAgent` | `string` | Management channel of the device.  
  
**Examples**: eas, mdm, easMdm, intuneClient, easIntuneClient, jamf, googleCloudDevicePolicyController |  |
| `registrationState` | `string` |  | **Any of**:

-   `notRegistered`

-   `registered`

-   `revoked`

-   `keyConflict`

-   `approvalPending`

-   `certificateReset`

-   `notRegisteredPendingEnrollment`

-   `unknown`

 |
| `state` | `string` |  | **Any of**:

-   `managed`

-   `retirePending`

-   `retireFailed`

-   `wipePending`

-   `wipeFailed`

-   `unhealthy`

-   `deletePending`

-   `retireIssued`

-   `wipeIssued`

-   `wipeCanceled`

-   `retireCanceled`

-   `discovered`

 |

---

### Intune Managed Application

`intune_managed_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `committedContentVersion` | `string` **|** `null` |  |  |
| `developer` | `string` **|** `null` | Most often the same as the owner |  |
| `featured` | `boolean` | Please use `isFeatured` instead | **deprecated**: true |
| `informationURL` | `string` **|** `null` |  |  |
| `isFeatured` | `boolean` | Indicates that this app is being featured on the Company Portal |  |
| 
`isPublished` \*

 | `boolean` |  |  |
| `lastUpdatedOn` | `number` |  |  |
| `packageId` | `string` **|** `null` |  |  |
| `privacyInformationURL` | `string` **|** `null` |  |  |
| `publisher` | `string` **|** `null` |  |  |
| `version` | `string` **|** `null` |  |  |

---

### Intune Noncompliance Finding

`intune_noncompliance_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` |  | **const**: endpoint |
| `id` | `string` |  |  |
| `lastProcessedOn` | `number` |  |  |
| `lastTestedOn` | `number` |  |  |
| `lastUpdatedOn` | `number` |  |  |
| `status` | `string` |  | **Any of**:

-   `unknown`

-   `notApplicable`

-   `compliant`

-   `remediated`

-   `nonCompliant`

-   `error`

-   `conflict`

-   `notAssigned`

 |

---

### Intune Settings Catalog Policy

`intune_settings_catalog_policy` inherits from [Configuration](/data-model/schemas/Configuration.md), [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appLockerApplicationControl` | `string` **|** `null` | AppLocker application control mode. Example values: `notConfigured`, `enforceComponentsAndStoreApps`, `auditComponentsAndStoreApps`, `enforceComponentsStoreAppsAndSmartlocker`, `auditComponentsStoreAppsAndSmartlocker`. |  |
| `bitlockerRemovableDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to removable drives. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| `bitlockerSystemDriveEncryptionMethod` | `string` **|** `null` | Encryption algorithm applied to the operating-system drive. Example values: `aesCbc128`, `aesCbc256`, `xtsAes128`, `xtsAes256`. |  |
| 
`category` \*

 | `string` |  | **const**: config |
| `creationSource` | `string` **|** `null` | How the policy was created (e.g. via the Settings Catalog UI, imported template, or via the API). |  |
| `defenderCloudBlockLevel` | `string` **|** `null` | Microsoft Defender cloud-block level. Example values: `notConfigured`, `high`, `highPlus`, `zeroTolerance`. |  |
| `diagnosticsDataSubmissionMode` | `string` **|** `null` | Telemetry/diagnostics data submission level. Example values: `userDefined`, `none`, `basic`, `enhanced`, `full`. |  |
| `firewallDomainFirewallState` | `string` **|** `null` | Domain-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPrivateFirewallState` | `string` **|** `null` | Private-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| `firewallPublicFirewallState` | `string` **|** `null` | Public-profile firewall state. Possible values: `enabled`, `disabled`, `notConfigured`, `allowed`, `blocked` (tri/quad-state, not boolean). |  |
| 

`function` \*

 | `string` |  | **const**: endpoint-configuration |
| `isActiveFirewallRequired` | `boolean` **|** `null` | Whether an active firewall (any profile) is required for compliance. |  |
| `isAntiSpywareRequired` | `boolean` **|** `null` | Whether an anti-spyware product must be installed and active for compliance. |  |
| `isAntivirusRequired` | `boolean` **|** `null` | Whether an antivirus product (any vendor) must be installed and active for compliance. |  |
| `isApplicationGuardEnabled` | `boolean` **|** `null` | Whether Windows Defender Application Guard is enabled. |  |
| `isAppStoreBlocked` | `boolean` **|** `null` | Whether the platform App Store is blocked entirely (no app install/update from the store). |  |
| `isAppStoreRequirePassword` | `boolean` **|** `null` | Whether the App Store is required to prompt for a password before every purchase / install. |  |
| `isAssigned` | `boolean` **|** `null` | Whether the policy currently has at least one assignment defined in Intune. |  |
| `isBitlockerEncryptDevice` | `boolean` **|** `null` | Whether BitLocker disk encryption is required on the device. |  |
| `isBitlockerRemovableDriveBlockCrossOrganizationWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to BitLocker-encrypted drives that were encrypted by another organization. |  |
| `isBitlockerRemovableDriveRequireEncryptionForWriteAccess` | `boolean` **|** `null` | Whether the device blocks write access to removable drives that are not BitLocker-encrypted. |  |
| `isBluetoothBlocked` | `boolean` **|** `null` | Whether Bluetooth is blocked. |  |
| `isCameraBlocked` | `boolean` **|** `null` | Whether the device camera is blocked. |  |
| `isCertificatesBlockUntrustedTlsCertificates` | `boolean` **|** `null` | Whether the device is blocked from accepting untrusted TLS certificates. |  |
| `isCodeIntegrityEnabled` | `boolean` **|** `null` | Whether Windows code integrity (HVCI) is required. |  |
| `isCommercialDataSharingDisabled` | `boolean` **|** `null` | Whether sharing of commercial telemetry data with Microsoft is disabled. |  |
| `isDefenderEnabled` | `boolean` **|** `null` | Whether Microsoft Defender must be enabled (compliance gate). |  |
| `isDefenderRequireBehaviorMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender behavior monitoring is required. |  |
| `isDefenderRequireCloudProtection` | `boolean` **|** `null` | Whether Microsoft Defender cloud-delivered protection is required. |  |
| `isDefenderRequireRealTimeMonitoring` | `boolean` **|** `null` | Whether Microsoft Defender real-time monitoring is required. |  |
| `isDefenderSecurityCenterBlockExploitProtectionOverride` | `boolean` **|** `null` | Whether users are blocked from overriding the configured exploit-protection settings via the Defender Security Center. |  |
| `isEdgeRequireSmartScreen` | `boolean` **|** `null` | Whether Microsoft Edge is required to have SmartScreen enabled. |  |
| `isFileVaultEnabled` | `boolean` **|** `null` | Whether FileVault disk encryption is required on macOS. |  |
| `isFirewallDomainInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Domain firewall profile. |  |
| `isFirewallDomainOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Domain firewall profile. |  |
| `isFirewallDomainStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Domain firewall profile. |  |
| `isFirewallPrivateInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Private firewall profile. |  |
| `isFirewallPrivateOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Private firewall profile. |  |
| `isFirewallPrivateStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Private firewall profile. |  |
| `isFirewallPublicInboundConnectionsBlocked` | `boolean` **|** `null` | Whether inbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicIncomingTrafficBlocked` | `boolean` **|** `null` | Whether incoming traffic is blocked on the Public firewall profile. |  |
| `isFirewallPublicOutboundConnectionsBlocked` | `boolean` **|** `null` | Whether outbound connections are blocked on the Public firewall profile. |  |
| `isFirewallPublicStealthModeBlocked` | `boolean` **|** `null` | Whether stealth mode is blocked on the Public firewall profile. |  |
| `isHealthyDeviceReportRequired` | `boolean` **|** `null` | Whether a recent Windows Health Attestation report is required for compliance. |  |
| `isICloudRequireEncryptedBackup` | `boolean` **|** `null` | Whether iCloud backups must be encrypted (iOS). |  |
| `isLocationServicesBlocked` | `boolean` **|** `null` | Whether device location services are blocked. |  |
| `isMicrophoneBlocked` | `boolean` **|** `null` | Whether the device microphone (or voice recording) is blocked. |  |
| `isMicrosoftAccountBlocked` | `boolean` **|** `null` | Whether sign-in with personal Microsoft accounts is blocked on the device. |  |
| `isOneDriveDisableFileSync` | `boolean` **|** `null` | Whether OneDrive file-sync is disabled on the device. |  |
| `isPasswordBlockFingerprint` | `boolean` **|** `null` | Whether fingerprint unlock (biometric) is blocked. |  |
| `isPasswordBlockSimple` | `boolean` **|** `null` | Whether simple passwords (e.g. repeating or sequential characters such as `1234`, `aaaa`) are blocked. |  |
| `isPasswordBlockSmartCard` | `boolean` **|** `null` | Whether smart-card sign-in is blocked. |  |
| `isPasswordRequired` | `boolean` **|** `null` | Whether the device or user must set a password/passcode to unlock the device. |  |
| `isSafariRequireFraudWarning` | `boolean` **|** `null` | Whether Safari is required to show fraudulent-website warnings (iOS). |  |
| `isScreenCaptureBlocked` | `boolean` **|** `null` | Whether screen capture / screenshots are blocked. |  |
| `isSecureBootEnabled` | `boolean` **|** `null` | Whether UEFI Secure Boot is required to be enabled. |  |
| `isSignatureOutOfDateRequired` | `boolean` **|** `null` | Whether the policy requires AV signatures to be up to date for the device to be considered compliant. |  |
| `isSiriBlockedWhenLocked` | `boolean` **|** `null` | Whether Siri is blocked from being invoked while the device is locked (iOS). |  |
| `isSmartScreenBlockOverrideForFiles` | `boolean` **|** `null` | Whether users are blocked from overriding SmartScreen warnings for files. |  |
| `isSmartScreenEnableInShell` | `boolean` **|** `null` | Whether Windows SmartScreen is enabled in the shell (file open / download warnings). |  |
| `isStorageRequireDeviceEncryption` | `boolean` **|** `null` | Whether device storage (full-disk) encryption is required, regardless of provider (BitLocker on Windows, FileVault on macOS, native on mobile). |  |
| `isTpmRequired` | `boolean` **|** `null` | Whether a Trusted Platform Module (TPM) is required for compliance. |  |
| `isUsbBlocked` | `boolean` **|** `null` | Whether USB connections / mass-storage are blocked. |  |
| `omaSettingCount` | `number` **|** `null` | Number of OMA-URI custom settings present on the policy (Windows custom configurations only). |  |
| `omaUris` | `array` **|** `null` | List of OMA-URI paths configured by the policy (e.g. `./Vendor/MSFT/BitLocker/...`). Useful for grepping which OMA-URIs are managed without inspecting the per-setting values. |  |
| `osMaximumVersion` | `string` **|** `null` | Maximum operating-system version the device may run to be considered compliant. |  |
| `osMinimumVersion` | `string` **|** `null` | Minimum operating-system version the device must run to be considered compliant. |  |
| `passwordExpirationDays` | `number` **|** `null` | Number of days after which the password must be changed. A value of 0 typically means no expiration. |  |
| `passwordMinimumCharacterSetCount` | `number` **|** `null` | Minimum number of distinct character sets (uppercase, lowercase, digits, symbols) the password must include. |  |
| `passwordMinimumLength` | `number` **|** `null` | Minimum number of characters required in the password/passcode. |  |
| `passwordMinutesOfInactivityBeforeLock` | `number` **|** `null` | Minutes of idle time before the device locks automatically. |  |
| `passwordMinutesOfInactivityBeforeScreenTimeout` | `number` **|** `null` | Minutes of idle time before the screen times out (display sleep). |  |
| `passwordPreviousPasswordBlockCount` | `number` **|** `null` | Number of previous passwords the user is blocked from reusing. |  |
| `passwordRequiredType` | `string` **|** `null` | The complexity class the password must satisfy. Example values: `deviceDefault`, `alphanumeric`, `numeric`, `alphabetic`, `alphanumericWithSymbols`. |  |
| `passwordSignInFailureCountBeforeFactoryReset` | `number` **|** `null` | Number of consecutive failed sign-in attempts that triggers an automatic factory reset of the device. |  |
| `platforms` | `string` **|** `null` | Platforms the Settings Catalog policy targets. Example values: `windows10`, `macOS`, `iOS`, `android`, `androidEnterprise`. |  |
| `priority` | `number` **|** `null` | Priority assigned to this policy by Intune for conflict resolution. Lower numeric values typically indicate higher priority. |  |
| `roleScopeTagIds` | `array` **|** `null` | Intune RBAC scope tag IDs associated with this policy. Used to limit which administrators can view/edit the policy. |  |
| `settingCount` | `number` **|** `null` | Number of settings configured by this Settings Catalog policy. |  |
| `technologies` | `string` **|** `null` | Comma-separated list of management technologies the policy applies through. Example values: `mdm`, `windows10XManagement`, `configManager`, `microsoftSense`. |  |
| `templateDisplayName` | `string` **|** `null` | Display name of the Settings Catalog template this policy was instantiated from, when applicable. |  |
| `templateDisplayVersion` | `string` **|** `null` | Display version of the Settings Catalog template this policy was instantiated from, when applicable. |  |
| `templateFamily` | `string` **|** `null` | Template family the policy was derived from, when applicable. Example values: `endpointSecurityAntivirus`, `endpointSecurityDiskEncryption`, `endpointSecurityFirewall`. |  |
| `templateId` | `string` **|** `null` | Microsoft identifier of the Settings Catalog template this policy was instantiated from, when applicable. |  |

---

### Laptop

`laptop` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

---

### Microsoft 365 Account

`microsoft_365_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `defaultDomain` | `string` |  |  |
| `intuneAccountId` | `string` |  |  |
| `intuneSubscriptionState` | `string` |  |  |
| `mobileDeviceManagementAuthority` | `string` |  |  |
| `organizationName` | `string` **|** `null` |  |  |
| `verifiedDomains` | `array` of `string`s |  |  |

---

### Microsoft 365 Copilot License

`microsoft_365_copilot_license` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aiPlatform` | `string` | Identifier of the AI platform the license grants, always "microsoft-365-copilot". |  |
| `appliesTo` | `string` **|** `null` | Whether the SKU is assigned to users or the company, e.g. "User". |  |
| `capabilityStatus` | `string` **|** `null` | Subscription status: Enabled, Warning, Suspended, Deleted or LockedOut. |  |
| `consumedUnits` | `number` **|** `null` | Number of Copilot seats assigned to users. |  |
| `enabledUnits` | `number` **|** `null` | Number of purchased seats that are active. |  |
| `isAi` | `boolean` | True for every Copilot license; marks the entity as an AI asset for AI ASM. |  |
| `lockedOutUnits` | `number` **|** `null` | Number of seats that are locked out. |  |
| 
`skuId` \*

 | `string` | Microsoft subscribedSku.skuId (GUID) of the product. |  |
| 

`skuPartNumber` \*

 | `string` | Microsoft subscribedSku.skuPartNumber, e.g. "Microsoft\_365\_Copilot". |  |
| `suspendedUnits` | `number` **|** `null` | Number of seats in the suspended state. |  |
| `warningUnits` | `number` **|** `null` | Number of seats in the warning (grace period) state. |  |

---

### Microsoft 365 Copilot Package

`microsoft_365_copilot_package` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetId` | `string` | Asset-store reference id for the package. |  |
| `availableTo` | `string` | Access scope from copilotPackage.availableTo (allowedForAll, allowedForSome, allowedForNone; responses may abbreviate to all/some/none). Who has access when the scope is "some" is carried by the ALLOWS relationships to azure\_user / azure\_user\_group. |  |
| `deployedTo` | `string` | Deployment scope from copilotPackage.deployedTo (acquiredForAll, acquiredForSome, acquiredForNone; responses may abbreviate to all/some/none). Who acquired it when the scope is "some" is carried by the INSTALLED relationships from azure\_user / azure\_user\_group. |  |
| `elementTypes` | `array` of `string`s | Element kinds declared by the package (e.g. bot, declarativeAgent, customEngineAgent, officeAddIn). Open vocabulary. |  |
| `governanceMetadata` | `string` | Agentic classification (e.g. PromptAgent, HostedAgent, WorkflowAgent, ManagedAgent, Unmanaged, AIApp). The ISO 42001 governance field. |  |
| `isBlocked` | `boolean` **|** `null` | Whether an admin has blocked the package from use in the tenant. Nullable because unknown is not the same as not-blocked. |  |
| `manifestId` | `string` | Manifest-declared id of the package (immutable). |  |
| `manifestVersion` | `string` | Manifest schema version of the package (immutable). |  |
| `packageType` | `string` | Package provenance from copilotPackage.type: microsoft (first-party), external (third-party), shared, or custom (line-of-business). Third-party/custom packages are the governance risk. |  |
| `platform` | `string` | Build provenance of the package (e.g. Copilot Studio, Microsoft 365 Copilot Agent Builder, web, teams). |  |
| `publisher` | `string` | Publishing organization that authored the package (supply-chain / trust signal). |  |
| `requestStatus` | `string` **|** `null` | Request-queue state when the package is a request item (e.g. pending, approved, rejected). Null when not a request. |  |
| `requestType` | `string` **|** `null` | Request kind when the package is a request item (e.g. publish, activate, access, update). Null when not a request. |  |
| `supportedHosts` | `array` of `string`s | Hosts the package runs in (e.g. Copilot, Outlook, Teams, M365). A Copilot host indicates it is a Copilot agent. |  |
| `version` | `string` | Package version (e.g. 1.2.3; immutable). |  |

---

### Microsoft 365 Secure Score

`microsoft_365_secure_score` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeUserCount` | `number` **|** `null` | Active user count of the tenant |  |
| `averageScoreAllTenants` | `number` **|** `null` | Average Secure Score across all Microsoft tenants (averageComparativeScores basis AllTenants) |  |
| `averageScoreIndustryTypes` | `number` **|** `null` | Average Secure Score of tenants in the same industry (averageComparativeScores basis IndustryTypes) |  |
| `averageScoreTotalSeats` | `number` **|** `null` | Average Secure Score of tenants with a similar seat count (averageComparativeScores basis TotalSeats) |  |
| `currentScore` | `number` **|** `null` | Score the tenant attained on the snapshot date |  |
| `enabledServices` | `array` **|** `null` | Microsoft-provided services enabled for the tenant (e.g. HasExchange, HasSharePoint) |  |
| `licensedUserCount` | `number` **|** `null` | Licensed user count of the tenant |  |
| `maxScore` | `number` **|** `null` | Maximum score attainable by the tenant on the snapshot date |  |
| `scorePercentage` | `number` **|** `null` | currentScore as a percentage of maxScore (0-100), rounded to two decimals |  |

---

### Microsoft 365 Secure Score Control

`microsoft_365_secure_score_control` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `actionType` | `string` **|** `null` | Control action type (Config, Review, Behavior) |  |
| `controlCategory` | `string` **|** `null` | Control category (Identity, Data, Device, Apps, Infrastructure) |  |
| `controlState` | `string` **|** `null` | Most recent state an administrator set on the control (e.g. Default, Ignored, ThirdParty, Reviewed) |  |
| `controlStateUpdatedOn` | `number` **|** `null` | When the most recent control state was set |  |
| `implementationCost` | `string` **|** `null` | Resource cost of implementing the control (Low, Moderate, High) |  |
| `isDeprecated` | `boolean` **|** `null` | True if Microsoft deprecated the control |  |
| `isFullyImplemented` | `boolean` **|** `null` | True when the tenant achieves the full maxScore for the control in the latest snapshot; null when the score is unknown or the control carries no points. Points-based, so it is also true when an administrator marked the control resolved through a third party or alternate mitigation (check controlState) |  |
| `maxScore` | `number` **|** `null` | Maximum score attainable for the control |  |
| `rank` | `number` **|** `null` | Microsoft's stack ranking of the control |  |
| `remediation` | `string` **|** `null` | What the control helps remediate and how to implement it |  |
| `remediationImpact` | `string` **|** `null` | Impact on users of implementing the remediation |  |
| `score` | `number` **|** `null` | Score the tenant achieves on the control in the latest Secure Score snapshot; null when the control is not in the snapshot's controlScores |  |
| `scoredOn` | `number` **|** `null` | Creation time of the Secure Score snapshot the score was read from |  |
| `scorePercentage` | `number` **|** `null` | score as a percentage of maxScore (0-100), rounded to two decimals |  |
| `service` | `string` **|** `null` | Microsoft service that owns the control, verbatim from Microsoft Graph (identifies e.g. Microsoft Defender for Office 365, Exchange Online, SharePoint or Microsoft Entra ID controls) |  |
| `threats` | `array` **|** `null` | Threats the control mitigates (e.g. Phishing, Malware, Account Breach) |  |
| `tier` | `string` **|** `null` | Control tier (Core, Defense in Depth, Advanced) |  |
| `userImpact` | `string` **|** `null` | User impact of implementing the control (Low, Moderate, High) |  |

---

### Microsoft 365 Sharepoint Document Library

`microsoft_365_sharepoint_document_library` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `driveType` | `string` **|** `null` | Microsoft Graph drive.driveType; "documentLibrary" for SharePoint libraries. |  |
| 
`path` \*

 | `string` | Server-relative, URL-decoded path of the resource (e.g. "/sites/Finance/Shared Documents/Audit"). This is the value the SharePoint include/exclude path settings are matched against. |  |

---

### Microsoft 365 Sharepoint Folder

`microsoft_365_sharepoint_folder` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `childCount` | `number` **|** `null` | Number of direct children (files and folders) reported by the folder facet. |  |
| 
`depth` \*

 | `number` | Nesting level below the document library root: 1 for a top-level folder of the library. |  |
| 

`path` \*

 | `string` | Server-relative, URL-decoded path of the resource (e.g. "/sites/Finance/Shared Documents/Audit"). This is the value the SharePoint include/exclude path settings are matched against. |  |
| `size` | `number` **|** `null` | Total size in bytes of the folder contents, as reported by Microsoft Graph. |  |

---

### Microsoft 365 Sharepoint Site

`microsoft_365_sharepoint_site` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dataLocationCode` | `string` **|** `null` | Multi-geo data location of the site collection (siteCollection.dataLocationCode), e.g. "NAM". Null outside multi-geo tenants. |  |
| `hostname` | `string` **|** `null` | SharePoint host the site collection lives on (siteCollection.hostName), e.g. "contoso.sharepoint.com". |  |
| 
`path` \*

 | `string` | Server-relative, URL-decoded path of the resource (e.g. "/sites/Finance/Shared Documents/Audit"). This is the value the SharePoint include/exclude path settings are matched against. |  |

---

### Microsoft 365 Team

`microsoft_365_team` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` | Free-text description of the team |  |
| `isArchived` | `boolean` | True if the team has been archived by an admin |  |
| `visibility` | `string` | Visibility scope of the team (private / public / hiddenMembership) |  |
| `webUrl` | `string` | Deep link to the team in the Microsoft Teams client |  |

---

### Microsoft 365 Teams App Installation

`microsoft_365_teams_app_installation` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appVersion` | `string` | teamsAppDefinition.version installed in this team |  |
| `distributionMethod` | `string` | How the app was published: store (Teams public app store), organization (tenant-published), or sideloaded (highest-risk; an admin manually uploaded the package) |  |
| `externalAppId` | `string` | teamsApp.externalId set by the app publisher when the app was registered |  |
| `publishingState` | `string` | teamsAppDefinition.publishingState (e.g. published, submitted, rejected) |  |
| `teamsAppId` | `string` | Microsoft Graph teamsApp.id of the catalog entry this installation references |  |

---

### Server

`server` inherits from [Host](/data-model/schemas/Host.md)

---

### Server

`server` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aadDeviceId` | `string` |  |  |
| `assetTag` | `array` of `string`s |  |  |
| `BYOD` | `boolean` |  |  |
| `deviceCategoryDisplayName` | `string` |  |  |
| `deviceName` | `string` |  |  |
| `deviceType` | `string` |  |  |
| `easDeviceId` | `string` |  |  |
| `encrypted` | `boolean` |  |  |
| `enrolledDateTime` | `number` |  |  |
| `ethernetMacAddress` | `string` |  |  |
| `freeStorageSpace` | `string` |  |  |
| `freeStorageSpaceInBytes` | `number` |  |  |
| `hardwareManufacturer` | `string` |  |  |
| `hardwareModel` | `string` |  |  |
| `hardwareSerial` | `string` |  |  |
| `hardwareVendor` | `string` |  |  |
| `hardwareVersion` | `string` |  |  |
| `iccid` | `string` |  |  |
| `id` | `string` |  |  |
| `imei` | `string` |  |  |
| `ipAddress` | `string` |  |  |
| `jailBroken` | `string` |  |  |
| `lastSyncDateTime` | `number` |  |  |
| `lastUpdateDateTime` | `number` |  |  |
| `macAddress` | `array` of `string`s |  |  |
| `managed` | `boolean` |  |  |
| `meid` | `string` |  |  |
| `name` | `string` |  |  |
| `ownerType` | `string` |  |  |
| `phoneNumber` | `string` |  |  |
| `physical` | `boolean` |  |  |
| `processorArchitecture` | `string` |  |  |
| `serialNumber` | `string` |  |  |
| `supervised` | `boolean` |  |  |
| `totalPhysicalMemory` | `string` |  |  |
| `totalPhysicalMemoryInBytes` | `number` |  |  |
| `totalStorageSpace` | `string` |  |  |
| `totalStorageSpaceInBytes` | `number` |  |  |
| `udid` | `string` |  |  |
| `userDisplayName` | `string` |  |  |
| `userEmails` | `array` of `string`s |  |  |
| `userId` | `string` |  |  |
| `username` | `string` |  |  |
| `version` | `string` |  |  |
| `wifiMacAddress` | `string` |  |  |

---

### Smartphone

`smartphone` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

---

### User Endpoint

`user_endpoint` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

---

### Workstation

`workstation` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

---

## Release Notes

-   **2026-10-12** — Added last interactive, non-interactive, and last-successful sign-in timestamps to Microsoft 365 user entities.
    
-   **2026-10-05** — Added ingestion of Microsoft Copilot packages and license assignments, with relationships linking users and groups to their Copilot access.
    
-   **2026-09-14** — Microsoft 365 users now include email aliases from proxy addresses as a queryable property.
    
-   **2026-09-14** — Added per-user Entra ID authentication method registration details as queryable properties on Microsoft 365 user entities.
    
-   **2026-06-01** — Added ingestion of Microsoft Teams apps and their installations as Non-Human Identity entities.
    
-   **2026-05-20** — Expanded Microsoft Intune policy coverage, including additional Windows, MacOS, and device configuration policy types as queryable entities.
    
-   **2026-04-08** — Improved OS type and detail accuracy for Microsoft 365 Intune managed device entities.
    
-   **2026-02-12** — Added raw data properties to Windows Autopilot device identity entities, including deployment profile assignment timestamps and last contact time.
    
-   **2025-10-21** — Added Windows Autopilot device identity ingestion, exposing enrollment state, deployment profile assignment, and last contact time.
    
-   **2025-07-01** — Added direct group membership relationships for Microsoft 365 group members when the user exists in JupiterOne, improving relationship accuracy over mapped relationships.

---

Source: /integrations/directory/microsoft-active-directory

# Microsoft Active Directory

Visualize Microsoft Active Directory users, groups, and devices, and monitor changes through queries and alerts.

## Installation

To use this integration, you must create a Microsoft Active Directory account capable of executing Active Directory read queries (It is strongly recommended to create a new account that is used strictly for this integration and not over-provisioned), and open the LDAP port on your server to allow queries to be executed.

> **INFO**
> 
> You can find additional information on managing Active Directory accounts on Microsoft's documentation, [here](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-default-user-accounts). Additionally, information on LDAP configuration can be found, [here](https://learn.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-configure-ldaps).

### Configuration in JupiterOne

To install the Microsoft Active Directory integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Microsoft Active Directory. Click **New Instance** to begin configuring your integration.

1.  Create an Active Directory user capable of executing read queries. It is strongly recommended to create a new account that is used strictly for this integration and not over-provisioned.
2.  Obtain the following information:
    -   **Client Username** - the username created in previous step, such as `user@corp.example.com`.
    -   **Client Password** - the password for the Client Username.
    -   **LDAP URL** - the URL of the LDAP server, such as `ldaps://dc01.corp.example.com` for LDAP over TLS or `ldap://dc01.corp.example.com` for unencrypted LDAP. Use the fully qualified domain name of the domain controller rather than an IP address, for the reasons described in [LDAP over TLS (LDAPS)](#ldap-over-tls-ldaps).
    -   **Base DN** - The base Distinguished Name of the subtree to be used in authentication and searches, such as `dc=corp`,`dc=example`,`dc=com`.

-   The **Account Name** used to identify the Microsoft Active Directory account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Microsoft Active Directry information** (username, password, LDAP URL, base DN) obtained in the previous section.
    

Click **Create** once all values are provided to finalize the integration.

## LDAP over TLS (LDAPS)

LDAP traffic is unencrypted over port 389. LDAPS wraps the same protocol in TLS over port 636, which keeps the bind credentials and directory queries from crossing the network in the clear. Microsoft's [LDAPS certificate documentation](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/configure-ldap-signing-certificates) describes how to install a certificate on the domain controller.

To use LDAPS, set the **LDAP URL** to `ldaps://dc01.corp.example.com`. The port defaults to 636 and does not need to be included.

Two requirements of the domain controller's certificate decide whether the connection succeeds, and both are checked by the client, which in this case is your integration collector:

-   **The host in the LDAP URL must match the certificate.** Microsoft requires the domain controller's Active Directory fully qualified domain name to appear either in the certificate's Subject common name or as a DNS entry in its Subject Alternative Name extension. Because certificates issued from the Domain Controller template identify the domain controller by name and not by address, an LDAP URL that uses an IP address fails this check even when the address is correct.
-   **The collector must trust the certificate authority that issued it.** Certificates issued by a public authority are trusted automatically. Certificates issued by your own enterprise or internal authority are not, and must be supplied to the integration.

### Trusting an internal certificate authority

If the domain controller's certificate was issued by an internal certificate authority, upload that authority's certificate in the **Certificate Authority Certificate** field, under **TLS Configuration**.

Provide the issuing authority's certificate together with every certificate above it in its chain, up to and including the root, concatenated into a single PEM file:

```text
-----BEGIN CERTIFICATE-----
(the authority that issued the domain controller certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(each authority above it, ending with the root)
-----END CERTIFICATE-----
```

The full chain matters because a domain controller usually presents only its own certificate and leaves the client to supply the rest. Uploading only part of the chain leaves the collector unable to verify the certificate, and the integration fails in the same way as uploading nothing at all.

To read the chain the domain controller presents, run the following from the host where your collector is installed:

```bash
openssl s_client -connect dc01.corp.example.com:636 -showcerts
```

> **CAUTION**
> 
> Only supply a certificate authority when the **LDAP URL** uses `ldaps://`. Uploading one alongside an `ldap://` URL makes the integration attempt a TLS handshake against port 389, where the domain controller is not expecting one, and the connection fails.

### Mutual TLS

If your domain controller requires the client to present its own certificate, upload it in **Client Certificate** and its private key in **Client Certificate Private Key**, both under **TLS Configuration**. Most deployments do not require this.

### Troubleshooting LDAPS connections

| Message in the job event | Cause and resolution |
| --- | --- |
| The LDAPS server certificate could not be verified | The collector cannot build a trust chain to the certificate. Upload the issuing certificate authority and the certificates above it in **Certificate Authority Certificate**. |
| The LDAPS server certificate does not identify the host used in the LDAP URL | The **LDAP URL** uses a name or address that is absent from the certificate. Use the fully qualified domain name that appears in its Subject or Subject Alternative Name. |
| The server did not complete a TLS handshake | The scheme and the port disagree. Use `ldaps://` for port 636 and `ldap://` for port 389, and remove any uploaded certificate authority when connecting over `ldap://`. |
| The server refused the connection | Port 636 is not reachable from the collector. Open it inbound on the domain controller. |
| The server requires the session to be protected before it accepts these credentials | The domain controller declines simple binds over an unprotected connection. Connect over `ldaps://`. |
| The server rejected the credentials | Active Directory rejected the bind. The diagnostic that accompanies the message identifies the reason, where `data 52e` is an incorrect password, `data 525` an unknown user, `data 532` an expired password, `data 533` a disabled account and `data 775` a locked-out account. |

## Data Volume Configuration

The Microsoft Active Directory integration provides configuration options to control the volume and scope of data ingested into JupiterOne:

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| Page Size | Controls the number of records returned per page from the Microsoft Active Directory LDAP server. This setting should be set below the server's maximum response size limit to avoid errors. Lower values reduce memory usage but may increase query time. | 100 | Any positive integer below your server's max response size limit |
| User Extension Attributes | Specifies which user extension attributes should be included on the `ad_user` entity. This allows you to selectively ingest custom Active Directory attributes that are relevant to your organization. | None | Comma-separated list of extension attribute names (e.g., 'extensionAttribute1,extensionAttribute2') |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `ad_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Contact | `ad_contact` | [Person](https://docs.jupiterone.io/data-model/schemas/Person) |
| Device | `ad_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| User | `ad_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| UserGroup | `ad_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `ad_account` | **HAS** | `ad_user` |
| `ad_account` | **HAS** | `ad_group` |
| `ad_account` | **MANAGES** | `ad_device` |
| `ad_device` | **HAS** | `ad_user` |
| `ad_group` | **HAS** | `ad_user` |
| `ad_group` | **HAS** | `ad_group` |
| `ad_group` | **HAS** | `ad_device` |
| `ad_group` | **HAS** | `ad_contact` |

### Ad Contact

`ad_contact` inherits from [Person](/data-model/schemas/Person.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `company` | `string` | The company recorded on the contact's directory object. |  |
| `department` | `string` | The department recorded on the contact's directory object. |  |
| `memberOf` | `array` of `string`s |  |  |
| `ou` | `array` of `string`s |  |  |

---

### Ad Device

`ad_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountExpiresOn` | `number` |  |  |
| `accountIsLockedOut` | `boolean` | Indicates whether the account is locked out |  |
| `accountNeverExpires` | `boolean` | Indicates if the account never expires |  |
| `doesNotRequirePreauth` | `boolean` | Indicates whether the device does not require preauthentication |  |
| `enabled` | `boolean` | Indicates whether the device account is enabled |  |
| `hasLoginScript` | `boolean` | Indicates whether the device has a login script |  |
| `isCriticalSystemObject` | `boolean` |  |  |
| `isTrustedForDelegation` | `boolean` | Indicates whether the device is trusted for delegation |  |
| `isTrustedToAuthForDelegation` | `boolean` | Indicates whether the device is trusted to authenticate for delegation |  |
| `logonCount` | `number` |  |  |
| `memberOf` | `array` of `string`s |  |  |
| `objectClass` | `array` of `string`s |  |  |
| `operatingSystem` | `string` | Please use osName instead | **deprecated**: true |
| `operatingSystemVersion` | `string` | Please use osVersion instead | **deprecated**: true |
| `ou` | `array` of `string`s |  |  |
| `passwordNotRequired` | `boolean` | Indicates whether the password is not required |  |
| `pwdLastSetOn` | `number` |  |  |

---

### Ad User

`ad_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountExpiresOn` | `number` | Indicates when the account expires |  |
| `accountNeverExpires` | `boolean` | Indicates if the account never expires |  |
| `active` | `boolean` |  |  |
| `createdOn` | `number` |  |  |
| `description` | `string` |  |  |
| 
`lastLogOn` \*

 | `number` **|** `null` |  |  |
| `memberOf` | `array` of `string`s |  |  |
| `pwdLastSetOn` | `number` |  |  |
| `updatedOn` | `number` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS details for Active Directory computer entities to include both operating system name and version.
-   **2026-01-23** — Improved accuracy of user active status by deriving it from the Active Directory User Account Control flags.
-   **2025-10-30** — Added support for CA certificate, client certificate, and client certificate key configuration options for mutual TLS authentication with Active Directory servers.
-   **2025-07-31** — Added Active Directory User Account Control flags as queryable properties on user and device entities, exposing account status details including lockout, password expiry, and delegation settings.
-   **2025-07-17** — Added account expiry date and password last set timestamps to Active Directory user and device entities; added group membership list to user entities.
-   **2025-07-04** — Added relationships linking Active Directory devices to their associated users based on login workstation assignments.
-   **2025-06-02** — Added configurable filters to limit Active Directory user and device ingestion to accounts with recent login activity, controlled by the number of days since last logon.

---

Source: /integrations/directory/microsoft-configuration-manager

# Microsoft Configuration Manager (SCCM)

Visualize Microsoft Configuration Manager (SCCM) devices, device collections, and local users in the JupiterOne graph. Use this integration to also monitor changes to Microsoft Configuration Manager entities using JupiterOne alerts.

## Installation

> **INFO**
> 
> JupiterOne uses a connection to the Microsoft SQL server that hosts data for Microsoft Configuration Manager to pull data. If you have the ability to log into the database, it is strongly recommended that a user create an account specifically for JupiterOne to use. At a minimum, login credentials for an account that includes `public` and `db_datareader` permissions will be needed.

### Configuration in Microsoft Configuration Manager

1.  In the object explorer, open the "Security" folder.
2.  Right-click on "Logins" and select "New Login..."
3.  Create a user using the following steps:
    -   Enter the login name `j1int`.
    -   Select "SQL Server Authentication".
    -   Create a password.
    -   Set the default database to your Microsoft Configuration Manager database
    -   Navigate to the "User Mapping" page.
    -   Check the "Map" box for the Microsoft Configuration Manager database row.
    -   Ensure that both `public` and `db_datareader` are checked under "Database role membership for: " the Microsoft Configuration Manager database.
    -   Click "OK".

### Configuration in JupiterOne

1.  From the top-bar menu, select Integrations.
2.  Scroll to, or search for, the Microsoft Configuration Manager (SCCM) integration tile and click it.
3.  Click the New Instance button and configure the settings:
    -   Enter the Host for the Microsoft Configuration Manager database.
    -   Enter the Database name.
    -   Enter the login name for the account to be used for SQL data retrieval. (the suggested name is `j1int`).
    -   Enter the password for the account to be used for SQL data retrieval.
    -   Enter in a name and description for the integration instance.
4.  Click the Create button to complete the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `microsoft_configuration_manager_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `microsoft_configuration_manager_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device | `microsoft_configuration_manager_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device Collection | `microsoft_configuration_manager_device_collection` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Local User | `microsoft_configuration_manager_local_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `microsoft_configuration_manager_account` | **HAS** | `microsoft_configuration_manager_device` |
| `microsoft_configuration_manager_device` | **INSTALLED** | `microsoft_configuration_manager_application` |
| `microsoft_configuration_manager_device_collection` | **HAS** | `microsoft_configuration_manager_device` |
| `microsoft_configuration_manager_local_user` | **OWNS** | `microsoft_configuration_manager_device` |

### Microsoft Configuration Manager Device

`microsoft_configuration_manager_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `aadDeviceId` | `string` **|** `null` | The Microsoft Entra ID (Azure AD) device identifier. |  |
| `aadTenantId` | `string` **|** `null` | The Microsoft Entra ID (Azure AD) tenant identifier. |  |
| `adSiteName` | `string` **|** `null` | The Active Directory site name that is assigned to the client. |  |
| `agentEdition` | `number` **|** `null` | The edition of the installed Configuration Manager client agent. |  |
| `clientType` | `string` **|** `null` | The type of client installed on the computer. Derived from the numeric source value: `0` -> `legacy`, `1` -> `advanced`, `3` -> `device`. |  |
| `clientVersion` | `string` **|** `null` | Version of the installed client software. |  |
| `cpuType` | `string` **|** `null` | The CPU type, for example `StrongARM`. Only device clients report this value. |  |
| `distinguishedName` | `string` **|** `null` | The Active Directory distinguished name of the computer account, e.g. `CN=host01,OU=Servers,DC=contoso,DC=com`. |  |
| `domainName` | `string` **|** `null` | The fully qualified Active Directory domain name the resource belongs to. |  |
| `easDeviceId` | `string` **|** `null` | The Exchange ActiveSync device ID used for mobile device management. |  |
| `hardwareId` | `string` **|** `null` | An ID that uniquely describes the hardware the client is installed on. Remains unchanged through re-imaging or successive operating system installations, unlike the Configuration Manager unique ID. |  |
| `isAlwaysInternet` | `boolean` | Indicates whether the client always behaves like an internet-based client. |  |
| `isAoacCapable` | `boolean` | Indicates whether the resource supports Always On/Always Connected (modern standby). |  |
| `isAssignedToUser` | `boolean` | Indicates whether the resource is assigned to a user. |  |
| `isClientInstalled` | `boolean` | Indicates whether the computer has the Configuration Manager client software installed. |  |
| `isDecommissioned` | `boolean` | Indicates whether the resource is decommissioned. |  |
| `isInternetEnabled` | `boolean` | Indicates whether the device is enabled as an internet device. |  |
| `isObsolete` | `boolean` | Indicates the record has been superseded by another record for the same computer. When several records share the same hardware ID, the older records are marked obsolete. |  |
| `isPortableOperatingSystem` | `boolean` | Indicates whether the resource runs a portable operating system, such as Windows To Go. |  |
| `isVirtualMachine` | `boolean` | Indicates whether the resource is a virtual machine. |  |
| `lastLogonUserDomain` | `string` **|** `null` | Domain used by the last logged-on user at the time the discovery agent ran. |  |
| `lastLogonUserName` | `string` **|** `null` | Name of the last logged-on user at the time the discovery agent ran. |  |
| `managementAuthority` | `number` **|** `null` | The authority that manages the device, used to distinguish Configuration Manager, Intune and co-managed devices. |  |
| `mdmDeviceCategoryId` | `string` **|** `null` | The GUID of the device category assigned to the device, if any. |  |
| `mdmStatus` | `string` **|** `null` | The mobile device management enrollment status of the device. |  |
| `netbiosName` | `string` **|** `null` | Name used by the NetBIOS protocol. |  |
| `objectGuid` | `string` **|** `null` | Object GUID of the resource, retrieved from Active Directory. |  |
| `previousSmsUuid` | `string` **|** `null` | The prior Configuration Manager GUID, reported when the client determines the hardware changed significantly enough that it likely moved to a different computer. |  |
| `primaryGroupId` | `number` **|** `null` | Primary group of the resource, retrieved from Active Directory. |  |
| `resourceDomainOrWorkgroup` | `string` **|** `null` | Domain or workgroup to which the resource belongs. |  |
| `senseId` | `string` **|** `null` | The Microsoft Defender for Endpoint (SENSE) device identifier. |  |
| `serialNumber` | `string` **|** `null` | Please use `serial` instead. | **deprecated**: true |
| `sid` | `string` **|** `null` | The security identifier (SID) of the resource, retrieved from Active Directory. |  |
| `smbiosGuid` | `string` **|** `null` | BIOS GUID of the client computer. |  |
| `smsUniqueIdentifier` | `string` **|** `null` | Unique ID that comes from the client computer. This ID is unique across Configuration Manager sites. |  |
| `smsUuidChangedOn` | `number` **|** `null` | The timestamp (in milliseconds since epoch) when the client generated a new Configuration Manager GUID. |  |
| `userAccountControl` | `number` **|** `null` | User account control value retrieved from Active Directory. |  |
| `virtualMachineHostName` | `string` **|** `null` | Virtual machine host name. |  |

---

### Microsoft Configuration Manager Local User

`microsoft_configuration_manager_local_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `localPath` | `string` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name, type, and version accuracy for Microsoft Configuration Manager device entities, stripping trailing version numbers from raw OS strings.

---

Source: /integrations/directory/microsoft-purview

# Microsoft Purview

The Microsoft Purview integration enhances data governance and compliance management capabilities. This integration empowers JupiterOne users to more efficiently govern their data landscape, manage compliance across various regulations, and mitigate risks through Purview's advanced data discovery and classification tools.

## Installation

> **INFO**
> 
> To use this integration, JupiterOne requires an app registration in Microsoft Entra ID (Azure Active Directory) and the created app's credentials. The app's service principal must then be granted the required roles on your Microsoft Purview root collection.

### Prerequisites

The integration authenticates as a service principal and reads from the Microsoft Purview data plane. Before you begin, assign the following collection roles to the service principal on your Purview root collection (a collection administrator must make these assignments):

-   **Data readers** — read-only access to data assets, classifications, classification rules, collections, and glossary terms. This covers reading the account, collections, data map assets, and classifications.
-   **Data source administrator** — manage and monitor data sources and scans. This covers listing data sources and reading their scans.

> **NOTE**
> 
> When a Purview account is created, no one but the creator can use its APIs until they are added to one or more of these roles in a collection. For a service-principal-created account, a collection administrator must grant these roles on the root collection.

### Create the app registration in Azure

1.  Sign in to the [Azure portal](https://portal.azure.com).
2.  Go to **App registrations** and select **New registration**. After the app is created, record its **Application (client) ID** and **Directory (tenant) ID**.
3.  In the app, go to **Certificates & secrets** and select **New client secret**. Record the secret **Value**; it is shown only once.

### Assign the Purview collection roles

1.  Open your Purview account in the Azure portal and select **Open Microsoft Purview governance portal**, or go to the [Microsoft Purview governance portal](https://web.purview.azure.com/resource/).
2.  From the left-side menu, select **Data Map**, then **Collections**.
3.  Select the root collection, which is named after your Microsoft Purview account and appears at the top of the list.
4.  Open the **Role assignments** tab and add the app's service principal to both **Data readers** and **Data source administrator**.

> **NOTE**
> 
> Only a collection administrator can add role assignments.

### Configuration in JupiterOne

To install this integration, navigate to the **Integrations** tab in JupiterOne and select **Microsoft Purview**. Select **New Instance** to begin configuring the integration.

In the new instance configuration, provide:

-   **Account Name** used to identify the integration instance in JupiterOne. Ingested entities have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Creating an instance requires:

-   **Purview Account Name** — the name of your Microsoft Purview account. This is the account name used to reach the Purview data plane.
    
-   **Tenant ID** — the Microsoft Entra ID directory (tenant) ID from your app registration.
    
-   **Client ID** — the application (client) ID from your app registration.
    
-   **Client Secret** — the client secret value generated under the app registration's **Certificates & secrets**.
    

Select **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (2)

-   `Data readers`
-   `Data source administrator`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `GET https://{purviewAccountName}.purview.azure.com/?api-version=2019-11-01-preview`
-   `GET https://{purviewAccountName}.purview.azure.com/collections?api-version=2019-11-01-preview`
-   `GET https://{purviewAccountName}.purview.azure.com/datamap/api/atlas/v2/entity/bulk`
-   `GET https://{purviewAccountName}.purview.azure.com/datamap/api/atlas/v2/types/classificationdef/name/{classificationName}`
-   `GET https://{purviewAccountName}.purview.azure.com/scan/datasources`
-   `GET https://{purviewAccountName}.purview.azure.com/scan/datasources/{dataSourceName}/scans?api-version=2023-09-01`
-   `POST https://{purviewAccountName}.purview.azure.com/datamap/api/search/query?api-version=2023-09-01`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (8)

-   [https://learn.microsoft.com/en-us/purview/data-gov-classic-permissions](https://learn.microsoft.com/en-us/purview/data-gov-classic-permissions)
-   [https://learn.microsoft.com/en-us/rest/api/purview/accountdataplane/accounts/get-account-properties?view=rest-purview-accountdataplane-2019-11-01-preview](https://learn.microsoft.com/en-us/rest/api/purview/accountdataplane/accounts/get-account-properties?view=rest-purview-accountdataplane-2019-11-01-preview)
-   [https://learn.microsoft.com/en-us/rest/api/purview/accountdataplane/collections/list-collections?view=rest-purview-accountdataplane-2019-11-01-preview](https://learn.microsoft.com/en-us/rest/api/purview/accountdataplane/collections/list-collections?view=rest-purview-accountdataplane-2019-11-01-preview)
-   [https://learn.microsoft.com/en-us/rest/api/purview/datamapdataplane/discovery/query?view=rest-purview-datamapdataplane-2023-09-01](https://learn.microsoft.com/en-us/rest/api/purview/datamapdataplane/discovery/query?view=rest-purview-datamapdataplane-2023-09-01)
-   [https://learn.microsoft.com/en-us/rest/api/purview/datamapdataplane/entity/list-by-guids?view=rest-purview-datamapdataplane-2023-09-01](https://learn.microsoft.com/en-us/rest/api/purview/datamapdataplane/entity/list-by-guids?view=rest-purview-datamapdataplane-2023-09-01)
-   [https://learn.microsoft.com/en-us/rest/api/purview/datamapdataplane/type/get-classification-def-by-name?view=rest-purview-datamapdataplane-2023-09-01](https://learn.microsoft.com/en-us/rest/api/purview/datamapdataplane/type/get-classification-def-by-name?view=rest-purview-datamapdataplane-2023-09-01)
-   [https://learn.microsoft.com/en-us/rest/api/purview/scanningdataplane/data-sources/list?view=rest-purview-scanningdataplane-2023-09-01](https://learn.microsoft.com/en-us/rest/api/purview/scanningdataplane/data-sources/list?view=rest-purview-scanningdataplane-2023-09-01)
-   [https://learn.microsoft.com/en-us/rest/api/purview/scanningdataplane/scans/list-by-data-source?view=rest-purview-scanningdataplane-2023-09-01](https://learn.microsoft.com/en-us/rest/api/purview/scanningdataplane/scans/list-by-data-source?view=rest-purview-scanningdataplane-2023-09-01)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Fetch Classifications | `Data readers` | `GET https://{purviewAccountName}.purview.azure.com/datamap/api/atlas/v2/types/classificationdef/name/{classificationName}` |
| Fetch Data Sources | `Data source administrator` | `GET https://{purviewAccountName}.purview.azure.com/scan/datasources` |
| Fetch Entities | `Data readers` | `POST https://{purviewAccountName}.purview.azure.com/datamap/api/search/query?api-version=2023-09-01`, `GET https://{purviewAccountName}.purview.azure.com/datamap/api/atlas/v2/entity/bulk` |
| Fetch Scans | `Data source administrator` | `GET https://{purviewAccountName}.purview.azure.com/scan/datasources/{dataSourceName}/scans?api-version=2023-09-01` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `microsoft_purview_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Classification | `microsoft_purview_classification` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Collection | `microsoft_purview_collection` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Data Source | `microsoft_purview_data_source` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| Entity | `microsoft_purview_entity` | [Entity](https://docs.jupiterone.io/data-model/schemas/Entity) |
| Scan | `microsoft_purview_scan` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `microsoft_purview_account` | **HAS** | `microsoft_purview_collection` |
| `microsoft_purview_classification` | **HAS** | `microsoft_purview_entity` |
| `microsoft_purview_collection` | **HAS** | `microsoft_purview_collection` |
| `microsoft_purview_collection` | **HAS** | `microsoft_purview_data_source` |
| `microsoft_purview_scan` | **SCANS** | `microsoft_purview_data_source` |
| `microsoft_purview_scan` | **IDENTIFIED** | `microsoft_purview_entity` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `microsoft_purview_account` | **HAS** | `azure_resource_group` | REVERSE |
| `microsoft_purview_data_source` | **CONNECTS** | `azure_resource` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_sql_server` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_sql_database` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_postgresql_server` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_postgresql_database` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_mysql_server` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_mysql_database` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_cosmosdb_account` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_cosmosdb_sql_database` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_storage_account` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_mariadb_server` | FORWARD |
| `microsoft_purview_entity` | **IS** | `azure_mariadb_database` | FORWARD |

---

Source: /integrations/directory/microsoft-teams

# Microsoft Teams

Visualize Microsoft Teams users, teams, and channels, map Microsoft Teams users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> To use this integration, JupiterOne requires a registering an app on portal.azure.com, and providing the created app's API credentials in JupiterOne.

### Configuration in Microsoft Teams

Before configuring the integration, ensure that you have, at minimum, a Microsoft 365 Business Standard account, and have the login credentials at hand.

1.  Sign in at [portal.azure.com](https://portal.azure.com).
2.  Go to **App Registrations** and register for a new app. Note the **client ID** and **tenant ID** for use in JupiterOne.
3.  Go to **Certificates and Secrets** and register a client secret and retain the value for JupiterOne.
4.  Go to **API permissions** and add the following permissions for Microsoft Graph (application permission):
    -   Group.Read.All - allows getting the teams data
    -   TeamMember.Read.All - allows getting all the teams' members' data
    -   User.Read.All - allows getting user's data
5.  Grant admin consent for all above permissions for your organization.

### Configuration in JupiterOne

-   The **Account Name** used to identify the Addigy account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Provide your Microsoft Teams **Client ID**, **Tenant ID**, and **Client Secret**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `microsoft_teams_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Channel | `microsoft_teams_channel` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| Team | `microsoft_teams_team` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `microsoft_teams_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `microsoft_teams_account` | **HAS** | `microsoft_teams_user` |
| `microsoft_teams_account` | **HAS** | `microsoft_teams_team` |
| `microsoft_teams_team` | **HAS** | `microsoft_teams_user` |
| `microsoft_teams_team` | **HAS** | `microsoft_teams_channel` |

### Microsoft Teams User

`microsoft_teams_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `jobTitle` | `string` |  |  |
| `userPrincipalName` | `string` |  |  |

---

---

Source: /integrations/directory/mimecast

# Mimecast

Visualize Mimecast accounts, domains, users, map Mimecast users to employees, and monitor changes through queries and alerts.

## Installation

The Mimecast integration ingests account details, internal domains, users, and awareness-training campaigns using the Mimecast API 1.0. Before configuring the integration in JupiterOne, you must create a registered API Application in the Mimecast Administration Console.

### Prerequisites

-   A Mimecast account with **admin access** — you must have a Mimecast Administrator role to register API applications and generate credentials.
-   Access to JupiterOne with permission to configure integrations.

### Creating credentials in Mimecast

1.  Log in to the Mimecast Administration Console as an administrator.
2.  Navigate to **Administration > Services > API and Platform Integrations**.
3.  Select the **Your Application Integrations** category.
4.  Click **Add API Application**, or open an existing enabled application.
5.  Note the **Application ID** and **Application Key** shown on the application page.
6.  If you have not already generated access keys, click **Create Keys** to generate an **Access Key** and a **Secret Key**. Save both values — they are shown only once.

### Configuration in JupiterOne

To install the Mimecast integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Mimecast. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Mimecast account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Mimecast Access Key** — the Access Key generated in the **Create Keys** step above. This value is used to sign API requests.
    
-   **Mimecast Secret Key** — the Secret Key generated in the **Create Keys** step above. Used together with the Access Key to authenticate requests.
    
-   **Mimecast Application Key** — the Application Key for your registered API Application.
    
-   **Mimecast Application ID** — the Application ID for your registered API Application.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `Mimecast Administrator`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (5)

-   `https://us-api.mimecast.com/api/account/get-account`
-   `https://us-api.mimecast.com/api/awareness-training/campaign/get-campaigns`
-   `https://us-api.mimecast.com/api/awareness-training/campaign/get-user-data`
-   `https://us-api.mimecast.com/api/domain/get-internal-domain`
-   `https://us-api.mimecast.com/api/user/get-internal-users`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (6)

-   [https://developer.services.mimecast.com/docs/accountmanagement/1/routes/api%2Faccount%2Fget-account/post](https://developer.services.mimecast.com/docs/accountmanagement/1/routes/api%2Faccount%2Fget-account/post)
-   [https://developer.services.mimecast.com/docs/awarenesstraining/1/routes/api%2Fawareness-training%2Fcampaign%2Fget-campaigns/post](https://developer.services.mimecast.com/docs/awarenesstraining/1/routes/api%2Fawareness-training%2Fcampaign%2Fget-campaigns/post)
-   [https://developer.services.mimecast.com/docs/awarenesstraining/1/routes/api%2Fawareness-training%2Fcampaign%2Fget-user-data/post](https://developer.services.mimecast.com/docs/awarenesstraining/1/routes/api%2Fawareness-training%2Fcampaign%2Fget-user-data/post)
-   [https://developer.services.mimecast.com/docs/userandgroupmanagement/1/routes/api%2Fdomain%2Fget-internal-domain/post](https://developer.services.mimecast.com/docs/userandgroupmanagement/1/routes/api%2Fdomain%2Fget-internal-domain/post)
-   [https://developer.services.mimecast.com/docs/userandgroupmanagement/1/routes/api%2Fuser%2Fget-internal-users/post](https://developer.services.mimecast.com/docs/userandgroupmanagement/1/routes/api%2Fuser%2Fget-internal-users/post)
-   [https://mimecastsupport.zendesk.com/hc/en-us/articles/53486642898195](https://mimecastsupport.zendesk.com/hc/en-us/articles/53486642898195)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Fetch Awareness Campaigns Enrollment Data | `Mimecast Administrator` | `https://us-api.mimecast.com/api/awareness-training/campaign/get-user-data` |
| Fetch Users | `Mimecast Administrator` | `https://us-api.mimecast.com/api/user/get-internal-users` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `mimecast_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Awareness\_Campaign | `mimecast_awareness_campaign` | [Training](https://docs.jupiterone.io/data-model/schemas/Training) |
| Domain | `mimecast_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| User | `mimecast_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `mimecast_account` | **HAS** | `mimecast_domain` |
| `mimecast_account` | **HAS** | `mimecast_awareness_campaign` |
| `mimecast_domain` | **HAS** | `mimecast_user` |
| `mimecast_user` | **ASSIGNED** | `mimecast_awareness_campaign` |
| `mimecast_user` | **COMPLETED** | `mimecast_awareness_campaign` |

### Mimecast User

`mimecast_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`addressType` \*

 | `string` |  |  |
| 

`alias` \*

 | `boolean` |  |  |
| 

`source` \*

 | `string` |  |  |

---

---

Source: /integrations/directory/mongodb

# MongoDB

Visualize MongoDB users, projects, teams, API keys, clusters, and roles in the JupiterOne graph. Our guide provides step-by-step instructions on setting up the integration and utilizing its data model to gain visibility into your MongoDB Atlas environment.

## Installation

To use this integration, JupiterOne requires an API public key and corresponding private key from MongoDB Atlas.

### Configuration in MongoDB Atlas (UI)

> **NOTE**
> 
> In order to create an API Key, you must have Organization Owner access to Atlas.
> 
> Each API Key is associated with an organization. If you have multiple organizations in your MongoDB environment that you'd like to integrate with JupiterOne, you'll need to create an API Key for each organization and set up a separate integration instance for each organization/API Key.

1.  Log in to your MongoDB Atlas account.
2.  Follow the detailed instructions in the [MongoDB Atlas documentation](https://www.mongodb.com/docs/atlas/configure-api-access/#create-an-api-key-in-an-organization) to create both a public and private key. Note that the private key will only be shown once, so be sure to save it in a secure location.
3.  Grant the API key the **Organization Read Only** [role](https://www.mongodb.com/docs/atlas/reference/user-roles/) (or higher) at the organization level. This role lets JupiterOne list the organization, its projects, users, teams, and API keys, and read the clusters within each project. A key with less than organization-level read access will ingest incomplete data.

By default, MongoDB Atlas turns on the setting to require an IP Access List on the organization level. In order for JupiterOne to successfully connect to your MongoDB Atlas environment, you will need to toggle the setting `Require IP Access List for the Atlas Administration API` to `OFF`. You can find this under Organization settings.

### Configuration in JupiterOne

1.  From the top-bar menu, select **Integrations**.
2.  Scroll to, or search for, the **MongoDB Atlas** integration tile and click it.
3.  Click the **New Instance** button and configure the settings:
    -   Enter the **public key** into the **Public Key** field.
    -   Enter the **private key** into the **Private Key** field.
    -   Test your credentials and configuration by clicking the **Test Credentials** button.
    -   Enter the **Account Name** by which you'd like to identify this MongoDB instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
4.  Click the **Create** button to complete the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data about your MongoDB environment within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| API Key | `mongodb_api_key` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Cluster | `mongodb_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Organization | `mongodb_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Project | `mongodb_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Role | `mongodb_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Team | `mongodb_team` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup), [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `mongodb_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `mongodb_api_key` | **HAS** | `mongodb_role` |
| `mongodb_organization` | **HAS** | `mongodb_project` |
| `mongodb_organization` | **HAS** | `mongodb_user` |
| `mongodb_organization` | **HAS** | `mongodb_team` |
| `mongodb_organization` | **HAS** | `mongodb_api_key` |
| `mongodb_project` | **HAS** | `mongodb_user` |
| `mongodb_project` | **OWNS** | `mongodb_role` |
| `mongodb_project` | **HAS** | `mongodb_cluster` |
| `mongodb_project` | **HAS** | `mongodb_team` |
| `mongodb_project` | **HAS** | `mongodb_api_key` |
| `mongodb_team` | **HAS** | `mongodb_user` |
| `mongodb_team` | **HAS** | `mongodb_role` |
| `mongodb_user` | **ASSIGNED** | `mongodb_role` |

---

Source: /integrations/directory/mosyle-mdm

# Mosyle MDM

Visualize Mosyle MDM devices, groups, and users, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need your Mosyle MDM email, password, and an access token to set up this integration. Access tokens can be created in the integrations settings of your Mosyle MDM console.

### Configuration in Mosyle MDM

1.  Log in to your Mosyle MDM console.
2.  Navigate to the integrations settings page.
3.  Create a new Access Token for JupiterOne integration.
4.  Keep your email and password credentials ready, as they are required for authentication along with the access token.

### Configuration in JupiterOne

To install the Mosyle MDM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Mosyle MDM. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Mosyle MDM account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Mosyle MDM **Email** address that you use to log in.
    
-   Your Mosyle MDM **Password** that you use to log in.
    
-   Your Mosyle MDM **Access Token** created in the integrations settings.
    
-   Optionally, enable **Use Manager API** if you want to use the Manager API ([https://managerapi.mosyle.com/v2](https://managerapi.mosyle.com/v2)) instead of the Business API ([https://businessapi.mosyle.com/v1](https://businessapi.mosyle.com/v1)).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Device | `mosyle_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device Group | `mosyle_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| User | `mosyle_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `mosyle_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `mosyle_device_group` | **HAS** | `mosyle_device` |
| `mosyle_user` | **ASSIGNED** | `mosyle_device` |
| `mosyle_user_group` | **HAS** | `mosyle_user` |

### Mosyle Device

`mosyle_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `AssetTag` | `string` |  | **deprecated**: true |
| `deviceStatus` | `string` |  |  |
| `DeviceStatus` | `string` |  | **deprecated**: true |

---

### Mosyle User

`mosyle_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `name` | `string` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name accuracy for Mosyle MDM device entities, using human-readable names for macOS, iOS, iPadOS, and tvOS devices.
-   **2025-04-29** — Added normalized email, short login ID, and email domain properties to Mosyle MDM user entities.

---

Source: /integrations/directory/n2-ws-cpm

# N2WS CPM

Visualize your N2WS Backup & Recovery (CPM) accounts, backup policies, schedules and protected resources in JupiterOne. Map protected resources to your AWS assets, find AWS resources that no backup policy protects, and monitor changes through queries and alerts.

## Installation

This integration connects to your N2WS Backup & Recovery (CPM) server using the N2WS RESTful API and ingests the AWS accounts configured in CPM, backup policies, backup schedules, protected resources, and resource control (power management) groups with the resources they manage. The CPM server runs in your own AWS VPC and is usually reachable only from inside it, so the integration normally runs on a [JupiterOne Collector](/integrations/development/collector.md) that can reach the server's API over HTTPS (port `443` by default).

The integration authenticates with an **API Authentication Key**. It exchanges the key at `POST /api/token/obtain/api_key/` for a one-hour access token, sends that token as an `Authorization: Bearer` header on every request, and obtains a new one automatically when it expires. The integration only issues read requests.

### Configuration in N2WS

Before you configure the integration in JupiterOne, prepare the following in the N2WS console:

-   The **hostname or IP address** of your CPM server. The JupiterOne Collector must be able to reach it over HTTPS.
-   A **CPM user** to own the API key. The key acts as that user: the integration only sees the accounts, policies, and resources that user can see, so a key created by a delegate of a managed user only returns that managed user's data. N2WS recommends a dedicated delegate user. If you create the delegate with all of its permission options cleared, it is a read-only user that can list information such as policies but cannot change configuration or run recoveries, which is all the integration needs.
-   An **API Authentication Key** for that user. Sign in to the console as the user, enable API access, and generate the key. The menu location differs between N2WS versions, so see [A Beginner's Guide to N2W RESTful API](https://n2ws.com/blog/aws-automation/n2ws-restful-api) for the steps. The key is only used to obtain access tokens.
-   If the server presents a self-signed or internal-CA TLS certificate, get the **CA certificate** in PEM format so the collector can verify the connection.

Once you have obtained the information above, proceed to JupiterOne to finalize the integration.

### Configuration in JupiterOne

To install the N2WS CPM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **N2WS CPM**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the N2WS CPM account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **CPM Host** (required): the hostname or IP address of your CPM server, optionally with a `:port`, for example `cpm.example.internal`. Do not include a path. If you paste a URL such as `https://cpm.example.internal/api/`, the `https://` prefix, trailing slash, and `/api` suffix are removed automatically.
    
-   The **API Authentication Key** (required) generated above.
    
-   Optionally, a **CA Certificate** to trust a self-signed or internal-CA certificate, or enable **Disable TLS Verification** to skip certificate validation (not recommended). Both are empty by default.
    

The integration validates the configuration by obtaining an access token and listing the AWS accounts in CPM, so the key's user must be able to list accounts.

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default**, so enable the ones you want to ingest. The CPM server itself is always ingested as an `n2ws_account` entity.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Backup Accounts** | AWS accounts configured in N2WS CPM | `n2ws_backup_account` |
| **Backup Policies** | N2WS CPM backup and DR policies | `n2ws_policy` |
| **Backup Schedules** | N2WS CPM backup schedules | `n2ws_schedule` |
| **Resource Control (Power Management)** | N2WS CPM resource control groups and the EC2 instances and RDS databases they power-manage | `n2ws_resource_control_group`, `n2ws_power_managed_resource` |
| **Protected Resources** | AWS resources covered by an N2WS CPM backup policy | `n2ws_protected_resource` |

The relationships between data sources are built only when both sides are enabled:

-   Backup account to policy (`HAS`) requires **Backup Accounts** and **Backup Policies**.
-   Backup account to resource control group (`HAS`) requires **Backup Accounts** and **Resource Control (Power Management)**.
-   Policy to schedule (`USES`) requires **Backup Policies** and **Backup Schedules**.
-   Policy to protected resource (`PROTECTS`) requires **Backup Policies** and **Protected Resources**.
-   Schedule to protected resource (`HAS`) requires **Backup Schedules** and **Protected Resources**.

CPM reports the policies and schedules covering a protected resource by name, so a protected resource is linked to a policy or schedule only when exactly one ingested policy or schedule has that name.

#### Relationships to AWS entities

The integration links CPM data to the AWS entities ingested by the [JupiterOne AWS integration](/integrations/directory/aws.md) through mapped relationships. It never creates AWS entities itself, so these relationships only appear for AWS accounts that the AWS integration also ingests.

| Source | Relationship | AWS entity | Matched on |
| --- | --- | --- | --- |
| `n2ws_backup_account` | `IS` | `aws_account` | AWS account number |
| `n2ws_protected_resource` (EC2 instance) | `PROTECTS` | `aws_instance` | Instance ID |
| `n2ws_protected_resource` (independent EBS volume) | `PROTECTS` | `aws_ebs_volume` | Volume ID |
| `n2ws_protected_resource` (RDS) | `PROTECTS` | `aws_db_instance` | DB instance identifier |
| `n2ws_protected_resource` (Aurora) | `PROTECTS` | `aws_rds_cluster` | DB cluster identifier |
| `n2ws_protected_resource` (Redshift) | `PROTECTS` | `aws_redshift_cluster` | Cluster identifier |
| `n2ws_power_managed_resource` (EC2 instance) | `MANAGES` | `aws_instance` | Instance ID |
| `n2ws_power_managed_resource` (RDS database) | `MANAGES` | `aws_db_instance` | DB instance identifier |

Only EC2 instances, independent EBS volumes, RDS instances, Aurora clusters, and Redshift clusters are linked to AWS entities. Other resource types that CPM can back up, such as EFS, DynamoDB, FSx, and DocumentDB, are not linked to AWS entities.

Because coverage is expressed as relationships to AWS entities, a query for unprotected resources is only meaningful for AWS accounts that the AWS integration ingests. For example, with the **Protected Resources** data source enabled, the following query lists EC2 instances that no CPM protected resource covers:

```j1ql
FIND aws_instance THAT !PROTECTS n2ws_protected_resource
```

With **Backup Policies** also enabled, the following query lists EC2 instances together with the CPM policy that protects them:

```j1ql
FIND n2ws_policy THAT PROTECTS n2ws_protected_resource THAT PROTECTS aws_instance
```

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [N2WS RESTful API guide (v2.3.0)](https://n2ws.com/wp-content/uploads/2024/06/N2WS-RESTful-API-v230.pdf)
-   [A Beginner's Guide to N2W RESTful API](https://n2ws.com/blog/aws-automation/n2ws-restful-api)

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (8)

-   `https://<cpm-host>/api/aws/accounts/`
-   `https://<cpm-host>/api/aws/policies/`
-   `https://<cpm-host>/api/aws/reports/protected_resources/`
-   `https://<cpm-host>/api/aws/resource_control/groups/`
-   `https://<cpm-host>/api/aws/resource_control/groups/{group_id}/targets/instances/`
-   `https://<cpm-host>/api/aws/resource_control/groups/{group_id}/targets/rds_databases/`
-   `https://<cpm-host>/api/schedules/`
-   `https://<cpm-host>/api/version/`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://n2ws.com/wp-content/uploads/2024/06/N2WS-RESTful-API-v230.pdf](https://n2ws.com/wp-content/uploads/2024/06/N2WS-RESTful-API-v230.pdf)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (1)

| Step | Endpoints |
| --- | --- |
| Fetch Power-Managed Resources | `https://<cpm-host>/api/aws/resource_control/groups/{group_id}/targets/instances/`, `https://<cpm-host>/api/aws/resource_control/groups/{group_id}/targets/rds_databases/` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Backup Policy | `n2ws_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Backup Schedule | `n2ws_schedule` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CPM Backup Account | `n2ws_backup_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| CPM Service | `n2ws_account` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Power-Managed Resource | `n2ws_power_managed_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Protected Resource | `n2ws_protected_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Resource Control Group | `n2ws_resource_control_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `n2ws_account` | **HAS** | `n2ws_backup_account` |
| `n2ws_backup_account` | **HAS** | `n2ws_policy` |
| `n2ws_backup_account` | **HAS** | `n2ws_resource_control_group` |
| `n2ws_policy` | **USES** | `n2ws_schedule` |
| `n2ws_policy` | **PROTECTS** | `n2ws_protected_resource` |
| `n2ws_resource_control_group` | **MANAGES** | `n2ws_power_managed_resource` |
| `n2ws_schedule` | **HAS** | `n2ws_protected_resource` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `n2ws_backup_account` | **IS** | `aws_account` | FORWARD |
| `n2ws_power_managed_resource` | **MANAGES** | `aws_instance` | FORWARD |
| `n2ws_power_managed_resource` | **MANAGES** | `aws_db_instance` | FORWARD |
| `n2ws_protected_resource` | **PROTECTS** | `aws_instance` | FORWARD |
| `n2ws_protected_resource` | **PROTECTS** | `aws_ebs_volume` | FORWARD |
| `n2ws_protected_resource` | **PROTECTS** | `aws_db_instance` | FORWARD |
| `n2ws_protected_resource` | **PROTECTS** | `aws_rds_cluster` | FORWARD |
| `n2ws_protected_resource` | **PROTECTS** | `aws_redshift_cluster` | FORWARD |

### N2ws Account

`n2ws_account` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cpmHost` \*

 | `string` | Hostname of the N2WS CPM appliance. |  |
| 

`version` \*

 | `string` **|** `null` | CPM appliance software version. |  |

---

### N2ws Backup Account

`n2ws_backup_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountNumber` \*

 | `string` **|** `null` | The 12-digit AWS account number. |  |
| 

`authentication` \*

 | `string` **|** `null` | Authentication method: C (IAM user), R (IAM role), A (assume role). |  |
| 

`awsCloud` \*

 | `string` **|** `null` | AWS cloud: S (standard), G (GovCloud), C (China). |  |
| 

`isCaptureVpcsEnabled` \*

 | `boolean` **|** `null` | Whether CPM captures VPC settings for this account. |  |
| 

`isDrAccount` \*

 | `boolean` **|** `null` | Whether this account is used as a DR (disaster recovery) target. |  |
| 

`isScanTaggedResourcesEnabled` \*

 | `boolean` **|** `null` | Whether CPM scans tagged resources for backup in this account. |  |

---

### N2ws Policy

`n2ws_policy` inherits from [Policy](/data-model/schemas/Policy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`autoRemoveResource` \*

 | `string` **|** `null` | Auto-remove behaviour for resources: N (no), Y (yes), A (ask). |  |
| 

`backupRetentionTimeUnit` \*

 | `string` **|** `null` | Time unit for backup retention. |  |
| 

`backupRetentionTimeValue` \*

 | `number` **|** `null` | Backup retention time value. |  |
| 

`drGenerations` \*

 | `number` **|** `null` | Number of DR backup generations retained. |  |
| 

`drRetentionTimeUnit` \*

 | `string` **|** `null` | Time unit for DR backup retention. |  |
| 

`drRetentionTimeValue` \*

 | `number` **|** `null` | DR backup retention time value. |  |
| 

`generations` \*

 | `number` **|** `null` | Number of backup generations retained. |  |
| 

`isCopyToS3Enabled` \*

 | `boolean` **|** `null` | Whether backups are copied to S3. |  |
| 

`isCreatedByTag` \*

 | `boolean` **|** `null` | Whether the policy was created by a tag-scan. |  |
| 

`isDrEnabled` \*

 | `boolean` **|** `null` | Whether disaster recovery is enabled for the policy. |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` | Whether the policy is enabled. |  |

---

### N2ws Power Managed Resource

`n2ws_power_managed_resource` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`awsRegion` \*

 | `string` **|** `null` | The AWS region the resource resides in. |  |
| 

`awsResourceId` \*

 | `string` **|** `null` | The AWS id of the power-managed resource. |  |
| 

`awsResourceType` \*

 | `string` **|** `null` | The AWS resource type reported by CPM. |  |
| 

`resourceType` \*

 | `string` **|** `null` | CPM resource type of the target. |  |
| 

`state` \*

 | `string` **|** `null` | Current state (EC2) or status (RDS) of the resource as reported by CPM. |  |
| 

`targetKind` \*

 | `string` | Which Resource Control target list the resource came from: instance (EC2) or rds\_database (RDS). |  |

---

### N2ws Protected Resource

`n2ws_protected_resource` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountName` \*

 | `string` **|** `null` | The CPM account name the resource belongs to. |  |
| 

`awsRegion` \*

 | `string` **|** `null` | The AWS region the resource resides in. |  |
| 

`awsResourceId` \*

 | `string` **|** `null` | The AWS id of the protected resource. |  |
| 

`awsResourceName` \*

 | `string` **|** `null` | The AWS name of the protected resource. |  |
| 

`isPartial` \*

 | `boolean` **|** `null` | Whether the resource is only partially protected. |  |
| 

`resourceType` \*

 | `string` **|** `null` | CPM resource type: instance, independent\_volume, rds, aurora, or redshift. |  |

---

### N2ws Resource Control Group

`n2ws_resource_control_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isEnabled` \*

 | `boolean` **|** `null` | Whether the group is enabled. |  |
| 

`isHibernate` \*

 | `boolean` **|** `null` | Whether the group hibernates instances when stopping. |  |
| 

`operationMode` \*

 | `string` **|** `null` | Operation mode of the group: on-off or off. |  |
| 

`timeout` \*

 | `number` **|** `null` | Operation timeout in seconds. |  |

---

### N2ws Schedule

`n2ws_schedule` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`endedOn` \*

 | `number` **|** `null` | Schedule end time (epoch milliseconds, UTC). |  |
| 

`everyHowMany` \*

 | `number` **|** `null` | How many frequency units between runs. |  |
| 

`everyUnit` \*

 | `string` **|** `null` | Frequency unit: M (minutes), H (hours), D (days), W (weeks), O (months). |  |
| 

`isAllowedOnFriday` \*

 | `boolean` **|** `null` | Whether the schedule may run on Friday. |  |
| 

`isAllowedOnMonday` \*

 | `boolean` **|** `null` | Whether the schedule may run on Monday. |  |
| 

`isAllowedOnSaturday` \*

 | `boolean` **|** `null` | Whether the schedule may run on Saturday. |  |
| 

`isAllowedOnSunday` \*

 | `boolean` **|** `null` | Whether the schedule may run on Sunday. |  |
| 

`isAllowedOnThursday` \*

 | `boolean` **|** `null` | Whether the schedule may run on Thursday. |  |
| 

`isAllowedOnTuesday` \*

 | `boolean` **|** `null` | Whether the schedule may run on Tuesday. |  |
| 

`isAllowedOnWednesday` \*

 | `boolean` **|** `null` | Whether the schedule may run on Wednesday. |  |
| 

`startedOn` \*

 | `number` **|** `null` | Schedule start time (epoch milliseconds, UTC). |  |
| 

`timezone` \*

 | `string` **|** `null` | Timezone the schedule evaluates in. |  |

---

---

Source: /integrations/directory/nebius

# Nebius

Visualize your Nebius AI Cloud projects, compute instances, storage buckets, users, service accounts and IAM groups in JupiterOne. Find publicly reachable instances and buckets, trace who has which role, and monitor changes through queries and alerts.

## Installation

This integration connects to **Nebius AI Cloud** using the Nebius AI Cloud REST API (`https://api.nebius.cloud`) and ingests your tenant and its projects, compute instances, object-storage buckets, tenant user accounts, service accounts, IAM groups, group memberships and access permits. It is built for exposure management (which instances and buckets are reachable from the internet) and access reviews (who holds which role through which group). The integration authenticates as a Nebius **service account**, every request is read-only, and it is managed by JupiterOne and runs in the JupiterOne cloud, so no collector is needed.

### Prerequisites

-   A **Nebius AI Cloud** tenant.
-   A Nebius account that can create service accounts and add them to groups. Nebius requires membership in a group with the `admin` role in the tenant or project, such as the default `admins` group.
-   `openssl` (or another tool) to generate an RSA key pair.
-   Access to **JupiterOne** with permission to configure integrations.

### Configuration in Nebius

The integration authenticates with a **service-account authorized key**. You upload the public half of an RSA key pair to a service account and give JupiterOne the private half. On each run the integration signs a short-lived JWT (RS256) with the private key and exchanges it at `https://auth.eu.nebius.com/oauth2/token/exchange` for a Bearer access token, which authorizes every API request. The private key itself is never sent to Nebius.

Each integration instance ingests **one tenant**: the tenant that contains the service account. To ingest another tenant, create a service account there and a separate integration instance.

#### Create the service account

1.  In the Nebius web console, open **Administration** → **IAM**.
2.  Click **Create resource**, then **Service account**.
3.  Confirm the service account name, select the project to create it in, and click **Create and continue**.

You can also create it with the Nebius CLI: `nebius iam service-account create --name <service_account_name>`. Note the service account ID (`serviceaccount-...`); `nebius iam service-account get-by-name --name <service_account_name>` returns it.

#### Grant read access

Nebius grants roles to groups, not directly to service accounts. Add the service account to a group that holds the **`viewer`** role across the tenant. The simplest option is the default **`viewers`** group, which Nebius creates in every tenant with the tenant-wide `viewer` role:

1.  In **Administration** → **IAM**, open the **Groups** tab and open the `viewers` group.
2.  Click **Add members**, switch to the **Service accounts** tab, and click **Add** next to the service account.

With the CLI: `nebius iam group-membership create --parent-id <group_ID> --member-id <service_account_ID>`.

We recommend granting the role at the **tenant** level. Users, groups and access permits are read from the tenant, and the integration lists the tenant's projects to find everything else. The integration never writes to Nebius, so `editor` and `admin` are not needed.

> **CAUTION**
> 
> The Nebius `viewer` role is read-only for configuration, but Nebius documents that it also lets the holder access data in resources, for example download objects from buckets. The integration never reads bucket objects or other resource data. Nebius also offers a `security-auditor` role, which grants read-only access to resource configuration without the data in them and is intended for third-party security tools. The integration was built against `viewer`; if you use a custom group with `security-auditor` instead, run the integration once and check the job log for permission errors.

#### Create the authorized key

1.  Generate an RSA key pair:
    
    ```bash
    openssl genrsa -out private.pem 4096 && \
    openssl rsa -in private.pem -outform PEM -pubout -out public.pem
    ```
    
2.  In **Administration** → **IAM**, open the **Service accounts** tab and open the service account.
    
3.  Click **Upload authorized key**, click **Attach file** and select `public.pem`. Optionally set an expiration date, then click **Upload key**.
    
4.  The key appears on the **Authorized keys** tab. Copy its ID (`publickey-...`).
    

With the CLI: `nebius iam auth-public-key create --account-service-account-id <service_account_ID> --data "$(cat public.pem)"`.

You now have the three values JupiterOne needs: the **service account ID**, the **authorized key ID**, and the **private key** (`private.pem`). Store the private key somewhere safe. If you set an expiration date on the key, the integration stops ingesting when it expires, until you upload a new key and update the instance.

### Configuration in JupiterOne

To install the Nebius integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Nebius**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Nebius account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Authentication** fields below.
    

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **Service Account ID** | Yes | The ID of the service account created above (`serviceaccount-...`). |
| **Authorized Key ID** | Yes | The ID of the authorized key uploaded to the service account (`publickey-...`). |
| **Private Key (PEM)** | Yes | The RSA private key paired with the authorized key. Paste the full contents of `private.pem`, including the `BEGIN` and `END` lines. |

When you save the instance, JupiterOne checks that all three fields are set, signs a JWT and exchanges it for an access token, then reads the service account's own profile (`GET /iam/v1/profiles`). A malformed or non-RSA private key, an unknown key or service account, or a rejected request fails the check.

#### Filters

The filter is optional. Leave it empty to ingest every project in the tenant.

| Field | Default | Description |
| --- | --- | --- |
| **Project IDs** | Empty (all projects in the tenant) | Ingest only these Nebius projects, by project ID. Applies to projects and to the compute instances, buckets and service accounts inside them. If none of the IDs match a project, no project data is ingested. |

**Project IDs** does not limit tenant-wide data: users, groups, group memberships and access permits are always read for the whole tenant. A group member or an instance's service account that lives in a project outside the filter is not ingested, so no relationship is created to it.

> **CAUTION**
> 
> Narrowing **Project IDs** later removes data from JupiterOne. Projects that no longer match, and the compute instances, buckets and service accounts in them, are deleted from the graph on the next run.

Click **Create** once all values are provided to finalize the integration.

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default**, so enable the ones you want to ingest. The `nebius_account` entity for the tenant and the `nebius_project` entities for its projects are always created, because every other data source depends on them.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Fetch Users** | Tenant user accounts, with their email address, name, username, state and federation ID. | `nebius_user` |
| **Fetch Groups** | IAM groups in the tenant. | `nebius_group` |
| **Fetch Group Memberships** | Which users and service accounts belong to each group. Requires **Fetch Users**, **Fetch Groups** and **Fetch Service Accounts**. | Relationships only |
| **Fetch Service Accounts** | Service accounts in each ingested project. | `nebius_service_account` |
| **Fetch Compute Instances** | Compute instances (virtual machines) in each ingested project, with their private and public IP addresses, hostname, DNS name and state. | `nebius_compute_instance` |
| **Fetch Buckets** | Object-storage buckets in each ingested project, with whether anonymous access is enabled, versioning, default storage class, audit logging, domain name and region. | `nebius_bucket` |
| **Fetch Access Permits** | Access permits granted to each ingested group: the role, and the tenant, project or resource it applies to. Requires **Fetch Groups**. | `nebius_access_role` |

To ingest everything the integration supports, enable all seven data sources.

> **CAUTION**
> 
> **Fetch Group Memberships must be enabled together with Fetch Users, Fetch Groups and Fetch Service Accounts**, and **Fetch Access Permits must be enabled together with Fetch Groups**. If a data source they depend on is disabled, they do not run at all and no memberships or access permits are ingested.

Relationships are built only when every data source they need is enabled:

| Relationship | Requires |
| --- | --- |
| `nebius_account` **HAS** `nebius_project` | Always created |
| `nebius_account` **HAS** `nebius_user` | **Fetch Users** |
| `nebius_account` **HAS** `nebius_group` | **Fetch Groups** |
| `nebius_project` **HAS** `nebius_compute_instance` | **Fetch Compute Instances** |
| `nebius_project` **HAS** `nebius_bucket` | **Fetch Buckets** |
| `nebius_project` **HAS** `nebius_service_account` | **Fetch Service Accounts** |
| `nebius_group` **HAS** `nebius_user` | **Fetch Group Memberships** (with Users, Groups and Service Accounts) |
| `nebius_group` **HAS** `nebius_service_account` | **Fetch Group Memberships** (with Users, Groups and Service Accounts) |
| `nebius_compute_instance` **USES** `nebius_service_account` (the service account the instance runs as) | **Fetch Compute Instances** and **Fetch Service Accounts** |
| `nebius_access_role` **ASSIGNED** `nebius_group` | **Fetch Access Permits** and **Fetch Groups** |

With **Fetch Service Accounts** disabled, compute instances are still ingested, but without the **USES** relationship.

##### Users

Nebius returns only the profile attributes each user has chosen to share with the tenant. A user whose attributes are not shared, or could not be read, is still ingested, named by its Nebius account name or ID, without email or name. A user is `isActive: true` when Nebius reports the account state as `ACTIVE`.

##### Groups and access permits

Groups are listed at the tenant level, so groups created inside a project are not ingested, and neither are the access permits granted to them. Each access permit becomes a `nebius_access_role` entity named after its role, with the granted role in `role` and the ID of the tenant, project or resource it applies to in `resourceId`.

##### Public instances and buckets

A compute instance has `public: true` when any of its network interfaces has a public IP address, or a private address in a public IP range. A bucket has `public: true` when Nebius reports anonymous access as enabled; when that status is missing, it is `true` if the bucket policy has a rule for anonymous access.

#### Example queries

Publicly available buckets:

```j1ql
FIND nebius_bucket WITH public = true
```

Compute instances with a public IP address, and the service account each one runs as:

```j1ql
FIND nebius_compute_instance WITH public = true AS i
  THAT USES nebius_service_account AS sa
RETURN i.displayName, i.publicIpAddresses, sa.displayName
```

Everyone who holds the `admin` role, through which group, and where:

```j1ql
FIND nebius_access_role WITH role = 'admin' AS r
  THAT ASSIGNED nebius_group AS g
  THAT HAS (nebius_user | nebius_service_account) AS m
RETURN m.displayName, g.displayName, r.resourceId
```

#### Errors and permissions

The integration lists compute instances, buckets and service accounts project by project, and group memberships and access permits group by group:

-   If Nebius denies access (`401` or `403`) for any project or group, the step fails with an authorization error. Data from that step's previous run is kept rather than deleted.
-   If a project or group is not found (`404`), it is skipped and the step continues.
-   Any other error fails the step.

If the integration cannot read the service account's profile, or the project the service account belongs to, it cannot resolve the tenant. The **Fetch Account** step then fails and no tenant data is ingested.

#### What the integration does not collect

-   Bucket objects and other data stored in resources.
-   Instance cloud-init user data, which often holds secrets. It is removed before the instance is stored.
-   User phone numbers, profile photos, locale and time zone.
-   Authorized keys, or any other credential material.
-   Encryption state and data classification of buckets. Nebius does not expose them on the bucket, so `encrypted` and `classification` are left empty.
-   Other Nebius resources, such as networks, disks, Kubernetes clusters and container registries.

#### Rate limits

The integration does not throttle its own requests. When Nebius answers with `429 Too Many Requests`, it waits for the time given in the `Retry-After` header (30 seconds when the header is missing) before retrying. Requests that fail with a `5xx` error or a network error are also retried, up to three attempts in total. Access tokens last 12 hours; if Nebius rejects the token with `401` or `403`, the integration requests a new one and retries once.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Authentication in the Nebius AI Cloud REST API](https://docs.nebius.com/rest-api/authentication) — service-account authorized keys and the JWT token exchange
-   [Managing service accounts](https://docs.nebius.com/iam/service-accounts/manage)
-   [Authorized keys for service accounts](https://docs.nebius.com/iam/service-accounts/authorized-keys)
-   [Groups](https://docs.nebius.com/iam/authorization/groups) — default groups and how roles are granted to groups
-   [Adding members to groups](https://docs.nebius.com/iam/authorization/groups/members)
-   [Managing custom groups and access permits](https://docs.nebius.com/iam/authorization/groups/manage)
-   [Roles](https://docs.nebius.com/iam/authorization/roles) — `viewer`, `security-auditor` and the other roles
-   [Nebius AI Cloud REST API reference](https://docs.nebius.com/rest-api/reference)

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (6)

-   `compute.instances.list`
-   `iam.accessPermits.list`
-   `iam.groupMemberships.list`
-   `iam.groups.list`
-   `iam.serviceAccounts.list`
-   `storage.buckets.list`

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (2)

-   `security-auditor`
-   `viewer`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (9)

-   `GET /compute/v1/instances`
-   `GET /iam/v1/access-permits`
-   `GET /iam/v1/group-memberships/list-members`
-   `GET /iam/v1/groups`
-   `GET /iam/v1/service-accounts`
-   `GET /iam/v1/tenant-user-account-with-attributes`
-   `GET /storage/v1/buckets`
-   `GET https://api.nebius.cloud/iam/v1/profiles`
-   `GET https://api.nebius.cloud/iam/v1/projects/{id}`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (11)

-   [https://docs.nebius.com/iam/authorization/groups/manage](https://docs.nebius.com/iam/authorization/groups/manage)
-   [https://docs.nebius.com/iam/authorization/roles](https://docs.nebius.com/iam/authorization/roles)
-   [https://docs.nebius.com/iam/service-accounts/manage](https://docs.nebius.com/iam/service-accounts/manage)
-   [https://docs.nebius.com/rest-api/authentication](https://docs.nebius.com/rest-api/authentication)
-   [https://docs.nebius.com/rest-api/iam/v1/tenant-user-account-with-attributes/list](https://docs.nebius.com/rest-api/iam/v1/tenant-user-account-with-attributes/list)
-   [https://docs.nebius.com/terraform-provider/reference/data-sources/compute\_v1\_instance](https://docs.nebius.com/terraform-provider/reference/data-sources/compute_v1_instance)
-   [https://docs.nebius.com/terraform-provider/reference/data-sources/iam\_v1\_access\_permit](https://docs.nebius.com/terraform-provider/reference/data-sources/iam_v1_access_permit)
-   [https://docs.nebius.com/terraform-provider/reference/data-sources/iam\_v1\_group](https://docs.nebius.com/terraform-provider/reference/data-sources/iam_v1_group)
-   [https://docs.nebius.com/terraform-provider/reference/data-sources/iam\_v1\_group\_membership](https://docs.nebius.com/terraform-provider/reference/data-sources/iam_v1_group_membership)
-   [https://docs.nebius.com/terraform-provider/reference/data-sources/iam\_v1\_service\_account](https://docs.nebius.com/terraform-provider/reference/data-sources/iam_v1_service_account)
-   [https://docs.nebius.com/terraform-provider/reference/data-sources/storage\_v1\_bucket](https://docs.nebius.com/terraform-provider/reference/data-sources/storage_v1_bucket)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | Permissions | Roles | Endpoints |
| --- | --- | --- | --- |
| Fetch Access Permits | `iam.accessPermits.list` | `viewer` | `GET /iam/v1/access-permits` |
| Fetch Group Memberships | `iam.groupMemberships.list` | `viewer` | `GET /iam/v1/group-memberships/list-members` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Access Role | `nebius_access_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Account | `nebius_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Bucket | `nebius_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Compute Instance | `nebius_compute_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Group | `nebius_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Project | `nebius_project` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Service Account | `nebius_service_account` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User | `nebius_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `nebius_access_role` | **ASSIGNED** | `nebius_group` |
| `nebius_account` | **HAS** | `nebius_project` |
| `nebius_account` | **HAS** | `nebius_user` |
| `nebius_account` | **HAS** | `nebius_group` |
| `nebius_compute_instance` | **USES** | `nebius_service_account` |
| `nebius_group` | **HAS** | `nebius_user` |
| `nebius_group` | **HAS** | `nebius_service_account` |
| `nebius_project` | **HAS** | `nebius_service_account` |
| `nebius_project` | **HAS** | `nebius_compute_instance` |
| `nebius_project` | **HAS** | `nebius_bucket` |

### Nebius Access Role

`nebius_access_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`permitId` \*

 | `string` | The Nebius access permit id. |  |
| 

`resourceId` \*

 | `string` **|** `null` | Id of the resource the role is scoped to. |  |
| 

`role` \*

 | `string` | The granted role name (e.g. 'viewer', 'editor'). |  |

---

### Nebius Account

`nebius_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`tenantId` \*

 | `string` | The Nebius tenant id that owns the ingested resources. |  |

---

### Nebius Bucket

`nebius_bucket` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`bucketId` \*

 | `string` | The Nebius bucket id (unique within Nebius). |  |
| 

`defaultStorageClass` \*

 | `string` **|** `null` | Default storage class for uploads (e.g. 'STANDARD', 'INTELLIGENT'). |  |
| 

`domainName` \*

 | `string` **|** `null` | Public domain name of the bucket. |  |
| 

`isVersioningEnabled` \*

 | `boolean` **|** `null` | Whether object versioning is enabled (versioningPolicy == ENABLED). |  |
| 

`objectAuditLogging` \*

 | `string` **|** `null` | Which requests are audit-logged ('NONE', 'MUTATE\_ONLY', or 'ALL'). |  |
| 

`region` \*

 | `string` **|** `null` | Region the bucket resides in. |  |
| 

`state` \*

 | `string` **|** `null` | Lifecycle state of the bucket (e.g. 'ACTIVE'). |  |

---

### Nebius Compute Instance

`nebius_compute_instance` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`instanceId` \*

 | `string` | The Nebius compute instance id (unique within Nebius). |  |
| 

`state` \*

 | `string` **|** `null` | Vendor VM lifecycle state (e.g. 'RUNNING', 'STOPPED', 'ERROR'). |  |

---

### Nebius Group

`nebius_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`groupId` \*

 | `string` | The Nebius group id (unique within the tenant). |  |
| 

`state` \*

 | `string` **|** `null` | Group state reported by IAM (e.g. 'ACTIVE'). |  |

---

### Nebius Project

`nebius_project` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`containerState` \*

 | `string` **|** `null` | Lifecycle state of the project container (e.g. 'ACTIVE'). |  |
| 

`projectId` \*

 | `string` | The Nebius project id (unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | The region the project resides in. |  |

---

### Nebius Service Account

`nebius_service_account` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`serviceAccountId` \*

 | `string` | The Nebius service account id. |  |

---

### Nebius User

`nebius_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`federationId` \*

 | `string` **|** `null` | Federation id of the linked global user account, when present. |  |
| 

`state` \*

 | `string` **|** `null` | Account state reported by IAM ('ACTIVE', 'INACTIVE', 'BLOCKED'). |  |
| 

`userId` \*

 | `string` | The Nebius tenant user account id. |  |

---

## Release Notes

-   **2026-10-05** — New Nebius AI Cloud integration: ingests tenant accounts, projects, compute instances, object storage buckets, users, service accounts, and groups.

---

Source: /integrations/directory/netbox

# Netbox

## Installation

> **INFO**
> 
> You will need your Netbox instance hostname and an API Key to set up this integration. See [Netbox's documentation](https://docs.netbox.dev/en/stable/integrations/rest-api/#authentication) for more information on creating API tokens.

### Configuration in Netbox

1.  Log in to your Netbox instance.
2.  Navigate to your user profile or the admin panel.
3.  Create a new API token with appropriate permissions to read the resources you want to ingest into JupiterOne.
4.  Note your Netbox instance hostname (e.g., `https://netbox.example.com`).

### Configuration in JupiterOne

To install the Netbox integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Netbox. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Netbox account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Netbox **Host** location (e.g., `https://netbox.example.com`).
    
-   Your Netbox **API Key** secret to access your Netbox instance.
    
-   Optionally, you can enable **Disable TLS Verification** to disable TLS certificate verification. This is NOT RECOMMENDED. Please install a valid TLS certificate on your Netbox server instead.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Device | `netbox_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| NetBox IP Address | `netbox_ip_address` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| NetBox IP Prefix | `netbox_ip_prefix` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Service | `netbox_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `netbox_device` | **HAS** | `netbox_ip_address` |
| `netbox_service` | **MANAGES** | `netbox_device` |
| `netbox_service` | **MANAGES** | `netbox_ip_address` |
| `netbox_service` | **MANAGES** | `netbox_ip_prefix` |

### Netbox Ip Address

`netbox_ip_address` inherits from [IpAddress](/data-model/schemas/IpAddress.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`address` \*

 | `string` |  |  |
| 

`assignedObjectId` \*

 | `number` **|** `null` |  |  |
| 

`assignedObjectName` \*

 | `string` **|** `null` |  |  |
| 

`assignedObjectType` \*

 | `string` **|** `null` |  |  |
| 

`assignedToDeviceId` \*

 | `number` **|** `null` |  |  |
| 

`assignedToDeviceName` \*

 | `string` **|** `null` |  |  |
| 

`comments` \*

 | `string` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`dnsName` \*

 | `string` **|** `null` |  |  |
| 

`family` \*

 | `number` **|** `null` |  |  |
| 

`familyLabel` \*

 | `string` **|** `null` |  |  |
| 

`ipAddress` \*

 | `string` |  |  |
| 

`isActive` \*

 | `boolean` |  |  |
| 

`natInsideAddress` \*

 | `string` **|** `null` |  |  |
| 

`natInsideId` \*

 | `number` **|** `null` |  |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` |  |  |
| 

`publicIpAddress` \*

 | `string` **|** `null` |  |  |
| 

`role` \*

 | `string` **|** `null` |  |  |
| 

`roleLabel` \*

 | `string` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`statusLabel` \*

 | `string` **|** `null` |  |  |
| 

`tenantId` \*

 | `number` **|** `null` |  |  |
| 

`tenantName` \*

 | `string` **|** `null` |  |  |
| 

`vrfId` \*

 | `number` **|** `null` |  |  |
| 

`vrfName` \*

 | `string` **|** `null` |  |  |
| 

`vrfRd` \*

 | `string` **|** `null` |  |  |

---

### Netbox Ip Prefix

`netbox_ip_prefix` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`children` \*

 | `number` **|** `null` |  |  |
| 

`CIDR` \*

 | `string` |  |  |
| 

`comments` \*

 | `string` **|** `null` |  |  |
| 

`depth` \*

 | `number` **|** `null` |  |  |
| 

`description` \*

 | `string` **|** `null` |  |  |
| 

`family` \*

 | `number` **|** `null` |  |  |
| 

`familyLabel` \*

 | `string` **|** `null` |  |  |
| 

`internal` \*

 | `boolean` |  |  |
| 

`isActive` \*

 | `boolean` |  |  |
| 

`isMarkUtilized` \*

 | `boolean` |  |  |
| 

`isPool` \*

 | `boolean` |  |  |
| 

`prefix` \*

 | `string` |  |  |
| 

`public` \*

 | `boolean` |  |  |
| 

`roleId` \*

 | `number` **|** `null` |  |  |
| 

`roleName` \*

 | `string` **|** `null` |  |  |
| 

`roleSlug` \*

 | `string` **|** `null` |  |  |
| 

`scopeId` \*

 | `number` **|** `null` |  |  |
| 

`scopeName` \*

 | `string` **|** `null` |  |  |
| 

`scopeSlug` \*

 | `string` **|** `null` |  |  |
| 

`scopeType` \*

 | `string` **|** `null` |  |  |
| 

`siteId` \*

 | `number` **|** `null` |  |  |
| 

`siteName` \*

 | `string` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`statusLabel` \*

 | `string` **|** `null` |  |  |
| 

`tenantId` \*

 | `number` **|** `null` |  |  |
| 

`tenantName` \*

 | `string` **|** `null` |  |  |
| 

`vlanId` \*

 | `number` **|** `null` |  |  |
| 

`vlanName` \*

 | `string` **|** `null` |  |  |
| 

`vlanVid` \*

 | `number` **|** `null` |  |  |
| 

`vrfId` \*

 | `number` **|** `null` |  |  |
| 

`vrfName` \*

 | `string` **|** `null` |  |  |
| 

`vrfRd` \*

 | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-02-11** — Added ingestion of NetBox IP addresses and network prefixes as new entity types, with configurable status filtering for each.

---

Source: /integrations/directory/netskope

# Netskope

Visualize Netskope devices, users, and app instances, map Netskope users to employee entities, and monitor changes through queries and alerts.

## Prerequisites

The Netskope integration authenticates with two separate tokens:

-   **API V1 Token** (required) — grants access to devices, users, and app instances.
-   **API V2 Token** (optional) — unlocks additional data types including NPA private apps, publishers, NPA policies, URL lists, discovered/shadow-AI apps, DLP incidents, and SCIM users.

### Generate an API V1 Token

1.  Log in to the Netskope admin console.
2.  Navigate to **Settings** > **Tools** > **REST API v1**.
3.  Click **New Token**, give it a name, and click **Generate**.
4.  Copy the token value — you will not be able to view it again.

### Generate an API V2 Token (optional)

The V2 token uses RBAC V3 service-account credentials. Grant it read access to the API domains you want to ingest.

1.  Navigate to **Settings** > **Administration** > **Administrators**.
2.  Select the **Service Accounts** tab.
3.  Click **New Service Account**, enter a name, and select **Read** access for each API domain you want to enable (for example: Steering, Infrastructure, Policy, Events, SCIM).
4.  Click **Save**, then copy the generated token.

For more information see the [Netskope REST API v1 overview](https://docs.netskope.com/en/netskope-help/rest-api-v1-overview/) and [REST API v2 token management](https://docs.netskope.com/en/netskope-help/rest-api-v2-overview-312207/rest-api-v2-token-management-312226/).

## Configuration in JupiterOne

To install the Netskope integration in JupiterOne, navigate to the **Integrations** tab and select **Netskope**. Click **New Instance** to begin configuring your integration.

1.  Enter an **Account Name** to identify this Netskope integration instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the toggle is enabled.
2.  (Optional) Enter a **Description** to help identify the instance.
3.  Set a **Polling Interval** for automatic data refresh, or leave it as `DISABLED` to run manually.
4.  Enter your **Tenant Name** — the subdomain portion of your Netskope tenant URL (`example` from `example.goskope.com`).
5.  Enter your **API V1 Token**.
6.  (Optional) Enter your **API V2 Token** to enable additional data ingestion (NPA private apps, publishers, NPA policies, URL lists, discovered apps, and DLP incidents).

Click **Create** to save the instance.

## Data Volume Configuration

Control how much data is ingested from Netskope to manage storage and processing.

### Ingestion Windows

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Event Lookback (days)** | Rolling lookback window for event-derived steps (DLP incidents and discovered/shadow-AI apps). Longer windows increase the number of events ingested. | 7 days | 7 days, 30 days, 90 days |

## Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (14)

-   `https://{tenantName}.goskope.com/api/v1/app_instances`
-   `https://{tenantName}.goskope.com/api/v1/clients`
-   `https://{tenantName}.goskope.com/api/v1/userconfig`
-   `https://{tenantName}.goskope.com/api/v2/events/datasearch/application`
-   `https://{tenantName}.goskope.com/api/v2/events/datasearch/incident`
-   `https://{tenantName}.goskope.com/api/v2/infrastructure/publishers`
-   `https://{tenantName}.goskope.com/api/v2/infrastructure/publisherupgradeprofiles`
-   `https://{tenantName}.goskope.com/api/v2/platform/administration/scim/Users`
-   `https://{tenantName}.goskope.com/api/v2/policy/npa/policygroups`
-   `https://{tenantName}.goskope.com/api/v2/policy/npa/rules`
-   `https://{tenantName}.goskope.com/api/v2/policy/urllist`
-   `https://{tenantName}.goskope.com/api/v2/rbac/roles`
-   `https://{tenantName}.goskope.com/api/v2/scim/Users`
-   `https://{tenantName}.goskope.com/api/v2/steering/apps/private`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (5)

-   [https://docs.netskope.com/en/administrators-rbac-v3/](https://docs.netskope.com/en/administrators-rbac-v3/)
-   [https://docs.netskope.com/en/netskope-help/rest-api-v1-overview/](https://docs.netskope.com/en/netskope-help/rest-api-v1-overview/)
-   [https://docs.netskope.com/en/netskope-help/rest-api-v2-overview-312207/](https://docs.netskope.com/en/netskope-help/rest-api-v2-overview-312207/)
-   [https://docs.netskope.com/en/netskope-rbac-v3-overview/](https://docs.netskope.com/en/netskope-rbac-v3-overview/)
-   [https://docs.netskope.com/en/rest-api-v2-overview-312207/](https://docs.netskope.com/en/rest-api-v2-overview-312207/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (15)

| Step | Endpoints |
| --- | --- |
| Fetch Admin Roles | `https://{tenantName}.goskope.com/api/v2/rbac/roles` |
| Fetch Admins | `https://{tenantName}.goskope.com/api/v2/platform/administration/scim/Users` |
| Fetch and Build User Configuration | `https://{tenantName}.goskope.com/api/v1/userconfig` |
| Fetch App Instances | `https://{tenantName}.goskope.com/api/v1/app_instances` |
| Fetch Devices | `https://{tenantName}.goskope.com/api/v1/clients` |
| Fetch Discovered Apps | `https://{tenantName}.goskope.com/api/v2/events/datasearch/application` |
| Fetch DLP Incidents | `https://{tenantName}.goskope.com/api/v2/events/datasearch/incident` |
| Fetch NPA Policies | `https://{tenantName}.goskope.com/api/v2/policy/npa/rules` |
| Fetch NPA Policy Groups | `https://{tenantName}.goskope.com/api/v2/policy/npa/policygroups` |
| Fetch OAuth Apps (SSPM) | \- |
| Fetch Private Apps | `https://{tenantName}.goskope.com/api/v2/steering/apps/private` |
| Fetch Publisher Upgrade Profiles | `https://{tenantName}.goskope.com/api/v2/infrastructure/publisherupgradeprofiles` |
| Fetch Publishers | `https://{tenantName}.goskope.com/api/v2/infrastructure/publishers` |
| Fetch URL Lists | `https://{tenantName}.goskope.com/api/v2/policy/urllist` |
| Fetch Users and Build Device Relationships | `https://{tenantName}.goskope.com/api/v2/scim/Users` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Admin | `netskope_admin` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Admin Role | `netskope_admin_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| App Instance | `netskope_app_instance` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device | `netskope_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Discovered App | `netskope_discovered_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| DLP Incident | `netskope_dlp_incident` | [Incident](https://docs.jupiterone.io/data-model/schemas/Incident) |
| NPA Policy | `netskope_npa_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| NPA Policy Group | `netskope_npa_policy_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| OAuth App | `netskope_oauth_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Private App | `netskope_private_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Publisher | `netskope_publisher` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Publisher Upgrade Profile | `netskope_publisher_upgrade_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Service Account | `netskope_service_account` | [User](https://docs.jupiterone.io/data-model/schemas/User), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Tenant | `netskope_tenant` | [Account](https://docs.jupiterone.io/data-model/schemas/Account), [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| URL List | `netskope_url_list` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| User | `netskope_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Configuration | `netskope_user_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `netskope_admin` | **ASSIGNED** | `netskope_admin_role` |
| `netskope_device` | **HAS** | `netskope_user` |
| `netskope_device` | **HAS** | `netskope_dlp_incident` |
| `netskope_npa_policy` | **PROTECTS** | `netskope_private_app` |
| `netskope_publisher` | **CONNECTS** | `netskope_private_app` |
| `netskope_publisher` | **USES** | `netskope_publisher_upgrade_profile` |
| `netskope_service_account` | **ASSIGNED** | `netskope_admin_role` |
| `netskope_tenant` | **HAS** | `netskope_device` |
| `netskope_tenant` | **HAS** | `netskope_app_instance` |
| `netskope_tenant` | **HAS** | `netskope_private_app` |
| `netskope_tenant` | **HAS** | `netskope_publisher` |
| `netskope_tenant` | **HAS** | `netskope_npa_policy` |
| `netskope_tenant` | **HAS** | `netskope_npa_policy_group` |
| `netskope_tenant` | **HAS** | `netskope_url_list` |
| `netskope_tenant` | **HAS** | `netskope_discovered_app` |
| `netskope_tenant` | **HAS** | `netskope_oauth_app` |
| `netskope_tenant` | **HAS** | `netskope_admin_role` |
| `netskope_tenant` | **HAS** | `netskope_admin` |
| `netskope_tenant` | **HAS** | `netskope_service_account` |
| `netskope_user` | **HAS** | `netskope_user_configuration` |
| `netskope_user` | **HAS** | `netskope_dlp_incident` |

### Netskope Admin

`netskope_admin` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authType` | `string` | Authentication method configured for the administrator (e.g. API\_KEY). |  |
| `isLocked` | `boolean` | Whether the administrator account is locked out. |  |
| `isPasswordResetPending` | `boolean` | Whether a password reset is outstanding for the account. |  |
| `isVerified` | `boolean` | Whether the administrator has accepted their invitation and verified the account. |  |
| `lastLoginOn` | `number` | Epoch (ms) of the last console login. |  |
| `provisionedBy` | `string` | How the administrator was created in Netskope: LOCAL, SAML or SCIM. |  |

---

### Netskope Admin Role

`netskope_admin_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isObfuscated` | `boolean` | Whether the role obfuscates sensitive data (e.g. user identifiers) from its holders. |  |
| `isScoped` | `boolean` | Whether the role restricts its holders to a subset of objects (Label Based Access Control). |  |
| `userCount` | `number` | Number of administrators currently holding the role. |  |

---

### Netskope App Instance

`netskope_app_instance` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `app` | `string` | Name of the application this is an instance of. |  |
| `appId` | `string` | Netskope application identifier. |  |
| `instanceTags` | `array` of `string`s | Tags applied to the instance (e.g. Sanctioned, Untagged). |  |
| `lastModifiedOn` | `number` | Epoch (ms) when the instance was last modified. |  |
| `type` | `string` | Instance type (e.g. Custom, Sanctioned). |  |

---

### Netskope Device

`netskope_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `asn` | `string` | Autonomous system number of the device connection. |  |
| `asName` | `string` | Autonomous system name of the device connection. |  |
| `city` | `string` | City geolocated from the connection. |  |
| `clientConfig` | `string` | Name of the client configuration applied to the device. |  |
| `clientInstallTime` | `number` | Epoch (seconds) when the Netskope client was installed. |  |
| `clientVersion` | `string` | Version of the installed Netskope client. |  |
| `continent` | `string` | Continent geolocated from the connection. |  |
| `country` | `string` | Country code geolocated from the connection. |  |
| `deviceClassificationStatus` | `string` | Netskope device classification status (e.g. Managed, Unmanaged). |  |
| `isp` | `string` | Internet service provider of the device connection. |  |
| `lastConnectedFromPrivateIp` | `string` | Private IP the device last connected from. |  |
| `lastConnectedFromPublicIp` | `string` | Public IP the device last connected from. |  |
| `lastEvent` | `string` | The device's most recent client event name. |  |
| `lastEventActor` | `string` | Actor that triggered the most recent client event. |  |
| `lastEventNpaStatus` | `string` | Netskope Private Access status reported with the most recent event. |  |
| `lastEventOccurredOn` | `number` | Epoch (ms) when the most recent client event occurred. |  |
| `lastEventStatus` | `string` | Status reported with the most recent client event. |  |
| `lastEventStatusV2` | `string` | Secondary (v2) status reported with the most recent client event. |  |
| `latitude` | `number` | Latitude geolocated from the connection. |  |
| `longitude` | `number` | Longitude geolocated from the connection. |  |
| `managementId` | `string` | Device management identifier reported by the client. |  |
| `netskopePop` | `string` | Netskope point of presence the device connected through. |  |
| `organizationUnit` | `string` | Organization unit of the device user. |  |
| `os` | `string` | Raw operating system value as reported by Netskope. |  |
| `region` | `string` | Region/state geolocated from the connection. |  |
| `steeringConfig` | `string` | Name of the steering configuration applied to the device. |  |
| `userGroups` | `array` of `string`s | Groups of the users associated with the device. |  |
| `username` | `string` | Primary username associated with the device. |  |

---

### Netskope Discovered App

`netskope_discovered_app` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appCategory` | `string` | Netskope application category (e.g. Generative AI, Collaboration). |  |
| `cci` | `number` | Cloud Confidence Index score (0-100). |  |
| `ccl` | `string` | Cloud Confidence Level (poor, low, medium, high, excellent). |  |
| `isGenAI` | `boolean` | Whether the app is categorised as Generative AI by Netskope. |  |
| `usesAI` | `boolean` | Whether the app is an AI/GenAI application. |  |

---

### Netskope Dlp Incident

`netskope_dlp_incident` inherits from [Incident](/data-model/schemas/Incident.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessMethod` | `string` | Access method used (e.g. Client, Clientless, CASB API). |  |
| `activity` | `string` | Activity that triggered the incident (e.g. Upload). |  |
| `app` | `string` | Application the incident occurred in. |  |
| `appCategory` | `string` | Category of the application the incident occurred in (e.g. Generative AI). |  |
| `assignee` | `string` | Assignee of the incident. |  |
| `dlpPolicies` | `array` of `string`s | DLP policy names that matched. |  |
| `dlpProfiles` | `array` of `string`s | DLP profile names that matched. |  |
| `dlpRules` | `array` of `string`s | DLP rule names that matched. |  |
| `fileSize` | `number` | Size of the object in bytes. |  |
| `fileType` | `string` | MIME/file type of the object involved. |  |
| `incidentId` | `string` | Netskope DLP incident identifier. |  |
| `md5` | `string` | MD5 hash of the object. |  |
| `objectName` | `string` | Name of the file/object involved in the incident. |  |
| `objectType` | `string` | Type of the object involved (e.g. File). |  |
| `occurredOn` | `number` | Epoch (ms) when the incident occurred. |  |
| `sha256` | `string` | SHA-256 hash of the object. |  |
| `status` | `string` | Incident status (e.g. new, in-progress, closed). |  |
| `url` | `string` | URL associated with the incident. |  |

---

### Netskope Npa Policy

`netskope_npa_policy` inherits from [AccessPolicy](/data-model/schemas/AccessPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessMethod` | `array` of `string`s | Access methods the rule applies to (Client, Clientless). |  |
| `action` | `string` | Action taken when the rule matches (e.g. allow, block). |  |
| `isEnabled` | `boolean` | Whether the policy rule is enabled. |  |
| `policyType` | `string` | Policy type (e.g. private-app). |  |
| `privateApps` | `array` of `string`s | Names of the private apps referenced by the rule (a PROTECTS relationship is created for each ingested app). |  |
| `users` | `array` of `string`s | User or group identifiers the rule targets. |  |
| `userType` | `string` | Subject type the rule targets (e.g. user, group). |  |

---

### Netskope Npa Policy Group

`netskope_npa_policy_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdBy` | `string` | Identifier of the admin that created the group. |  |
| `groupType` | `string` | Group type identifier reported by Netskope. |  |
| `isEditableDeletable` | `boolean` | Whether the group can be edited or deleted (false for system-managed groups). |  |

---

### Netskope Oauth App

`netskope_oauth_app` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appDisplayName` | `string` | Human-readable name of the OAuth application. |  |
| `appId` | `string` | Netskope identifier for the app. Mirrored on `clientId` to maximise the AIASM nhiAi enricher match surface. |  |
| `clientId` | `string` | OAuth client identifier of the application. |  |
| `lastActivityOn` | `number` | Epoch (ms) of the last observed activity. |  |
| `scopes` | `array` of `string`s | OAuth scopes granted to the application. |  |
| `status` | `string` | Status of the OAuth application. |  |

---

### Netskope Private App

`netskope_private_app` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appTags` | `array` of `string`s | Tag names applied to the private app. |  |
| `host` | `string` | Reachability target of the app (FQDN, wildcard, IP, or subnet). |  |
| `isClientlessAccess` | `boolean` | Whether clientless (browser) access is enabled. |  |
| `isReachable` | `boolean` | Whether Netskope last reported the app as reachable via a publisher. |  |
| `ports` | `array` of `string`s | Transport:port pairs exposed by the app (e.g. tcp:80). |  |
| `privateAppProtocol` | `string` | Application-layer protocol (e.g. http, https). |  |
| `protocols` | `array` of `string`s | Transport protocols exposed by the app (e.g. tcp, udp). |  |
| `publicHost` | `string` | Public proxy host assigned for clientless access. |  |
| `steeringConfigs` | `array` of `string`s | Steering configurations the app is included in. |  |

---

### Netskope Publisher

`netskope_publisher` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appsCount` | `number` | Number of private apps served by the publisher. |  |
| `commonName` | `string` | Common name presented by the publisher certificate. |  |
| `connectedApps` | `array` of `string`s | Names of the private apps the publisher serves. |  |
| `ipAddress` | `string` | IP address of the publisher host. |  |
| `isLbrokerConnect` | `boolean` | Whether the publisher connects via a local broker. |  |
| `isRegistered` | `boolean` | Whether the publisher has completed registration. |  |
| `publisherStatus` | `string` | Connection status (e.g. connected, disconnected, not registered). |  |
| `version` | `string` | Publisher software version. |  |

---

### Netskope Publisher Upgrade Profile

`netskope_publisher_upgrade_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dockerTag` | `string` | Docker image tag the profile upgrades publishers to. |  |
| `externalId` | `number` | Stable external identifier of the profile (referenced by publishers). |  |
| `frequency` | `string` | Cron expression describing the upgrade schedule. |  |
| `isEnabled` | `boolean` | Whether the upgrade profile is enabled. |  |
| `nextUpdateOn` | `number` | Epoch (ms) of the next scheduled upgrade. |  |
| `numAssociatedPublisher` | `number` | Number of publishers associated with the profile. |  |
| `releaseType` | `string` | Release channel the profile upgrades to (e.g. Latest). |  |
| `timezone` | `string` | Timezone the upgrade schedule is evaluated in. |  |

---

### Netskope Service Account

`netskope_service_account` inherits from [User](/data-model/schemas/User.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiTokenIssuedOn` | `number` | Epoch (ms) when the REST API token was issued. Its expiry is on `expiresOn`. |  |
| `appDisplayName` | `string` | Human-readable name of the service account. |  |
| `appId` | `string` | Netskope identifier for the service account. Mirrored on `clientId` to maximise the AIASM nhiAi enricher match surface. |  |
| `authType` | `string` | Authentication method configured for the administrator (e.g. API\_KEY). |  |
| `clientId` | `string` | Identifier the service account authenticates with. |  |
| `isLocked` | `boolean` | Whether the administrator account is locked out. |  |
| `isPasswordResetPending` | `boolean` | Whether a password reset is outstanding for the account. |  |
| `isVerified` | `boolean` | Whether the administrator has accepted their invitation and verified the account. |  |
| `lastActivityOn` | `number` | Epoch (ms) of the last observed activity. |  |
| `lastLoginOn` | `number` | Epoch (ms) of the last console login. |  |
| 
`nhiType` \*

 | `string` |  | **const**: service\_account |
| `provisionedBy` | `string` | How the administrator was created in Netskope: LOCAL, SAML or SCIM. |  |

---

### Netskope Tenant

`netskope_tenant` inherits from [Account](/data-model/schemas/Account.md), [Organization](/data-model/schemas/Organization.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `region` | `string` | Region suffix of the tenant host (e.g. "eu" for a `<tenant>.eu.goskope.com` host). |  |

---

### Netskope Url List

`netskope_url_list` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isPending` | `boolean` | Whether the list has pending (not yet applied) modifications. |  |
| `listType` | `string` | How entries are matched (e.g. exact, regex). |  |
| `urlCount` | `number` | Number of entries in the list. |  |
| `urls` | `array` of `string`s | URL/host/IP entries in the list. |  |

---

### Netskope User

`netskope_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `userAddedTime` | `number` | Epoch (seconds) when the user was added in Netskope. |  |
| `userSource` | `string` | Source that provisioned the user (e.g. Manual, SCIM, IdP). |  |

---

### Netskope User Configuration

`netskope_user_configuration` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `addonCheckerHost` | `string` | Addon checker host for the client. |  |
| `addonCheckerResponseCode` | `string` | Expected addon checker response code. |  |
| `addonManagerHost` | `string` | Addon manager host for the client. |  |
| `email` | `string` | Email address the configuration belongs to. |  |
| `orgName` | `string` | Netskope organization name. |  |
| `SFCheckerHost` | `string` | Steering-forward checker host. |  |
| `SFCheckerIP` | `string` | Steering-forward checker IP. |  |

---

## Release Notes

-   **2026-07-10** — Added API v2 support with new entity types including private applications, publishers, URL lists, network access policies and policy groups, discovered applications, and OAuth applications (disabled by default).
-   **2026-04-08** — Improved OS name accuracy for Netskope client device entities, using human-readable names for Windows, macOS, Linux, iOS, Android, and ChromeOS devices.

---

Source: /integrations/directory/nexthink

# Nexthink

Visualize Nexthink-managed endpoints, the users and installed applications on them, and the alerts raised by Nexthink monitors. This integration ingests data through pre-created NQL queries via the Nexthink Infinity API, mapping devices to their users, installed software, and alerts so you can monitor your endpoint estate through queries and alerts in JupiterOne.

## Installation

> **INFO**
> 
> Before configuring the integration you will need:
> 
> -   **Nexthink API credentials** — an OAuth 2.0 client (Client ID and Client Secret) with the `service:integration` scope. In your Nexthink tenant, go to **Administration → Integrations → API credentials**, create a new API client, and note the **Client ID** and **Client Secret**. See [Nexthink's authentication documentation](https://docs.nexthink.com/api/getting-authentication-token) for more information.
>     
> -   **Your tenant ID and region** — the tenant ID is the subdomain of your Nexthink URL (e.g. `acme` from `acme.api.us.nexthink.cloud`). The region is one of `us`, `eu`, `pac`, or `meta`.
>     
> -   **Pre-created NQL queries** — Nexthink exposes no resource-level REST endpoints; all data is retrieved through pre-created NQL queries that you save in your tenant. Create one query per data type you want to ingest before running the integration (see **NQL query setup** below).
>     

To install the Nexthink integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Nexthink. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Nexthink account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Nexthink **Client ID** and **Client Secret** used to authenticate with the Nexthink Infinity API.
    
-   Your **Tenant ID** and **Region**.
    
-   The **NQL Query IDs** for each data type you want to ingest (see below). Each query ID is optional — leave one blank to skip ingesting that data type.
    

### NQL query setup

Because Nexthink has no resource-level REST endpoints, the integration retrieves data by running NQL queries that you pre-create in your tenant under **Administration → NQL API queries**. Each query is assigned an ID that must start with `#` and contain only lowercase letters, digits, and underscores (e.g. `#j1_devices`). Copy each ID into the matching field in the integration configuration.

The recommended queries below select the fields the integration maps. You can adjust them as long as the listed fields are present.

#### Devices — suggested ID `#j1_devices`

```text
devices
| list device.uid, device.name, device.collector.uid,
        device.operating_system.platform, device.operating_system.name,
        device.operating_system.build, device.hardware.manufacturer,
        device.hardware.model, device.hardware.chassis_serial_number,
        device.hardware.machine_serial_number, device.hardware.type,
        device.license_type, device.last_seen, device.first_seen,
        device.entity, device.sid, device.connectivity.last_local_ip
```

#### Users — suggested ID `#j1_users`

```text
users
| list user.uid, user.name, user.upn, user.sid, user.type,
        user.last_seen, user.first_seen, user.entity,
        user.ad.email_address, user.ad.full_name, user.ad.department
```

The `user.ad.*` fields (email, full name, department) are only populated if you have the Entra ID (Azure AD) connector configured in Nexthink.

#### Packages — suggested ID `#j1_packages`

```text
package.installed_packages
| list device.uid, package.uid, package.name,
        package.version, package.publisher, package.type, package.platform
```

#### Alerts — suggested ID `#j1_alerts`

```text
alerts
| list alert.uid, alert.status, alert.trigger_time,
        alert.recovery_time, alert.trigger_value, alert.duration,
        monitor.name, monitor.nql_id, monitor.priority,
        monitor.type, monitor.origin,
        device.uid, user.uid
```

Click **Create** once all values are provided to finalize the integration.

> **NOTE**
> 
> Nexthink controls data volume through the NQL query itself. Large tenants may return very large result sets, so add `where` filters or a `| limit` clause to your queries to bound the volume. The asynchronous export also enforces a license-based maximum number of results; when that maximum is reached the results are truncated and the integration logs a warning so the incomplete ingestion is visible.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (1)

-   `service:integration`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (3)

-   `https://{tenantId}-login.{region}.nexthink.cloud/oauth2/default/v1/token`
-   `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/export`
-   `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/status/{exportId}`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://docs.nexthink.com/api/getting-authentication-token.md](https://docs.nexthink.com/api/getting-authentication-token.md)
-   [https://docs.nexthink.com/api/nql/export-an-nql.md](https://docs.nexthink.com/api/nql/export-an-nql.md)
-   [https://docs.nexthink.com/platform/understanding-key-data-platform-concepts/nql-data-model.md](https://docs.nexthink.com/platform/understanding-key-data-platform-concepts/nql-data-model.md)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Fetch Alerts | `service:integration` | `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/export`, `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/status/{exportId}` |
| Fetch Devices | `service:integration` | `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/export`, `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/status/{exportId}` |
| Fetch Packages | `service:integration` | `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/export`, `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/status/{exportId}` |
| Fetch Users | `service:integration` | `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/export`, `https://{tenantId}.api.{region}.nexthink.cloud/api/v1/nql/status/{exportId}` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `nexthink_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `nexthink_alert` | [Alert](https://docs.jupiterone.io/data-model/schemas/Alert), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Device | `nexthink_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Package | `nexthink_package` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| User | `nexthink_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `nexthink_account` | **HAS** | `nexthink_device` |
| `nexthink_account` | **HAS** | `nexthink_user` |
| `nexthink_device` | **INSTALLED** | `nexthink_package` |
| `nexthink_device` | **HAS** | `nexthink_alert` |
| `nexthink_user` | **HAS** | `nexthink_alert` |

### Nexthink Account

`nexthink_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`region` \*

 | `string` | The Nexthink region (e.g. us, eu, pac, meta). |  |
| 

`tenantId` \*

 | `string` | The Nexthink tenant/instance identifier. |  |

---

### Nexthink Alert

`nexthink_alert` inherits from [Alert](/data-model/schemas/Alert.md), [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`duration` \*

 | `string` **|** `null` | Duration the alert condition was active. |  |
| 

`monitorName` \*

 | `string` **|** `null` | Name of the Nexthink monitor that triggered the alert. |  |
| 

`monitorNqlId` \*

 | `string` **|** `null` | NQL identifier of the monitor. |  |
| 

`monitorOrigin` \*

 | `string` **|** `null` | Origin of the monitor (e.g. nexthink\_library, custom). |  |
| 

`monitorPriority` \*

 | `string` **|** `null` | Priority of the monitor (e.g. critical, high, medium, low). |  |
| 

`monitorType` \*

 | `string` **|** `null` | Type of monitor (e.g. metric, event). |  |
| 

`triggerValue` \*

 | `string` **|** `null` | The value that triggered the alert. |  |

---

### Nexthink Device

`nexthink_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`collectorUid` \*

 | `string` **|** `null` | Nexthink Collector UID installed on the device. |  |
| 

`entity` \*

 | `string` **|** `null` | Nexthink organizational entity the device belongs to. |  |
| 

`licenseType` \*

 | `string` **|** `null` | Nexthink license type assigned to the device. |  |
| 

`sid` \*

 | `string` **|** `null` | Windows Security Identifier (SID) for the device. |  |

---

### Nexthink Package

`nexthink_package` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`packageType` \*

 | `string` **|** `null` | Package type (e.g. msi, exe, deb, rpm). |  |
| 

`platform` \*

 | `string` **|** `null` | Operating system platform the package targets. |  |
| 

`publisher` \*

 | `string` **|** `null` | Software publisher/vendor name. |  |
| 

`version` \*

 | `string` **|** `null` | Package version string. |  |

---

### Nexthink User

`nexthink_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`department` \*

 | `string` **|** `null` | Department from Active Directory (requires Entra ID connector). |  |
| 

`entity` \*

 | `string` **|** `null` | Nexthink organizational entity the user belongs to. |  |
| 

`sid` \*

 | `string` **|** `null` | Windows Security Identifier (SID) for the user. |  |
| 

`upn` \*

 | `string` **|** `null` | User Principal Name (UPN) from Active Directory. |  |
| 

`userType` \*

 | `string` **|** `null` | Nexthink user type (e.g. local, domain). |  |

---

---

Source: /integrations/directory/ninja-one

# NinjaOne

Visualize NinjaOne Users, Devices, Policies, Alerts, and monitor changes through queries and alerts.

## Installation

### Requirements

-   A NinjaOne **Client ID** and **Client Secret** generated from a client application in your NinjaOne account. Only a NinjaOne **system administrator** can configure OAuth tokens and create the client application.
-   The client application needs the **Monitoring** scope. This integration is read-only, and Monitoring grants read-only access to monitoring data and organization structure, which is sufficient for every endpoint it calls.
-   You must have permission in JupiterOne to install new integrations.

### Configuration in NinjaOne

#### Create a client application and generate a Client ID and Client Secret

1.  In the NinjaOne portal, go to **Administration** > **Apps** > **API**.
2.  Select the **Client app IDs** tab.
3.  Click **Add client app**.
4.  Choose an **Application Platform** that offers the **Client credentials** grant type, such as **API Services (machine-to-machine)** or **Web (PHP, Java, .NET Core, etc.)**.
5.  Provide a **Name** for the client application.
6.  Under **Scopes**, select **Monitoring**.
7.  Under **Allowed Grant Types**, select **Client credentials** and **Refresh token**. The integration's token request includes the `offline_access` scope along with `monitoring`.
8.  Click **Save**.
9.  Copy the **Client Secret**. It is shown only once and disappears when you close the window.
10.  Copy the **Client ID**. You will need both values when you configure the integration in JupiterOne.

> **NOTE**
> 
> Only system administrators may configure OAuth tokens for the NinjaOne Public API. See NinjaOne's [OAuth token configuration guide](https://www.ninjaone.com/docs/application-programming-interface-api/oauth-token-configuration/) for details.

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**.
2.  Search for **NinjaOne** and select it.
3.  Click **Add Instance** and configure the following settings:

-   Enter the **Account Name** by which you'd like to identify this NinjaOne instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
-   Enter a **Description** that will further assist your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
-   Select the **NinjaOne Server URL** for your region. This defaults to the US region (`https://app.ninjarmm.com`). The available regions are US, US2, EU, Oceania, and Canada.
-   Enter the **NinjaOne Client ID** generated in your NinjaOne client application.
-   Enter the **NinjaOne Client Secret** generated in your NinjaOne client application.
-   (Optional) Enter a **Custom Fields Allow List**: a comma-separated list of NinjaOne custom field names to ingest onto `ninjaone_device` entities as `customField.<name>` properties (for example, `Browser Extensions,Asset Tag`). Use each field's name as configured in NinjaOne. Leave this empty to skip custom field ingestion. Each field you list must have its **API** permission set to at least **Read Only** in its NinjaOne custom field permission settings, otherwise NinjaOne does not return its value over the API.

4.  Click **Create Configuration** once all values are provided.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (2)

-   `monitoring`
-   `offline_access`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `GET /v2/alerts`
-   `GET /v2/device/{deviceId}/volumes`
-   `GET /v2/devices-detailed`
-   `GET /v2/policies`
-   `GET /v2/queries/custom-fields`
-   `GET /v2/queries/software`
-   `GET /v2/users`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://www.ninjaone.com/docs/application-programming-interface-api/oauth-token-configuration/](https://www.ninjaone.com/docs/application-programming-interface-api/oauth-token-configuration/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Fetch NinjaOne Devices | `monitoring`, `offline_access` | `GET /v2/devices-detailed`, `GET /v2/device/{deviceId}/volumes`, `GET /v2/queries/custom-fields` |
| Fetch NinjaOne Incidents | `monitoring`, `offline_access` | `GET /v2/alerts` |
| Fetch NinjaOne Software | `monitoring`, `offline_access` | `GET /v2/queries/software` |
| Fetch NinjaOne Users | `monitoring`, `offline_access` | `GET /v2/users` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `ninjaone_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `ninjaone_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device | `ninjaone_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Incident | `ninjaone_alert` | [Alert](https://docs.jupiterone.io/data-model/schemas/Alert) |
| Policy | `ninjaone_controlpolicy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| User | `ninjaone_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `ninjaone_account` | **OWNS** | `ninjaone_device` |
| `ninjaone_account` | **HAS** | `ninjaone_application` |
| `ninjaone_controlpolicy` | **ENFORCES** | `ninjaone_device` |
| `ninjaone_device` | **HAS** | `ninjaone_alert` |
| `ninjaone_device` | **INSTALLED** | `ninjaone_application` |
| `ninjaone_user` | **OWNS** | `ninjaone_device` |

### Ninjaone Account

`ninjaone_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_key` \*

 | `string` |  |  |
| 

`mfaEnabled` \*

 | `boolean` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Ninjaone Alert

`ninjaone_alert` inherits from [Alert](/data-model/schemas/Alert.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_key` \*

 | `string` |  |  |
| 

`deviceId` \*

 | `number` |  |  |
| 

`message` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`sourceConfigUid` \*

 | `string` |  |  |
| 

`sourceName` \*

 | `string` |  |  |
| `sourceType` | `string` |  |  |
| `subject` | `string` |  |  |
| `ticketTemplateId` | `number` |  |  |
| `userId` | `number` |  |  |

---

### Ninjaone Application

`ninjaone_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`productCode` \*

 | `string` **|** `null` |  |  |
| 

`publisher` \*

 | `string` **|** `null` |  |  |
| 

`version` \*

 | `string` **|** `null` |  |  |

---

### Ninjaone Controlpolicy

`ninjaone_controlpolicy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`_key` \*

 | `string` |  |  |
| `description` | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`nodeClass` \*

 | `string` |  |  |
| 

`nodeClassDefault` \*

 | `boolean` |  |  |
| `parentPolicyId` | `number` |  |  |
| `tags` | `array` of `string`s |  |  |

---

### Ninjaone Device

`ninjaone_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`approvalStatus` \*

 | `string` |  |  |
| `biosSerialNumber` | `string` |  |  |
| `bitLockerConversionStatus` | `string` |  | **Any of**:

-   `FULLY_DECRYPTED`

-   `FULLY_ENCRYPTED`

-   `ENCRYPTION_IN_PROGRESS`

-   `DECRYPTION_IN_PROGRESS`

-   `ENCRYPTION_PAUSED`

-   `DECRYPTION_PAUSED`

-   `UNKNOWN`

 |
| `bitLockerEncryptionMethod` | `string` |  | **Any of**:

-   `NONE`

-   `AES_128_WITH_DIFFUSER`

-   `AES_256_WITH_DIFFUSER`

-   `AES_128`

-   `AES_256`

-   `HARDWARE_ENCRYPTION`

-   `XTS_AES_128`

-   `XTS_AES_256`

-   `UNKNOWN`

 |
| `bitLockerInitializedForProtection` | `boolean` |  |  |
| `bitLockerLockStatus` | `string` |  | **Any of**:

-   `UNKNOWN`

-   `UNLOCKED`

-   `LOCKED`

 |
| `bitLockerProtectionStatus` | `string` |  | **Any of**:

-   `UNPROTECTED`

-   `PROTECTED`

-   `UNKNOWN`

-   `PENDING`

 |
| `bitLockerVolumeName` | `string` | The name of the first volume with BitLocker enabled. Multiple volumes with BitLocker enabled will not be represented. |  |
| 

`category` \*

 | `string` |  |  |
| `chassisType` | `string` |  |  |
| `domainRole` | `string` |  |  |
| `ipAddresses` | `array` of `string`s |  |  |
| `isVirtualMachine` | `boolean` |  |  |
| `lastLoggedInUser` | `string` |  |  |
| 

`locationId` \*

 | `number` |  |  |
| `memoryCapacity` | `number` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`nodeClass` \*

 | `string` |  |  |
| 

`nodeRoleId` \*

 | `number` |  |  |
| `numberOfProcessors` | `number` |  |  |
| 

`organizationId` \*

 | `number` |  |  |
| `osArchitecture` | `string` |  |  |
| `osBuildNumber` | `string` |  |  |
| `osLanguage` | `string` |  |  |
| `osLastBootOn` | `number` |  |  |
| `osLocale` | `string` |  |  |
| `osNeedsReboot` | `boolean` |  |  |
| `osServicePackMajorVersion` | `number` |  |  |
| `osServicePackMinorVersion` | `number` |  |  |
| `policyId` | `number` |  |  |
| `processorArchitectures` | `array` of `string`s |  |  |
| `processorClockSpeeds` | `array` of `number`s |  |  |
| `processorMaxClockSpeeds` | `array` of `number`s |  |  |
| `processorNames` | `array` of `string`s |  |  |
| `processorNumCores` | `array` of `number`s |  |  |
| `processorNumLogicalCores` | `array` of `number`s |  |  |
| `publicIP` | `string` |  |  |
| 

`rolePolicyId` \*

 | `number` |  |  |
| `totalPhysicalMemory` | `string` |  |  |
| `totalPhysicalMemoryInBytes` | `number` |  |  |

---

### Ninjaone User

`ninjaone_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fields` | `array` of `string`s |  |  |
| 
`invitationStatus` \*

 | `string` |  |  |
| 

`mustChangePassword` \*

 | `boolean` |  |  |
| 

`notifyAllClients` \*

 | `boolean` |  |  |
| 

`permitAllClients` \*

 | `boolean` |  |  |
| 

`phoneNumber` \*

 | `string` |  |  |
| `tags` | `array` of `string`s |  |  |
| 

`userType` \*

 | `string` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS details for NinjaOne device entities, adding OS build number alongside the OS name.
-   **2026-02-23** — Added software inventory ingestion to NinjaOne, providing visibility into installed applications and versions across managed devices.
-   **2025-12-09** — Added configuration option for NinjaOne server URL, supporting regional server endpoints for EU, US2, and Oceania deployments.

---

Source: /integrations/directory/nowsecure

# NowSecure

Visualize NowSecure users, services, applications, and findings, map NowSecure users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to provide an API key from your NowSecure account. See [their documentation](https://support.nowsecure.com/hc/en-us/articles/7499657262093-Creating-an-API-Bearer-Token-in-Platform) for more information.

### Configuration in JupiterOne

To install the NowSecure integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select NowSecure. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the NowSecure account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   lastly, your NowSecure **API Key**.
    

Click **Create** once all values are provided to finalize the integration.

> **NOTE**
> 
> By default, JupiterOne ingests findings from the past 30 days. You can adjust the configuration to ingest findings from the latest scan reports if you have a NowSecure Enterprise Plan.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `nowsecure_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Finding | `nowsecure_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Mobile Applications | `mobile_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Service | `nowsecure_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `nowsecure_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `mobile_app` | **HAS** | `nowsecure_finding` |
| `nowsecure_account` | **PROVIDES** | `nowsecure_service` |
| `nowsecure_account` | **HAS** | `nowsecure_user` |
| `nowsecure_account` | **HAS** | `mobile_app` |
| `nowsecure_service` | **SCANS** | `mobile_app` |

---

Source: /integrations/directory/nozomi

# Nozomi Networks

Visualize your Nozomi Networks Vantage OT, IoT, and IT assets in the JupiterOne graph. Ingest the devices discovered on your operational-technology network along with their network security alerts and CVE-backed vulnerabilities, and monitor your OT/ICS security posture through queries and alerts.

## Installation

The Nozomi Networks integration ingests your Nozomi Vantage asset inventory, network security alerts, and CVE-backed vulnerabilities using the Vantage REST and pipe-query APIs. It authenticates with a Vantage API key (a key name and key token), which Vantage exchanges for a short-lived bearer token, then reads nodes (devices), alerts, and node CVEs to build a graph of your OT/IoT/IT environment.

### Prerequisites

-   A **Nozomi Networks Vantage** account, and the base URL you use to reach the Vantage web UI (for example, `https://<tenant>.nozominetworks.io`).
-   A Vantage user with permission to view the assets, alerts, and vulnerabilities you want to ingest. An API key inherits the data-access permissions of the user that owns it.
-   A Vantage **API key** (key name and key token) — see below.
-   Access to JupiterOne with permission to configure integrations.

### Obtaining a Nozomi API key

1.  Sign in to Vantage as the user who will own the API key. The key inherits that user's data-access permissions.
2.  Select **Profile** in the top navigation bar, then select **API Keys**.
3.  Generate a new API key and record its **Key Name** and **Key Token**.

> **CAUTION**
> 
> The key token is displayed only once, at generation time. If you lose it, you must generate a new API key, so store the token securely.

For more detail, see the Nozomi [API key authentication documentation](https://technicaldocs.nozominetworks.com/products/vantage/topics/administration/teams/c_vantage_admin_teams_api-keys_authentication.html).

### Configuration in JupiterOne

To install the Nozomi Networks integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Nozomi Networks**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Nozomi account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **Nozomi Vantage URL** — the base URL of your Vantage instance (the same URL you use for the web UI), in the form `https://<tenant>.nozominetworks.io`. This field is required.
    
-   Your **Nozomi API Key Name** — the API key name generated in your Vantage user profile. This field is required.
    
-   Your **Nozomi API Key Token** — the API key token generated alongside the key name. This field is required.
    
-   **Historical Days** — the number of days of historical alerts to retrieve (`7`, `30`, `90`, `180`, or `365`; default `30`). Vulnerabilities are not time-bounded; the current set of matched CVEs is always ingested in full.
    
-   Optionally, **Disable TLS Verification** — intended only for on-premises Nozomi deployments that do not present a valid TLS certificate. Leave this off whenever possible and install valid certificates instead.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (5)

-   `/api/open/query/do?query=alerts`
-   `/api/open/query/do?query=node_cves`
-   `/api/open/query/do?query=nodes`
-   `/api/v1/keys/sign_in`
-   `/api/v1/organizations/mine`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (4)

-   [https://technicaldocs.nozominetworks.com/products/n2os/topics/sdk/data-model/r\_n2os-sdk\_data\_model\_alerts.html](https://technicaldocs.nozominetworks.com/products/n2os/topics/sdk/data-model/r_n2os-sdk_data_model_alerts.html)
-   [https://technicaldocs.nozominetworks.com/products/n2os/topics/sdk/data-model/r\_n2os-sdk\_data\_model\_node\_cves.html](https://technicaldocs.nozominetworks.com/products/n2os/topics/sdk/data-model/r_n2os-sdk_data_model_node_cves.html)
-   [https://technicaldocs.nozominetworks.com/products/n2os/topics/sdk/data-model/r\_n2os-sdk\_data\_model\_nodes.html](https://technicaldocs.nozominetworks.com/products/n2os/topics/sdk/data-model/r_n2os-sdk_data_model_nodes.html)
-   [https://technicaldocs.nozominetworks.com/products/vantage/topics/administration/teams/c\_vantage\_admin\_teams\_api-keys\_authentication.html](https://technicaldocs.nozominetworks.com/products/vantage/topics/administration/teams/c_vantage_admin_teams_api-keys_authentication.html)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | Endpoints |
| --- | --- |
| Fetch Alerts | `/api/open/query/do?query=alerts` |
| Fetch Vulnerabilities | `/api/open/query/do?query=node_cves` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `nozomi_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `nozomi_finding_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Device | `nozomi_device` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Service | `nozomi_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Vulnerability | `nozomi_finding_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `nozomi_account` | **PROVIDES** | `nozomi_service` |
| `nozomi_account` | **MANAGES** | `nozomi_device` |
| `nozomi_device` | **HAS** | `nozomi_finding_alert` |
| `nozomi_device` | **HAS** | `nozomi_finding_vulnerability` |
| `nozomi_service` | **IDENTIFIED** | `nozomi_finding_alert` |
| `nozomi_service` | **IDENTIFIED** | `nozomi_finding_vulnerability` |

### Nozomi Account

`nozomi_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`url` \*

 | `string` | The base URL of the Nozomi Vantage instance |  |

---

### Nozomi Device

`nozomi_device` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `firstSeenOn` | `number` | Epoch milliseconds when the device first sent a packet |  |
| 
`isCompromised` \*

 | `boolean` **|** `null` | True if the device was recognised as compromised |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | True if this is an outside, public IP rather than a local node |  |
| 

`macVendor` \*

 | `string` **|** `null` | Vendor of the device MAC address, when known |  |
| 

`nodeType` \*

 | `string` **|** `null` | The Nozomi node type (e.g. PLC, HMI, computer) |  |
| 

`protocols` \*

 | `array` **|** `null` | Unique protocols observed from and to the device |  |
| 

`purdueLevel` \*

 | `string` **|** `null` | The Purdue-model level of the device (OT segmentation) |  |
| 

`subnet` \*

 | `string` **|** `null` | The subnet to which the device belongs, if any |  |
| 

`vlanId` \*

 | `string` **|** `null` | The VLAN identifier of the device, if VLAN-tagged |  |
| 

`zone` \*

 | `string` **|** `null` | The Nozomi network zone the device belongs to |  |

---

### Nozomi Finding Alert

`nozomi_finding_alert` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`applianceHost` \*

 | `string` **|** `null` | Hostname of the sensor where the alert was observed |  |
| 

`applianceSite` \*

 | `string` **|** `null` | Site name of the sensor where the alert was observed |  |
| 

`closedOn` \*

 | `number` **|** `null` | Epoch milliseconds when the alert was closed |  |
| 

`ipDst` \*

 | `string` **|** `null` | Destination IP address of the alert |  |
| 

`ipSrc` \*

 | `string` **|** `null` | Source IP address of the alert |  |
| 

`isAcknowledged` \*

 | `boolean` **|** `null` | True if the alert has been acknowledged |  |
| 

`isIncident` \*

 | `boolean` **|** `null` | True if the alert is an incident grouping more alerts |  |
| 

`isSecurity` \*

 | `boolean` **|** `null` | True if the alert is a cybersecurity alert |  |
| 

`protocol` \*

 | `string` **|** `null` | The protocol in which the alert was observed |  |
| 

`threatName` \*

 | `string` **|** `null` | The threat name, when the alert matches a known threat |  |
| 

`zoneDst` \*

 | `string` **|** `null` | Destination zone of the alert |  |
| 

`zoneSrc` \*

 | `string` **|** `null` | Source zone of the alert |  |

---

### Nozomi Finding Vulnerability

`nozomi_finding_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cveScore` \*

 | `number` **|** `null` | CVSS score assigned to the CVE |  |
| 

`cveSource` \*

 | `string` **|** `null` | The entity that provided the CVE information |  |
| 

`cweId` \*

 | `string` **|** `null` | The CWE (vulnerability category) identifier |  |
| 

`isResolved` \*

 | `boolean` **|** `null` | Whether the vulnerability has been resolved |  |
| 

`latestHotfix` \*

 | `string` **|** `null` | Latest hotfix to install to resolve the CVE |  |
| 

`minimumHotfix` \*

 | `string` **|** `null` | Minimum hotfix to install to resolve the CVE |  |
| 

`zone` \*

 | `string` **|** `null` | Network zone of the vulnerable node |  |

---

### Nozomi Service

`nozomi_service` inherits from [Service](/data-model/schemas/Service.md)

---

## Release Notes

-   **2026-07-21** — Added initial Nozomi Networks Vantage integration, ingesting OT and IoT devices, security alerts, and vulnerability findings with their relationships.

---

Source: /integrations/directory/npm

# npm

Visualize NPM users, groups, and packages, map NPM users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> For this integration, you will need to create an NPM token with `Read only` access. See [their documentation](https://docs.npmjs.com/creating-and-viewing-authentication-tokens) for more information.

### Configuration in JupiterOne

To install the NPM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select NPM. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the NPM account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **NPM Organization** and **Access Token** (configured for read access).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Package | `npm_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Team | `npm_team` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| User | `npm_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `npm_team` | **HAS** | `npm_user` |

### Npm User

`npm_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `role` | `string` |  |  |

---

---

Source: /integrations/directory/nutanix

# Nutanix

Visualize your Nutanix infrastructure in JupiterOne — Prism Central accounts, clusters, hosts, and virtual machines — map hosts to the workloads they run, and monitor changes through queries and alerts.

## Installation

This integration connects to a Nutanix Prism Central instance using the Nutanix v4.2 REST APIs and ingests clusters, hosts (physical nodes), and virtual machines. It is a collector-based integration and communicates with Prism Central over HTTPS on port `9440`.

### Configuration in Nutanix

Before configuring the integration in JupiterOne, prepare the following in Nutanix Prism Central:

-   The **hostname or IP address** of your Prism Central instance, reachable from the JupiterOne collector on port `9440`.
-   A **local or authentication-domain user** for the integration to authenticate as. Assign it a role with at least read (**Viewer**) access to clusters, hosts, and virtual machines.
-   The **username** and **password** for that user.
-   If Prism Central presents a self-signed or internal-CA TLS certificate, obtain the **CA certificate** (in PEM format) so the collector can verify the connection.

Once you have obtained the information above, proceed to JupiterOne to finalize the integration.

### Configuration in JupiterOne

To install the Nutanix integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Nutanix**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Nutanix account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Prism Central **Host**, **Username**, and **Password**.
    
-   Optionally, a **CA Certificate** to trust a self-signed or internal-CA certificate, or enable **Disable TLS Verification** to skip certificate validation (not recommended).
    
-   Optionally, enable **Include Powered-Off VMs** to also ingest virtual machines that are powered off.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `Viewer`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (3)

-   `https://<prism-central-host>:9440/api/clustermgmt/v4.0/config/clusters`
-   `https://<prism-central-host>:9440/api/clustermgmt/v4.0/config/hosts`
-   `https://<prism-central-host>:9440/api/vmm/v4.0/ahv/config/vms`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://developers.nutanix.com/api-reference?namespace=clustermgmt&version=v4.0](https://developers.nutanix.com/api-reference?namespace=clustermgmt&version=v4.0)
-   [https://developers.nutanix.com/api-reference?namespace=vmm&version=v4.0](https://developers.nutanix.com/api-reference?namespace=vmm&version=v4.0)
-   [https://www.nutanix.dev/api-reference-v4/](https://www.nutanix.dev/api-reference-v4/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Fetch Hosts | `Viewer` | `https://<prism-central-host>:9440/api/clustermgmt/v4.0/config/hosts` |
| Fetch Virtual Machines | `Viewer` | `https://<prism-central-host>:9440/api/vmm/v4.0/ahv/config/vms` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `nutanix_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cluster | `nutanix_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Host | `nutanix_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| VirtualMachine | `nutanix_vm` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `nutanix_account` | **HAS** | `nutanix_cluster` |
| `nutanix_cluster` | **HAS** | `nutanix_host` |
| `nutanix_cluster` | **CONTAINS** | `nutanix_vm` |
| `nutanix_host` | **HOSTS** | `nutanix_vm` |

### Nutanix Account

`nutanix_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Nutanix Cluster

`nutanix_cluster` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`clusterFqdn` \*

 | `string` **|** `null` | Fully qualified domain name of the cluster. |  |
| 

`clusterType` \*

 | `string` **|** `null` | The type of cluster (e.g. AOS, PRISM\_CENTRAL). |  |
| 

`encryptionInTransitStatus` \*

 | `string` **|** `null` | Encryption-in-transit status for the cluster. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | Cluster external (virtual) IPv4 address. |  |
| 

`hypervisorTypes` \*

 | `array` **|** `null` | Hypervisor types running on the cluster (e.g. AHV, ESX). |  |
| 

`version` \*

 | `string` **|** `null` | Cluster software (AOS) build version. |  |
| 

`vmCount` \*

 | `number` **|** `null` | Number of VMs running on the cluster. |  |

---

### Nutanix Host

`nutanix_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cpuCapacityHz` \*

 | `number` **|** `null` | Total CPU capacity of the host in Hz. |  |
| 

`cpuFrequencyHz` \*

 | `number` **|** `null` | CPU frequency of the host in Hz. |  |
| 

`cpuModel` \*

 | `string` **|** `null` | CPU model name of the host. |  |
| 

`hypervisorState` \*

 | `string` **|** `null` | Current state of the hypervisor on the host. |  |
| 

`hypervisorType` \*

 | `string` **|** `null` | Hypervisor type running on the host (e.g. AHV). |  |
| 

`isDegraded` \*

 | `boolean` **|** `null` | Whether the node is in a degraded state. |  |
| 

`isSecureBooted` \*

 | `boolean` **|** `null` | Whether the host booted with Secure Boot enabled. |  |
| 

`maintenanceState` \*

 | `string` **|** `null` | Maintenance state of the host. |  |
| 

`memorySizeBytes` \*

 | `number` **|** `null` | Total memory size of the host in bytes. |  |
| 

`numCpuCores` \*

 | `number` **|** `null` | Number of CPU cores on the host. |  |
| 

`numCpuSockets` \*

 | `number` **|** `null` | Number of CPU sockets on the host. |  |
| 

`numCpuThreads` \*

 | `number` **|** `null` | Number of CPU threads on the host. |  |

---

### Nutanix Vm

`nutanix_vm` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`biosUuid` \*

 | `string` **|** `null` | BIOS UUID of the VM. |  |
| 

`categoryIds` \*

 | `array` **|** `null` | External ids of the categories associated with the VM. |  |
| 

`ipAddresses` \*

 | `array` **|** `null` | IPv4 addresses learned on the VM NICs, as reported by the guest. |  |
| 

`isAgentVm` \*

 | `boolean` **|** `null` | Whether the VM is an agent VM. |  |
| 

`isLiveMigrateCapable` \*

 | `boolean` **|** `null` | Whether the VM is capable of live migration. |  |
| 

`memorySizeBytes` \*

 | `number` **|** `null` | Memory size assigned to the VM in bytes. |  |
| 

`numCoresPerSocket` \*

 | `number` **|** `null` | Number of cores per socket assigned to the VM. |  |
| 

`numSockets` \*

 | `number` **|** `null` | Number of vCPU sockets assigned to the VM. |  |
| 

`numThreadsPerCore` \*

 | `number` **|** `null` | Number of threads per core assigned to the VM. |  |
| 

`powerState` \*

 | `string` **|** `null` | Power state of the VM (ON, OFF, PAUSED, UNDETERMINED). |  |
| 

`protectionType` \*

 | `string` **|** `null` | Data protection type applied to the VM. |  |

---

## Release Notes

-   **2026-07-14** — Nutanix virtual machines are now classified as hosts and participate in unified device correlation across integrations.
-   **2026-07-14** — Added hostname to Nutanix virtual machine entities.
-   **2026-07-10** — Added initial Nutanix integration support, ingesting accounts, clusters, physical hosts, and virtual machines with their relationships.

---

Source: /integrations/directory/okta

# Okta

Visualize Okta users, groups, devices, applications, and services, map users to employees, and monitor changes through queries and alerts.

## Installation

The integration can authenticate to Okta in two ways. Pick one when you create the instance:

-   **OAuth 2.0 Service App**: an API Services app that signs in with a private key and gets short-lived, scoped access tokens.
-   **Basic**: an Okta API token.

The integration only reads from Okta. Whichever method you use, it needs the **Read-Only Administrator** role. That covers users, groups, group rules, applications, devices and the System Log.

> **NOTE**
> 
> Two things need the **Super Administrator** role, per [Okta's admin role comparison](https://help.okta.com/en-us/content/topics/security/administrators-admin-comparison.htm):
> 
> -   **Admin role assignments** (the **Okta User Roles** data source). With a lower role, those steps are skipped and every other step still runs.
> -   **The Okta Support access setting.** With a lower role, `okta_account.supportEnabled` is left empty.

The **Authorization** tab lists every Okta API endpoint the integration calls, the admin role each one needs and, for the OAuth method, the scope each one needs.

### Option 1: OAuth 2.0 Service App

These steps follow Okta's guide, [Implement OAuth for Okta with a service app](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/). Only a Super Administrator can grant API scopes to an app.

1.  In the Okta Admin Console, go to **Applications** > **Applications**, click **Create App Integration**, select **API Services** and give the app a name, such as `JupiterOne`.
    
2.  On the app's **General** tab, in **Client Credentials**, click **Edit** and set **Client authentication** to **Public key / Private key**. Add a key: either let Okta **Generate new key** and save the private key it shows (it is shown only once), or paste the public key of a key pair you created. Okta accepts RSA keys and EC keys on the P-256, P-384 and P-521 curves.
    
3.  In **General Settings**, clear **Require Demonstrating Proof of Possession (DPoP) header in token requests**. Okta turns it on for new service apps, and the integration does not support DPoP.
    
4.  On the **Okta API Scopes** tab, click **Grant** for each of these scopes:
    
    | Scope | Used for |
    | --- | --- |
    | `okta.users.read` | Users and their MFA factors |
    | `okta.groups.read` | Groups, group members and group rules |
    | `okta.apps.read` | Applications and their user and group assignments |
    | `okta.logs.read` | System Log events that record who created each application |
    | `okta.roles.read` | Admin role assignments of users and groups |
    | `okta.orgs.read` | The Okta Support access setting |
    | `okta.devices.read` | Devices. Only needed when the **Okta Devices** data source is on |
    
    If `okta.devices.read` is not granted, the integration requests a token without it and every other data source still runs.
    
5.  On the **Admin Roles** tab, click **Edit assignments** and assign **Read-Only Administrator**, or **Super Administrator** to also ingest admin role assignments and the Okta Support setting (see the note above). Without an admin role, every API call returns 403.
    
6.  Copy the app's **Client ID** from the **General** tab.
    

The private key goes into JupiterOne as a file. Save it as the JWK (JSON) that Okta generated, or as a PEM. If the app has more than one public key and you use a PEM, also note the key's **KID** from the **General** tab. A JWK already carries it.

### Option 2: API token

Create an [API Token on Okta](https://help.okta.com/en-us/Content/Topics/Security/API.htm#create-okta-api-token) from an Okta account with admin permissions. Ensure that you are in admin-mode when creating the token by selecting the **Admin** button in the top right prior to creating the API Token.

An Okta API token carries the admin role of the user who created it, so create the token from a **Read-Only Administrator** account, or a **Super Administrator** one for the two items in the note above.

Per the Okta documentation: API tokens are valid for 30 days and automatically renew every time they are used with an API request. When a token has been inactive for more than 30 days it is revoked and cannot be used again. Tokens are also only valid if the user who created the token is also active.

> **INFO**
> 
> For additional information regarding Okta API tokens, see [their documentation](https://help.okta.com/en-us/Content/Topics/Security/API.htm) for more information.

### Configuration in JupiterOne

To install the Okta integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Okta. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Okta account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Choose the authentication method and enter the **Organization URL** unique to your Okta organization. Then:
    
    -   For **OAuth 2.0 Service App**: the service app's **Client ID**, the **Private Key** file and, only if the app has several keys and the file is a PEM, the **Key ID**.
    -   For **Basic**: your Okta **API Key**.

These settings are optional:

-   **Additional user profile attributes**: a comma-separated list of Okta user profile attributes to add to `okta_user` entities, such as custom attributes your admins created (for example: `badgeNumber, building`). Use the variable names shown in Okta's Profile Editor. Each attribute is added under its camelCased name (`team_code` becomes `teamCode`). Okta's standard profile attributes, such as `title`, `department` and `employeeNumber`, are ingested without being listed.
    
-   **Ingest Admin Notes**: adds each application's admin notes to `okta_application.adminNotes`.
    

The data sources section lets you turn off what you don't need: Okta Apps, User Groups, MFA Devices, User Roles and Group Rules are on by default. **Okta Devices** is off by default and requires the org to be on Okta Identity Engine. Turning a data source off stops its API calls and removes its entities from JupiterOne on the next run.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (2)

-   `Read-Only Administrator`
-   `Super Administrator`

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (7)

-   `okta.apps.read`
-   `okta.devices.read`
-   `okta.groups.read`
-   `okta.logs.read`
-   `okta.orgs.read`
-   `okta.roles.read`
-   `okta.users.read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (14)

-   `https://{yourOktaDomain}/api/v1/apps`
-   `https://{yourOktaDomain}/api/v1/apps/{appId}/groups`
-   `https://{yourOktaDomain}/api/v1/apps/{appId}/users`
-   `https://{yourOktaDomain}/api/v1/devices`
-   `https://{yourOktaDomain}/api/v1/groups`
-   `https://{yourOktaDomain}/api/v1/groups/rules`
-   `https://{yourOktaDomain}/api/v1/groups/{groupId}/roles`
-   `https://{yourOktaDomain}/api/v1/groups/{groupId}/users`
-   `https://{yourOktaDomain}/api/v1/iam/assignees/users`
-   `https://{yourOktaDomain}/api/v1/logs`
-   `https://{yourOktaDomain}/api/v1/org/privacy/oktaSupport`
-   `https://{yourOktaDomain}/api/v1/users`
-   `https://{yourOktaDomain}/api/v1/users/{userId}/factors`
-   `https://{yourOktaDomain}/api/v1/users/{userId}/roles`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (14)

-   [https://developer.okta.com/docs/api/openapi/okta-management/management/tags/application](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/application)
-   [https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationgroups](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationgroups)
-   [https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationusers](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationusers)
-   [https://developer.okta.com/docs/api/openapi/okta-management/management/tags/device](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/device)
-   [https://developer.okta.com/docs/api/openapi/okta-management/management/tags/group](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/group)
-   [https://developer.okta.com/docs/api/openapi/okta-management/management/tags/grouprule](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/grouprule)
-   [https://developer.okta.com/docs/api/openapi/okta-management/management/tags/orgsettingsupport](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/orgsettingsupport)
-   [https://developer.okta.com/docs/api/openapi/okta-management/management/tags/roleassignmentauser](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/roleassignmentauser)
-   [https://developer.okta.com/docs/api/openapi/okta-management/management/tags/roleassignmentbgroup](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/roleassignmentbgroup)
-   [https://developer.okta.com/docs/api/openapi/okta-management/management/tags/systemlog](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/systemlog)
-   [https://developer.okta.com/docs/api/openapi/okta-management/management/tags/user](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/user)
-   [https://developer.okta.com/docs/api/openapi/okta-management/management/tags/userfactor](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/userfactor)
-   [https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/)
-   [https://help.okta.com/en-us/content/topics/security/administrators-admin-comparison.htm](https://help.okta.com/en-us/content/topics/security/administrators-admin-comparison.htm)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (7)

| Step | Roles | OAuth Scopes | Endpoints |
| --- | --- | --- | --- |
| Build User Created Application Relationship | `Read-Only Administrator` | `okta.logs.read` | `https://{yourOktaDomain}/api/v1/logs` |
| Create app user group to user relationships | `Read-Only Administrator` | `okta.groups.read` | `https://{yourOktaDomain}/api/v1/groups/{groupId}/users` |
| Create group to app relationships | `Read-Only Administrator` | `okta.apps.read` | `https://{yourOktaDomain}/api/v1/apps/{appId}/groups` |
| Create user group to user relationships | `Read-Only Administrator` | `okta.groups.read` | `https://{yourOktaDomain}/api/v1/groups/{groupId}/users` |
| Create user to app relationships | `Read-Only Administrator` | `okta.apps.read` | `https://{yourOktaDomain}/api/v1/apps/{appId}/users` |
| Fetch Group Roles | `Super Administrator` | `okta.roles.read` | `https://{yourOktaDomain}/api/v1/groups/{groupId}/roles` |
| Fetch Rules | `Read-Only Administrator` | `okta.groups.read` | `https://{yourOktaDomain}/api/v1/groups/rules` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Okta Account | `okta_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Okta App UserGroup | `okta_app_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Okta Application | `okta_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Okta Device | `okta_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Okta Factor Device | `mfa_device` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Okta Role | `okta_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Okta Rule | `okta_rule` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Okta Service | `okta_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service), [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Okta User | `okta_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Okta UserGroup | `okta_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `okta_account` | **MANAGES** | `okta_service` |
| `okta_account` | **HAS** | `okta_service` |
| `okta_account` | **HAS** | `okta_user` |
| `okta_account` | **HAS** | `okta_user_group` |
| `okta_account` | **HAS** | `okta_app_user_group` |
| `okta_account` | **HAS** | `okta_application` |
| `okta_account` | **HAS** | `okta_rule` |
| `okta_account` | **MANAGES** | `okta_device` |
| `okta_app_user_group` | **HAS** | `okta_user` |
| `okta_rule` | **MANAGES** | `okta_user_group` |
| `okta_user` | **ASSIGNED** | `mfa_device` |
| `okta_user` | **MANAGES** | `okta_user` |
| `okta_user` | **ASSIGNED** | `okta_application` |
| `okta_user` | **ASSIGNED** | `aws_iam_role` |
| `okta_user` | **ASSIGNED** | `okta_role` |
| `okta_user` | **CREATED** | `okta_application` |
| `okta_user` | **OWNS** | `okta_device` |
| `okta_user_group` | **HAS** | `okta_user` |
| `okta_user_group` | **ASSIGNED** | `aws_iam_role` |
| `okta_user_group` | **ASSIGNED** | `okta_role` |
| `okta_user_group, okta_app_user_group` | **ASSIGNED** | `okta_application` |

### Mfa Device

`mfa_device` inherits from [Key](/data-model/schemas/Key.md), [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authenticatorName` | `string` | Authenticator name for WebAuthn factors, e.g. `YubiKey 5`. |  |
| `created` | `number` | Please use `createdOn` instead | **deprecated**: true |
| `device` | `string` | Device reported for the factor, if any. |  |
| `deviceType` | `string` | Device type for Okta Verify factors, e.g. `SmartPhone_IPhone`. |  |
| `factorType` | `string` | Okta factor type, e.g. `push`, `sms`, `token:software:totp` or `webauthn`. |  |
| `lastUpdated` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `lastVerifiedOn` | `number` | When the factor was last used to verify the user. |  |
| `platform` | `string` | Device platform for Okta Verify factors, e.g. `IOS`. |  |
| `profileName` | `string` | Device name for Okta Verify factors. |  |
| `provider` | `string` | Factor provider, e.g. `OKTA`, `GOOGLE`, `FIDO` or `YUBICO`. |  |
| `vendorName` | `string` | Factor vendor name reported by Okta. |  |

---

### Okta Account

`okta_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` | Okta org domain, e.g. `acme.okta.com`. |  |
| 

`supportEnabled` \*

 | `boolean` **|** `null` | Whether Okta Support currently has temporary access to the org. Null when the API token cannot read the setting (it requires a Super Administrator token). |  |
| `supportExpiresOn` | `number` | When Okta Support access to the org expires. |  |

---

### Okta App User Group

`okta_app_user_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `created` | `number` | Please use `createdOn` instead | **deprecated**: true |
| `lastMembershipUpdated` | `number` | Please use `lastMembershipUpdatedOn` instead | **deprecated**: true |
| `lastMembershipUpdatedOn` | `number` | When the group's membership last changed. |  |
| `lastUpdated` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `lastUpdatedOn` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `objectClass` | `array` of `string`s | Okta object classes of the group, e.g. `okta:user_group`. |  |
| `type` | `string` | Okta group type: `OKTA_GROUP`, `APP_GROUP` (imported from an app such as Active Directory) or `BUILT_IN`. |  |

---

### Okta Application

`okta_application` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`adminNotes` \*

 | `string` **|** `null` | Admin notes on the app. Only populated when the Ingest Admin Notes setting is on. |  |
| `appAccountType` | `string` **|** `array` | Kind of vendor account the app grants access to, for known vendors. |  |
| `appVendorName` | `string` | Human readable, capitalized vendor name  
  
**Examples**: Atlassian, Snyk |  |
| `created` | `number` | Please use `createdOn` instead | **deprecated**: true |
| 

`endUserNotes` \*

 | `string` **|** `null` | Notes shown to end users for the app. |  |
| `features` | `array` of `string`s | Provisioning features enabled for the app, e.g. `PUSH_NEW_USERS`. |  |
| `imageUrl` | `string` | URL of the app logo in Okta. |  |
| `isMultiInstanceApp` | `boolean` | True if one of: aws, githubcloud, gcp, google, office365 |  |
| `isSAMLApp` | `boolean` | True if the application is a SAML application |  |
| `label` | `string` | App label as shown in the Okta admin console. |  |
| `lastUpdated` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `loginUrl` | `string` | URL users open to sign in to the app from Okta. |  |
| `oauthApplicationType` | `string` | OAuth client application type: web, native, browser, or service |  |
| `oauthClientUri` | `string` | Publisher-supplied landing page URL for the OAuth client |  |
| `oauthConsentMethod` | `string` | OAuth consent flow: REQUIRED (end-user consent) or TRUSTED (admin pre-approved — risk signal for third-party access) |  |
| `oauthGrantTypes` | `array` of `string`s | OAuth grant types the client is configured for (e.g. authorization\_code, client\_credentials, refresh\_token) |  |
| `oauthLogoUri` | `string` | Publisher-supplied URL of the client's logo |  |
| `oauthPolicyUri` | `string` | Publisher-supplied privacy policy URL |  |
| `oauthPostLogoutRedirectUris` | `array` of `string`s | OAuth post-logout redirect URIs the client is allowed to use |  |
| `oauthRedirectUris` | `array` of `string`s | OAuth redirect URIs the client is allowed to use after authorization |  |
| `oauthTosUri` | `string` | Publisher-supplied terms of service URL |  |
| `shortName` | `string` | Short app name derived from the Okta app name.  
  
**Examples**: aws, gcp |  |
| `signOnAttribute` | `array` of `string`s | Filter values of the app's SAML attribute statements. |  |
| `signOnMode` | `string` | Sign-on mode: `AUTO_LOGIN`, `BASIC_AUTH`, `BOOKMARK`, `BROWSER_PLUGIN`, `OPENID_CONNECT`, `SAML_1_1`, `SAML_2_0`, `SECURE_PASSWORD_STORE` or `WS_FEDERATION`. |  |

---

### Okta Device

`okta_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deviceStatus` | `string` | Okta device status: `active`, `created`, `deactivated` or `suspended`. |  |
| `isRegistered` | `boolean` | Whether the device is registered with Okta. |  |
| `platform` | `string` | Device platform reported by Okta, lowercased, e.g. `macos`. |  |
| `registered` | `boolean` | Please use `isRegistered` instead | **deprecated**: true |

---

### Okta Role

`okta_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `lastUpdatedOn` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `roleType` | `string` | Okta admin role type, e.g. `SUPER_ADMIN`, `ORG_ADMIN` or `READ_ONLY_ADMIN`. |  |

---

### Okta Rule

`okta_rule` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `actions` | `string` | JSON stringified object of actions |  |
| `conditions` | `string` | JSON stringified object of conditions |  |
| `created` | `number` | Please use `createdOn` instead | **deprecated**: true |
| `lastUpdated` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `lastUpdatedOn` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `ruleType` | `string` | Okta rule type.  
  
**Examples**: group\_rule, policy\_rule |  |

---

### Okta Service

`okta_service` inherits from [Service](/data-model/schemas/Service.md), [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`controlDomain` \*

 | `string` | Security control domain of the service: `identity-access`. |  |

---

### Okta User

`okta_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activated` | `number` | Please use `activatedOn` instead | **deprecated**: true |
| `activatedOn` | `number` | When the user was activated in Okta. |  |
| `city` | `string` **|** `null` | City from the Okta user profile. |  |
| `costCenter` | `string` **|** `null` | Cost center from the Okta user profile. |  |
| `countryCode` | `string` | Country code from the Okta user profile, e.g. `US`. |  |
| `created` | `number` | Please use `createdOn` instead | **deprecated**: true |
| `credentialProvider` | `string` | The type of authentication provider backing the user (e.g. OKTA for native credentials, FEDERATION for SSO-bound). | **Any of**:
-   `ACTIVE_DIRECTORY`

-   `FEDERATION`

-   `IMPORT`

-   `LDAP`

-   `OKTA`

-   `SOCIAL`

 |
| `credentialProviderName` | `string` **|** `null` | The display name of the authentication provider (e.g. an AD domain or federated IdP label). |  |
| `department` | `string` **|** `null` | Department from the Okta user profile. |  |
| `division` | `string` **|** `null` | Division from the Okta user profile. |  |
| `employeeNumber` | `string` **|** `null` | Employee number from the Okta user profile. |  |
| `employeeType` | `string` | Employment classification from Okta user profile (e.g. "Full-time", "Contractor"). Custom attribute configured per-organization. |  |
| `hiredOn` | `number` | Hire date from the Okta profile `hireDate` attribute. |  |
| `honorificPrefix` | `string` **|** `null` | Honorific prefix (e.g. `Dr.`) from the Okta user profile. Only ingested when personal properties are included. |  |
| `honorificSuffix` | `string` **|** `null` | Honorific suffix (e.g. `Jr.`) from the Okta user profile. Only ingested when personal properties are included. |  |
| `isSsoBound` | `boolean` | True when the user authenticates through a federated SSO provider (credentialProvider === FEDERATION). |  |
| `lastLogin` | `number` | Please use `lastLoginOn` instead | **deprecated**: true |
| `lastLoginOn` | `number` | When the user last signed in to Okta. |  |
| `lastUpdated` | `number` | Please use `lastUpdatedOn` instead | **deprecated**: true |
| `lastUpdatedOn` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `locale` | `string` **|** `null` | Locale from the Okta user profile, e.g. `en_US`. |  |
| 

`login` \*

 | `string` **|** `null` | The user's Okta login. |  |
| `manager` | `string` **|** `null` | Manager's display name from the Okta user profile. |  |
| `managerId` | `string` | The manager's identifier from the Okta profile `managerId` attribute. |  |
| `middleName` | `string` **|** `null` | Middle name from the Okta user profile. Only ingested when personal properties are included. |  |
| `mobilePhone` | `string` **|** `null` | Mobile phone number from the Okta user profile. Only ingested when personal properties are included. |  |
| `nickName` | `string` **|** `null` | Nickname from the Okta user profile. Only ingested when personal properties are included. |  |
| `organization` | `string` **|** `null` | Organization from the Okta user profile. |  |
| `passwordChanged` | `number` | Please use `passwordChangedOn` instead | **deprecated**: true |
| `postalAddress` | `string` **|** `null` | Mailing address from the Okta user profile. Only ingested when personal properties are included. |  |
| `preferredLanguage` | `string` **|** `null` | Preferred language from the Okta user profile. Only ingested when personal properties are included. |  |
| `primaryPhone` | `string` **|** `null` | Primary phone number from the Okta user profile. Only ingested when personal properties are included. |  |
| `profileUrl` | `string` **|** `null` | Profile URL from the Okta user profile. Only ingested when personal properties are included. |  |
| `secondEmail` | `string` **|** `null` | Secondary email address from the Okta user profile. Only ingested when personal properties are included. |  |
| `state` | `string` **|** `null` | State or region from the Okta user profile. |  |
| `statusChanged` | `number` | Please use `statusChangedOn` instead | **deprecated**: true |
| `statusChangedOn` | `number` | When the user's status last changed. |  |
| `streetAddress` | `string` **|** `null` | Street address from the Okta user profile. Only ingested when personal properties are included. |  |
| `terminatedOn` | `number` | Termination date from the Okta profile `terminationDate` attribute. |  |
| `timezone` | `string` **|** `null` | Time zone from the Okta user profile, e.g. `America/New_York`. |  |
| `title` | `string` **|** `null` | Job title from the Okta user profile. |  |
| `unverifiedEmails` | `array` of `string`s | Email addresses on the user's Okta credentials that are not verified. | 

**Format**: `email`

  
 |
| `userType` | `string` **|** `null` | User type from the Okta user profile, e.g. `Employee` or `Contractor`. |  |
| `verifiedEmails` | `array` of `string`s | Email addresses on the user's Okta credentials that Okta reports as verified. | 

**Format**: `email`

  
 |
| `zipCode` | `string` **|** `null` | ZIP or postal code from the Okta user profile. Only ingested when personal properties are included. |  |

---

### Okta User Group

`okta_user_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `created` | `number` | Please use `createdOn` instead | **deprecated**: true |
| `lastMembershipUpdated` | `number` | Please use `lastMembershipUpdatedOn` instead | **deprecated**: true |
| `lastMembershipUpdatedOn` | `number` | When the group's membership last changed. |  |
| `lastUpdated` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `lastUpdatedOn` | `number` | Please use `updatedOn` instead | **deprecated**: true |
| `objectClass` | `array` of `string`s | Okta object classes of the group, e.g. `okta:user_group`. |  |
| `type` | `string` | Okta group type: `OKTA_GROUP`, `APP_GROUP` (imported from an app such as Active Directory) or `BUILT_IN`. |  |

---

## Release Notes

-   **2026-10-13** — Added an "Include personal & custom properties" option for Okta user entities. When enabled, it adds personal profile attributes such as secondary email, phone numbers, postal address, and preferred language, plus any custom profile attributes you list in the "Custom attributes" setting.
    
-   **2026-10-09** — Okta entities now store only the properties the integration maps. Okta user profile attributes outside the standard set, including custom attributes, are no longer ingested by default; see the 2026-10-13 entry to include them.
    
-   **2026-08-24** — Added employment type property to Okta user entities, capturing employment classification such as full-time or contractor status.
    
-   **2026-06-10** — Added authentication provider properties to Okta user entities, showing whether a user authenticates via Okta native credentials, a federated SSO provider, Active Directory, or another identity source.
    
-   **2026-05-27** — Added OAuth client configuration properties to Okta OIDC application entities, including grant types, consent method, application type, and redirect URIs.
    
-   **2026-05-05** — Okta application entities are now classified as Non-Human Identity, enabling visibility into non-human access and identity risk.
    
-   **2026-04-08** — Improved OS name display for Okta device entities, providing human-readable names for all supported platforms.
    
-   **2026-03-05** — Added MFA enabled status property to Okta user entities, indicating whether a user has active MFA configured.
    
-   **2025-10-09** — Added management hierarchy relationships linking Okta users to the users who manage them.
    
-   **2025-06-16** — Added notes field and configuration option to Okta user entities for storing user notes.
    
-   **2025-05-12** — Added device management status property to Okta user-to-device relationships.

---

Source: /integrations/directory/one-trust

# OneTrust

Visualize OneTrust users, groups, risk, and vendors, and monitor changes through queries and alerts.

## Installation

### Requirements

-   User must have an active OneTrust account with **API access**.
-   User must have permission in JupiterOne to install new integrations.

### Configuration in OneTrust

#### Generate OAuth 2.0 Client Credentials and collect Host URL

1.  **Log in** to your OneTrust account.
2.  Click the **gear icon** in the upper-right corner to access **Global Settings**.
3.  From the Global Settings menu, select **Access Management** > **Client Credentials**. The **Credentials** screen appears.
4.  Click the **Add** button. The **Add Client Credential** screen will open.
5.  In the **Name** field, enter a name for the client credential.
6.  (Optional) In the **Description** field, provide a description for the client credential.
7.  In the Access Token Lifetime field, set the duration of the access token to 1 hour.
8.  (Optional) Enable the **Restrict IP Addresses** setting to restrict incoming communication to specific IP addresses. If enabled, enter the allowed IP addresses. You can add multiple IPs by clicking the **Add** icon.
9.  Click **Next**. The **Scope** section appears.
10.  Select following Scopes
     -   RISK\_READ: To fetch Risk Data
     -   SCIM: To fetch User and Group Data
     -   INVENTORY\_READ: To fetch Vendor Data
11.  Click **Create**. The **Client ID** and **Client Secret** section will appear.
12.  Click **Download** to save the `.txt` file containing your **Client ID** and **Client Secret** to a secure location.
13.  Click **Close** to finish.
14.  Note down your OneTrust **Host URL** from URL bar (e.g., `https://customer.my.onetrust.com`).

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**.
2.  Search for **OneTrust** and select it.
3.  Click on the **Add Instance** button and configure the following settings:

-   Enter the **OneTrust Host URL**.
-   Enter the **OneTrust Client ID**.
-   Enter the **OneTrust Client Secret**.
-   Enter the **Account Name** by which you'd like to identify this OneTrust instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
-   Enter a **Description** to help your team identify the integration instance.
-   Select a **Polling Interval** that fits your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.

4.  Click **Create Instance** once all values are provided.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `onetrust_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Risk | `onetrust_risk` | [Risk](https://docs.jupiterone.io/data-model/schemas/Risk) |
| User | `onetrust_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `onetrust_user_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Vendor | `onetrust_vendor` | [Vendor](https://docs.jupiterone.io/data-model/schemas/Vendor) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `onetrust_account` | **HAS** | `onetrust_user_group` |
| `onetrust_account` | **HAS** | `onetrust_vendor` |
| `onetrust_account` | **HAS** | `onetrust_risk` |
| `onetrust_user_group` | **HAS** | `onetrust_user` |

### Onetrust Account

`onetrust_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Onetrust Risk

`onetrust_risk` inherits from [Risk](/data-model/schemas/Risk.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `actionId` | `number` |  |  |
| `closedAt` | `number` |  |  |
| 
`controlsIdentifier` \*

 | `array` of `string`s |  |  |
| `deadline` | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| `impactLevel` | `string` |  |  |
| `impactLevelId` | `number` |  |  |
| 

`inherentImpact` \*

 | `number` |  |  |
| `inherentImpactLevel` | `string` |  |  |
| 

`inherentProbability` \*

 | `number` |  |  |
| `inherentProbabilityLevel` | `string` |  |  |
| `inherentRiskScore` | `number` |  |  |
| `justification` | `string` |  |  |
| `level` | `string` |  |  |
| `levelId` | `number` |  |  |
| `mitigatedOn` | `number` |  |  |
| `orgGroupId` | `string` |  |  |
| `orgGroupName` | `string` |  |  |
| `previousState` | `string` |  |  |
| `probabilityLevel` | `string` |  |  |
| `probabilityLevelId` | `number` |  |  |
| `recommendation` | `string` |  |  |
| `references` | `string` |  |  |
| `remediationProposal` | `string` |  |  |
| `result` | `string` |  |  |
| 

`riskNumber` \*

 | `number` |  |  |
| 

`riskOwnersId` \*

 | `array` of `string`s |  |  |
| `riskType` | `string` |  |  |
| `sourceId` | `string` |  |  |
| `sourceName` | `string` |  |  |
| 

`targetImpact` \*

 | `number` |  |  |
| `targetImpactLevel` | `string` |  |  |
| `targetLevel` | `string` |  |  |
| 

`targetProbability` \*

 | `number` |  |  |
| `targetProbabilityLevel` | `string` |  |  |
| `targetRiskScore` | `number` |  |  |
| `threatName` | `string` |  |  |
| `treatment` | `string` |  |  |
| `treatmentStatus` | `string` |  |  |
| `updatedBy` | `string` |  |  |
| `updatedByName` | `string` |  |  |
| `vulnerabilityNames` | `string` |  |  |
| `workflowId` | `string` |  |  |
| `workflowName` | `string` |  |  |

---

### Onetrust User

`onetrust_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `title` | `string` |  |  |

---

### Onetrust User Group

`onetrust_user_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `externalId` | `string` |  |  |

---

### Onetrust Vendor

`onetrust_vendor` inherits from [Vendor](/data-model/schemas/Vendor.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `canViewDetails` | `boolean` |  |  |
| `isDeletable` | `boolean` |  |  |
| `isEditable` | `boolean` |  |  |
| `isParent` | `boolean` |  |  |
| `organizationId` | `string` |  |  |
| `organizationName` | `string` |  |  |
| `typeId` | `string` |  |  |
| `typeValue` | `string` |  |  |
| `vendorNumber` | `number` | A number value assign to each vendor by OneTrust |  |
| `workflowId` | `string` |  |  |
| `workflowStage` | `string` |  |  |
| `workflowValue` | `string` |  |  |

---

---

Source: /integrations/directory/onelogin

# OneLogin

Visualize OneLogin users, groups, roles, devices, apps, and services, map OneLogin users to employees, and monitor changes through alerts and queries.

## Installation

> **INFO**
> 
> For this integration, you will need to create an API Client ID and Client Secret on OneLogin with the **Read All** scope as an administrator. See [their documentation](https://developers.onelogin.com/api-docs/1/getting-started/working-with-api-credentials) for more information.

### Configuration in JupiterOne

To install the OneLogin integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select OneLogin. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the OneLogin account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your OneLogin **API Client ID**, **API Client Secret**, and your **Organization Domain** (format: `<yourdomain>.onelogin.com`).
    

Click **Create** once all values are provided to finalize the integration.

### Troubleshooting

This integration's authentication is achieved by fetching an OAuth token from OneLogin. You can reproduce this authentication strategy by running the following curl, replacing `<CLIENT_ID>` and `<CLIENT_SECRET>` with your own. `<API_HOSTNAME>` defaults to `https://api.us.onelogin.com`:

```bash
curl --request POST \
  --url <API_HOSTNAME> \
  --header 'authorization: client_id:<CLIENT_ID>, client_secret:<CLIENT_SECRET>' \
  --header 'content-type: application/json' \
  --data '{
	"grant_type":"client_credentials"
}'
```

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Onelogin Account | `onelogin_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Onelogin Application | `onelogin_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Onelogin Application Rule | `onelogin_application_rule` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Onelogin Group | `onelogin_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Onelogin Personal Application | `onelogin_personal_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Onelogin Personal Device | `mfa_device` | [Key](https://docs.jupiterone.io/data-model/schemas/Key), [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Onelogin Role | `onelogin_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Onelogin Service | `onelogin_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service), [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Onelogin User | `onelogin_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `onelogin_account` | **HAS** | `onelogin_service` |
| `onelogin_account` | **HAS** | `onelogin_group` |
| `onelogin_account` | **HAS** | `onelogin_role` |
| `onelogin_account` | **HAS** | `onelogin_user` |
| `onelogin_account` | **HAS** | `onelogin_application` |
| `onelogin_application` | **HAS** | `onelogin_application_rule` |
| `onelogin_group` | **HAS** | `onelogin_user` |
| `onelogin_user` | **ASSIGNED** | `onelogin_group` |
| `onelogin_user` | **ASSIGNED** | `onelogin_role` |
| `onelogin_user` | **ASSIGNED** | `onelogin_application` |
| `onelogin_user` | **HAS** | `onelogin_personal_application` |
| `onelogin_user` | **ASSIGNED** | `aws_iam_role` |
| `onelogin_user` | **ASSIGNED** | `mfa_device` |

---

Source: /integrations/directory/oomnitza

# Oomnitza

Visualize Oomnitza IT asset management data including hardware, servers, software, and users. Map asset ownership to users and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need your Oomnitza tenant URL and an API token to set up this integration. See [Oomnitza's documentation](https://oomnitza.zendesk.com/hc/en-us/articles/360049276794-Adding-revoking-and-refreshing-an-Oomnitza-API-token) for more information on creating API tokens.

### Configuration in Oomnitza

1.  Log in to your Oomnitza instance as an administrator.
2.  Navigate to **Configuration** > **Security** > **API Tokens**.
3.  Click **Add API Token** to generate a new token.
4.  Copy and save the token value securely.
5.  Note your Oomnitza tenant URL (e.g., `https://acme.oomnitza.com`).

> **TIP**
> 
> Create a dedicated user for the JupiterOne integration rather than using a personal administrator account. This makes the API token's activity easier to identify and audit.

### Configuration in JupiterOne

Navigate to the **Integrations** tab, select **Oomnitza**, and click **New Instance**.

Creating an instance requires the following:

-   The **Account Name** used to identify this Oomnitza account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to help identify the integration instance, if desired.
    
-   **Polling Interval** for how often JupiterOne collects data from Oomnitza. Set to `DISABLED` to run the integration manually only.
    
-   Your Oomnitza **Base URL** — the tenant URL for your Oomnitza instance (e.g., `https://acme.oomnitza.com`).
    
-   Your Oomnitza **API Key** — the API token generated in the steps above.
    

Click **Create** to save the instance.

### Next steps

Once configured, the integration will run on the polling interval you set and populate data within JupiterOne. See the [Instance management guide](/integrations/instance-management.md) for details on managing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (9)

-   `https://{tenant}.oomnitza.com/api/v3/assets`
-   `https://{tenant}.oomnitza.com/api/v3/assets/{equipmentId}/software`
-   `https://{tenant}.oomnitza.com/api/v3/contracts`
-   `https://{tenant}.oomnitza.com/api/v3/saas`
-   `https://{tenant}.oomnitza.com/api/v3/saas/users`
-   `https://{tenant}.oomnitza.com/api/v3/saas/{saasId}/users`
-   `https://{tenant}.oomnitza.com/api/v3/software`
-   `https://{tenant}.oomnitza.com/api/v3/users`
-   `https://{tenant}.oomnitza.com/api/v3/users/{username}/software/software`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://oomnitza.zendesk.com/hc/en-us/articles/360049276794-Adding-revoking-and-refreshing-an-Oomnitza-API-token](https://oomnitza.zendesk.com/hc/en-us/articles/360049276794-Adding-revoking-and-refreshing-an-Oomnitza-API-token)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (5)

| Step | Endpoints |
| --- | --- |
| Fetch Asset Installed Software | `https://{tenant}.oomnitza.com/api/v3/assets/{equipmentId}/software` |
| Fetch Assets | `https://{tenant}.oomnitza.com/api/v3/assets` |
| Fetch Contracts | `https://{tenant}.oomnitza.com/api/v3/contracts` |
| Fetch SaaS User Assignments | `https://{tenant}.oomnitza.com/api/v3/saas/users`, `https://{tenant}.oomnitza.com/api/v3/saas/{saasId}/users` |
| Fetch User Software Assignments | `https://{tenant}.oomnitza.com/api/v3/users/{username}/software/software` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `oomnitza_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Asset | `oomnitza_asset` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Contract | `oomnitza_contract` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| Hardware | `oomnitza_hardware` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| SaaS | `oomnitza_saas` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Server | `oomnitza_server` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Software | `oomnitza_software` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Software Catalog | `oomnitza_software_catalog` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| User | `oomnitza_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `oomnitza_account` | **HAS** | `oomnitza_user` |
| `oomnitza_account` | **HAS** | `oomnitza_hardware` |
| `oomnitza_account` | **HAS** | `oomnitza_server` |
| `oomnitza_account` | **HAS** | `oomnitza_software` |
| `oomnitza_account` | **HAS** | `oomnitza_asset` |
| `oomnitza_account` | **HAS** | `oomnitza_software_catalog` |
| `oomnitza_account` | **HAS** | `oomnitza_saas` |
| `oomnitza_account` | **HAS** | `oomnitza_contract` |
| `oomnitza_asset` | **INSTALLED** | `oomnitza_software_catalog` |
| `oomnitza_contract` | **PROVIDES** | `oomnitza_software_catalog` |
| `oomnitza_contract` | **PROVIDES** | `oomnitza_saas` |
| `oomnitza_hardware` | **INSTALLED** | `oomnitza_software_catalog` |
| `oomnitza_server` | **INSTALLED** | `oomnitza_software_catalog` |
| `oomnitza_user` | **HAS** | `oomnitza_hardware` |
| `oomnitza_user` | **HAS** | `oomnitza_server` |
| `oomnitza_user` | **HAS** | `oomnitza_software` |
| `oomnitza_user` | **HAS** | `oomnitza_asset` |
| `oomnitza_user` | **ASSIGNED** | `oomnitza_saas` |
| `oomnitza_user` | **ASSIGNED** | `oomnitza_software_catalog` |

### Oomnitza Account

`oomnitza_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Oomnitza Asset

`oomnitza_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` **|** `null` |  |  |
| 

`assignedTo` \*

 | `string` **|** `null` |  |  |
| 

`barcode` \*

 | `string` **|** `null` |  |  |
| 

`totalMemoryMb` \*

 | `string` **|** `null` |  |  |
| 

`warrantyEndDate` \*

 | `number` **|** `null` |  |  |

---

### Oomnitza Contract

`oomnitza_contract` inherits from [Subscription](/data-model/schemas/Subscription.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`contractId` \*

 | `string` | Oomnitza contract identifier (contract\_id). |  |
| 

`contractType` \*

 | `string` **|** `null` | Contract type, e.g. "License". |  |
| 

`cost` \*

 | `number` **|** `null` | Contract cost. |  |
| 

`endDate` \*

 | `number` **|** `null` | Contract end date (UNIX epoch seconds). |  |
| `id` | `string` **|** `null` | Oomnitza internal numeric UID of the contract record. |  |
| 

`startDate` \*

 | `number` **|** `null` | Contract start date (UNIX epoch seconds). |  |
| 

`totalLicenses` \*

 | `number` **|** `null` | Total number of licenses provisioned by the contract. |  |
| 

`usedLicenses` \*

 | `number` **|** `null` | Number of licenses currently consumed under the contract. |  |
| 

`vendor` \*

 | `string` **|** `null` | Contract vendor. |  |

---

### Oomnitza Hardware

`oomnitza_hardware` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` **|** `null` |  |  |
| 

`assignedTo` \*

 | `string` **|** `null` |  |  |
| 

`barcode` \*

 | `string` **|** `null` |  |  |
| 

`totalMemoryMb` \*

 | `string` **|** `null` |  |  |
| 

`warrantyEndDate` \*

 | `number` **|** `null` |  |  |

---

### Oomnitza Saas

`oomnitza_saas` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` | SaaS application category. |  |
| `createdBy` | `string` | Username of the record creator. |  |
| `id` | `string` **|** `null` | Oomnitza internal numeric UID of the SaaS record. |  |
| 

`saasId` \*

 | `string` | Oomnitza SaaS application identifier (saas\_id). |  |
| `updatedBy` | `string` | Username of the last modifier. |  |
| 

`url` \*

 | `string` **|** `null` | SaaS application URL. |  |
| 

`vendor` \*

 | `string` **|** `null` | The vendor or the software publisher if vendor isn't provided. |  |

---

### Oomnitza Server

`oomnitza_server` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` **|** `null` |  |  |
| 

`assignedTo` \*

 | `string` **|** `null` |  |  |
| 

`barcode` \*

 | `string` **|** `null` |  |  |
| 

`totalMemoryMb` \*

 | `string` **|** `null` |  |  |
| 

`warrantyEndDate` \*

 | `number` **|** `null` |  |  |

---

### Oomnitza Software

`oomnitza_software` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` **|** `null` |  |  |
| 

`assignedTo` \*

 | `string` **|** `null` |  |  |
| 

`barcode` \*

 | `string` **|** `null` |  |  |
| 

`totalMemoryMb` \*

 | `string` **|** `null` |  |  |
| 

`warrantyEndDate` \*

 | `number` **|** `null` |  |  |

---

### Oomnitza Software Catalog

`oomnitza_software_catalog` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` | Software category. |  |
| `id` | `string` **|** `null` | Oomnitza internal numeric UID of the software record. |  |
| 

`softwareId` \*

 | `string` | Oomnitza software catalog record identifier (software\_id). |  |
| 

`vendor` \*

 | `string` **|** `null` | The vendor or the software publisher if vendor isn't provided. |  |
| 

`version` \*

 | `string` **|** `null` | Software version. |  |

---

### Oomnitza User

`oomnitza_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`role` \*

 | `number` **|** `null` |  |  |

---

## Release Notes

-   **2026-03-02** — Added software catalog, SaaS applications, contracts, and software assignment ingestion to the Oomnitza integration.
-   **2026-02-12** — New Oomnitza integration: ingests hardware assets, devices, users, and user-device assignments.

---

Source: /integrations/directory/open-nebula

# OpenNebula

Visualize your OpenNebula infrastructure in JupiterOne — accounts, clusters, physical hypervisor hosts, and virtual machines — map hosts to the workloads they run, and monitor changes through queries and alerts.

## Installation

This integration connects to an OpenNebula deployment through its XML-RPC API and ingests clusters, hosts (physical hypervisor nodes), and virtual machines. It is a collector-based integration. Every method is sent as an XML-RPC request to the single `/RPC2` path on the OpenNebula endpoint (default port `2633`), over either `http://` or `https://`.

### Configuration in OpenNebula

Before configuring the integration in JupiterOne, prepare the following in OpenNebula:

-   The **XML-RPC endpoint URL** of your OpenNebula deployment, reachable from the JupiterOne collector (for example, `http://opennebula:2633/RPC2`). The `/RPC2` suffix is optional and may be omitted.
    
-   A **user** for the integration to authenticate as. OpenNebula authenticates XML-RPC calls with a session string of the form `username:password`, the same format used by the `ONE_AUTH` file, so no API key or token is required.
    
-   Read access for that user to the resources you want ingested:
    
    -   `one.clusterpool.info` requires `CLUSTER:USE` (`* CLUSTER:USE #*`).
    -   `one.hostpool.info` requires `HOST:USE` (`* HOST:USE #*`).
    -   `one.vmpool.infoextended` requires admin, or a `VM:USE` ACL over all VMs (`* VM:USE #*`).
    
    The simplest setup is a dedicated read-only service user in the `oneadmin` group.
    
-   If the endpoint presents a self-signed or internal-CA TLS certificate over HTTPS, obtain the **CA certificate** (in PEM format) so the collector can verify the connection.
    

Once you have obtained the information above, proceed to JupiterOne to finalize the integration.

### Configuration in JupiterOne

To install the OpenNebula integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **OpenNebula**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the OpenNebula account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your OpenNebula **Endpoint URL**, **Username**, and **Password**.
    
-   Optionally, enable **Include Stopped VMs** to also ingest virtual machines in the stopped, suspended, done, poweroff, and undeployed states. This is disabled by default.
    
-   Optionally, a **CA Certificate** to trust a self-signed or internal-CA certificate, or enable **Disable TLS Verification** to skip certificate validation (not recommended).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (4)

-   `POST /RPC2 (one.clusterpool.info)`
-   `POST /RPC2 (one.hostpool.info)`
-   `POST /RPC2 (one.system.version)`
-   `POST /RPC2 (one.vmpool.infoextended)`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://docs.opennebula.io/6.10/integration\_and\_development/system\_interfaces/api.html](https://docs.opennebula.io/6.10/integration_and_development/system_interfaces/api.html)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `opennebula_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cluster | `opennebula_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Host | `opennebula_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| VirtualMachine | `opennebula_vm` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `opennebula_account` | **HAS** | `opennebula_cluster` |
| `opennebula_cluster` | **HAS** | `opennebula_host` |
| `opennebula_cluster` | **CONTAINS** | `opennebula_vm` |
| `opennebula_host` | **HOSTS** | `opennebula_vm` |

### Opennebula Account

`opennebula_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`version` \*

 | `string` **|** `null` | OpenNebula version reported by one.system.version. |  |

---

### Opennebula Cluster

`opennebula_cluster` inherits from [Cluster](/data-model/schemas/Cluster.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`hostCount` \*

 | `number` **|** `null` | Number of hosts that belong to the cluster. |  |

---

### Opennebula Host

`opennebula_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`clusterId` \*

 | `number` **|** `null` | Id of the cluster the host belongs to (HOST.CLUSTER\_ID); -1 when it belongs to none. Used to build the cluster-host relationship. |  |
| 

`cpu` \*

 | `number` **|** `null` | Total physical CPU cores (HOST.HOST\_SHARE.TOTAL\_CPU divided by 100). |  |
| 

`hostState` \*

 | `string` **|** `null` | Host state mapped from HOST.STATE (e.g. enabled, disabled, error, offline). |  |
| 

`hypervisorDriver` \*

 | `string` **|** `null` | Virtualization driver (HOST.VM\_MAD, e.g. kvm, lxc). |  |
| 

`maxMemoryKB` \*

 | `number` **|** `null` | Total host memory in KB (HOST.HOST\_SHARE.MAX\_MEM). |  |
| 

`monitoringDriver` \*

 | `string` **|** `null` | Information/monitoring driver (HOST.IM\_MAD). |  |
| 

`runningVMs` \*

 | `number` **|** `null` | Number of VMs running on the host. |  |
| 

`usedMemoryKB` \*

 | `number` **|** `null` | Used host memory in KB (HOST.HOST\_SHARE.MEM\_USAGE). |  |

---

### Opennebula Vm

`opennebula_vm` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cpu` \*

 | `number` **|** `null` | Number of vCPUs (VM.TEMPLATE.CPU). |  |
| 

`currentClusterId` \*

 | `number` **|** `null` | Id of the cluster currently hosting the VM (CID of the active HISTORY record); -1 or null when unplaced. Used to build the cluster-VM relationship. |  |
| 

`currentHostId` \*

 | `number` **|** `null` | Id of the host currently running the VM (HID of the active HISTORY record); -1 or null when unplaced. Used to build the host-VM relationship. |  |
| 

`deployId` \*

 | `string` **|** `null` | Hypervisor-level instance id (VM.DEPLOY\_ID). |  |
| 

`group` \*

 | `string` **|** `null` | Owner group name (VM.GNAME). |  |
| 

`ipAddress` \*

 | `string` **|** `null` | Primary NIC IP address (VM.TEMPLATE.NIC\[0\].IP). |  |
| 

`macAddress` \*

 | `string` **|** `null` | Primary NIC MAC address (VM.TEMPLATE.NIC\[0\].MAC). |  |
| 

`memoryMB` \*

 | `number` **|** `null` | Memory assigned to the VM in MB (VM.TEMPLATE.MEMORY). |  |
| 

`networkName` \*

 | `string` **|** `null` | Primary NIC virtual network name (VM.TEMPLATE.NIC\[0\].NETWORK). |  |
| 

`vmState` \*

 | `string` **|** `null` | VM state mapped from VM.STATE (e.g. active, poweroff, stopped). |  |

---

---

Source: /integrations/directory/oracle-cloud

# Oracle Cloud

Visualize OCI compute instances, virtual machine hosts, domains, access policies, oracle object storage, vaults, nosql services, streaming services , devops, functions, redis, resource manager , map OCI users to employees, and monitor changes through queries and alerts.

## Installation

This guide walks you through setting up the Oracle Cloud Infrastructure (OCI) integration in JupiterOne. The process involves two main steps:

1.  **Configure API access in Oracle Cloud** - Set up authentication credentials
2.  **Configure the integration in JupiterOne** - Connect JupiterOne to your OCI account

---

## Prerequisites

Before you begin, make sure you have:

-   **Admin access** to your Oracle Cloud Infrastructure account (or a user with sufficient permissions)
-   The ability to create API keys and configure IAM policies in OCI
-   Access to your JupiterOne account

---

## Step 1: Configure API Access in Oracle Cloud

To connect JupiterOne to your Oracle Cloud account, you'll need to create API credentials. Here's what you'll be collecting:

| Credential | What It Is | Where You'll Get It |
| --- | --- | --- |
| **Private Key** | The private half of an RSA key pair used for API authentication | Generated/downloaded during API key creation |
| **Tenancy OCID** | Your Oracle Cloud tenancy's unique identifier | Shown in the configuration preview after creating the API key |
| **User OCID** | The unique identifier for your OCI user account | Shown in the configuration preview after creating the API key |
| **Fingerprint** | A unique identifier for your public key | Shown in the configuration preview after creating the API key |
| **Region** | The Oracle Cloud region you want to connect to | Shown in the configuration preview after creating the API key |
| **Passphrase** | Optional password protecting your private key | Only needed if you used a passphrase when generating the key |

### Create an API Key in Oracle Cloud

1.  **Log into Oracle Cloud Infrastructure Console**
    
    -   Sign in as a tenancy administrator or a user with permissions to create API keys and manage IAM policies
2.  **Open your user settings**
    
    -   Open the **Profile** menu in the top-right corner and select **User settings** to configure a key for your own user
    -   Alternatively, go to **Identity & Security > Identity > Users** and select the user the key belongs to
3.  **Add an API key**
    
    -   On the user's page, open the **Tokens and keys** tab (in the older Console layout, click **API Keys** in the **Resources** section at the bottom left)
    -   Click **Add API Key**
4.  **Generate or upload a key pair**
    
    -   **Recommended**: Select **Generate API Key Pair**, then **Download Private Key** and save the file (for example, to `~/.oci`)
    -   **Alternative**: Select **Choose Public Key File** or **Paste Public Key** to supply a key you already have
5.  **Add the key**
    
    -   Click **Add**
    -   Keep the downloaded private key file secure; you'll need its contents for the JupiterOne integration
6.  **Save Your Configuration Values**
    
    -   After adding the API key, Oracle Cloud displays a **Configuration File Preview**
    -   This preview contains the following values you'll need:
        -   **User OCID**: `ocid1.user.oc1..xxxxx`
        -   **Tenancy OCID**: `ocid1.tenancy.oc1..xxxxx`
        -   **Fingerprint**: A string like `aa:bb:cc:dd:ee:ff:...`
        -   **Region**: Your region identifier (e.g., `us-ashburn-1`)
    -   **Copy and save these values** - you'll enter them in JupiterOne in the next step

For more detail, see Oracle's [Required Keys and OCIDs](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm) guide.

### Set Up Required Permissions

JupiterOne needs specific permissions to collect data from your Oracle Cloud account. This section walks you through creating a user group and assigning the necessary permissions via an IAM policy.

> **Why create a group?** Oracle Cloud policies are typically applied to groups rather than individual users. This makes management easier and follows security best practices.

#### Step 1: Create a User Group

1.  **Navigate to Identity & Security**
    
    -   In the OCI Console, open **Identity & Security** from the main menu
2.  **Select Domains**
    
    -   Click **Domains** in the left sidebar
    -   Select your **default domain** (usually named "Default")
3.  **Create a New Group**
    
    -   Click the **User Management** tab
    -   Scroll to the **Groups** section
    -   Click **Create Group**
4.  **Configure the Group**
    
    -   **Name**: Enter `J1Group` (or any name you prefer)
    -   **Description**: Add a description like "JupiterOne integration access group"
    -   **Users**: Add your current user (the one with the API key) to this group
    -   Click **Create**

#### Step 2: Create an IAM Policy

Now you'll create a policy that grants the necessary permissions to your group. You can choose between two approaches:

**Option A: Simple (Recommended for Most Users)**

-   Fastest to set up
-   Grants broad read and inspect permissions
-   Perfect if you don't need fine-grained control

**Option B: Granular**

-   More restrictive permissions
-   Follows the principle of least privilege
-   Better for organizations with strict security requirements

##### Option A: Simple Permissions (Recommended)

This approach grants JupiterOne the permissions it needs with just 3 policy statements:

1.  **Navigate to Policies**
    
    -   In the OCI Console, go to **Identity & Security > Identity > Policies**
2.  **Create New Policy**
    
    -   Click **Create Policy**
    -   **Name**: Enter a name like `J1-Integration-Policy`
    -   **Description**: Add a description like "Policy for JupiterOne integration access"
    -   **Policy Builder**: Select **Show manual builder**
3.  **Add Policy Statements**
    
    -   Copy and paste the following three statements into the policy editor:

```plaintext
Allow group J1Group to inspect all-resources in tenancy
Allow group J1Group to read all-resources in tenancy
Allow group J1Group to use network-security-groups in tenancy
```

4.  **Save the Policy**
    -   Click **Create** to save the policy

> **Important**: Replace `J1Group` with your actual group name if you used something different.

> **Note**: `read all-resources` is broader than JupiterOne needs. It includes `read secret-bundles`, which returns Vault secret contents, and `read objects`, which returns Object Storage object data. JupiterOne does not call those APIs, but if you don't want the group to hold those grants, use Option B instead.

##### Option B: Granular Permissions (Advanced)

If you prefer more restrictive, fine-grained permissions, use this comprehensive policy set instead:

1.  **Navigate to Policies**
    
    -   In the OCI Console, go to **Identity & Security > Identity > Policies**
2.  **Create New Policy**
    
    -   Click **Create Policy**
    -   **Name**: Enter a name like `J1-Integration-Policy-Granular`
    -   **Description**: Add a description like "Granular policy for JupiterOne integration access"
    -   **Policy Builder**: Select **Show manual builder**
3.  **Add Policy Statements**
    
    -   Copy and paste all of the following statements into the policy editor:

```plaintext
Allow group J1Group to inspect groups in tenancy
Allow group J1Group to read policies in tenancy
Allow group J1Group to inspect devops-family in tenancy
Allow group J1Group to read fn-function in tenancy
Allow group J1Group to read fn-app in tenancy
Allow group J1Group to read instances in tenancy
Allow group J1Group to inspect dedicated-vm-hosts in tenancy
Allow group J1Group to read nosql-indexes in tenancy
Allow group J1Group to inspect nosql-tables in tenancy
Allow group J1Group to read buckets in tenancy
Allow group J1Group to inspect redis-clusters in tenancy
Allow group J1Group to inspect orm-stacks in tenancy
Allow group J1Group to inspect streams in tenancy
Allow group J1Group to inspect stream-pools in tenancy
Allow group J1Group to inspect keys in tenancy
Allow group J1Group to inspect vaults in tenancy
Allow group J1Group to inspect secrets in tenancy
Allow group J1Group to inspect secret-bundles in tenancy
Allow group J1Group to inspect cloud-guard-problems in tenancy
Allow group J1Group to inspect cloud-guard-detectors in tenancy
Allow group J1Group to inspect cloud-guard-detector-recipes in tenancy
Allow group J1Group to inspect cloud-guard-detector-rule-definitions in tenancy
Allow group J1Group to inspect cloud-exadata-infrastructures in tenancy
Allow group J1Group to inspect cloud-vmclusters in tenancy
Allow group J1Group to read vcns in tenancy
Allow group J1Group to read subnets in tenancy
Allow group J1Group to read vnics in tenancy
Allow group J1Group to inspect load-balancers in tenancy
Allow group J1Group to inspect file-systems in tenancy
Allow group J1Group to inspect mount-targets in tenancy
Allow group J1Group to inspect volumes in tenancy
Allow group J1Group to inspect volume-groups in tenancy
Allow group J1Group to inspect log-groups in tenancy
Allow group J1Group to inspect ons-topics in tenancy
Allow group J1Group to inspect ons-subscriptions in tenancy
Allow group J1Group to inspect analytics-instances in tenancy
Allow group J1Group to inspect integration-instances in tenancy
Allow group J1Group to use network-security-groups in tenancy
Allow group J1Group to read security-lists in tenancy
Allow group J1Group to inspect recovery-service-protected-databases in tenancy
Allow group J1Group to inspect instance-images in tenancy
Allow group J1Group to read authentication-policies in tenancy
Allow group J1Group to read compartments in tenancy
Allow group J1Group to read domains in tenancy
Allow group J1Group to read users in tenancy
Allow group J1Group to inspect vnic-attachments in tenancy
Allow group J1Group to inspect loganalytics-resources-family in tenancy
Allow group J1Group to inspect db-homes in tenancy
Allow group J1Group to inspect databases in tenancy
Allow group J1Group to inspect data-safe-family in tenancy
Allow group J1Group to inspect container-instances in tenancy
Allow group J1Group to read alarms in tenancy
Allow group J1Group to read fast-connect-providers in tenancy
Allow group J1Group to inspect virtual-circuits in tenancy
Allow group J1Group to read email-domains in tenancy
Allow group J1Group to inspect dkims in tenancy
Allow group J1Group to read approved-senders in tenancy
Allow group J1Group to read suppressions in tenancy
Allow group J1Group to inspect credentials in tenancy
```

4.  **Save the Policy**
    -   Click **Create** to save the policy

> **Important**: Replace `J1Group` with your actual group name if you used something different.

#### Verify Your Setup

Before proceeding, confirm that:

-   Your user is a member of the group you created
-   The IAM policy has been created successfully
-   The policy includes your group name in all statements

---

## Step 2: Configure the Integration in JupiterOne

Now that you have your Oracle Cloud credentials ready, it's time to set up the integration in JupiterOne.

### Create a New Integration Instance

1.  **Navigate to Integrations**
    
    -   In JupiterOne, go to the **Integrations** page
    -   Find and select **Oracle Cloud** from the list of available integrations
2.  **Start Configuration**
    
    -   Click **New Instance** to begin setting up a new Oracle Cloud integration

### Enter Configuration Details

Fill out the following fields in the integration configuration form:

#### Basic Information

-   **Account Name** (Required)
    
    -   A friendly name to identify this Oracle Cloud account in JupiterOne
    -   This name will appear in tags on ingested entities (`tag.AccountName`)
    -   Example: `production-oci`, `us-east-oci`, or `company-oci`
-   **Description** (Optional)
    
    -   Additional information to help you identify this integration instance
    -   Useful if you have multiple Oracle Cloud accounts

#### Connection Settings

-   **Polling Interval** (Required)
    -   How often JupiterOne should automatically collect data from Oracle Cloud
    -   Options typically include: `DISABLED`, `1 hour`, `4 hours`, `12 hours`, `24 hours`
    -   Choose `DISABLED` if you prefer to run the integration manually

#### Oracle Cloud Credentials

Enter the values you collected in Step 1:

-   **Private Key** (Required)
    
    -   Upload the private key file (`.pem` file) you downloaded
    -   Upload the file as downloaded, without editing it. It includes the header and footer lines:
        
        ```text
        -----BEGIN PRIVATE KEY-----
        [key content]
        -----END PRIVATE KEY-----
        ```
        
-   **Tenancy OCID** (Required)
    
    -   Your tenancy's unique identifier
    -   Format: `ocid1.tenancy.oc1..xxxxx`
-   **User OCID** (Required)
    
    -   Your user's unique identifier
    -   Format: `ocid1.user.oc1..xxxxx`
-   **Fingerprint** (Required)
    
    -   The fingerprint associated with your API key
    -   Format: `aa:bb:cc:dd:ee:ff:...`
-   **Region** (Required)
    
    -   One or more Oracle Cloud regions to ingest, comma-separated
    -   Single region: `us-ashburn-1`; multiple regions: `us-ashburn-1,eu-frankfurt-1`
    -   Common values: `us-ashburn-1`, `us-phoenix-1`, `eu-frankfurt-1`, `ap-tokyo-1`
-   **Private Key Passphrase** (Optional, under **Other options**)
    
    -   Only required if you used a passphrase when generating the private key
    -   Leave blank if your key is not encrypted
-   **Cloud Guard Problems Ingestion Window** (Optional)
    
    -   Filters Cloud Guard problems by last-detected date
    -   Select `30 days`, `60 days`, or `90 days`; defaults to `30 days`

### Complete the Setup

1.  **Review your configuration**
    
    -   Double-check that all required fields are filled in correctly
    -   Verify that OCID values and fingerprints match what you saved from Oracle Cloud
2.  **Click Create**
    
    -   JupiterOne will validate the credentials and start the initial data collection
    -   The integration will begin running on your specified polling interval

---

## Next Steps

Once your integration is configured:

-   The integration will automatically run according to your polling interval (or you can run it manually)
-   Data from your Oracle Cloud account will begin populating in JupiterOne
-   You can view, manage, and edit your integration instance by visiting the [Instance management guide](/integrations/instance-management.md)

**Need help?** If you encounter any issues during setup, verify that:

-   Your API key permissions are correctly configured
-   All OCID values and fingerprints are copied correctly (watch for extra spaces)
-   You uploaded the complete private key file, including the header and footer lines

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (85)

-   `inspect analytics-instances`
-   `inspect approved-senders`
-   `inspect cloud-exadata-infrastructures`
-   `inspect cloud-guard-detector-recipes`
-   `inspect cloud-guard-detectors`
-   `inspect cloud-guard-problems`
-   `inspect cloud-guard-resource-types`
-   `inspect cloud-guard-targets`
-   `inspect cloud-vmclusters`
-   `inspect container-instances`
-   `inspect data-safe-family`
-   `inspect databases`
-   `inspect db-homes`
-   `inspect dedicated-vm-hosts`
-   `inspect devops-family`
-   `inspect dkims`
-   `inspect drg-attachments`
-   `inspect drgs`
-   `inspect email-domains`
-   `inspect filesystem-snapshot-policies`
-   `inspect fleet-resources`
-   `inspect groups`
-   `inspect instance-images`
-   `inspect integration-instances`
-   `inspect keys`
-   `inspect load-balancers`
-   `inspect log-groups`
-   `inspect loganalytics-resources-family`
-   `inspect nosql-tables`
-   `inspect ons-subscriptions`
-   `inspect ons-topics`
-   `inspect opsi-configurations`
-   `inspect opsi-data-objects`
-   `inspect opsi-database-insights`
-   `inspect opsi-exadata-insights`
-   `inspect opsi-host-insights`
-   `inspect opsi-private-endpoints`
-   `inspect orm-stacks`
-   `inspect recovery-service-protected-databases`
-   `inspect redis-clusters`
-   `inspect replication-targets`
-   `inspect replications`
-   `inspect secret-bundles`
-   `inspect secrets`
-   `inspect security-policy`
-   `inspect security-recipe`
-   `inspect security-zone`
-   `inspect stream-pools`
-   `inspect streams`
-   `inspect suppressions`
-   `inspect vaults`
-   `inspect virtual-circuits`
-   `inspect vnic-attachments`
-   `inspect volume-groups`
-   `inspect volumes`
-   `read alarms`
-   `read approved-senders`
-   `read audit-events`
-   `read authentication-policies`
-   `read buckets`
-   `read compartments`
-   `read compliance-policy-rules`
-   `read compliance-records`
-   `read domains`
-   `read email-domains`
-   `read fast-connect-providers`
-   `read file-systems`
-   `read fleet-resources`
-   `read fn-app`
-   `read fn-function`
-   `read goldengate-connections`
-   `read goldengate-deployment-backups`
-   `read goldengate-deployment-upgrades`
-   `read goldengate-deployments`
-   `read instances`
-   `read mount-targets`
-   `read nosql-indexes`
-   `read policies`
-   `read security-lists`
-   `read serviceconnectors`
-   `read subnets`
-   `read suppressions`
-   `read vcns`
-   `read vnics`
-   `use network-security-groups`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (122)

-   `https://analytics.{region}.ocp.oraclecloud.com/20190331/analyticsInstances`
-   `https://analytics.{region}.ocp.oraclecloud.com/20190331/analyticsInstances/{analyticsInstanceId}`
-   `https://audit.{region}.oraclecloud.com/20190901/configuration`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/detectorRecipes`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/detectorRecipes/{detectorRecipeId}`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/detectorRecipes/{detectorRecipeId}/detectorRules`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/problems`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/resourceTypes`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/securityPolicies`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/securityRecipes`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/securityZones`
-   `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/targets`
-   `https://compute-containers.{region}.oci.oraclecloud.com/20210415/containerInstances`
-   `https://compute-containers.{region}.oci.oraclecloud.com/20210415/containerInstances/{containerInstanceId}`
-   `https://compute-containers.{region}.oci.oraclecloud.com/20210415/containers/{containerId}`
-   `https://ctrl.email.{region}.oci.oraclecloud.com/20170907/dkims`
-   `https://ctrl.email.{region}.oci.oraclecloud.com/20170907/emailDomains`
-   `https://ctrl.email.{region}.oci.oraclecloud.com/20170907/emailDomains/{emailDomainId}`
-   `https://ctrl.email.{region}.oci.oraclecloud.com/20170907/senders`
-   `https://ctrl.email.{region}.oci.oraclecloud.com/20170907/senders/{senderId}`
-   `https://ctrl.email.{region}.oci.oraclecloud.com/20170907/suppressions`
-   `https://ctrl.email.{region}.oci.oraclecloud.com/20170907/suppressions/{suppressionId}`
-   `https://database.{region}.oraclecloud.com/20160918/cloudExadataInfrastructures`
-   `https://database.{region}.oraclecloud.com/20160918/cloudVmClusters`
-   `https://database.{region}.oraclecloud.com/20160918/databases`
-   `https://database.{region}.oraclecloud.com/20160918/dbHomes`
-   `https://datasafe.{region}.oci.oraclecloud.com/20181201/auditPolicies`
-   `https://datasafe.{region}.oci.oraclecloud.com/20181201/dataSafeConfiguration`
-   `https://datasafe.{region}.oci.oraclecloud.com/20181201/dataSafePrivateEndpoints`
-   `https://datasafe.{region}.oci.oraclecloud.com/20181201/dataSafePrivateEndpoints/{privateEndpointId}`
-   `https://datasafe.{region}.oci.oraclecloud.com/20181201/securityPolicies`
-   `https://datasafe.{region}.oci.oraclecloud.com/20181201/targetDatabases`
-   `https://datasafe.{region}.oci.oraclecloud.com/20181201/targetDatabases/{targetDatabaseId}`
-   `https://devops.{region}.oci.oraclecloud.com/20210630/buildPipelines`
-   `https://devops.{region}.oci.oraclecloud.com/20210630/deployEnvironments`
-   `https://devops.{region}.oci.oraclecloud.com/20210630/deployPipelines`
-   `https://devops.{region}.oci.oraclecloud.com/20210630/projects`
-   `https://devops.{region}.oci.oraclecloud.com/20210630/repositories`
-   `https://fams.{region}.oci.oraclecloud.com/20250228/compliancePolicyRules`
-   `https://fams.{region}.oci.oraclecloud.com/20250228/complianceRecords`
-   `https://fams.{region}.oci.oraclecloud.com/20250228/fleets`
-   `https://fams.{region}.oci.oraclecloud.com/20250228/fleets/{fleetId}`
-   `https://fams.{region}.oci.oraclecloud.com/20250228/fleets/{fleetId}/fleetResources`
-   `https://filestorage.{region}.oraclecloud.com/20171215/fileSystems`
-   `https://filestorage.{region}.oraclecloud.com/20171215/fileSystems/{fileSystemId}`
-   `https://filestorage.{region}.oraclecloud.com/20171215/filesystemSnapshotPolicies`
-   `https://filestorage.{region}.oraclecloud.com/20171215/mountTargets`
-   `https://filestorage.{region}.oraclecloud.com/20171215/mountTargets/{mountTargetId}`
-   `https://filestorage.{region}.oraclecloud.com/20171215/replicationTargets`
-   `https://filestorage.{region}.oraclecloud.com/20171215/replications`
-   `https://filestorage.{region}.oraclecloud.com/20171215/snapshots`
-   `https://functions.{region}.oci.oraclecloud.com/20181201/applications`
-   `https://functions.{region}.oci.oraclecloud.com/20181201/functions`
-   `https://goldengate.{region}.oci.oraclecloud.com/20200407/connections`
-   `https://goldengate.{region}.oci.oraclecloud.com/20200407/connections/{connectionId}`
-   `https://goldengate.{region}.oci.oraclecloud.com/20200407/deploymentBackups`
-   `https://goldengate.{region}.oci.oraclecloud.com/20200407/deploymentUpgrades`
-   `https://goldengate.{region}.oci.oraclecloud.com/20200407/deployments`
-   `https://goldengate.{region}.oci.oraclecloud.com/20200407/deployments/{deploymentId}`
-   `https://iaas.{region}.oraclecloud.com/20160918/bootVolumes`
-   `https://iaas.{region}.oraclecloud.com/20160918/dedicatedVmHosts`
-   `https://iaas.{region}.oraclecloud.com/20160918/dedicatedVmHosts/{dedicatedVmHostId}`
-   `https://iaas.{region}.oraclecloud.com/20160918/drgAttachments`
-   `https://iaas.{region}.oraclecloud.com/20160918/drgs`
-   `https://iaas.{region}.oraclecloud.com/20160918/fastConnectProviderServices`
-   `https://iaas.{region}.oraclecloud.com/20160918/images`
-   `https://iaas.{region}.oraclecloud.com/20160918/instances`
-   `https://iaas.{region}.oraclecloud.com/20160918/networkSecurityGroups`
-   `https://iaas.{region}.oraclecloud.com/20160918/networkSecurityGroups/{networkSecurityGroupId}/securityRules`
-   `https://iaas.{region}.oraclecloud.com/20160918/securityLists`
-   `https://iaas.{region}.oraclecloud.com/20160918/subnets`
-   `https://iaas.{region}.oraclecloud.com/20160918/vcns`
-   `https://iaas.{region}.oraclecloud.com/20160918/virtualCircuits`
-   `https://iaas.{region}.oraclecloud.com/20160918/vnicAttachments`
-   `https://iaas.{region}.oraclecloud.com/20160918/vnics/{vnicId}`
-   `https://iaas.{region}.oraclecloud.com/20160918/volumeGroups`
-   `https://iaas.{region}.oraclecloud.com/20160918/volumes`
-   `https://iaas.{region}.oraclecloud.com/20170115/loadBalancers`
-   `https://identity.{region}.oraclecloud.com/20160918/authenticationPolicies/{compartmentId}`
-   `https://identity.{region}.oraclecloud.com/20160918/compartments`
-   `https://identity.{region}.oraclecloud.com/20160918/compartments/{tenancyId}`
-   `https://identity.{region}.oraclecloud.com/20160918/domains`
-   `https://identity.{region}.oraclecloud.com/20160918/policies`
-   `https://identity.{region}.oraclecloud.com/20160918/userGroupMemberships`
-   `https://identity.{region}.oraclecloud.com/20160918/users/{userId}/smtpCredentials`
-   `https://integration.{region}.ocp.oraclecloud.com/20190131/integrationInstances`
-   `https://kms.{region}.oraclecloud.com/20180608/vaults`
-   `https://loganalytics.{region}.oci.oraclecloud.com/20200601/namespaces/{namespace}/logAnalyticsEntities`
-   `https://loganalytics.{region}.oci.oraclecloud.com/20200601/namespaces/{namespace}/rules`
-   `https://logging.{region}.oci.oraclecloud.com/20200531/logGroups`
-   `https://logging.{region}.oci.oraclecloud.com/20200531/logGroups/{logGroupId}/logs`
-   `https://logging.{region}.oci.oraclecloud.com/20200531/logGroups/{logGroupId}/logs/{logId}`
-   `https://logging.{region}.oci.oraclecloud.com/20200531/logServices`
-   `https://nosql.{region}.oci.oraclecloud.com/20190828/tables`
-   `https://nosql.{region}.oci.oraclecloud.com/20190828/tables/{tableName}/indexes`
-   `https://notification.{region}.oraclecloud.com/20181201/subscriptions`
-   `https://notification.{region}.oraclecloud.com/20181201/topics`
-   `https://objectstorage.{region}.oraclecloud.com/n/`
-   `https://objectstorage.{region}.oraclecloud.com/n/{namespace}/b`
-   `https://objectstorage.{region}.oraclecloud.com/n/{namespace}/b/{bucketName}`
-   `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/databaseInsights`
-   `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/exadataConfigurations`
-   `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/exadataInsights`
-   `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/hostConfigurations`
-   `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/hostInsights`
-   `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/operationsInsightsPrivateEndpoints`
-   `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/opsiConfigurations`
-   `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/opsiConfigurations/{opsiConfigurationId}`
-   `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/opsiDataObjects`
-   `https://recovery.{region}.oci.oraclecloud.com/20210216/protectedDatabases`
-   `https://redis.{region}.oci.oraclecloud.com/20220315/redisClusters`
-   `https://resourcemanager.{region}.oraclecloud.com/20180917/stacks`
-   `https://service-connector-hub.{region}.oci.oraclecloud.com/20200909/serviceConnectors`
-   `https://service-connector-hub.{region}.oci.oraclecloud.com/20200909/serviceConnectors/{serviceConnectorId}`
-   `https://streaming.{region}.oci.oraclecloud.com/20180418/streamPools`
-   `https://streaming.{region}.oci.oraclecloud.com/20180418/streams`
-   `https://telemetry-ingestion.{region}.oraclecloud.com/20180401/alarms`
-   `https://telemetry-ingestion.{region}.oraclecloud.com/20180401/alarms/{alarmId}`
-   `https://vaults.{region}.oci.oraclecloud.com/20180608/secrets`
-   `https://{domain_host}/admin/v1/Groups`
-   `https://{domain_host}/admin/v1/Users`
-   `https://{vault_management_endpoint}/20180608/keys`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (112)

-   [https://docs.oracle.com/en-us/iaas/Content/Audit/Concepts/auditoverview.htm](https://docs.oracle.com/en-us/iaas/Content/Audit/Concepts/auditoverview.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Balance/home.htm](https://docs.oracle.com/en-us/iaas/Content/Balance/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Functions/home.htm](https://docs.oracle.com/en-us/iaas/Content/Functions/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/corepolicyreference.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/corepolicyreference.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/emailpolicyreference.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/emailpolicyreference.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/filestoragepolicyreference.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/filestoragepolicyreference.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Identity/access/working-with-smtp-credentials.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/access/working-with-smtp-credentials.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Identity/policyreference/iampolicyreference.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/policyreference/iampolicyreference.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/KeyManagement/home.htm](https://docs.oracle.com/en-us/iaas/Content/KeyManagement/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Logging/home.htm](https://docs.oracle.com/en-us/iaas/Content/Logging/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Monitoring/home.htm](https://docs.oracle.com/en-us/iaas/Content/Monitoring/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/ResourceManager/home.htm](https://docs.oracle.com/en-us/iaas/Content/ResourceManager/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/Streaming/home.htm](https://docs.oracle.com/en-us/iaas/Content/Streaming/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/cloud-guard/home.htm](https://docs.oracle.com/en-us/iaas/Content/cloud-guard/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/connector-hub/overview.htm](https://docs.oracle.com/en-us/iaas/Content/connector-hub/overview.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/container-instances/home.htm](https://docs.oracle.com/en-us/iaas/Content/container-instances/home.htm)
-   [https://docs.oracle.com/en-us/iaas/Content/devops/using/home.htm](https://docs.oracle.com/en-us/iaas/Content/devops/using/home.htm)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/analytics/20190331/AnalyticsInstance/ListAnalyticsInstances](https://docs.oracle.com/en-us/iaas/api/#/en/analytics/20190331/AnalyticsInstance/ListAnalyticsInstances)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/audit/20190901/Configuration/GetConfiguration](https://docs.oracle.com/en-us/iaas/api/#/en/audit/20190901/Configuration/GetConfiguration)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/DetectorRecipe/GetDetectorRecipe](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/DetectorRecipe/GetDetectorRecipe)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/DetectorRecipe/ListDetectorRecipes](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/DetectorRecipe/ListDetectorRecipes)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/DetectorRecipeDetectorRule/ListDetectorRecipeDetectorRules](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/DetectorRecipeDetectorRule/ListDetectorRecipeDetectorRules)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/Problem/ListProblems](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/Problem/ListProblems)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/ResourceTypeSummary/ListResourceTypes](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/ResourceTypeSummary/ListResourceTypes)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/SecurityPolicy/ListSecurityPolicies](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/SecurityPolicy/ListSecurityPolicies)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/SecurityRecipe/ListSecurityRecipes](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/SecurityRecipe/ListSecurityRecipes)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/SecurityZone/ListSecurityZones](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/SecurityZone/ListSecurityZones)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/Target/ListTargets](https://docs.oracle.com/en-us/iaas/api/#/en/cloud-guard/20200131/Target/ListTargets)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/container-instances/20210415/Container/GetContainer](https://docs.oracle.com/en-us/iaas/api/#/en/container-instances/20210415/Container/GetContainer)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/container-instances/20210415/ContainerInstance/ListContainerInstances](https://docs.oracle.com/en-us/iaas/api/#/en/container-instances/20210415/ContainerInstance/ListContainerInstances)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/AuditPolicySummary/ListAuditPolicies](https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/AuditPolicySummary/ListAuditPolicies)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/DataSafeConfiguration/GetDataSafeConfiguration](https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/DataSafeConfiguration/GetDataSafeConfiguration)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/PrivateEndpointSummary/ListPrivateEndpoints](https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/PrivateEndpointSummary/ListPrivateEndpoints)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/SecurityPolicySummary/ListSecurityPolicies](https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/SecurityPolicySummary/ListSecurityPolicies)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/TargetDatabaseSummary/ListTargetDatabases](https://docs.oracle.com/en-us/iaas/api/#/en/data-safe/20181201/TargetDatabaseSummary/ListTargetDatabases)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/CloudExadataInfrastructure/ListCloudExadataInfrastructures](https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/CloudExadataInfrastructure/ListCloudExadataInfrastructures)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/CloudVmCluster/ListCloudVmClusters](https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/CloudVmCluster/ListCloudVmClusters)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/Database/ListDatabases](https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/Database/ListDatabases)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/DbHome/ListDbHomes](https://docs.oracle.com/en-us/iaas/api/#/en/database/20160918/DbHome/ListDbHomes)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/BuildPipeline/ListBuildPipelines](https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/BuildPipeline/ListBuildPipelines)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/DeployEnvironment/ListDeployEnvironments](https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/DeployEnvironment/ListDeployEnvironments)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/DeployPipeline/ListDeployPipelines](https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/DeployPipeline/ListDeployPipelines)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/Project/ListProjects](https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/Project/ListProjects)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/Repository/ListRepositories](https://docs.oracle.com/en-us/iaas/api/#/en/devops/20210630/Repository/ListRepositories)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/FileSystem/GetFileSystem](https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/FileSystem/GetFileSystem)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/FileSystem/ListFileSystems](https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/FileSystem/ListFileSystems)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/FilesystemSnapshotPolicy/ListFilesystemSnapshotPolicies](https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/FilesystemSnapshotPolicy/ListFilesystemSnapshotPolicies)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/MountTarget/GetMountTarget](https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/MountTarget/GetMountTarget)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/MountTarget/ListMountTargets](https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/MountTarget/ListMountTargets)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/Replication/ListReplications](https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/Replication/ListReplications)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/ReplicationTarget/ListReplicationTargets](https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/ReplicationTarget/ListReplicationTargets)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/Snapshot/ListSnapshots](https://docs.oracle.com/en-us/iaas/api/#/en/filestorage/20171215/Snapshot/ListSnapshots)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/fleet-management/20250228/Compliance/](https://docs.oracle.com/en-us/iaas/api/#/en/fleet-management/20250228/Compliance/)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/fleet-management/20250228/CompliancePolicyRule/](https://docs.oracle.com/en-us/iaas/api/#/en/fleet-management/20250228/CompliancePolicyRule/)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/fleet-management/20250228/Fleet/](https://docs.oracle.com/en-us/iaas/api/#/en/fleet-management/20250228/Fleet/)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/fleet-management/20250228/FleetResource/](https://docs.oracle.com/en-us/iaas/api/#/en/fleet-management/20250228/FleetResource/)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/functions/20181201/Application/ListApplications](https://docs.oracle.com/en-us/iaas/api/#/en/functions/20181201/Application/ListApplications)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/Connection/](https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/Connection/)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/Deployment/](https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/Deployment/)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/DeploymentBackup/](https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/DeploymentBackup/)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/DeploymentUpgrade/](https://docs.oracle.com/en-us/iaas/api/#/en/goldengate/20200407/DeploymentUpgrade/)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/BootVolume/ListBootVolumes](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/BootVolume/ListBootVolumes)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/DedicatedVmHost/ListDedicatedVmHosts](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/DedicatedVmHost/ListDedicatedVmHosts)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Drg/ListDrgs](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Drg/ListDrgs)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/DrgAttachment/ListDrgAttachments](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/DrgAttachment/ListDrgAttachments)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/FastConnectProviderService/ListFastConnectProviderServices](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/FastConnectProviderService/ListFastConnectProviderServices)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Image/ListImages](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Image/ListImages)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Instance/ListInstances](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Instance/ListInstances)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/NetworkSecurityGroup/ListNetworkSecurityGroups](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/NetworkSecurityGroup/ListNetworkSecurityGroups)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/SecurityList/ListSecurityLists](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/SecurityList/ListSecurityLists)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/SecurityRule/ListNetworkSecurityGroupSecurityRules](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/SecurityRule/ListNetworkSecurityGroupSecurityRules)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Subnet/ListSubnets](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Subnet/ListSubnets)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Vcn/ListVcns](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Vcn/ListVcns)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/VirtualCircuit/ListVirtualCircuits](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/VirtualCircuit/ListVirtualCircuits)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/VnicAttachment/ListVnicAttachments](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/VnicAttachment/ListVnicAttachments)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Volume/ListVolumes](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/Volume/ListVolumes)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/VolumeGroup/ListVolumeGroups](https://docs.oracle.com/en-us/iaas/api/#/en/iaas/20160918/VolumeGroup/ListVolumeGroups)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/AuthenticationPolicy/GetAuthenticationPolicy](https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/AuthenticationPolicy/GetAuthenticationPolicy)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/Compartment/ListCompartments](https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/Compartment/ListCompartments)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/Domain/ListDomains](https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/Domain/ListDomains)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/Policy/ListPolicies](https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/Policy/ListPolicies)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/UserGroupMembership/ListUserGroupMemberships](https://docs.oracle.com/en-us/iaas/api/#/en/identity/20160918/UserGroupMembership/ListUserGroupMemberships)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/integration/20190131/IntegrationInstance/ListIntegrationInstances](https://docs.oracle.com/en-us/iaas/api/#/en/integration/20190131/IntegrationInstance/ListIntegrationInstances)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/key/release/Key/ListKeys](https://docs.oracle.com/en-us/iaas/api/#/en/key/release/Key/ListKeys)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/key/release/Vault/ListVaults](https://docs.oracle.com/en-us/iaas/api/#/en/key/release/Vault/ListVaults)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/loadbalancer/20170115/LoadBalancer/ListLoadBalancers](https://docs.oracle.com/en-us/iaas/api/#/en/loadbalancer/20170115/LoadBalancer/ListLoadBalancers)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/log-analytics/20200601/LogAnalyticsEntity/ListLogAnalyticsEntities](https://docs.oracle.com/en-us/iaas/api/#/en/log-analytics/20200601/LogAnalyticsEntity/ListLogAnalyticsEntities)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/logging-management/20200531/Log/ListLogs](https://docs.oracle.com/en-us/iaas/api/#/en/logging-management/20200531/Log/ListLogs)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/logging-management/20200531/LogGroup/ListLogGroups](https://docs.oracle.com/en-us/iaas/api/#/en/logging-management/20200531/LogGroup/ListLogGroups)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/monitoring/20180401/AlarmSummary/ListAlarms](https://docs.oracle.com/en-us/iaas/api/#/en/monitoring/20180401/AlarmSummary/ListAlarms)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/nosql-database/20190828/Index/ListIndexes](https://docs.oracle.com/en-us/iaas/api/#/en/nosql-database/20190828/Index/ListIndexes)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/nosql-database/20190828/Table/ListTables](https://docs.oracle.com/en-us/iaas/api/#/en/nosql-database/20190828/Table/ListTables)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/objectstorage/20160918/Bucket/ListBuckets](https://docs.oracle.com/en-us/iaas/api/#/en/objectstorage/20160918/Bucket/ListBuckets)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/ons/20181201/NotificationTopicSummary/ListTopics](https://docs.oracle.com/en-us/iaas/api/#/en/ons/20181201/NotificationTopicSummary/ListTopics)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/ons/20181201/SubscriptionSummary/ListSubscriptions](https://docs.oracle.com/en-us/iaas/api/#/en/ons/20181201/SubscriptionSummary/ListSubscriptions)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/DatabaseInsights/ListDatabaseInsights](https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/DatabaseInsights/ListDatabaseInsights)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/ExadataInsights/ListExadataConfigurations](https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/ExadataInsights/ListExadataConfigurations)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/ExadataInsights/ListExadataInsights](https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/ExadataInsights/ListExadataInsights)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/HostInsights/ListHostConfigurations](https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/HostInsights/ListHostConfigurations)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/HostInsights/ListHostInsights](https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/HostInsights/ListHostInsights)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/OperationsInsightsPrivateEndpoint/](https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/OperationsInsightsPrivateEndpoint/)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/OpsiConfigurations/GetOpsiConfiguration](https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/OpsiConfigurations/GetOpsiConfiguration)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/OpsiDataObjects/ListOpsiDataObjects](https://docs.oracle.com/en-us/iaas/api/#/en/operations-insights/20200630/OpsiDataObjects/ListOpsiDataObjects)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/recovery-service/20210216/ProtectedDatabase/ListProtectedDatabases](https://docs.oracle.com/en-us/iaas/api/#/en/recovery-service/20210216/ProtectedDatabase/ListProtectedDatabases)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/redis/20220315/RedisCluster/ListRedisClusters](https://docs.oracle.com/en-us/iaas/api/#/en/redis/20220315/RedisCluster/ListRedisClusters)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/resourcemanager/20180917/Stack/ListStacks](https://docs.oracle.com/en-us/iaas/api/#/en/resourcemanager/20180917/Stack/ListStacks)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/secretmgmt/20180608/SecretSummary/ListSecrets](https://docs.oracle.com/en-us/iaas/api/#/en/secretmgmt/20180608/SecretSummary/ListSecrets)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/serviceconnectors/20200909/ServiceConnector/ListServiceConnectors](https://docs.oracle.com/en-us/iaas/api/#/en/serviceconnectors/20200909/ServiceConnector/ListServiceConnectors)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/streaming/20180418/Stream/ListStreams](https://docs.oracle.com/en-us/iaas/api/#/en/streaming/20180418/Stream/ListStreams)
-   [https://docs.oracle.com/en-us/iaas/api/#/en/streaming/20180418/StreamPool/ListStreamPools](https://docs.oracle.com/en-us/iaas/api/#/en/streaming/20180418/StreamPool/ListStreamPools)
-   [https://docs.oracle.com/en/cloud/paas/identity-cloud/rest-api/op-admin-v1-groups-get.html](https://docs.oracle.com/en/cloud/paas/identity-cloud/rest-api/op-admin-v1-groups-get.html)
-   [https://docs.oracle.com/en/cloud/paas/identity-cloud/rest-api/op-admin-v1-users-get.html](https://docs.oracle.com/en/cloud/paas/identity-cloud/rest-api/op-admin-v1-users-get.html)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (50)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Build DRG Connects VCN Relationships | `inspect drg-attachments` | `https://iaas.{region}.oraclecloud.com/20160918/drgAttachments` |
| Build Group -> User Relationships | `inspect groups` | `https://identity.{region}.oraclecloud.com/20160918/userGroupMemberships` |
| Fetch CloudGuard Detector Recipe Rules | `inspect cloud-guard-detectors` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/detectorRecipes/{detectorRecipeId}/detectorRules` |
| Fetch CloudGuard Detector Recipes | `inspect cloud-guard-detector-recipes` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/detectorRecipes`, `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/detectorRecipes/{detectorRecipeId}` |
| Fetch CloudGuard Problems | `inspect cloud-guard-problems` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/problems` |
| Fetch CloudGuard Resource Types | `inspect cloud-guard-resource-types` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/resourceTypes` |
| Fetch CloudGuard Security Policies | `inspect security-policy` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/securityPolicies` |
| Fetch CloudGuard Security Recipes | `inspect security-recipe` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/securityRecipes` |
| Fetch CloudGuard Security Zones | `inspect security-zone` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/securityZones` |
| Fetch CloudGuard Targets | `inspect cloud-guard-targets` | `https://cloudguard-cp-api.{region}.oci.oraclecloud.com/20200131/targets` |
| Fetch Container Instances | `inspect container-instances` | `https://compute-containers.{region}.oci.oraclecloud.com/20210415/containerInstances`, `https://compute-containers.{region}.oci.oraclecloud.com/20210415/containerInstances/{containerInstanceId}` |
| Fetch Containers | `inspect container-instances` | `https://compute-containers.{region}.oci.oraclecloud.com/20210415/containers/{containerId}` |
| Fetch Data Safe Audit Policies | `inspect data-safe-family` | `https://datasafe.{region}.oci.oraclecloud.com/20181201/auditPolicies` |
| Fetch Data Safe Private Endpoints | `inspect data-safe-family` | `https://datasafe.{region}.oci.oraclecloud.com/20181201/dataSafePrivateEndpoints`, `https://datasafe.{region}.oci.oraclecloud.com/20181201/dataSafePrivateEndpoints/{privateEndpointId}` |
| Fetch Data Safe Security Policies | `inspect data-safe-family` | `https://datasafe.{region}.oci.oraclecloud.com/20181201/securityPolicies` |
| Fetch Data Safe Target Databases | `inspect data-safe-family` | `https://datasafe.{region}.oci.oraclecloud.com/20181201/targetDatabases`, `https://datasafe.{region}.oci.oraclecloud.com/20181201/targetDatabases/{targetDatabaseId}` |
| Fetch Email DKIMs | `inspect dkims` | `https://ctrl.email.{region}.oci.oraclecloud.com/20170907/dkims` |
| Fetch FastConnect Virtual Circuits | `inspect virtual-circuits` | `https://iaas.{region}.oraclecloud.com/20160918/virtualCircuits` |
| Fetch File System Snapshots | `read file-systems` | `https://filestorage.{region}.oraclecloud.com/20171215/snapshots` |
| Fetch File Systems | `read file-systems` | `https://filestorage.{region}.oraclecloud.com/20171215/fileSystems`, `https://filestorage.{region}.oraclecloud.com/20171215/fileSystems/{fileSystemId}` |
| Fetch Fleet Application Management Compliance Records | `read compliance-records` | `https://fams.{region}.oci.oraclecloud.com/20250228/complianceRecords` |
| Fetch Fleet Application Management Fleet Resources | `inspect fleet-resources`, `read fleet-resources` | `https://fams.{region}.oci.oraclecloud.com/20250228/fleets/{fleetId}/fleetResources` |
| Fetch GoldenGate Deployment Backups | `read goldengate-deployment-backups` | `https://goldengate.{region}.oci.oraclecloud.com/20200407/deploymentBackups` |
| Fetch GoldenGate Deployment Upgrades | `read goldengate-deployment-upgrades` | `https://goldengate.{region}.oci.oraclecloud.com/20200407/deploymentUpgrades` |
| Fetch Groups | `read domains` | `https://{domain_host}/admin/v1/Groups` |
| Fetch Instances | `read instances` | `https://iaas.{region}.oraclecloud.com/20160918/instances` |
| Fetch OCI Logs | `inspect log-groups` | `https://logging.{region}.oci.oraclecloud.com/20200531/logGroups/{logGroupId}/logs` |
| Fetch OPSI Configurations | `inspect opsi-configurations` | `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/opsiConfigurations`, `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/opsiConfigurations/{opsiConfigurationId}` |
| Fetch OPSI Data Objects | `inspect opsi-data-objects` | `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/opsiDataObjects` |
| Fetch OPSI Database Insights | `inspect opsi-database-insights` | `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/databaseInsights` |
| Fetch OPSI Exadata Configurations | `inspect opsi-exadata-insights` | `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/exadataConfigurations` |
| Fetch OPSI Exadata Insights | `inspect opsi-exadata-insights` | `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/exadataInsights` |
| Fetch OPSI Host Configurations | `inspect opsi-host-insights` | `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/hostConfigurations` |
| Fetch OPSI Host Insights | `inspect opsi-host-insights` | `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/hostInsights` |
| Fetch OPSI Private Endpoints | `inspect opsi-private-endpoints` | `https://operationsinsights.{region}.oci.oraclecloud.com/20200630/operationsInsightsPrivateEndpoints` |
| Fetch Oracle Kms Key | `inspect keys` | `https://{vault_management_endpoint}/20180608/keys` |
| Fetch Oracle Nosql Index | `read nosql-indexes` | `https://nosql.{region}.oci.oraclecloud.com/20190828/tables/{tableName}/indexes` |
| Fetch SMTP Credentials | \- | `https://identity.{region}.oraclecloud.com/20160918/users/{userId}/smtpCredentials` |
| Fetch Subscriptions | `inspect ons-subscriptions` | `https://notification.{region}.oraclecloud.com/20181201/subscriptions` |
| Fetch Users | `read domains` | `https://{domain_host}/admin/v1/Users` |
| fetch-databases | `inspect databases` | `https://database.{region}.oraclecloud.com/20160918/databases` |
| fetch-devops-build-pipelines | `inspect devops-family` | `https://devops.{region}.oci.oraclecloud.com/20210630/buildPipelines` |
| fetch-devops-deploy-environment | `inspect devops-family` | `https://devops.{region}.oci.oraclecloud.com/20210630/deployEnvironments` |
| fetch-devops-deploy-pipelines | `inspect devops-family` | `https://devops.{region}.oci.oraclecloud.com/20210630/deployPipelines` |
| fetch-network-security-group | `use network-security-groups` | `https://iaas.{region}.oraclecloud.com/20160918/networkSecurityGroups` |
| fetch-network-security-Rule | `use network-security-groups` | `https://iaas.{region}.oraclecloud.com/20160918/networkSecurityGroups/{networkSecurityGroupId}/securityRules` |
| fetch-oac-analytics-instances | `inspect analytics-instances` | `https://analytics.{region}.ocp.oraclecloud.com/20190331/analyticsInstances`, `https://analytics.{region}.ocp.oraclecloud.com/20190331/analyticsInstances/{analyticsInstanceId}` |
| fetch-oic-integration-instances | `inspect integration-instances` | `https://integration.{region}.ocp.oraclecloud.com/20190131/integrationInstances` |
| fetch-repository | `inspect devops-family` | `https://devops.{region}.oci.oraclecloud.com/20210630/repositories` |
| fetch-security-list | `read security-lists` | `https://iaas.{region}.oraclecloud.com/20160918/securityLists` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `oci_compartment` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| ADB Protected Database | `oci_adb_protected_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Alert Object | `oci_alert_object` | [Alert](https://docs.jupiterone.io/data-model/schemas/Alert) |
| Audit | `oci_audit` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Authentication Policy | `oci_authentication_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Block Volume | `oci_block_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Boot Disk Image | `oci_boot_disk_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Boot Volume | `oci_boot_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| CachingService | `oci_caching` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| CloudGuard Detector Recipe | `oci_cloudguard_detector_recipe` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| CloudGuard Detector Recipe Rule | `oci_cloudguard_detector_recipe_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| CloudGuard Problems | `oci_cloudguard_problem` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| CloudGuard Resource Type | `oci_cloudguard_resource_type` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CloudGuard Security Policy | `oci_cloudguard_security_policy` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| CloudGuard Security Recipe | `oci_cloudguard_security_recipe` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| CloudGuard Security Zone | `oci_cloudguard_security_zone` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| CloudGuard Service | `oci_cloudguard` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| CloudGuard Target | `oci_cloudguard_target` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ComputeInstance | `oci_compute_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Container | `oci_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| ContainerInstance | `oci_container_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| ContainerInstancesService | `oci_container_instance_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Database | `oci_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Database Home | `oci_database_home` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DatabaseInsight | `oci_opsi_database_insight` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DataSafeAuditPolicy | `oci_data_safe_audit_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DataSafePrivateEndpoint | `oci_data_safe_private_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| DataSafeSecurityPolicy | `oci_data_safe_security_policy` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DataSafeService | `oci_data_safe` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| DataSafeTargetDatabase | `oci_data_safe_target_database` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| DedicatedVMHost | `oci_dedicated_vm_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| DevopsBuildPipeline | `oci_devops_build_pipeline` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DevopsDeployEnvironment | `oci_devops_deploy_environment` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DevopsDeployPipeline | `oci_devops_deploy_pipeline` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DevopsProject | `oci_devops_project` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| DevopsRepository | `oci_devops_repository` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| DevopsService | `oci_devops_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Domain | `oci_domain` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| DynamicRoutingGateway | `oci_drg` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Email Delivery Service | `oci_email_delivery_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Email DKIM | `oci_email_dkim` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Email Domain | `oci_email_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| Email Sender | `oci_email_sender` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Email Suppression | `oci_email_suppression` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Exadata Infrastructure | `oci_exadata_infrastructure` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| ExadataConfiguration | `oci_opsi_exadata_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ExadataInsight | `oci_opsi_exadata_insight` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| FastConnectCrossConnectMapping | `oci_fastconnect_cross_connect_mapping` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| FastConnectProviderService | `oci_fastconnect_provider_service` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| FastConnectProviderServiceKey | `oci_fastconnect_provider_service_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| FastConnectService | `oci_fastconnect` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| FastConnectVirtualCircuit | `oci_fastconnect_virtual_circuit` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| File system | `oci_file_system` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| File System Replication | `oci_file_system_replication` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| File System Replication Target | `oci_file_system_replication_target` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| File System Snapshot | `oci_file_system_snapshot` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| File System Snapshot Policy | `oci_file_system_snapshot_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Fleet | `oci_fleet` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Fleet Compliance Policy Rule | `oci_fleet_compliance_policy_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Fleet Compliance Record | `oci_fleet_compliance_record` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Fleet Resource | `oci_fleet_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| FunctionsFunction | `oci_functions_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| FunctionsService | `oci_functions` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| GoldenGate Connection | `oci_goldengate_connection` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| GoldenGate Deployment | `oci_goldengate_deployment` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| GoldenGate Deployment Backup | `oci_goldengate_deployment_backup` | [Backup](https://docs.jupiterone.io/data-model/schemas/Backup) |
| GoldenGate Deployment Upgrade | `oci_goldengate_deployment_upgrade` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Group | `oci_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| HostConfiguration | `oci_opsi_host_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| HostInsight | `oci_opsi_host_insight` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Kms key | `oci_kms_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| Load Balancer | `oci_load_balancer` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Log | `oci_log` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| Log Analytics Entity | `oci_log_analytics_entity` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Logging Object | `oci_logging_object` | [Logs](https://docs.jupiterone.io/data-model/schemas/Logs) |
| Logging Service Summary | `oci_logging_service_summary` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| MonitoringAlarm | `oci_monitoring_alarm` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Mount Target | `oci_mount_target` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Network Security Group | `oci_network_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Network Security Rule | `oci_network_security_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| NOSQL Index | `oci_nosql_index` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| NOSQL Service | `oci_nosql` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| NOSQL table | `oci_nosql_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Notification Topic | `oci_notification_topic` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| OAC Analytics Instance | `oci_oac_analytics_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| ObjectStorageBucket | `oci_objectstorage_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| OIC Integration Instance | `oci_oic_integration_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| OperationsInsightsPrivateEndpoint | `oci_opsi_private_endpoint` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| OperationsInsightsService | `oci_opsi_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| OpsiConfiguration | `oci_opsi_configuration` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| OpsiDataObject | `oci_opsi_data_object` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| OracleObjectStorage | `oci_objectstorage` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Policy | `oci_access_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| RedisCluster | `oci_caching_redis_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| ResourceManagerService | `oci_resourcemanager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| ResourceManagerStacks | `oci_resourcemanager_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Security List | `oci_security_list` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Service Connector | `oci_service_connector` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| SMTP Credential | `oci_smtp_credential` | [AccessKey](https://docs.jupiterone.io/data-model/schemas/AccessKey) |
| Streaming Pool | `oci_streaming_stream_pool` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Streaming Service | `oci_streaming` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Streaming Stream | `oci_streaming_stream` | [DataCollection](https://docs.jupiterone.io/data-model/schemas/DataCollection) |
| Subnet | `oci_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Subscription | `oci_subscription` | [Subscription](https://docs.jupiterone.io/data-model/schemas/Subscription) |
| UseCase | `oci_use_case` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| User | `oci_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| vault | `oci_kms_vault` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Vault secret | `oci_vault_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Vault Service | `oci_vault` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Virtual Cloud Network | `oci_virtual_cloud_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Virtual Network Interface Card | `oci_vnic` | [NetworkInterface](https://docs.jupiterone.io/data-model/schemas/NetworkInterface) |
| VM Cluster | `oci_exadata_vm_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Volume group | `oci_volume_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `oci_access_policy` | **HAS** | `oci_use_case` |
| `oci_boot_volume` | **HAS** | `oci_kms_key` |
| `oci_boot_volume` | **USES** | `oci_boot_disk_image` |
| `oci_caching` | **HAS** | `oci_caching_redis_cluster` |
| `oci_cloudguard` | **HAS** | `oci_cloudguard_detector_recipe` |
| `oci_cloudguard` | **HAS** | `oci_cloudguard_resource_type` |
| `oci_cloudguard` | **HAS** | `oci_cloudguard_security_policy` |
| `oci_cloudguard` | **HAS** | `oci_cloudguard_security_recipe` |
| `oci_cloudguard` | **HAS** | `oci_cloudguard_security_zone` |
| `oci_cloudguard` | **HAS** | `oci_cloudguard_target` |
| `oci_cloudguard_detector_recipe` | **HAS** | `oci_cloudguard_detector_recipe_rule` |
| `oci_cloudguard_detector_recipe_rule` | **IDENTIFIED** | `oci_cloudguard_problem` |
| `oci_cloudguard_security_recipe` | **HAS** | `oci_cloudguard_security_policy` |
| `oci_cloudguard_security_zone` | **USES** | `oci_cloudguard_security_recipe` |
| `oci_cloudguard_target` | **USES** | `oci_cloudguard_detector_recipe` |
| `oci_compartment` | **CONTAINS** | `oci_compartment` |
| `oci_compartment` | **HAS** | `oci_domain` |
| `oci_compartment` | **HAS** | `oci_authentication_policy` |
| `oci_compartment` | **HAS** | `oci_access_policy` |
| `oci_compartment` | **HAS** | `oci_compute_instance` |
| `oci_compartment` | **HAS** | `oci_dedicated_vm_host` |
| `oci_compartment` | **HAS** | `oci_devops_service` |
| `oci_compartment` | **HAS** | `oci_resourcemanager` |
| `oci_compartment` | **HAS** | `oci_caching` |
| `oci_compartment` | **HAS** | `oci_functions` |
| `oci_compartment` | **HAS** | `oci_objectstorage` |
| `oci_compartment` | **HAS** | `oci_vault` |
| `oci_compartment` | **HAS** | `oci_streaming` |
| `oci_compartment` | **HAS** | `oci_nosql` |
| `oci_compartment` | **HAS** | `oci_boot_disk_image` |
| `oci_compartment` | **HAS** | `oci_volume_group` |
| `oci_compartment` | **HAS** | `oci_mount_target` |
| `oci_compartment` | **HAS** | `oci_file_system` |
| `oci_compartment` | **HAS** | `oci_file_system_snapshot_policy` |
| `oci_compartment` | **HAS** | `oci_file_system_snapshot` |
| `oci_compartment` | **HAS** | `oci_file_system_replication` |
| `oci_compartment` | **HAS** | `oci_file_system_replication_target` |
| `oci_compartment` | **HAS** | `oci_alert_object` |
| `oci_compartment` | **HAS** | `oci_subscription` |
| `oci_compartment` | **HAS** | `oci_notification_topic` |
| `oci_compartment` | **HAS** | `oci_logging_object` |
| `oci_compartment` | **HAS** | `oci_log_analytics_entity` |
| `oci_compartment` | **HAS** | `oci_cloudguard` |
| `oci_compartment` | **HAS** | `oci_virtual_cloud_network` |
| `oci_compartment` | **HAS** | `oci_network_security_group` |
| `oci_compartment` | **HAS** | `oci_load_balancer` |
| `oci_compartment` | **HAS** | `oci_adb_protected_database` |
| `oci_compartment` | **HAS** | `oci_exadata_vm_cluster` |
| `oci_compartment` | **HAS** | `oci_database_home` |
| `oci_compartment` | **HAS** | `oci_database` |
| `oci_compartment` | **HAS** | `oci_vnic` |
| `oci_compartment` | **HAS** | `oci_subnet` |
| `oci_compartment` | **HAS** | `oci_exadata_infrastructure` |
| `oci_compartment` | **HAS** | `oci_data_safe` |
| `oci_compartment` | **HAS** | `oci_container_instance_service` |
| `oci_compartment` | **HAS** | `oci_container_instance` |
| `oci_compartment` | **HAS** | `oci_fastconnect` |
| `oci_compartment` | **HAS** | `oci_fastconnect_virtual_circuit` |
| `oci_compartment` | **HAS** | `oci_audit` |
| `oci_compartment` | **HAS** | `oci_service_connector` |
| `oci_compartment` | **HAS** | `oci_opsi_service` |
| `oci_compartment` | **HAS** | `oci_email_delivery_service` |
| `oci_compartment` | **HAS** | `oci_goldengate_deployment` |
| `oci_compartment` | **HAS** | `oci_goldengate_connection` |
| `oci_compartment` | **HAS** | `oci_fleet` |
| `oci_compartment` | **HAS** | `oci_fleet_compliance_record` |
| `oci_compartment` | **HAS** | `oci_fleet_compliance_policy_rule` |
| `oci_compartment` | **HAS** | `oci_drg` |
| `oci_compute_instance` | **HAS** | `oci_boot_volume` |
| `oci_container_instance` | **HAS** | `oci_container` |
| `oci_container_instance` | **USES** | `oci_subnet` |
| `oci_container_instance` | **USES** | `oci_network_security_group` |
| `oci_container_instance` | **USES** | `oci_vault_secret` |
| `oci_container_instance_service` | **HAS** | `oci_container_instance` |
| `oci_data_safe` | **HAS** | `oci_data_safe_private_endpoint` |
| `oci_data_safe` | **HAS** | `oci_data_safe_security_policy` |
| `oci_data_safe` | **HAS** | `oci_data_safe_target_database` |
| `oci_data_safe` | **HAS** | `oci_data_safe_audit_policy` |
| `oci_data_safe_audit_policy` | **MONITORS** | `oci_data_safe_target_database` |
| `oci_data_safe_private_endpoint` | **USES** | `oci_subnet` |
| `oci_data_safe_target_database` | **USES** | `oci_data_safe_private_endpoint` |
| `oci_database` | **USES** | `oci_kms_vault` |
| `oci_database_home` | **HAS** | `oci_database` |
| `oci_dedicated_vm_host` | **HAS** | `oci_compute_instance` |
| `oci_devops_project` | **USES** | `oci_devops_deploy_pipeline` |
| `oci_devops_project` | **USES** | `oci_devops_deploy_environment` |
| `oci_devops_project` | **USES** | `oci_devops_build_pipeline` |
| `oci_devops_project` | **USES** | `oci_devops_repository` |
| `oci_devops_service` | **HAS** | `oci_devops_project` |
| `oci_domain` | **HAS** | `oci_group` |
| `oci_domain` | **HAS** | `oci_user` |
| `oci_drg` | **CONNECTS** | `oci_virtual_cloud_network` |
| `oci_email_delivery_service` | **HAS** | `oci_email_domain` |
| `oci_email_delivery_service` | **HAS** | `oci_email_sender` |
| `oci_email_delivery_service` | **HAS** | `oci_email_suppression` |
| `oci_email_domain` | **HAS** | `oci_email_dkim` |
| `oci_exadata_infrastructure` | **HOSTS** | `oci_exadata_vm_cluster` |
| `oci_exadata_vm_cluster` | **USES** | `oci_subnet` |
| `oci_exadata_vm_cluster` | **USES** | `oci_network_security_group` |
| `oci_exadata_vm_cluster` | **HAS** | `oci_database_home` |
| `oci_fastconnect` | **HAS** | `oci_fastconnect_provider_service` |
| `oci_fastconnect` | **HAS** | `oci_fastconnect_virtual_circuit` |
| `oci_fastconnect_provider_service` | **HAS** | `oci_fastconnect_provider_service_key` |
| `oci_fastconnect_virtual_circuit` | **HAS** | `oci_fastconnect_cross_connect_mapping` |
| `oci_fastconnect_virtual_circuit` | **USES** | `oci_fastconnect_provider_service` |
| `oci_fastconnect_virtual_circuit` | **USES** | `oci_drg` |
| `oci_file_system` | **HAS** | `oci_file_system_snapshot` |
| `oci_file_system` | **HAS** | `oci_kms_key` |
| `oci_file_system` | **USES** | `oci_file_system_snapshot_policy` |
| `oci_file_system_replication` | **CONNECTS** | `oci_file_system` |
| `oci_file_system_replication` | **USES** | `oci_file_system_replication_target` |
| `oci_fleet` | **HAS** | `oci_fleet_resource` |
| `oci_fleet` | **HAS** | `oci_fleet_compliance_record` |
| `oci_functions` | **HAS** | `oci_functions_function` |
| `oci_functions_function` | **USES** | `oci_subnet` |
| `oci_functions_function` | **USES** | `oci_network_security_group` |
| `oci_functions_function` | **USES** | `oci_kms_key` |
| `oci_goldengate_connection` | **USES** | `oci_subnet` |
| `oci_goldengate_connection` | **USES** | `oci_kms_vault` |
| `oci_goldengate_connection` | **USES** | `oci_vault_secret` |
| `oci_goldengate_deployment` | **HAS** | `oci_goldengate_deployment_backup` |
| `oci_goldengate_deployment` | **HAS** | `oci_goldengate_deployment_upgrade` |
| `oci_goldengate_deployment` | **USES** | `oci_subnet` |
| `oci_goldengate_deployment` | **USES** | `oci_domain` |
| `oci_goldengate_deployment` | **USES** | `oci_vault_secret` |
| `oci_group` | **HAS** | `oci_user` |
| `oci_kms_key` | **PROTECTS** | `oci_streaming_stream_pool` |
| `oci_kms_key` | **PROTECTS** | `oci_block_volume` |
| `oci_kms_key` | **PROTECTS** | `oci_oac_analytics_instance` |
| `oci_kms_key` | **PROTECTS** | `oci_database_home` |
| `oci_kms_key` | **PROTECTS** | `oci_database` |
| `oci_kms_key` | **PROTECTS** | `oci_goldengate_connection` |
| `oci_kms_vault` | **HAS** | `oci_kms_key` |
| `oci_kms_vault` | **HAS** | `oci_vault_secret` |
| `oci_load_balancer` | **HAS** | `oci_subnet` |
| `oci_log` | **LOGS** | `oci_subnet` |
| `oci_log` | **LOGS** | `oci_virtual_cloud_network` |
| `oci_log` | **LOGS** | `oci_network_security_group` |
| `oci_log` | **LOGS** | `oci_objectstorage_bucket` |
| `oci_log` | **LOGS** | `oci_kms_vault` |
| `oci_log` | **LOGS** | `oci_kms_key` |
| `oci_log` | **LOGS** | `oci_vault_secret` |
| `oci_log` | **USES** | `oci_logging_service_summary` |
| `oci_log` | **LOGS** | `oci_file_system` |
| `oci_log` | **LOGS** | `oci_mount_target` |
| `oci_log` | **LOGS** | `oci_email_domain` |
| `oci_log` | **LOGS** | `oci_goldengate_deployment` |
| `oci_logging_object` | **HAS** | `oci_log` |
| `oci_monitoring_alarm` | **MONITORS** | `oci_streaming_stream` |
| `oci_monitoring_alarm` | **MONITORS** | `oci_streaming_stream_pool` |
| `oci_monitoring_alarm` | **MONITORS** | `oci_functions_function` |
| `oci_monitoring_alarm` | **USES** | `oci_notification_topic` |
| `oci_monitoring_alarm` | **MONITORS** | `oci_logging_object` |
| `oci_monitoring_alarm` | **MONITORS** | `oci_file_system` |
| `oci_monitoring_alarm` | **MONITORS** | `oci_mount_target` |
| `oci_mount_target` | **USES** | `oci_subnet` |
| `oci_mount_target` | **USES** | `oci_vault_secret` |
| `oci_network_security_group` | **PROTECTS** | `oci_streaming_stream_pool` |
| `oci_network_security_group` | **PROTECTS** | `oci_mount_target` |
| `oci_network_security_group` | **HAS** | `oci_network_security_rule` |
| `oci_network_security_group` | **PROTECTS** | `oci_data_safe_private_endpoint` |
| `oci_network_security_group` | **PROTECTS** | `oci_goldengate_deployment` |
| `oci_network_security_group` | **PROTECTS** | `oci_goldengate_connection` |
| `oci_nosql` | **HAS** | `oci_nosql_table` |
| `oci_nosql` | **HAS** | `oci_nosql_index` |
| `oci_nosql_table` | **HAS** | `oci_nosql_index` |
| `oci_notification_topic` | **HAS** | `oci_subscription` |
| `oci_oac_analytics_instance` | **ALLOWS** | `oci_virtual_cloud_network` |
| `oci_objectstorage` | **HAS** | `oci_objectstorage_bucket` |
| `oci_oic_integration_instance` | **ALLOWS** | `oci_virtual_cloud_network` |
| `oci_opsi_database_insight` | **MONITORS** | `oci_database` |
| `oci_opsi_exadata_insight` | **HAS** | `oci_opsi_exadata_configuration` |
| `oci_opsi_host_insight` | **HAS** | `oci_opsi_host_configuration` |
| `oci_opsi_host_insight` | **MONITORS** | `oci_compute_instance` |
| `oci_opsi_private_endpoint` | **USES** | `oci_subnet` |
| `oci_opsi_service` | **HAS** | `oci_opsi_database_insight` |
| `oci_opsi_service` | **HAS** | `oci_opsi_private_endpoint` |
| `oci_opsi_service` | **HAS** | `oci_opsi_exadata_insight` |
| `oci_opsi_service` | **HAS** | `oci_opsi_configuration` |
| `oci_opsi_service` | **HAS** | `oci_opsi_host_insight` |
| `oci_resource` | **HAS** | `oci_cloudguard_problem` |
| `oci_resourcemanager` | **HAS** | `oci_resourcemanager_stack` |
| `oci_service_connector` | **USES** | `oci_logging_object` |
| `oci_service_connector` | **USES** | `oci_log` |
| `oci_service_connector` | **USES** | `oci_streaming_stream` |
| `oci_service_connector` | **LOGS** | `oci_objectstorage_bucket` |
| `oci_service_connector` | **LOGS** | `oci_streaming_stream` |
| `oci_service_connector` | **TRIGGERS** | `oci_functions_function` |
| `oci_service_connector` | **SENDS** | `oci_notification_topic` |
| `oci_streaming` | **HAS** | `oci_streaming_stream_pool` |
| `oci_streaming_stream_pool` | **USES** | `oci_subnet` |
| `oci_streaming_stream_pool` | **HAS** | `oci_streaming_stream` |
| `oci_use_case` | **ASSIGNED** | `oci_compartment` |
| `oci_use_case` | **ASSIGNED** | `oci_group` |
| `oci_user` | **HAS** | `oci_smtp_credential` |
| `oci_vault` | **HAS** | `oci_kms_vault` |
| `oci_virtual_cloud_network` | **HAS** | `oci_network_security_group` |
| `oci_virtual_cloud_network` | **HAS** | `oci_security_list` |
| `oci_virtual_cloud_network` | **HAS** | `oci_subnet` |
| `oci_volume_group` | **HAS** | `oci_block_volume` |
| `oci_volume_group` | **HAS** | `oci_boot_volume` |

### Oci Audit

`oci_audit` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isEnabled` | `boolean` | Always true — OCI Audit captures every API call in every compartment automatically and cannot be turned off. Provided for CloudTrail parity queries. |  |
| `region` | `string` | Home region the tenancy-global Audit configuration was read in (informational; the config itself is tenancy-wide). |  |
| `retentionPeriodDays` | `number` **|** `null` | Number of days audit records are retained (90–365). Null if the Audit configuration could not be read. |  |

---

### Oci Compute Instance

`oci_compute_instance` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availabilityDomain` | `string` |  |  |
| `baselineOcpuUtilization` | `string` **|** `null` | Baseline OCPU utilization for burstable instances |  |
| `bootVolumeSizeInGBs` | `number` **|** `null` | Boot volume size requested at launch, for image-sourced instances |  |
| `bootVolumeType` | `string` **|** `null` | Emulation type of the boot volume |  |
| `compartmentId` | `string` |  |  |
| `enabledAgentPlugins` | `array` **|** `null` | Names of the Oracle Cloud Agent plugins set to ENABLED |  |
| `faultDomain` | `string` |  |  |
| `firmware` | `string` **|** `null` | Firmware used to boot the instance (BIOS or UEFI\_64) |  |
| `gpuDescription` | `string` **|** `null` | Description of the instance GPUs |  |
| `gpus` | `number` **|** `null` | Number of GPUs available to the instance |  |
| `imageId` | `string` |  |  |
| `isAllPluginsDisabled` | `boolean` **|** `null` | Whether all Oracle Cloud Agent plugins are disabled |  |
| `isConsistentVolumeNamingEnabled` | `boolean` **|** `null` | Whether consistent volume naming is enabled |  |
| `isCrossNumaNode` | `boolean` **|** `null` | Whether the instance spans more than one NUMA node |  |
| `isLegacyImdsEndpointsDisabled` | `boolean` **|** `null` | Whether the legacy (IMDSv1) instance metadata endpoints are disabled |  |
| `isLiveMigrationPreferred` | `boolean` **|** `null` | Whether live migration is preferred during infrastructure maintenance |  |
| `isManagementDisabled` | `boolean` **|** `null` | Whether the Oracle Cloud Agent management plugins are disabled |  |
| `isMeasuredBootEnabled` | `boolean` **|** `null` | Whether Measured Boot is enabled on the instance |  |
| `isMonitoringDisabled` | `boolean` **|** `null` | Whether the Oracle Cloud Agent monitoring plugins are disabled |  |
| `isPvEncryptionInTransitEnabled` | `boolean` **|** `null` | Whether in-transit encryption is enabled for paravirtualized volume attachments |  |
| `isSecureBootEnabled` | `boolean` **|** `null` | Whether Secure Boot is enabled on the instance |  |
| `isTrustedPlatformModuleEnabled` | `boolean` **|** `null` | Whether the Trusted Platform Module (TPM) is enabled on the instance |  |
| `launchMode` | `string` **|** `null` | Launch mode of the instance (NATIVE, EMULATED, PARAVIRTUALIZED or CUSTOM) |  |
| `lifecycleState` | `string` |  |  |
| `localDisks` | `number` **|** `null` | Number of local disks available to the instance |  |
| `localDisksTotalSizeInGBs` | `number` **|** `null` | Total size of the local disks, in GB |  |
| `maintenanceRebootDueOn` | `number` **|** `null` | When the instance is due for a maintenance reboot |  |
| `maxVnicAttachments` | `number` **|** `null` | Maximum number of VNIC attachments for the instance |  |
| `memoryInGBs` | `number` **|** `null` | Memory allocated to the instance, in GB |  |
| `networkingBandwidthInGbps` | `number` **|** `null` | Networking bandwidth available to the instance, in Gbps |  |
| `networkType` | `string` **|** `null` | Emulation type of the physical network interface card |  |
| `ocpus` | `number` **|** `null` | Number of OCPUs allocated to the instance |  |
| `processorDescription` | `string` **|** `null` | Description of the instance processor |  |
| `recoveryAction` | `string` **|** `null` | Action taken when the instance is affected by an infrastructure maintenance event |  |
| `region` | `string` |  |  |
| `remoteDataVolumeType` | `string` **|** `null` | Emulation type of attached data volumes |  |
| `securityAttributesState` | `string` |  |  |
| `shape` | `string` |  |  |
| `sourceType` | `string` **|** `null` | How the instance was launched: from an image or an existing boot volume |  |
| `vcpus` | `number` **|** `null` | Number of VCPUs allocated to the instance |  |

---

### Oci Container

`oci_container` inherits from [Container](/data-model/schemas/Container.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availabilityDomain` | `string` |  |  |
| `compartmentId` | `string` |  |  |
| `containerInstanceId` | `string` |  |  |
| `containerRestartAttemptCount` | `number` **|** `null` | Number of times the container has been restarted |  |
| `environmentVariableNames` | `array` **|** `null` | Names of the environment variables set on the container (values are never ingested) |  |
| `exitCode` | `number` **|** `null` | Exit code of the container process, if it has exited |  |
| `faultDomain` | `string` **|** `null` |  |  |
| `imageUrl` | `string` |  |  |
| `isNonRootUserCheckEnabled` | `boolean` **|** `null` |  |  |
| `isResourcePrincipalDisabled` | `boolean` **|** `null` |  |  |
| `isRootFileSystemReadonly` | `boolean` **|** `null` |  |  |
| `lifecycleDetails` | `string` **|** `null` |  |  |
| `lifecycleState` | `string` |  |  |
| `memoryLimitInGBs` | `number` **|** `null` |  |  |
| `region` | `string` |  |  |
| `runAsGroup` | `number` **|** `null` |  |  |
| `runAsUser` | `number` **|** `null` |  |  |
| `terminatedOn` | `number` **|** `null` | When the container was terminated |  |
| `vcpusLimit` | `number` **|** `null` |  |  |
| `volumeMountPaths` | `array` **|** `null` | Paths inside the container where volumes are mounted |  |
| `workingDirectory` | `string` **|** `null` | Working directory the container process starts in |  |

---

### Oci Container Instance

`oci_container_instance` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availabilityDomain` | `string` |  |  |
| `compartmentId` | `string` |  |  |
| `containerCount` | `number` |  |  |
| `containerRestartPolicy` | `string` |  |  |
| `encrypted` | `boolean` |  |  |
| `encryptionKeyId` | `string` **|** `null` |  |  |
| `faultDomain` | `string` **|** `null` |  |  |
| `gracefulShutdownTimeoutInSeconds` | `number` **|** `null` |  |  |
| `lifecycleDetails` | `string` **|** `null` |  |  |
| `lifecycleState` | `string` |  |  |
| `memoryInGBs` | `number` |  |  |
| `networkingBandwidthInGbps` | `number` **|** `null` |  |  |
| `ocpus` | `number` |  |  |
| `region` | `string` |  |  |
| `shape` | `string` |  |  |
| `vnicIds` | `array` **|** `null` |  |  |
| `volumeCount` | `number` **|** `null` |  |  |

---

### Oci Dedicated Vm Host

`oci_dedicated_vm_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availabilityDomain` | `string` |  |  |
| `faultDomain` | `string` |  |  |
| `lifecycleState` | `string` |  |  |
| `region` | `string` |  |  |

---

### Oci Drg

`oci_drg` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`compartmentId` \*

 | `string` | OCID of the compartment that owns this Dynamic Routing Gateway. |  |
| `defaultDrgRouteTableIpsecTunnel` | `string` **|** `null` | OCID of the default DRG route table applied to IPSec tunnel attachments. Null when no default is configured. |  |
| `defaultDrgRouteTableRemotePeeringConnection` | `string` **|** `null` | OCID of the default DRG route table applied to remote peering connection attachments. Null when no default is configured. |  |
| `defaultDrgRouteTableVcn` | `string` **|** `null` | OCID of the default DRG route table applied to VCN attachments. Null when no default is configured. |  |
| `defaultDrgRouteTableVirtualCircuit` | `string` **|** `null` | OCID of the default DRG route table applied to virtual circuit (FastConnect) attachments. Null when no default is configured. |  |
| `defaultExportDrgRouteDistributionId` | `string` **|** `null` | OCID of the DRG route distribution used by default for exporting routes from this DRG. Null when none is configured. |  |
| 

`lifecycleState` \*

 | `string` | Current lifecycle state of the DRG (e.g. PROVISIONING, AVAILABLE, TERMINATING, TERMINATED). |  |
| `region` | `string` **|** `null` | OCI region in which this Dynamic Routing Gateway resides. |  |

---

### Oci Email Dkim

`oci_email_dkim` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cnameRecordValue` | `string` **|** `null` |  |  |
| `compartmentId` | `string` **|** `null` |  |  |
| `dnsSubdomainName` | `string` **|** `null` |  |  |
| 
`emailDomainId` \*

 | `string` |  |  |
| `lifecycleDetails` | `string` **|** `null` |  |  |
| `lifecycleState` | `string` **|** `null` |  |  |
| `region` | `string` |  |  |

---

### Oci Email Domain

`oci_email_domain` inherits from [Domain](/data-model/schemas/Domain.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeDkimId` | `string` **|** `null` |  |  |
| `compartmentId` | `string` **|** `null` |  |  |
| `domainVerificationId` | `string` **|** `null` |  |  |
| `domainVerificationStatus` | `string` **|** `null` |  |  |
| 
`emailDomainId` \*

 | `string` |  |  |
| `isSpf` | `boolean` **|** `null` |  |  |
| `lifecycleState` | `string` **|** `null` |  |  |
| `region` | `string` |  |  |

---

### Oci Email Sender

`oci_email_sender` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `compartmentId` | `string` |  |  |
| 
`emailAddress` \*

 | `string` |  |  |
| `emailDomainId` | `string` **|** `null` |  |  |
| `isSpf` | `boolean` **|** `null` |  |  |
| `lifecycleState` | `string` **|** `null` |  |  |
| `region` | `string` |  |  |

---

### Oci Email Suppression

`oci_email_suppression` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `compartmentId` | `string` |  |  |
| 
`emailAddress` \*

 | `string` |  |  |
| `errorDetail` | `string` **|** `null` |  |  |
| `errorSource` | `string` **|** `null` |  |  |
| `messageId` | `string` **|** `null` |  |  |
| `reason` | `string` **|** `null` |  |  |
| `timeLastSuppressedOn` | `number` **|** `null` |  |  |

---

### Oci Fleet

`oci_fleet` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`compartmentId` \*

 | `string` | OCID of the compartment that owns this fleet. |  |
| `environmentType` | `string` **|** `null` | Environment type (e.g. DEV, TEST, PROD) — applicable to ENVIRONMENT fleets. |  |
| `fleetType` | `string` **|** `null` | Kind of fleet: PRODUCT, GROUP, ENVIRONMENT, or GENERIC. GROUP fleets can contain sub-fleets. |  |
| `isTargetAutoConfirm` | `boolean` **|** `null` | True when discovered targets are auto-confirmed into the fleet without manual review — a weaker control posture. |  |
| `lifecycleDetails` | `string` **|** `null` | Human-readable detail about the current lifecycle state; carries the failure reason for a FAILED fleet. |  |
| 

`lifecycleState` \*

 | `string` | Lifecycle state of the fleet (ACTIVE, INACTIVE, CREATING, DELETED, DELETING, FAILED, UPDATING, NEEDS\_ATTENTION). |  |
| `parentFleetId` | `string` **|** `null` | OCID of the parent fleet for a GROUP fleet hierarchy. |  |
| `products` | `array` **|** `null` | PlatformConfiguration OCIDs for the products associated with the fleet. |  |
| 

`region` \*

 | `string` | OCI region in which the fleet resides. |  |
| `resourceRegion` | `string` **|** `null` | Region the fleet is associated with. |  |

---

### Oci Fleet Compliance Policy Rule

`oci_fleet_compliance_policy_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`compartmentId` \*

 | `string` | OCID of the compartment that owns this rule. |  |
| 

`compliancePolicyId` \*

 | `string` | OCID of the parent compliance policy. |  |
| `gracePeriod` | `string` **|** `null` | Grace period (in days, weeks, months, or years) during which a missing patch is not reported as non-compliant. |  |
| `lifecycleDetails` | `string` **|** `null` | Human-readable detail about the current lifecycle state; carries the failure reason for a FAILED rule. |  |
| 

`lifecycleState` \*

 | `string` | Lifecycle state of the rule (CREATING, UPDATING, ACTIVE, DELETING, DELETED, FAILED). |  |
| `patchSelectionType` | `string` **|** `null` | Baseline selection type: PATCH\_LEVEL, PATCH\_RELEASE\_DATE, or PATCH\_NAME. |  |
| 

`patchTypeIds` \*

 | `array` of `string`s | PlatformConfiguration OCIDs for the patch types this rule applies to. |  |
| `productVersionName` | `string` **|** `null` | Product version this rule applies to. |  |
| 

`region` \*

 | `string` | OCI region in which the rule applies. |  |
| `severity` | `array` **|** `null` | Severities this rule applies to: CRITICAL, HIGH, MEDIUM, LOW. CRITICAL/HIGH rules require the fastest patching. |  |

---

### Oci Fleet Compliance Record

`oci_fleet_compliance_record` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `compartmentId` | `string` **|** `null` | OCID of the compartment of the compliance record. |  |
| `compliancePolicyId` | `string` **|** `null` | OCID of the compliance policy linked to this record. |  |
| `compliancePolicyRuleId` | `string` **|** `null` | OCID of the compliance policy rule linked to this record. |  |
| `complianceState` | `string` **|** `null` | Compliance verdict for the target: COMPLIANT, NON\_COMPLIANT, WARNING, or UNKNOWN. |  |
| 
`entityDisplayName` \*

 | `string` | Display name of the entity for which compliance was calculated. |  |
| 

`entityId` \*

 | `string` | OCID of the entity (typically a fleet) for which compliance was calculated. |  |
| `gracePeriod` | `string` **|** `null` | Grace period before non-compliance is reported for this record. |  |
| `lifecycleState` | `string` **|** `null` | Lifecycle state of the compliance record (ACTIVE, DELETED, FAILED). |  |
| 

`region` \*

 | `string` | OCI region in which the compliance record was produced. |  |
| 

`resourceId` \*

 | `string` | OCID of the evaluated resource. |  |
| 

`resourceName` \*

 | `string` | Name of the evaluated resource. |  |
| `resourceRegion` | `string` **|** `null` | Region of the evaluated resource. |  |
| 

`targetId` \*

 | `string` | Identifier of the evaluated target. |  |
| 

`targetName` \*

 | `string` | Name of the evaluated target. |  |
| `targetVersion` | `string` **|** `null` | Current version installed on the target; used to detect patching that is behind. |  |

---

### Oci Fleet Resource

`oci_fleet_resource` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`compartmentId` \*

 | `string` | OCID of the resource's compartment. |  |
| `complianceState` | `string` **|** `null` | Patch compliance state of the resource: COMPLIANT, NON\_COMPLIANT, WARNING, or UNKNOWN. The primary patch posture signal. |  |
| `environmentType` | `string` **|** `null` | Environment type of the resource (for ENVIRONMENT fleets within a GROUP fleet). |  |
| 

`fleetId` \*

 | `string` | OCID of the fleet this resource belongs to. |  |
| `lifecycleDetails` | `string` **|** `null` | Human-readable detail about the current lifecycle state. |  |
| 

`lifecycleState` \*

 | `string` | Lifecycle state of the fleet resource (ACTIVE, DELETED, FAILED, NEEDS\_ATTENTION). |  |
| `percentCompliant` | `number` **|** `null` | Quantitative compliance score for the resource (0-100). |  |
| `product` | `string` **|** `null` | Product associated with the resource (for PRODUCT fleets within a GROUP fleet). |  |
| `productCount` | `number` **|** `null` | Count of products within this resource. |  |
| 

`region` \*

 | `string` | OCI region in which the resource resides. |  |
| 

`resourceId` \*

 | `string` | OCID of the underlying OCI resource. |  |
| `resourceRegion` | `string` **|** `null` | Region of the underlying resource. |  |
| 

`resourceType` \*

 | `string` | Type of the underlying resource (e.g. Instance, dbsystem, fleet). |  |
| `targetCount` | `number` **|** `null` | Count of managed targets within this resource. |  |
| 

`tenancyId` \*

 | `string` | OCID of the tenancy the resource belongs to. |  |

---

### Oci Goldengate Connection

`oci_goldengate_connection` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `compartmentId` | `string` | OCID of the compartment that owns this connection. |  |
| `connectionType` | `string` | Broad family of the connected system, e.g. ORACLE, KAFKA, MYSQL, POSTGRESQL, AMAZON\_S3, SNOWFLAKE, OCI\_OBJECT\_STORAGE. |  |
| `goldenGateConnectionId` | `string` | OCID of the GoldenGate connection. |  |
| `ingressIpAddresses` | `array` **|** `null` | Source IP addresses from which GoldenGate deployments connect to this target private IP. These are the addresses ingress security rules on the target need to allow. |  |
| `isUsingSecretIds` | `boolean` **|** `null` | True when sensitive connection attributes are supplied as OCI Vault secret references rather than inline values. Reported by the API as doesUseSecretIds. |  |
| `keyId` | `string` **|** `null` | OCID of the customer-managed KMS master key protecting this connection secrets. Absent when Oracle-managed keys are used. Drives the oci\_kms\_key\_protects\_goldengate\_connection relationship. |  |
| `lifecycleDetails` | `string` **|** `null` | Human-readable detail about the current lifecycle state. |  |
| `lifecycleState` | `string` **|** `null` | Connection lifecycle state (CREATING, UPDATING, ACTIVE, DELETING, DELETED, FAILED). Deleted connections are not ingested. |  |
| `nsgIds` | `array` **|** `null` | OCIDs of the network security groups applied to the connection endpoint. Drives the oci\_network\_security\_group\_protects\_goldengate\_connection relationship. |  |
| `region` | `string` | OCI region in which the connection is defined. |  |
| `routingMethod` | `string` **|** `null` | How deployment traffic reaches the target: SHARED\_SERVICE\_ENDPOINT (through the GoldenGate service network to public hosts), SHARED\_DEPLOYMENT\_ENDPOINT (out of the deployment subnet), or DEDICATED\_ENDPOINT (a private endpoint in the target VCN subnet). SHARED\_SERVICE\_ENDPOINT implies traffic leaves the customer VCN. |  |
| `secretIds` | `array` **|** `null` | Distinct OCIDs of every Vault secret referenced by this connection, collected from all of its \*SecretId attributes (password, wallet, key store, and so on). Drives the oci\_goldengate\_connection\_uses\_vault\_secret relationship. |  |
| `subnetId` | `string` **|** `null` | OCID of the VCN subnet hosting the dedicated private endpoint for this connection. Set when routingMethod is DEDICATED\_ENDPOINT. Drives the oci\_goldengate\_connection\_uses\_subnet relationship. |  |
| `technologyType` | `string` **|** `null` | Specific technology within the connection family, e.g. OCI\_AUTONOMOUS\_DATABASE, AMAZON\_RDS\_ORACLE, APACHE\_KAFKA, AZURE\_SYNAPSE\_ANALYTICS. Distinguishes a managed OCI target from an external third-party one. |  |
| `vaultId` | `string` **|** `null` | OCID of the customer OCI Vault in which GoldenGate manages this connection secrets. Drives the oci\_goldengate\_connection\_uses\_vault relationship. |  |

---

### Oci Goldengate Deployment

`oci_goldengate_deployment` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `backupScheduleBucketName` | `string` **|** `null` | Object Storage bucket that scheduled backups are written to. |  |
| `backupScheduleCompartmentId` | `string` **|** `null` | OCID of the compartment holding the scheduled-backup bucket. May differ from the deployment compartment, which matters when reasoning about who can read backup contents. |  |
| `backupScheduledOn` | `number` **|** `null` | Time of day, as an epoch timestamp in milliseconds, at which the scheduled backup runs. |  |
| `backupScheduleFrequency` | `string` **|** `null` | Cadence of the automatic backup schedule: DAILY, WEEKLY, or MONTHLY. Null when no automatic backup schedule is configured. |  |
| `backupScheduleNamespaceName` | `string` **|** `null` | Object Storage namespace containing the scheduled-backup bucket. |  |
| `compartmentId` | `string` | OCID of the compartment that owns this deployment. |  |
| `cpuCoreCount` | `number` **|** `null` | Number of OCPUs assigned to the deployment. Acts as the auto-scaling baseline when isAutoScalingEnabled is true. |  |
| `deploymentType` | `string` **|** `null` | Kind of GoldenGate deployment, e.g. DATABASE\_ORACLE, BIGDATA, DATABASE\_MICROSOFT\_SQLSERVER, DATABASE\_POSTGRESQL, DATA\_TRANSFORMS. |  |
| `deploymentUrl` | `string` **|** `null` | URL of the GoldenGate deployment console, where the deployment-local REST API and encryption settings are administered. |  |
| `environmentType` | `string` **|** `null` | Deployment environment tier: PRODUCTION or DEVELOPMENT\_OR\_TESTING. Useful for scoping policy to production replication only. |  |
| `fqdn` | `string` **|** `null` | Fully qualified domain name assigned to the deployment console. |  |
| `goldenGateDeploymentId` | `string` | OCID of the GoldenGate deployment. |  |
| `isAutoScalingEnabled` | `boolean` **|** `null` | True when the deployment scales OCPUs automatically up to three times the configured cpuCoreCount. |  |
| `isBackupScheduleMetadataOnly` | `boolean` **|** `null` | True when scheduled backups capture deployment metadata only, excluding trail data. Metadata-only backups are not sufficient for full recovery. |  |
| `isHealthy` | `boolean` **|** `null` | True when OCI reports the deployment as healthy. False indicates the deployment is running but degraded. |  |
| `isLatestVersion` | `boolean` **|** `null` | True when the deployment runs the latest available GoldenGate version. False means a newer version — potentially carrying security fixes — is available. |  |
| `isPublic` | `boolean` **|** `null` | True when the deployment console and endpoints are reachable from the public internet via a public IP. Security-relevant: a public GoldenGate deployment exposes its admin console beyond the VCN. |  |
| `isStorageUtilizationLimitExceeded` | `boolean` **|** `null` | True when the deployment has exceeded its storage limit, which stalls replication until storage is reclaimed. |  |
| `licenseModel` | `string` **|** `null` | Licensing model for the deployment: LICENSE\_INCLUDED or BRING\_YOUR\_OWN\_LICENSE. |  |
| `lifecycleDetails` | `string` **|** `null` | Human-readable detail about the current lifecycle state; carries the actionable reason when the deployment is FAILED or NEEDS\_ATTENTION. |  |
| `lifecycleState` | `string` **|** `null` | Deployment lifecycle state (CREATING, UPDATING, ACTIVE, INACTIVE, DELETING, DELETED, FAILED, NEEDS\_ATTENTION, IN\_PROGRESS, CANCELING, CANCELED, SUCCEEDED, WAITING). Only ACTIVE deployments are running replication. |  |
| `lifecycleSubState` | `string` **|** `null` | Finer-grained state within the lifecycle state, e.g. RECOVERING, STARTING, STOPPING, UPGRADING, RESTORING, BACKUP\_IN\_PROGRESS, ROLLBACK\_IN\_PROGRESS. |  |
| `maintenanceBundleReleaseUpgradePeriodInDays` | `number` **|** `null` | Grace period, in days, before an available bundle release is applied automatically. |  |
| `maintenanceInterimReleaseUpgradePeriodInDays` | `number` **|** `null` | Grace period, in days, before an available interim release is applied automatically. |  |
| `maintenanceIsInterimReleaseAutoUpgradeEnabled` | `boolean` **|** `null` | True when the deployment automatically takes interim releases, which include out-of-cycle security fixes. |  |
| `maintenanceMajorReleaseUpgradePeriodInDays` | `number` **|** `null` | Grace period, in days, before an available major release is applied automatically. |  |
| `maintenanceSecurityPatchUpgradePeriodInDays` | `number` **|** `null` | Grace period, in days, before an available security patch is applied automatically. A long period leaves known vulnerabilities unpatched. |  |
| `nsgIds` | `array` **|** `null` | OCIDs of the network security groups applied to the deployment endpoint. Drives the oci\_network\_security\_group\_protects\_goldengate\_deployment relationship. |  |
| `oggAdminUsername` | `string` **|** `null` | Administrator username for the GoldenGate deployment console. |  |
| `oggCredentialStore` | `string` **|** `null` | Where deployment credentials are held: GOLDENGATE (the deployment-local credential store) or IAM (OCI Identity Domains). IAM centralises authentication and is the stronger posture. |  |
| `oggIdentityDomainId` | `string` **|** `null` | OCID of the OCI Identity Domain backing deployment authentication. Present when oggCredentialStore is IAM. |  |
| `oggVersion` | `string` **|** `null` | GoldenGate software version running in the deployment. Compare against isLatestVersion to spot unpatched deployments. |  |
| `privateIpAddress` | `string` **|** `null` | Private IP address of the deployment within its VCN subnet. |  |
| `publicIpAddress` | `string` **|** `null` | Public IP address of the deployment. Present only when isPublic is true. |  |
| `region` | `string` | OCI region in which the deployment resides. |  |
| `secretIds` | `array` **|** `null` | Distinct OCIDs of the Vault secrets holding this deployment own credentials: the console admin password and the SSL private key. Drives the oci\_goldengate\_deployment\_uses\_vault\_secret relationship. Absent when the deployment could not be enriched beyond its list summary. |  |
| `storageUtilizationInBytes` | `number` **|** `null` | Storage currently consumed by the deployment, in bytes. |  |
| `subnetId` | `string` **|** `null` | OCID of the VCN subnet the deployment private endpoint is attached to. Drives the oci\_goldengate\_deployment\_uses\_subnet relationship. |  |

---

### Oci Goldengate Deployment Backup

`oci_goldengate_deployment_backup` inherits from [Backup](/data-model/schemas/Backup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `backupOn` | `number` **|** `null` | Epoch timestamp in milliseconds at which the backup was started. |  |
| `backupType` | `string` **|** `null` | Backup type: INCREMENTAL or FULL. |  |
| `bucketName` | `string` **|** `null` | Object Storage bucket holding the backup object. Bucket-level access controls determine who can read the backup contents. |  |
| `compartmentId` | `string` | OCID of the compartment that owns this backup. |  |
| `deploymentType` | `string` **|** `null` | Kind of deployment the backup was taken from, e.g. DATABASE\_ORACLE or BIGDATA. |  |
| `goldenGateBackupId` | `string` | OCID of the deployment backup. |  |
| `isAutomatic` | `boolean` **|** `null` | True when the backup was produced by the deployment backup schedule rather than taken on demand. |  |
| `isMetadataOnly` | `boolean` **|** `null` | True when the backup captures deployment metadata only, excluding trail data. Metadata-only backups are not sufficient for full recovery. |  |
| `lifecycleDetails` | `string` **|** `null` | Human-readable detail about the current lifecycle state; carries the failure reason for a FAILED backup. |  |
| `lifecycleState` | `string` **|** `null` | Backup lifecycle state (CREATING, ACTIVE, DELETING, DELETED, FAILED, NEEDS\_ATTENTION, IN\_PROGRESS, CANCELING, CANCELED). Only ACTIVE backups are restorable. |  |
| `namespaceName` | `string` **|** `null` | Object Storage namespace containing the bucket. |  |
| `objectName` | `string` **|** `null` | Name of the backup object within the bucket. |  |
| `oggVersion` | `string` | GoldenGate version the backup was taken from, which constrains the deployments it can be restored into. |  |
| `region` | `string` | OCI region in which the backup resides. |  |
| `sizeInBytes` | `number` **|** `null` | Size of the backup object, in bytes. |  |
| `timeBackupFinishedOn` | `number` **|** `null` | Epoch timestamp in milliseconds at which the backup completed. |  |

---

### Oci Goldengate Deployment Upgrade

`oci_goldengate_deployment_upgrade` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `compartmentId` | `string` | OCID of the compartment that owns this upgrade. |  |
| `deploymentUpgradeType` | `string` **|** `null` | How the upgrade is driven: MANUAL (customer-initiated) or AUTOMATIC (applied by OCI under the deployment maintenance configuration). |  |
| `goldenGateUpgradeId` | `string` | OCID of the deployment upgrade. |  |
| `isCancelAllowed` | `boolean` **|** `null` | True when the upgrade can still be cancelled. |  |
| `isRescheduleAllowed` | `boolean` **|** `null` | True when the upgrade can still be rescheduled. |  |
| `isRollbackAllowed` | `boolean` **|** `null` | True when the deployment can still be rolled back to previousOggVersion. |  |
| `isSecurityFix` | `boolean` **|** `null` | True when the upgrade carries a security fix. A pending security-fix upgrade means the deployment currently runs a known-vulnerable version. |  |
| `isSnoozed` | `boolean` **|** `null` | True when the upgrade has been deferred. A snoozed security-fix upgrade is a deliberately deferred patch. |  |
| `lifecycleDetails` | `string` **|** `null` | Human-readable detail about the current lifecycle state; carries the failure reason for a FAILED upgrade. |  |
| `lifecycleState` | `string` **|** `null` | Upgrade lifecycle state (CREATING, ACTIVE, IN\_PROGRESS, SUCCEEDED, FAILED, CANCELING, CANCELED, WAITING, NEEDS\_ATTENTION, DELETING, DELETED). |  |
| `lifecycleSubState` | `string` **|** `null` | Finer-grained state within the upgrade lifecycle, e.g. UPGRADING, ROLLBACK\_IN\_PROGRESS, RECOVERING. |  |
| `oggVersion` | `string` **|** `null` | GoldenGate version the deployment is being upgraded to. |  |
| `previousOggVersion` | `string` **|** `null` | GoldenGate version the deployment ran before this upgrade, and the version a rollback would return it to. |  |
| `region` | `string` | OCI region in which the upgrade applies. |  |
| `releaseType` | `string` **|** `null` | Release channel of the target version: MAJOR, BUNDLE, or INTERIM. |  |
| `timeFinishedOn` | `number` **|** `null` | Epoch timestamp in milliseconds at which the upgrade completed. |  |
| `timeOggVersionSupportedUntilOn` | `number` **|** `null` | Epoch timestamp in milliseconds after which the current GoldenGate version is no longer supported. A past value means the deployment runs an end-of-support version. |  |
| `timeReleasedOn` | `number` **|** `null` | Epoch timestamp in milliseconds at which the target version was released by Oracle. The gap to now measures patch latency. |  |
| `timeScheduledOn` | `number` **|** `null` | Epoch timestamp in milliseconds at which the upgrade is scheduled to run. |  |
| `timeScheduleMaxOn` | `number` **|** `null` | Latest epoch timestamp in milliseconds to which the upgrade may be rescheduled before OCI applies it. |  |
| `timeSnoozedUntilOn` | `number` **|** `null` | Epoch timestamp in milliseconds until which the upgrade has been deferred. |  |
| `timeStartedOn` | `number` **|** `null` | Epoch timestamp in milliseconds at which the upgrade began. |  |

---

### Oci Log

`oci_log` inherits from [Logs](/data-model/schemas/Logs.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `compartmentId` | `string` | OCID of the compartment that owns this log. |  |
| `configurationCompartmentId` | `string` **|** `null` | OCID from configuration.compartmentId; may differ from compartmentId for cross-compartment log configurations. |  |
| `isArchivingEnabled` | `boolean` **|** `null` | Whether legacy archiving is enabled (configuration.archiving.isEnabled). Deprecated by OCI in favour of Service Connector Hub but still surfaced for security visibility. |  |
| `isEnabled` | `boolean` **|** `null` | Whether the log is actively ingesting. Disabled logs on sensitive resources are a security signal. |  |
| `lifecycleState` | `string` | Lifecycle state of the log: CREATING, ACTIVE, INACTIVE, UPDATING, DELETING, FAILED. |  |
| `logType` | `string` | Type of log: CUSTOM (agent-emitted) or SERVICE (OCI service-emitted). Security-relevant: SERVICE logs are audited differently. |  |
| `region` | `string` | OCI region of the log. |  |
| `retentionDuration` | `number` **|** `null` | Retention duration in days. CIS-relevant: minimum retention is 90 days for many regulatory frameworks. |  |
| `sourceCategory` | `string` **|** `null` | Log category from configuration.source.category, e.g. read, write, all. |  |
| `sourceResource` | `string` **|** `null` | OCID (or bucket name, for objectstorage) of the resource being logged. Flattened from configuration.source.resource. ADR-005 exception: kept as flat property because cross-tenancy / cross-region / not-yet-ingested OCIDs cannot resolve to relationships. |  |
| `sourceService` | `string` **|** `null` | Service that emits this log (flattened from configuration.source.service). Examples: flowlogs, objectstorage, kms, vaultsecret. Drives the Log→ServiceSummary join. |  |
| `sourceType` | `string` **|** `null` | Source-type discriminator from configuration.source.sourceType, typically OCISERVICE. |  |
| `tenancyId` | `string` **|** `null` | OCID of the tenancy that owns this log. Populated from `getLog` enrichment; null if enrichment failed. |  |
| `timeLastModified` | `number` **|** `null` | Epoch milliseconds of last modification. Parsed via parseTimePropertyValue from timeLastModified. |  |

---

### Oci Log Analytics Entity

`oci_log_analytics_entity` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `areLogsCollected` | `boolean` **|** `null` | Security-critical flag: false means LA is registered but not actively shipping logs. |  |
| `cloudResourceId` | `string` **|** `null` | OCID of the underlying OCI resource (when applicable). Kept flat — not all targets are guaranteed ingested. |  |
| `compartmentId` | `string` | OCID of the compartment. |  |
| `creationSourceDetails` | `string` **|** `null` | creationSource.details. |  |
| `creationSourceType` | `string` **|** `null` | creationSource.type if non-null. |  |
| `entityTypeInternalName` | `string` | Internal entity-type identifier used by LA queries. |  |
| `entityTypeName` | `string` | Human-readable entity type (e.g. 'Linux Host'). |  |
| `hostname` | `string` **|** `null` | Hostname when applicable. |  |
| `lastDiscoveredOn` | `number` **|** `null` | Epoch milliseconds when the entity was last discovered. Parsed via parseTimePropertyValue from timeLastDiscovered. |  |
| `lifecycleDetails` | `string` **|** `null` | Substep/agent-deployment details for the lifecycle state. |  |
| `lifecycleState` | `string` | Entity lifecycle state. |  |
| `managementAgentCompartmentId` | `string` **|** `null` | Compartment OCID of the management agent. |  |
| `managementAgentDisplayName` | `string` **|** `null` | Display name of the management agent. |  |
| `managementAgentId` | `string` **|** `null` | Optional OCID of the Management Agent that ships logs for this entity. |  |
| `metadataItemCount` | `number` **|** `null` | Count of metadata items if present. |  |
| `propertyCount` | `number` **|** `null` | Count of LA properties on the entity (flattened from `properties` keys — never stringify per pr-review.md). |  |
| `region` | `string` | OCI region. |  |
| `sourceId` | `string` **|** `null` | Enterprise Manager repo ID when applicable. |  |
| `timezoneRegion` | `string` **|** `null` | Timezone of the entity for log timestamp normalisation. |  |

---

### Oci Logging Service Summary

`oci_logging_service_summary` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `categoryDisplayNames` | `array` **|** `null` | Deduped list of category display names (resourceTypes\[\].categories\[\].displayName). |  |
| `categoryNames` | `array` **|** `null` | Deduped list of category names across all resource types (resourceTypes\[\].categories\[\].name). |  |
| `endpoint` | `string` | Logging endpoint URL for this service. |  |
| `namespace` | `string` **|** `null` | Logging Analytics namespace if applicable. |  |
| `region` | `string` | Region in which this catalog was fetched (home region by Q7). |  |
| `resourceTypeNames` | `array` **|** `null` | Flattened list of resource-type names this service can emit logs for (resourceTypes\[\].name). |  |
| `serviceId` | `string` **|** `null` | Optional service OCID. |  |
| `serviceName` | `string` | Human-readable service name (mapped from ServiceSummary.name). Also mirrored to inherited displayName. |  |
| `servicePrincipalName` | `string` | Service principal identifier (e.g. 'flowlogs', 'objectstorage'). Used as the join key against oci\_log.sourceService. |  |
| `tenantId` | `string` | OCID of the tenancy in which the service catalog applies. |  |

---

### Oci Monitoring Alarm

`oci_monitoring_alarm` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alarmSummary` | `string` **|** `null` | Short human-readable alarm summary text from OCI. Surfaces on the inherited Rule.summary property. |  |
| `body` | `string` **|** `null` | Human-readable notification body content sent when the alarm fires. From getAlarm enrichment; null if getAlarm failed and the integration fell back to the summary. |  |
| `compartmentId` | `string` | OCID of the compartment that owns this alarm. |  |
| `destinations` | `array` of `string`s | OCIDs of notification destinations (typically oci\_notification\_topic). Drives the alarm-uses-notification-topic relationship; orphan/cross-tenancy OCIDs are skipped silently. |  |
| `evaluationSlackDuration` | `string` **|** `null` | ISO 8601 duration the evaluator waits for late-arriving metrics before scoring a window. Range PT3M-PT2H; default PT3M. |  |
| `isEnabled` | `boolean` | Whether the alarm is currently active. Disabled alarms do not evaluate or notify. Also surfaces on the inherited Rule.active property. |  |
| `isNotificationsPerMetricDimensionEnabled` | `boolean` **|** `null` | When true, the alarm splits notifications per distinct metric dimension stream rather than aggregating. |  |
| `lifecycleState` | `string` | Lifecycle state of the alarm resource. The integration filters listAlarms to lifecycleState=ACTIVE, so this field is effectively always ACTIVE in the graph today. |  |
| `messageFormat` | `string` **|** `null` | Message format used to render the notification body (e.g. RAW, PRETTY\_JSON, ONS\_OPTIMIZED). From getAlarm enrichment. |  |
| `metricCompartmentId` | `string` | OCID of the compartment whose metrics this alarm evaluates. May differ from compartmentId for cross-compartment alarms. |  |
| `namespace` | `string` | The OCI Monitoring namespace this alarm queries (e.g. oci\_streaming, oci\_faas, oci\_computeagent). Drives which resource type can be the alarm target. Also surfaces on the inherited Rule.category property. |  |
| `notificationTitle` | `string` **|** `null` | Customizable notification title shown in delivered messages. |  |
| `notificationVersion` | `string` | Version of the notification payload format delivered when the alarm fires. |  |
| `overrideCount` | `number` | Number of conditional overrides configured on this alarm. Overrides allow per-dimension severity/predicate variation and complicate audit review. |  |
| `pendingDuration` | `string` **|** `null` | ISO 8601 duration the alarm waits in the firing state before triggering notifications. Used to suppress noisy short-lived breaches. From getAlarm enrichment. |  |
| `query` | `string` | The MQL expression evaluated by this alarm. Includes the metric name, dimension filters (e.g. resourceId="ocid1.stream..."), aggregation, and predicate. This field is the source of truth for the alarm-monitors-resource relationships. |  |
| `region` | `string` | OCI region in which the alarm is configured. |  |
| `repeatNotificationDuration` | `string` **|** `null` | ISO 8601 duration between repeated notifications while the alarm remains in the firing state. From getAlarm enrichment. |  |
| `resolution` | `string` **|** `null` | Time grain at which the metric is evaluated (e.g. 1m, 5m, 1h). From getAlarm enrichment. |  |
| `resourceGroup` | `string` **|** `null` | Optional MQL resource group filter, used for custom metrics. Null when the alarm targets a built-in namespace. |  |
| `ruleName` | `string` | Identifier of the alarm rule whose values this configuration represents. Defaults to "BASE". |  |
| `severity` | `string` | Operator-perceived severity when the alarm fires. One of CRITICAL, ERROR, WARNING, INFO. Mapped to the inherited Rule.criticality numeric (10/7/4/1) for queryability. |  |
| `suppressionDescription` | `string` **|** `null` | Reason for the active suppression window, if any. Flattened from suppression.description. |  |
| `suppressionFromOn` | `number` **|** `null` | Epoch ms when the active suppression window starts. Null if no suppression configured. Parsed via parseTimePropertyValue from suppression.timeSuppressFrom. |  |
| `suppressionUntilOn` | `number` **|** `null` | Epoch ms when the active suppression window ends. Parsed via parseTimePropertyValue from suppression.timeSuppressUntil. |  |

---

### Oci Oac Analytics Instance

`oci_oac_analytics_instance` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `capacityType` | `string` |  |  |
| `capacityValue` | `number` |  |  |
| `featureSet` | `string` |  |  |
| `lifecycleState` | `string` |  |  |
| `networkEndpointType` | `string` |  |  |
| `region` | `string` |  |  |

---

### Oci Oic Integration Instance

`oci_oic_integration_instance` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `consumptionModel` | `string` |  |  |
| `customEndpointAlias` | `string` |  |  |
| `customEndpointCertificateSecretId` | `string` |  |  |
| `customEndpointCertificateSecretVersion` | `number` |  |  |
| `customEndpointHostname` | `string` |  |  |
| `instanceUrl` | `string` |  |  |
| `integrationInstanceType` | `string` |  |  |
| `isByol` | `boolean` |  |  |
| `isFileServerEnabled` | `boolean` |  |  |
| `isIntegrationVcnAllowlisted` | `boolean` |  |  |
| `isVisualBuilderEnabled` | `boolean` |  |  |
| `lifecycleState` | `string` |  |  |
| `messagePacks` | `number` |  |  |
| `networkEndpointDetailsType` | `string` |  |  |
| `region` | `string` |  |  |
| `stateMessage` | `string` |  |  |

---

### Oci Service Connector

`oci_service_connector` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `batchRolloverSizeInMBs` | `number` **|** `null` | Batch rollover size (MB) for an objectStorage target. |  |
| `batchRolloverTimeInMs` | `number` **|** `null` | Batch rollover time (ms) for an objectStorage target. |  |
| `compartmentId` | `string` | OCID of the compartment that owns this connector. |  |
| `isAuditSource` | `boolean` | True when the connector reads from the tenancy \_Audit log group (i.e. it is routing audit logs). OCI represents this source with the reserved literal \_Audit/\_AuditIncludeSubcompartment rather than a log-group OCID, so it is captured here rather than in sourceLogGroupIds. |  |
| `isEnabled` | `boolean` | True when lifecycleState is ACTIVE (data is flowing). False means the connector exists but is not delivering data. |  |
| `isFormattedMessagingEnabled` | `boolean` **|** `null` | Whether formatted messaging is enabled for a notifications target. |  |
| `isFunctionTaskEnabled` | `boolean` | True when the connector has a function task that transforms/masks source data by invoking a function before delivery. |  |
| `isLogFilterEnabled` | `boolean` | True when the connector has a logRule task that filters/masks source data before delivery. |  |
| `lifecycleDetails` | `string` **|** `null` | Human-readable detail about the current lifecycle state. |  |
| `lifecycleState` | `string` **|** `null` | Connector lifecycle state (CREATING, UPDATING, ACTIVE, INACTIVE, DELETING, DELETED, FAILED). Only ACTIVE connectors are actually delivering data. |  |
| `logFilterCondition` | `string` **|** `null` | The logRule task condition applied to source data before delivery. |  |
| `region` | `string` | OCI region in which the connector is configured. |  |
| `sourceKind` | `string` **|** `null` | Source type: logging, streaming, monitoring, or plugin. |  |
| `sourceLogGroupIds` | `array` of `string`s | OCIDs of the Logging log groups read by this connector (logging source). Excludes the reserved audit log group — see isAuditSource. |  |
| `sourceLogIds` | `array` of `string`s | OCIDs of the specific Logging logs read by this connector (logging source). |  |
| `sourceMonitoringNamespaces` | `array` of `string`s | Metric namespaces read by this connector (monitoring source). |  |
| `sourcePluginName` | `string` **|** `null` | Plugin name when the source is a plugin (e.g. QueueSource). |  |
| `sourceStreamId` | `string` **|** `null` | OCID of the stream read by this connector (streaming source). |  |
| `targetBucketName` | `string` **|** `null` | Object Storage bucket name the connector delivers to (objectStorage target). |  |
| `targetFunctionId` | `string` **|** `null` | OCID of the function the connector invokes (functions target). |  |
| `targetKind` | `string` **|** `null` | Target sink type: objectStorage, streaming, functions, notifications, monitoring, or loggingAnalytics. |  |
| `targetLoggingAnalyticsLogGroupId` | `string` **|** `null` | OCID of the Logging Analytics log group the connector delivers to (loggingAnalytics target). No local entity is modelled for this sink. |  |
| `targetMonitoringMetric` | `string` **|** `null` | Metric name the connector writes to (monitoring target). |  |
| `targetMonitoringNamespace` | `string` **|** `null` | Metric namespace the connector writes to (monitoring target). |  |
| `targetNamespace` | `string` **|** `null` | Object Storage namespace of the target bucket. |  |
| `targetObjectNamePrefix` | `string` **|** `null` | Object name prefix applied to delivered objects (objectStorage target). |  |
| `targetStreamId` | `string` **|** `null` | OCID of the stream the connector delivers to (streaming target). |  |
| `targetTopicId` | `string` **|** `null` | OCID of the notification topic the connector delivers to (notifications target). |  |
| `taskFunctionId` | `string` **|** `null` | OCID of the function invoked by the connector function task, if any. |  |

---

### Oci Smtp Credential

`oci_smtp_credential` inherits from [AccessKey](/data-model/schemas/AccessKey.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `lifecycleState` | `string` **|** `null` |  |  |
| `username` | `string` **|** `null` |  |  |

---

### Oci Streaming Stream

`oci_streaming_stream` inherits from [DataCollection](/data-model/schemas/DataCollection.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `classification` | `string` | The lifecycle state of the stream (e.g., ACTIVE, DELETED) — surfaces as the DataCollection classification |  |
| `compartmentId` | `string` | The OCID of the compartment containing the stream |  |
| `messagesEndpoint` | `string` | The endpoint URL used to publish/consume messages on the stream |  |
| `oracleStreamingStreamId` | `string` | The OCID of the stream |  |
| `partitions` | `number` | Number of partitions in the stream |  |
| `region` | `string` | The OCI region of the stream |  |

---

### Oci Streaming Stream Pool

`oci_streaming_stream_pool` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `compartmentId` | `string` | The OCID of the compartment containing the stream pool |  |
| `endpointFqdn` | `string` **|** `null` | The fully qualified domain name (FQDN) of the stream pool endpoint |  |
| `isPrivate` | `boolean` | Whether the stream pool uses a private endpoint inside a customer VCN |  |
| `kafkaLogRetentionHours` | `number` **|** `null` | The number of hours to retain Kafka log files in the stream pool (OCI KafkaSettings.logRetentionHours) |  |
| `kmsKeyId` | `string` **|** `null` | The OCID of the customer-managed KMS key used to encrypt the stream pool |  |
| `kmsKeyState` | `string` **|** `null` | The state of the customer-managed KMS key (e.g., ACTIVE, REVOKED) |  |
| `lifecycleState` | `string` | The lifecycle state of the stream pool (e.g., ACTIVE, CREATING, DELETED) |  |
| `nsgIds` | `array` **|** `null` | OCIDs of network security groups attached to the stream pool private endpoint |  |
| `oracleStreamingPoolId` | `string` | The OCID of the stream pool |  |
| `privateEndpointIp` | `string` **|** `null` | The private IP address of the stream pool endpoint |  |
| `region` | `string` | The OCI region of the stream pool |  |
| `subnetId` | `string` **|** `null` | The OCID of the subnet hosting the stream pool private endpoint |  |

---

### Oci User

`oci_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `compartmentId` | `string` |  |  |

---

## Release Notes

-   **2026-09-15** — Added support for Oracle Cloud Infrastructure Operations Insights, ingesting database insights, host insights, private endpoints, Exadata insights, and OPSI configurations as queryable entities.
-   **2026-09-14** — Added support for OCI Email Delivery, ingesting email delivery resources as queryable entities.
-   **2026-09-14** — Added support for OCI Dynamic Routing Gateways, ingesting gateway entities and their route table and attachment configurations.
-   **2026-09-14** — Added support for OCI Fleet Application Management, ingesting fleet, maintenance, and patching resources as queryable entities.
-   **2026-09-14** — OCI CloudGuard detector recipe rules now include an enabled status property.
-   **2026-09-01** — Added support for OCI GoldenGate, ingesting deployments, connections, backups, and upgrade resources with relationships to VCN subnets, network security groups, KMS keys, and vault secrets.
-   **2026-09-01** — Enhanced OCI CloudGuard data model to include resource types, security policies, security recipes, security zones, targets, and detector recipe rules as queryable entities.
-   **2026-07-29** — Added OCI Audit configuration and Connector Hub ingestion as queryable entities.
-   **2026-06-10** — Enhanced OCI Notifications data model to include topics and subscriptions as queryable entities.
-   **2026-06-08** — OCI streaming stream pools now expose Kafka log retention hours as a queryable property.
-   **2026-05-27** — Enhanced OCI File Storage Service data model with additional file system, mount target, and export properties.
-   **2026-05-21** — Enhanced OCI Logging data model to include log entities, service summary entries, and Log Analytics entities.
-   **2026-04-30** — Added OCI Monitoring alarm ingestion, with relationships to monitored streams, stream pools, functions, and notification topics.
-   **2026-04-08** — Improved OS type and OS details accuracy on Oracle Cloud host and container instance entities.
-   **2026-03-26** — Added multi-region support to the Oracle Cloud integration, allowing ingestion across multiple OCI regions in a single run.
-   **2026-03-23** — Added OCI FastConnect data model, ingesting virtual circuits and cross-connect groups.
-   **2026-03-13** — Added OCI Container Instance data model, ingesting container instances and their containers.
-   **2026-03-13** — Added OCI Data Safe data model, ingesting target databases and security assessments.
-   **2026-02-19** — Promoted raw data properties to five OCI entity types including functions and networking resources.
-   **2026-02-17** — Extended OCI NoSQL table data model with new properties (lifecycle details, multi-region support, auto-reclaimable status, max read units, max write units, max storage in GBs, and capacity mode) and added CloudGuard problem mapping for NoSQL table resources.
-   **2025-12-15** — Added ingestion of OCI databases, Exadata infrastructure and VM clusters, dedicated VM hosts, network security rules, boot disk images, and NFS mount targets with full compartment relationship mapping.
-   **2025-12-04** — Added support for OCI Identity Domains, ingesting domain users and groups as Oracle IAM user and Oracle IAM group entities with user-group membership relationships.
-   **2025-11-13** — Added OCI CloudGuard Recipes and CloudGuard Recipe Rules as new ingested entity types.
-   **2025-11-04** — Promoted additional Oracle Database properties including database edition, character set, and connection string details.
-   **2025-10-16** — Added OCI Exadata Database Service resources including Exadata infrastructure and VM cluster entities.
-   **2025-10-02** — Added resource to CloudGuard problem relationships linking OCI resources to their associated CloudGuard problems.
-   **2025-09-10** — Promoted compartment ID from raw data to OCI compartment entities for easier querying.
-   **2025-08-25** — Added OCI Vault ingestion as vault entities with secret and key relationships.
-   **2025-05-06** — Added OCI Exadata Infrastructure ingestion and enhanced host entity properties.
-   **2025-05-06** — Added OCI Load Balancer ingestion as load balancer entities with listener and backend relationships.

---

Source: /integrations/directory/orca

# Orca Security

Visualize Orca Security assets, findings, roles, users, and user groups, map Orca users to employees, and monitor changes through queries and alerts.

## Installation

To initiate this integration in JupiterOne, you will first need to create an API token within Orca to use in JupiterOne.

### Configuration in Orca

**To create an API token:**

1.  Log into the [Orca dashboard](https://app.orcasecurity.io) and navigate to **Settings > Modules > Integrations**.
2.  Scroll to the `SIEM/SOAR` section.
3.  Find the JupiterOne tile and press `CONFIGURE`
4.  Enter a `Name` and `Description` (optional)
5.  Select the `Internal Viewer` role. If a lesser role is provided, the integration will attempt to run as many steps as it is able to.
6.  Select the desired unit `Scope`. To ingest all data from all units, select `All Cloud Accounts`
7.  Press `CREATE TOKEN` and copy the token value that appears for use in JupiterOne. The token value will not be available after closing this screen.

> **NOTE**
> 
> Legacy API Keys will continue to be supported until Orca removes support for them. For more information about API Tokens, see [Orca's documentation](https://docs.orcasecurity.io).

### Configuration in JupiterOne

To install the Orca integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Orca. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Orca account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **Orca Security Account Email** (the email address used within Orca to generate the API credentials).
    
-   Lastly, the Orca **API Key**, corresponding **Token**, and **Orca API Base URL** from your Orca account.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `orca_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `orca_finding_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Asset | `orca_asset` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Finding | `orca_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Finding | `orca_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Host | `orca_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Role | `orca_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| User | `orca_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| UserGroup | `orca_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `orca_account` | **HAS** | `orca_group` |
| `orca_account` | **HAS** | `orca_asset` |
| `orca_asset` | **IS** | `orca_host` |
| `orca_asset` | **HAS** | `orca_finding` |
| `orca_finding` | **IS** | `cve` |
| `orca_group` | **HAS** | `orca_user` |
| `orca_host` | **HAS** | `orca_finding` |
| `orca_user` | **ASSIGNED** | `orca_role` |

### Orca Finding

`orca_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `affectedPackages` | `array` of `string`s | Names of the packages affected by the vulnerability. |  |
| `assetCategory` | `string` | Orca category of the affected asset. |  |
| `assetDistributionName` | `string` | Operating system distribution of the affected asset. |  |
| `assetLabels` | `array` of `string`s | Labels attached to the affected asset. |  |
| `assetType` | `string` | Type of the affected asset, such as AwsEc2Instance. |  |
| `assetVendorId` | `string` | Vendor identifier of the affected asset. Not reported by the Serving Layer VulnerabilityV2 model. |  |
| `cloudProvider` | `string` | Cloud provider hosting the affected asset, such as aws. |  |
| `cloudVendorId` | `string` | Identifier given to the affected asset by its cloud provider. Not currently mapped from the Serving Layer. |  |
| `clusterType` | `string` | Orca cluster type of the affected asset. Not reported by the Serving Layer VulnerabilityV2 model. |  |
| `cvss2Score` | `number` | CVSS v2 base score reported for the vulnerability. |  |
| `cvss3Score` | `number` | CVSS v3 base score reported for the vulnerability. |  |
| 
`fixable` \*

 | `boolean` | Whether a patch is available for the vulnerability. |  |
| `groupType` | `string` | Orca group type of the affected asset. Not reported by the Serving Layer VulnerabilityV2 model. |  |
| `orcaScore` | `number` | Risk score assigned by Orca to the vulnerability. Not populated: the Serving Layer reports a risk score for the asset, not for the vulnerability. |  |
| `orcaSeverity` | `string` | Severity label as Orca reports it, lowercased. |  |
| `packages` | `array` of `string`s | Distinct names of the installed packages the vulnerability was found in. |  |
| `type` | `string` | Vulnerability type as classified by Orca. Not reported by the Serving Layer VulnerabilityV2 model. |  |
| `vmId` | `string` | Identifier given to the affected virtual machine by Orca. |  |

---

### Orca Finding

`orca_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `affectedPackages` | `array` of `string`s | Names of the packages affected by the vulnerability. |  |
| `assetCategory` | `string` | Orca category of the affected asset. |  |
| `assetDistributionName` | `string` | Operating system distribution of the affected asset. |  |
| `assetLabels` | `array` of `string`s | Labels attached to the affected asset. |  |
| `assetType` | `string` | Type of the affected asset, such as AwsEc2Instance. |  |
| `assetVendorId` | `string` | Vendor identifier of the affected asset. Not reported by the Serving Layer VulnerabilityV2 model. |  |
| `cloudProvider` | `string` | Cloud provider hosting the affected asset, such as aws. |  |
| `cloudVendorId` | `string` | Identifier given to the affected asset by its cloud provider. Not currently mapped from the Serving Layer. |  |
| `clusterType` | `string` | Orca cluster type of the affected asset. Not reported by the Serving Layer VulnerabilityV2 model. |  |
| `cvss2Score` | `number` | CVSS v2 base score reported for the vulnerability. |  |
| `cvss3Score` | `number` | CVSS v3 base score reported for the vulnerability. |  |
| 
`fixable` \*

 | `boolean` | Whether a patch is available for the vulnerability. |  |
| `groupType` | `string` | Orca group type of the affected asset. Not reported by the Serving Layer VulnerabilityV2 model. |  |
| `orcaScore` | `number` | Risk score assigned by Orca to the vulnerability. Not populated: the Serving Layer reports a risk score for the asset, not for the vulnerability. |  |
| `orcaSeverity` | `string` | Severity label as Orca reports it, lowercased. |  |
| `packages` | `array` of `string`s | Distinct names of the installed packages the vulnerability was found in. |  |
| `type` | `string` | Vulnerability type as classified by Orca. Not reported by the Serving Layer VulnerabilityV2 model. |  |
| `vmId` | `string` | Identifier given to the affected virtual machine by Orca. |  |

---

## Release Notes

-   **2026-04-21** — Orca host entities are now linked to the security findings affecting them.
-   **2026-03-31** — Added OS kernel version property to Orca host and asset entities.

---

Source: /integrations/directory/pagerduty

# PagerDuty

Visualize PagerDuty services, teams, and users, map PagerDuty users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create a General Access REST API key on PagerDuty for use in JupiterOne. See [their documentation](https://support.pagerduty.com/docs/generating-api-keys#section-generating-a-general-access-rest-api-key) for more information.

### Configuration in JupiterOne

To install the PagerDuty integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select PagerDuty. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the PagerDuty account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Lastly, your PagerDuty **API Key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Service | `pagerduty_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Team | `pagerduty_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `pagerduty_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `pagerduty_service` | **ASSIGNED** | `pagerduty_team` |
| `pagerduty_team` | **HAS** | `pagerduty_user` |
| `pagerduty_user` | **MONITORS** | `pagerduty_service` |

### Pagerduty User

`pagerduty_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `billed` | `boolean` |  |  |
| `description` | `string` |  |  |
| `invitationSent` | `boolean` |  |  |
| `jobTitle` | `string` |  |  |
| `role` | `string` |  |  |
| `timeZone` | `string` |  |  |
| `type` | `string` |  |  |
| `webLink` | `string` |  |  |

---

---

Source: /integrations/directory/palo-alto

# Palo Alto Cortex XDR

Strengthen your endpoint security with JupiterOne's Palo Alto Cortex XDR integration. Our guide offers detailed instructions on setting up the integration and utilizing its comprehensive data model to gain visibility into your device and endpoint security data. Learn how the integration can help you detect potential security threats and streamline your security operations.

## Installation

> **INFO**
> 
> Before you begin, create an API key in Palo Alto Cortex XDR. See the [Cortex XDR documentation](https://cortex-docs.paloaltonetworks.com/xdr-5-api/create-a-new-api-key) for step-by-step instructions.

To install the Palo Alto Cortex XDR integration in JupiterOne, navigate to the **Integrations** tab and select **Palo Alto Cortex XDR**. Click **New Instance** to begin.

### Prerequisites

Creating a Palo Alto Cortex XDR integration instance requires the following:

-   A Cortex XDR API key and API key ID. In Cortex XDR, navigate to **Settings** > **Configurations** > **Integrations** > **API Keys** and generate a new key.
    -   Select the **Standard** security level.
    -   Assign the appropriate role:
        -   To ingest Users, User Groups, and Roles, assign the **Instance Administrator** role.
        -   For all other data, the **Viewer** role is sufficient.
    -   After generation, copy the API key value and note the numeric **API Key ID** shown in the table. Your tenant **Host** is the FQDN displayed in the Cortex XDR top-right URL bar (for example, `tenant-id.xdr.us.paloaltonetworks.com`).
-   Your **Host** (the Cortex XDR tenant FQDN, for example `mytenant.xdr.us.paloaltonetworks.com`)
-   Your **API Key** (the generated key value)
-   Your **API Key ID** (the numeric ID displayed next to the key in the API Keys table)

### Create an instance

1.  Sign in to [Cortex Gateway](https://cortex-gateway.paloaltonetworks.com/signin/).
2.  Select the tenant you want to integrate.
3.  In the Cortex XDR console, navigate to **Settings** > **Configurations** > **Integrations** > **API Keys**.
4.  Click **New Key**. Under **Security Level** choose **Standard**; under **Role** choose **Instance Administrator** (for full data access) or **Viewer** (for alerts, incidents, and endpoints only).
5.  Click **Generate**. Copy the API key — it is shown only once.
6.  Note the **API Key ID** (the numeric value in the table) and the FQDN from your browser's address bar.
7.  In JupiterOne, enter the **Host**, **API Key**, and **API Key ID** in the corresponding fields, then click **Create**.

## Data Volume Configuration

### Ingestion Windows

Limit how far back the integration looks when ingesting incidents and alerts. Narrower windows reduce ingestion volume.

| Field | Description | Default |
| --- | --- | --- |
| Incident Ingestion Window | How far back (in days) to look for incidents based on their last modification time. | 90 days |
| Alert Ingestion Window | How far back (in days) to look for alerts based on their detection timestamp. | 90 days |

Available options for both fields: **1 day**, **7 days**, **30 days**, **60 days**, **90 days**.

### Data Filtering Options

Control which incidents are ingested by status.

| Field | Description | Default |
| --- | --- | --- |
| Incident Status | Restrict ingestion to incidents in specific statuses. When left at the default, only open incidents are ingested. | New, Under Investigation |

Available status options: New, Under Investigation, Resolved (auto-resolve), Resolved (duplicate incident), Resolved (false positive), Resolved (true positive), Resolved (known issue), Resolved (threat handled), Resolved (security testing), Resolved (other).

### Next steps

Your integration is now configured. It will run on the polling interval you selected and populate data in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) for more details on working with integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `Instance Administrator`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (15)

-   `https://{cortex-cloud-fqdn}/public_api/v1/assets`
-   `https://{cortex-cloud-fqdn}/public_api/v1/assets/{assetID}/sbom`
-   `https://{cortex-cloud-fqdn}/public_api/v1/case/search`
-   `https://{cortex-cloud-fqdn}/public_api/v1/issue/search`
-   `https://{cortex-cloud-fqdn}/vulnerability-management/v1/vulnerability-finding/search`
-   `https://{cortex-xdr-fqdn}/public_api/v1/alerts/get_alerts_multi_events`
-   `https://{cortex-xdr-fqdn}/public_api/v1/endpoints/get_endpoint`
-   `https://{cortex-xdr-fqdn}/public_api/v1/endpoints/get_policy`
-   `https://{cortex-xdr-fqdn}/public_api/v1/incidents/get_incident_extra_data`
-   `https://{cortex-xdr-fqdn}/public_api/v1/incidents/get_incidents`
-   `https://{cortex-xdr-fqdn}/public_api/v1/rbac/get_roles`
-   `https://{cortex-xdr-fqdn}/public_api/v1/rbac/get_user_group`
-   `https://{cortex-xdr-fqdn}/public_api/v1/rbac/get_users`
-   `https://{cortex-xdr-fqdn}/public_api/v1/xql/get_query_results`
-   `https://{cortex-xdr-fqdn}/public_api/v1/xql/start_xql_query`

### Licenses

Product licenses or SKUs required in the target environment.

Show Licenses (5)

-   `Cortex Cloud Posture Management`
-   `Cortex Cloud Runtime Security`
-   `Cortex XDR Prevent`
-   `Cortex XDR Pro per Endpoint`
-   `Cortex XDR Pro per GB`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (9)

-   [https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cases-apis/cases.md](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cases-apis/cases.md)
-   [https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-workload-protection/sbom.md](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-workload-protection/sbom.md)
-   [https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/asset-inventory.md](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/asset-inventory.md)
-   [https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/issues-apis/issues.md](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/issues-apis/issues.md)
-   [https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/vulnerability-management/vulnerability-findings.md](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/vulnerability-management/vulnerability-findings.md)
-   [https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/endpoint-management](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/endpoint-management)
-   [https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/incident-management](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/incident-management)
-   [https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/xql-query](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/xql-query)
-   [https://cortex-docs.paloaltonetworks.com/xdr-5-api/create-a-new-api-key](https://cortex-docs.paloaltonetworks.com/xdr-5-api/create-a-new-api-key)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | Endpoints | Licenses |
| --- | --- | --- |
| Fetch Cases | `https://{cortex-cloud-fqdn}/public_api/v1/case/search` | `Cortex Cloud Runtime Security`, `Cortex Cloud Posture Management` |
| Fetch Issues | `https://{cortex-cloud-fqdn}/public_api/v1/issue/search` | `Cortex Cloud Runtime Security`, `Cortex Cloud Posture Management` |
| Fetch SBOMs | `https://{cortex-cloud-fqdn}/public_api/v1/assets/{assetID}/sbom` | `Cortex Cloud Runtime Security` |
| Fetch Vulnerability Findings | `https://{cortex-cloud-fqdn}/vulnerability-management/v1/vulnerability-finding/search` | `Cortex Cloud Runtime Security`, `Cortex Cloud Posture Management` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `palo_alto_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `palo_alto_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Alert | `palo_alto_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Cortex Case | `palo_alto_cortex_case` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Cortex Compute Asset | `palo_alto_cortex_compute_asset` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cortex Issue | `palo_alto_cortex_issue` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Cortex Software Package | `palo_alto_cortex_software_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Cortex Vulnerability Finding | `palo_alto_cortex_vulnerability_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Endpoint Agent | `palo_alto_endpoint_sensor` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Endpoint Host | `palo_alto_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Endpoint Policy | `palo_alto_endpoint_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Incident | `palo_alto_incident` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Incident | `palo_alto_incident` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Role | `palo_alto_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Service | `palo_alto_endpoint_protection` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `palo_alto_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `palo_alto_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `palo_alto_account` | **HAS** | `palo_alto_endpoint_protection` |
| `palo_alto_account` | **HAS** | `palo_alto_cortex_compute_asset` |
| `palo_alto_cortex_compute_asset` | **HAS** | `palo_alto_cortex_vulnerability_finding` |
| `palo_alto_cortex_compute_asset` | **HAS** | `palo_alto_cortex_issue` |
| `palo_alto_cortex_compute_asset` | **HAS** | `palo_alto_cortex_case` |
| `palo_alto_cortex_compute_asset` | **CONTAINS** | `palo_alto_cortex_software_package` |
| `palo_alto_cortex_software_package` | **HAS** | `palo_alto_cortex_vulnerability_finding` |
| `palo_alto_endpoint_policy` | **HAS** | `palo_alto_endpoint_protection` |
| `palo_alto_endpoint_sensor` | **ASSIGNED** | `palo_alto_endpoint_policy` |
| `palo_alto_endpoint_sensor` | **PROTECTS** | `palo_alto_host` |
| `palo_alto_endpoint_sensor` | **IDENTIFIED** | `palo_alto_incident` |
| `palo_alto_endpoint_sensor` | **IDENTIFIED** | `palo_alto_alert` |
| `palo_alto_host` | **HAS** | `palo_alto_incident` |
| `palo_alto_incident` | **HAS** | `palo_alto_alert` |
| `palo_alto_user` | **HAS** | `palo_alto_role` |
| `palo_alto_user_group` | **HAS** | `palo_alto_role` |
| `palo_alto_user_group` | **HAS** | `palo_alto_user` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `palo_alto_cortex_compute_asset` | **IS** | `aws_instance` | FORWARD |
| `palo_alto_cortex_compute_asset` | **IS** | `aws_lambda_function` | FORWARD |
| `palo_alto_cortex_compute_asset` | **IS** | `aws_ecs_cluster` | FORWARD |
| `palo_alto_cortex_compute_asset` | **IS** | `aws_ecs_service` | FORWARD |
| `palo_alto_cortex_compute_asset` | **IS** | `aws_ecs_task` | FORWARD |
| `palo_alto_cortex_compute_asset` | **IS** | `aws_ecs_task_definition` | FORWARD |
| `palo_alto_cortex_compute_asset` | **IS** | `aws_ecs_container_instance` | FORWARD |
| `palo_alto_cortex_compute_asset` | **IS** | `aws_eks_cluster` | FORWARD |
| `palo_alto_cortex_compute_asset` | **IS** | `aws_eks_node_group` | FORWARD |

### Palo Alto Cortex Case

`palo_alto_cortex_case` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetIds` | `array` **|** `null` | Cortex asset IDs the case applies to. HAS relationships exist only for ingested Compute assets. |  |
| `caseId` | `number` | Cortex case ID. |  |
| `issueCount` | `number` | Number of issues in the case. |  |
| `mitreTactics` | `array` **|** `null` | MITRE ATT&CK tactics. |  |
| `mitreTechniques` | `array` **|** `null` | MITRE ATT&CK techniques. |  |
| `resolveReason` | `string` | Reason the case was resolved. |  |
| `statusProgress` | `string` | Case progress status, e.g. New, In Progress, Resolved. |  |

---

### Palo Alto Cortex Compute Asset

`palo_alto_cortex_compute_asset` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetCategory` | `string` **|** `null` | Cortex asset type category (`xdm.asset.type.category`). |  |
| `assetClass` | `string` **|** `null` | Cortex asset type class (`xdm.asset.type.class`), e.g. Compute. |  |
| 
`assetId` \*

 | `string` | Cortex asset ID (`xdm.asset.id`). |  |
| `assetType` | `string` **|** `null` | Cortex asset type ID (`xdm.asset.type.id`), e.g. EC2\_INSTANCE. |  |
| `firstObservedOn` | `number` | When Cortex first observed the asset. |  |
| `provider` | `string` **|** `null` | Cloud provider of the asset, e.g. AWS. |  |
| `region` | `string` **|** `null` | Cloud region of the asset. |  |
| `resourceGroup` | `string` **|** `null` | Resource group the asset belongs to. |  |
| `strongId` | `string` **|** `null` | Provider-side identifier of the asset (`xdm.asset.strong_id`). |  |

---

### Palo Alto Cortex Issue

`palo_alto_cortex_issue` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetIds` | `array` **|** `null` | Cortex asset IDs the issue applies to. HAS relationships exist only for ingested Compute assets. |  |
| `cveId` | `string` | CVE ID, for VULNERABILITY-category issues. |  |
| `detectionMethod` | `string` | Detection method of the issue. |  |
| `domain` | `string` | Issue domain, e.g. Security, Posture. |  |
| `externalId` | `string` | External ID of the issue. |  |
| `issueId` | `number` | Cortex issue ID. |  |
| `mitreTactics` | `array` **|** `null` | MITRE ATT&CK tactics. |  |
| `mitreTechniques` | `array` **|** `null` | MITRE ATT&CK techniques. |  |
| `remediation` | `string` | Remediation guidance. |  |

---

### Palo Alto Cortex Software Package

`palo_alto_cortex_software_package` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `author` | `string` | Package author. |  |
| `licenses` | `array` **|** `null` | Licenses declared for the package. |  |
| `packageType` | `string` | CycloneDX component type, e.g. library. |  |
| `purl` | `string` | Package URL (PURL). |  |
| `version` | `string` | Package version. |  |

---

### Palo Alto Cortex Vulnerability Finding

`palo_alto_cortex_vulnerability_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetId` | `string` | Cortex asset ID of the affected asset. The HAS relationship exists only when the asset is an ingested Compute asset. |  |
| `epssScore` | `number` | EPSS probability score (0-1). |  |
| `exploitLevel` | `string` **|** `null` | Exploit maturity level. |  |
| `fixVersions` | `array` **|** `null` | Package versions that fix the CVE. |  |
| `imageName` | `string` **|** `null` | Container image name, for image findings. |  |
| `isExploitable` | `boolean` | Whether Cortex considers the vulnerability exploitable. |  |
| `isFixAvailable` | `boolean` | Whether a fix is available for the finding. |  |
| `isInternetExposed` | `boolean` | Whether the affected asset is exposed to the internet. |  |
| `isKnownExploited` | `boolean` | Whether the CVE is in the CISA Known Exploited Vulnerabilities catalog. |  |
| `layerId` | `string` **|** `null` | Container image layer ID, for image findings. |  |
| `packageName` | `string` **|** `null` | Name of the affected package. |  |
| `packagePurl` | `string` **|** `null` | Package URL (PURL) of the affected package. |  |
| `packageType` | `string` **|** `null` | Type of the affected package, e.g. npm, pip, deb. |  |
| `packageVersion` | `string` **|** `null` | Version of the affected package. |  |
| `platformId` | `string` | Cortex platform identifier of the finding. |  |

---

### Palo Alto Host

`palo_alto_host` inherits from [Host](/data-model/schemas/Host.md)

---

### Palo Alto User

`palo_alto_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `groups` | `array` of `string`s |  |  |
| `lastLoggedIn` | `number` |  |  |
| `role` | `string` |  |  |

---

## Release Notes

-   **2026-07-08** — Added a configuration option to limit Palo Alto Cortex XDR alert ingestion to a configurable lookback window.
-   **2026-07-07** — Added configuration options to filter Palo Alto Cortex XDR incidents by status and to limit ingestion to a configurable lookback window.
-   **2026-06-26** — Palo Alto Cortex XDR host entities are now linked to the incidents they appear in.
-   **2026-06-24** — Vulnerability-type Palo Alto Cortex XDR alerts and incidents are now classified as Vulnerability entities, and CVE identifiers are extracted when available.

---

Source: /integrations/directory/palo-alto-panorama

# Palo Alto Panorama

Visualize your Palo Alto Panorama estate in JupiterOne — the managed firewalls, device groups, address objects and address groups, and the security policy rules applied across them — and monitor policy and inventory changes through queries and alerts.

## Installation

This integration reads data from Palo Alto **Panorama** over the [PAN-OS XML API](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api) — the Panorama instance itself, the firewalls it manages, device groups, address objects and address groups, and the pre- and post-rulebase security policy rules. It is read-only: it issues only configuration read and operational `show` requests, and never commits or modifies your configuration.

Panorama is typically deployed on-premises and not reachable from the internet, so this integration is most often run through a [JupiterOne Collector](/integrations/development/collector.md) inside your network.

### Configuration in Panorama

The integration authenticates as a Panorama administrator and generates an API key with a `type=keygen` request. Create a dedicated administrator for it rather than reusing an existing account.

#### 1\. Create an Admin Role profile with XML API access

1.  Log in to the Panorama web interface as an administrator.
    
2.  Select **Panorama > Admin Roles** and click **Add**.
    
3.  Enter a **Name** for the profile — for example, `jupiterone-readonly`.
    
4.  Set the **Role** type to **Panorama**.
    
    > **INFO**
    > 
    > The **XML API** tab is only available when the Role type is **Panorama**. A **Device Group and Template** role cannot be granted XML API access.
    
5.  Select the **XML API** tab and **Enable** the following two functional areas, leaving the rest **Disabled**:
    
    | XML API functional area | Why the integration needs it |
    | --- | --- |
    | **Configuration** | Reads device groups, address objects, address groups, and security rules (`type=config`). |
    | **Operational Requests** | Runs `show system info`, `show devices all`, and `show dg-hierarchy` (`type=op`). |
    
    **Report**, **Log**, **Commit**, **User-ID Agent**, **Export**, and **Import** are not used and should stay disabled.
    
    > **NOTE**
    > 
    > The XML API functional areas are single **Enabled**/**Disabled** toggles — unlike the Web UI tab, they have no read-only setting. Enabling **Configuration** therefore permits both retrieving and modifying configuration over the XML API. The integration only ever retrieves it.
    
6.  Click **OK**.
    

#### 2\. Create the administrator account

1.  Select **Panorama > Administrators** and click **Add**.
    
2.  Enter a **Name** for the administrator — for example, `jupiterone`.
    
3.  Leave **Authentication Profile** set to **None** and enter a **Password** to authenticate locally, or select an authentication profile if you manage administrators externally.
    
4.  Set **Administrator Type** to **Custom Panorama Admin** and select the Admin Role profile you created above.
    
5.  Click **OK**.
    

#### 3\. Commit your changes

Select **Commit > Commit to Panorama** to apply the new role and administrator.

#### Network and TLS requirements

-   The integration reaches Panorama over HTTPS on port `443`. Ensure the Collector has network access to the Panorama management interface, and that the management interface permits HTTPS access from it.
    
-   If Panorama presents a self-signed or internal-CA TLS certificate, obtain that CA certificate in PEM format so the Collector can verify the connection.
    

Once you have the hostname, username, and password, proceed to JupiterOne to finalize the integration.

### Configuration in JupiterOne

To install the Palo Alto Panorama integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Palo Alto Panorama**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Palo Alto Panorama account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **Panorama Host** — the hostname or IP address of your Panorama instance, without a scheme or path, for example `panorama.example.com`.
    
-   The **Username** and **Password** of the Panorama administrator you created.
    
-   Optionally, a **CA Certificate** in PEM format to trust a self-signed or internal-CA certificate, or enable **Disable TLS Verification** to skip certificate validation entirely (not recommended).
    

Click **Create** once all values are provided to finalize the integration.

#### Data sources

You can narrow what the integration collects from the instance's ingestion source settings. **Fetch Device Groups** underpins the others — device groups are the scope that address objects, address groups, and security rules are read from, and disabling it leaves those steps with only the shared-scope objects.

| Ingestion source | Data collected |
| --- | --- |
| **Fetch Firewalls** | Firewalls managed by Panorama, with model, PAN-OS and content versions, and HA state. |
| **Fetch Device Groups** | Device groups and the parent/child hierarchy between them. |
| **Fetch Address Objects** | Address objects in each device group and in the shared scope. |
| **Fetch Address Groups** | Static and dynamic address groups, and their static members. |
| **Fetch Security Rules** | Pre- and post-rulebase security policy rules in each device group and the shared scope. |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Configure an Admin Role Profile](https://docs.paloaltonetworks.com/panorama/administration/configure-administrative-access-to-panorama/configure-an-admin-role-profile)
-   [Configure a Panorama Administrator Account](https://docs.paloaltonetworks.com/panorama/administration/configure-administrative-access-to-panorama/configure-administrative-accounts-and-authentication/configure-a-panorama-administrator-account)
-   [Panorama > Admin Roles](https://docs.paloaltonetworks.com/ngfw/help/10-2/panorama-web-interface/panorama-admin-roles) — reference for each XML API functional area
-   [Enabling API Access](https://docs.paloaltonetworks.com/ngfw/api/api-authentication-and-security/pan-os-api-authentication)
-   [Get Started with the PAN-OS XML API](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/get-started-with-the-pan-os-xml-api)

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (11)

-   `GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group`
-   `GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='*']/address`
-   `GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='*']/address-group`
-   `GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='*']/{pre|post}-rulebase/security/rules`
-   `GET /api/?type=config&action=get&xpath=/config/shared/address`
-   `GET /api/?type=config&action=get&xpath=/config/shared/address-group`
-   `GET /api/?type=config&action=get&xpath=/config/shared/{pre|post}-rulebase/security/rules`
-   `GET /api/?type=op&cmd=<show><devices><all></all></devices></show>`
-   `GET /api/?type=op&cmd=<show><dg-hierarchy></dg-hierarchy></show>`
-   `GET /api/?type=op&cmd=<show><system><info></info></system></show>`
-   `POST /api/?type=keygen`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (4)

-   [https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/pan-os-xml-api-request-types](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/pan-os-xml-api-request-types)
-   [https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/pan-os-xml-api-use-cases/query-a-firewall-from-panorama-api](https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/pan-os-xml-api-use-cases/query-a-firewall-from-panorama-api)
-   [https://pan.dev/panos/docs/tutorials/rulebase-to-csv/](https://pan.dev/panos/docs/tutorials/rulebase-to-csv/)
-   [https://pan.dev/panos/docs/tutorials/working-with-address-groups/](https://pan.dev/panos/docs/tutorials/working-with-address-groups/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | Endpoints |
| --- | --- |
| Fetch Address Groups | `GET /api/?type=config&action=get&xpath=/config/shared/address-group`, `GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='*']/address-group` |
| Fetch Address Objects | `GET /api/?type=config&action=get&xpath=/config/shared/address`, `GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='*']/address` |
| Fetch Firewalls | `GET /api/?type=op&cmd=<show><devices><all></all></devices></show>` |
| Fetch Security Rules | `GET /api/?type=config&action=get&xpath=/config/shared/{pre|post}-rulebase/security/rules`, `GET /api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='*']/{pre|post}-rulebase/security/rules` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `palo_alto_panorama_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AddressGroup | `palo_alto_address_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AddressObject | `palo_alto_address_object` | [NetworkEndpoint](https://docs.jupiterone.io/data-model/schemas/NetworkEndpoint) |
| DeviceGroup | `palo_alto_device_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Firewall | `palo_alto_firewall` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| SecurityRule | `palo_alto_security_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `palo_alto_address_group` | **HAS** | `palo_alto_address_object` |
| `palo_alto_device_group` | **HAS** | `palo_alto_firewall` |
| `palo_alto_device_group` | **HAS** | `palo_alto_device_group` |
| `palo_alto_device_group` | **HAS** | `palo_alto_address_object` |
| `palo_alto_device_group` | **HAS** | `palo_alto_address_group` |
| `palo_alto_device_group` | **HAS** | `palo_alto_security_rule` |
| `palo_alto_panorama_account` | **MANAGES** | `palo_alto_firewall` |
| `palo_alto_panorama_account` | **HAS** | `palo_alto_device_group` |
| `palo_alto_panorama_account` | **HAS** | `palo_alto_address_object` |
| `palo_alto_panorama_account` | **HAS** | `palo_alto_address_group` |
| `palo_alto_panorama_account` | **HAS** | `palo_alto_security_rule` |

### Palo Alto Address Group

`palo_alto_address_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deviceGroupName` | `string` | Device group the group belongs to ('shared' for shared groups) |  |
| `dynamicFilter` | `string` | Tag match filter expression for a dynamic group |  |
| `groupType` | `string` | Whether the group is static or dynamic |  |
| `members` | `array` of `string`s | Names of the static member address objects |  |
| `scope` | `string` | Scope the group is defined in ('shared' or a device group name) |  |

---

### Palo Alto Address Object

`palo_alto_address_object` inherits from [NetworkEndpoint](/data-model/schemas/NetworkEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `addressType` | `string` | Type of the address value (ip-netmask, ip-range, ip-wildcard, or fqdn) |  |
| `deviceGroupName` | `string` | Device group the object belongs to ('shared' for shared objects) |  |
| `scope` | `string` | Scope the object is defined in ('shared' or a device group name) |  |
| `value` | `string` | The address value (IP/netmask, range, wildcard, or FQDN) |  |

---

### Palo Alto Device Group

`palo_alto_device_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `parentDeviceGroup` | `string` **|** `null` | Name of the parent device group in the Panorama hierarchy, or null for top-level groups |  |

---

### Palo Alto Firewall

`palo_alto_firewall` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appVersion` | `string` | Application content database version installed |  |
| `avVersion` | `string` | Antivirus content version installed |  |
| `family` | `string` | Hardware family of the firewall |  |
| `haPeerSerial` | `string` | Serial number of the HA peer firewall, if any |  |
| `haState` | `string` | High-availability state of the firewall (e.g. active) |  |
| `ipAddress` | `string` | Management IP address of the firewall |  |
| `isConnected` | `boolean` | Whether the firewall is currently connected to Panorama |  |
| `isMultiVsys` | `boolean` | Whether the firewall has multiple virtual systems |  |
| `macAddress` | `string` | MAC address of the firewall |  |
| `operationalMode` | `string` | Operational mode of the firewall (e.g. normal) |  |
| `swVersion` | `string` | PAN-OS software version of the firewall |  |
| `threatVersion` | `string` | Threat content version installed |  |
| `uptime` | `string` | System uptime reported by the firewall |  |
| `wildfireVersion` | `string` | WildFire content version installed |  |

---

### Palo Alto Panorama Account

`palo_alto_panorama_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `family` | `string` | Hardware family of the Panorama instance |  |
| `model` | `string` | Hardware (or VM) model of the Panorama instance |  |
| `serial` | `string` | Serial number of the Panorama instance |  |
| `uptime` | `string` | System uptime reported by the Panorama instance |  |
| `version` | `string` | PAN-OS software version running on the Panorama instance |  |

---

### Palo Alto Security Rule

`palo_alto_security_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `string` | Action taken on matching traffic (e.g. allow, deny, drop) |  |
| `application` | `array` of `string`s | Matched applications |  |
| `destination` | `array` of `string`s | Destination address objects/groups |  |
| `deviceGroupName` | `string` | Device group the rule belongs to |  |
| `from` | `array` of `string`s | Source zones |  |
| `groupTag` | `string` | Group tag assigned to the rule |  |
| `isDisabled` | `boolean` | Whether the rule is disabled |  |
| `isLogEnd` | `boolean` | Whether to log at session end |  |
| `isLogStart` | `boolean` | Whether to log at session start |  |
| `isNegateDestination` | `boolean` | Whether the destination match is negated |  |
| `isNegateSource` | `boolean` | Whether the source match is negated |  |
| `logSetting` | `string` | Name of the log forwarding profile applied |  |
| `rulebase` | `string` | Rulebase the rule belongs to (pre or post) |  |
| `ruleType` | `string` | Rule type (universal, intrazone, or interzone) |  |
| `schedule` | `string` | Name of the schedule the rule is bound to |  |
| `service` | `array` of `string`s | Matched services/ports |  |
| `source` | `array` of `string`s | Source address objects/groups |  |
| `sourceUser` | `array` of `string`s | Source users or user groups matched |  |
| `to` | `array` of `string`s | Destination zones |  |
| `urlCategories` | `array` of `string`s | URL categories matched by the rule |  |
| `uuid` | `string` | Panorama-assigned UUID of the rule |  |

---

---

Source: /integrations/directory/palo-alto-prisma-cloud

# Palo Alto Prisma Cloud

Visualize Palo Alto Prisma Cloud hosts, defender agents, container images, and vulnerabilities, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> Before configuring this integration in JupiterOne, you need to set up API access in Palo Alto Prisma Cloud Compute:
> 
> **Required in Prisma Cloud:**
> 
> -   Your Prisma Cloud Compute Console URL
> -   Your Prisma Cloud Compute version number
> -   A dedicated service account username and password with read-only permissions
> 
> **Authentication:** This integration uses HTTP Basic authentication to connect to the Prisma Cloud Compute API.
> 
> **Required Permissions:** The service account should have the **Auditor** role or any role with read access to:
> 
> -   Monitor data (hosts and defender agents)
> -   Vulnerabilities data (container images and host vulnerabilities)
> 
> **Supported Edition:** This integration currently supports **Prisma Cloud Compute Edition**. Please inform your customer success rep if you are interested in integrating with **Prisma Cloud Enterprise Edition**.
> 
> For more information about API access and roles, see the [Prisma Cloud Compute API documentation](https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/api/access-api).

This integration connects to Palo Alto Prisma Cloud **Compute Edition** to ingest hosts, defender agents, deployed images, and vulnerability data.

> **NOTE**
> 
> This integration currently supports **Prisma Cloud Compute Edition**. Please inform your customer success rep if you are interested in integrating with **Prisma Cloud Enterprise Edition**.

### Prerequisites in Palo Alto Prisma Cloud

Before configuring the integration in JupiterOne, you need to gather the following information:

#### 1\. Console URL

Your Prisma Cloud Compute Console URL can be found by:

1.  Log into your Prisma Cloud Console
2.  Navigate to **Compute** > **Manage** > **System** > **Downloads**
3.  The Console URL is displayed on this page

The URL format varies by deployment type:

-   **SaaS deployments**: `https://[region].cloud.twistlock.com/[tenant-id]`
-   **Self-hosted deployments**: Your self-hosted Console URL

#### 2\. Version

Find your Prisma Cloud Compute version:

1.  Log into your Prisma Cloud Compute console
2.  Click the **bell icon** in the top right of the page
3.  Your version is displayed (e.g., `34.02`)

#### 3\. Username and Password

Create a dedicated service account for JupiterOne with read-only permissions to access the Compute API.

**Required Permissions**: The account must be able to:

-   Read host information and vulnerabilities
-   Read defender agent data
-   Read container image information

A user with the **Auditor** role or any role with read access to Monitor and Vulnerabilities data will work for this integration.

### Configuration in JupiterOne

To install the Palo Alto Prisma Cloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Palo Alto Prisma Cloud. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Palo Alto Prisma Cloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Palo Alto Prisma Cloud Compute **Console URL**, **Version**, **Username**, and **Password**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Defender | `palo_alto_prisma_cloud_defender` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Deployed Image | `palo_alto_prisma_cloud_deployed_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Host | `palo_alto_prisma_cloud_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Host Vulnerability | `palo_alto_prisma_cloud_host_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Image Vulnerability | `palo_alto_prisma_cloud_image_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Service | `palo_alto_prisma_cloud_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `palo_alto_prisma_cloud_defender` | **PROTECTS** | `palo_alto_prisma_cloud_host` |
| `palo_alto_prisma_cloud_deployed_image` | **HAS** | `palo_alto_prisma_cloud_image_vulnerability` |
| `palo_alto_prisma_cloud_host` | **HAS** | `palo_alto_prisma_cloud_host_vulnerability` |
| `palo_alto_prisma_cloud_host` | **HAS** | `palo_alto_prisma_cloud_image_vulnerability` |
| `palo_alto_prisma_cloud_host` | **USES** | `palo_alto_prisma_cloud_deployed_image` |

### Palo Alto Prisma Cloud Defender

`palo_alto_prisma_cloud_defender` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` |  |  |
| 

`cluster` \*

 | `string` |  |  |
| 

`collections` \*

 | `array` of `string`s |  |  |
| 

`compatibleVersion` \*

 | `boolean` |  |  |
| 

`connected` \*

 | `boolean` |  |  |
| 

`isARM64` \*

 | `boolean` |  |  |
| 

`port` \*

 | `number` |  |  |
| 

`remoteLoggingSupported` \*

 | `boolean` |  |  |
| 

`remoteMgmtSupported` \*

 | `boolean` |  |  |
| 

`type` \*

 | `string` |  |  |
| 

`version` \*

 | `string` |  |  |
| 

`vpcObserver` \*

 | `boolean` |  |  |

---

### Palo Alto Prisma Cloud Deployed Image

`palo_alto_prisma_cloud_deployed_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`collections` \*

 | `array` of `string`s |  |  |
| 

`digest` \*

 | `string` |  |  |
| 

`distro` \*

 | `string` |  |  |
| 

`registry` \*

 | `string` |  |  |
| 

`repository` \*

 | `string` |  |  |
| 

`tag` \*

 | `string` |  |  |

---

### Palo Alto Prisma Cloud Host

`palo_alto_prisma_cloud_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cloudAccountId` \*

 | `string` **|** `null` | Cloud account ID the host belongs to. |  |
| 

`cloudProvider` \*

 | `string` **|** `null` | Cloud provider hosting the machine (aws, azure, gcp, alibaba, oci, others). |  |
| 

`cloudResourceId` \*

 | `string` **|** `null` | Cloud provider resource ID of the host. |  |
| 

`clusterType` \*

 | `string` **|** `null` | Type of cluster the host belongs to (AKS, ECS, EKS, GKE, Kubernetes). |  |
| 

`collections` \*

 | `array` **|** `null` |  |  |
| 

`complianceIssuesCount` \*

 | `number` **|** `null` | Number of compliance issues found on the host. |  |
| 

`complianceRiskScore` \*

 | `number` **|** `null` | Prisma Cloud compliance risk score of the host. |  |
| 

`distro` \*

 | `string` **|** `null` |  |  |
| 

`firewallProtectionMode` \*

 | `string` **|** `null` | Out-of-band firewall protection mode (Observation or Protection). |  |
| 

`firstScannedOn` \*

 | `number` **|** `null` | Time of the first Prisma Cloud scan of the host. |  |
| 

`isAgentless` \*

 | `boolean` **|** `null` | Whether the host was scanned agentlessly rather than by a Defender. |  |
| 

`isARM64` \*

 | `boolean` **|** `null` |  |  |
| 

`isDockerHost` \*

 | `boolean` **|** `null` | Whether Docker is installed on the host. |  |
| 

`isFirewallProtectionEnabled` \*

 | `boolean` **|** `null` | Whether Prisma Cloud firewall protection is enabled on the host. |  |
| 

`isFirewallProtectionSupported` \*

 | `boolean` **|** `null` | Whether the host supports Prisma Cloud firewall protection. |  |
| 

`isHostRuntimeEnabled` \*

 | `boolean` **|** `null` | Whether host runtime protection is enabled. |  |
| 

`isKubernetesNode` \*

 | `boolean` **|** `null` | Whether Kubernetes is installed on the host. |  |
| 

`isOpenshiftNode` \*

 | `boolean` **|** `null` | Whether OpenShift is installed on the host. |  |
| 

`osDistroRelease` \*

 | `string` **|** `null` |  |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the host runs in. |  |
| 

`scannedOn` \*

 | `number` **|** `null` | Time of the most recent Prisma Cloud scan of the host. |  |
| 

`trustStatus` \*

 | `string` **|** `null` | Prisma Cloud trust status of the host (trusted or untrusted). |  |
| 

`vulnerabilitiesCount` \*

 | `number` **|** `null` | Number of vulnerabilities found on the host. |  |
| 

`vulnerabilityRiskScore` \*

 | `number` **|** `null` | Prisma Cloud vulnerability risk score of the host. |  |

---

### Palo Alto Prisma Cloud Host Vulnerability

`palo_alto_prisma_cloud_host_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cause` | `string` |  |  |
| 
`complianceTemplates` \*

 | `array` **|** `null` | Compliance templates the finding applies to (for example PCI, HIPAA). |  |
| `cvss` | `number` |  |  |
| `description` | `string` |  |  |
| 

`exploitSources` \*

 | `array` **|** `null` | Sources reporting known exploits (exploit-db, exploit-windows, cisa-kev). |  |
| `firstSeenOn` | `number` | Time Prisma Cloud first discovered the vulnerability. |  |
| `fixLink` | `string` |  |  |
| `fixOn` | `number` |  |  |
| 

`gracePeriodDays` \*

 | `number` **|** `null` | Days remaining before the vulnerability becomes blocking under its grace period rule. |  |
| 

`isExploitedInTheWild` \*

 | `boolean` **|** `null` | Whether any known exploit is reported as exploited in the wild. |  |
| 

`packageName` \*

 | `string` **|** `null` | Name of the affected package. |  |
| 

`packageType` \*

 | `string` **|** `null` | Type of the affected package (for example package, python, jar, go). |  |
| 

`packageVersion` \*

 | `string` **|** `null` | Installed version of the affected package. |  |
| `publishedOn` | `number` |  |  |
| 

`riskFactors` \*

 | `array` **|** `null` |  |  |
| `status` | `string` |  |  |
| `title` | `string` |  |  |
| `type` | `string` |  |  |
| `vecStr` | `string` |  |  |
| `webLink` | `string` |  |  |

---

### Palo Alto Prisma Cloud Image Vulnerability

`palo_alto_prisma_cloud_image_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cause` \*

 | `string` |  |  |
| 

`complianceId` \*

 | `string` |  |  |
| 

`cvss` \*

 | `number` |  |  |
| 

`description` \*

 | `string` |  |  |
| `discoveredOn` | `number` |  |  |
| `fixedOn` | `number` |  |  |
| 

`fixStatus` \*

 | `string` |  |  |
| 

`graceDays` \*

 | `string` |  |  |
| 

`packageLicense` \*

 | `string` |  |  |
| 

`packagePath` \*

 | `string` |  |  |
| 

`packages` \*

 | `string` |  |  |
| 

`packageVersion` \*

 | `string` |  |  |
| `publishedOn` | `number` |  |  |
| 

`purl` \*

 | `string` |  |  |
| 

`result` \*

 | `string` |  |  |
| 

`riskFactors` \*

 | `string` |  |  |
| 

`sourcePackage` \*

 | `string` |  |  |
| 

`type` \*

 | `string` |  |  |
| 

`vulnerabilityLink` \*

 | `string` |  |  |
| 

`vulnerabilityTags` \*

 | `string` |  |  |

---

### Palo Alto Prisma Cloud Service

`palo_alto_prisma_cloud_service` inherits from [Service](/data-model/schemas/Service.md)

---

## Release Notes

-   **2025-10-29** — Added risk factor properties to Palo Alto Prisma Cloud host vulnerability entities.
-   **2025-09-01** — Added CVE ID as the display name and entity name for Prisma Cloud host vulnerability and image vulnerability findings.
-   **2025-06-18** — Added deployed container image ingestion with image vulnerability relationships to Palo Alto Prisma Cloud.
-   **2025-06-16** — Added Palo Alto Prisma Cloud integration, ingesting host vulnerabilities, defenders, and accounts as new entity types.

---

Source: /integrations/directory/pillar

# Pillar Security

Visualize your Pillar Security AI-asset inventory and findings in the JupiterOne graph. Map the AI coding assistants, agents, tools, and MCP clients Pillar discovers across your developer endpoints and source-control repositories, relate them to the users and repositories that own them, and monitor Pillar's security findings — secret leaks, sensitive data in metaprompts, and prompt-injection risks — through custom queries and alerts.

## Installation

The Pillar integration ingests your Pillar Security AI-asset inventory and findings using the Pillar API (`https://api.pillar.security`). It reads the endpoint inventory (`/api/v1/inventory/endpoints`), the repository inventory (`/api/v1/inventory/repositories`), and security issues (`/api/v1/issues`) to build a graph of the AI coding assistants, agents, tools, and MCP clients discovered across your developer machines and source-control repositories, along with the users and repositories that own them. Before setting up the integration in JupiterOne, you will need to create an **API key** in the Pillar dashboard.

### Prerequisites

-   A **Pillar Security** account with at least one application configured in the Inventory.
-   Permission in the Pillar dashboard to create an API key for that application.
-   Access to JupiterOne with permission to configure integrations.

### Creating an API key in Pillar

1.  Log in to the [Pillar Security dashboard](https://app.pillar.security/).
2.  Navigate to **Inventory** and select the application you want JupiterOne to ingest.
3.  Open **Settings > API Keys**.
4.  Create a new API key and give it a recognizable name (for example, `JupiterOne Integration`).
5.  Copy the generated key — it is used as a bearer token and is shown only once.

> **NOTE**
> 
> The integration only reads from Pillar. The API key is used as a `Bearer` token against the inventory and issues endpoints — no write scopes are required. If your Pillar API key serves multiple applications (for example, gateway integrations such as LiteLLM, Kong, or ngrok), note the **Application ID** you want to scope ingestion to; you can supply it during configuration below. Most installs leave this unset.

### Configuration in JupiterOne

To install the Pillar integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Pillar. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Pillar account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Pillar **API Key** — the key created above. This field is required.
    
-   Optionally, an **API Base URL** to override the Pillar API endpoint. Leave blank to use the default `https://api.pillar.security`. Only override this for self-hosted Pillar Stack deployments.
    
-   Optionally, an **Application ID** — the `x-plr-app-id` value used to scope requests to a specific Pillar application when a single API key serves multiple applications. Most installs leave this unset.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Pillar Account | `pillar_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Pillar AI Agent | `pillar_agent` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Pillar Coding Assistant | `pillar_coding_assistant` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Pillar Endpoint | `pillar_endpoint` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Pillar Issue | `pillar_issue` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Pillar MCP Client | `pillar_mcp_client` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Pillar Platform Integration | `pillar_platform_integration` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Pillar Repository | `pillar_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Pillar Tool | `pillar_tool` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Pillar User | `pillar_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `pillar_account` | **HAS** | `pillar_endpoint` |
| `pillar_account` | **HAS** | `pillar_repository` |
| `pillar_account` | **HAS** | `pillar_issue` |
| `pillar_endpoint` | **HAS** | `pillar_agent` |
| `pillar_issue` | **EXPLOITS** | `pillar_tool` |
| `pillar_repository` | **HAS** | `pillar_coding_assistant` |
| `pillar_repository` | **HAS** | `pillar_platform_integration` |
| `pillar_repository` | **HAS** | `pillar_tool` |
| `pillar_repository` | **HAS** | `pillar_mcp_client` |
| `pillar_user` | **HAS** | `pillar_agent` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `pillar_repository` | **SCANS** | `code_repo` | FORWARD |

### Pillar Account

`pillar_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiBaseUrl` | `string` | The Pillar API base URL the integration is configured against (e.g. `https://api.pillar.security`). Set when self-hosted Pillar Stack is in use. |  |
| `appId` | `string` | Optional `x-plr-app-id` value used to scope requests to a specific Pillar application. Echoed onto the account so consumers can see which Pillar tenant each ingestion run covered. |  |

---

### Pillar Agent

`pillar_agent` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentName` \*

 | `string` **|** `null` | Agent identifier (e.g. `claude-code`, `cursor`, `windsurf`). Sourced from `agents[].agentName`. |  |
| 

`agentType` \*

 | `string` **|** `null` | Agent form factor (`cli`, `ide`, etc.). Sourced from `agents[].agentType`. |  |
| 

`agentVersion` \*

 | `string` **|** `null` | Installed agent version, when reported. Sourced from `agents[].agentVersion`. |  |
| 

`mcpCount` \*

 | `number` **|** `null` | Number of MCP servers the agent has configured. Sourced from `agents[].mcpCount`. |  |
| 

`organization` \*

 | `string` **|** `null` | Organisation affiliation reported by the agent's logged-in user. Sourced from `agents[].organization`. |  |
| 

`permissionMode` \*

 | `string` **|** `null` | Permission mode in effect for the agent (`ask`, `auto`, `bypass`). Sourced from `agents[].permissionMode`. |  |
| 

`sandboxEnabled` \*

 | `boolean` **|** `null` | Whether the agent is configured to run in sandbox mode. Sourced from `agents[].sandboxEnabled`. |  |

---

### Pillar Coding Assistant

`pillar_coding_assistant` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` **|** `null` | Pillar-side classification of the assistant. Sourced from `codingAssistants[].category`. |  |
| 

`hasMcp` \*

 | `boolean` **|** `null` | Whether Pillar found MCP server configuration for this assistant in the repository. |  |
| 

`hasRuleFiles` \*

 | `boolean` **|** `null` | Whether Pillar found rule / configuration files for this assistant in the repository. |  |
| 

`tool` \*

 | `string` **|** `null` | Coding assistant tool name (e.g. `claude-code`, `cursor`, `copilot`). Sourced from `codingAssistants[].tool`. |  |

---

### Pillar Endpoint

`pillar_endpoint` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`criticalFindings` \*

 | `number` **|** `null` | Critical-severity findings from the latest scan. |  |
| 

`firstSeenOn` \*

 | `number` **|** `null` | Epoch ms of the first Pillar scan against this machine. Parsed from `firstSeen`. (Host base class supplies `lastSeenOn`.) |  |
| 

`highFindings` \*

 | `number` **|** `null` | High-severity findings from the latest scan. |  |
| 

`latestReportId` \*

 | `string` **|** `null` | Pillar UUID for the most recent endpoint scan — feed into `/inventory/scans/:id?source=endpoint` to fetch the full report. |  |
| 

`lowFindings` \*

 | `number` **|** `null` | Low-severity findings from the latest scan. |  |
| 

`mediumFindings` \*

 | `number` **|** `null` | Medium-severity findings from the latest scan. |  |
| 

`totalFindings` \*

 | `number` **|** `null` | Total finding count from the latest scan. |  |
| 

`totalReports` \*

 | `number` **|** `null` | All-time count of scan reports submitted from this machine. |  |
| 

`username` \*

 | `string` **|** `null` | OS username under which the latest Pillar scan ran. Sourced from Pillar `username`. |  |

---

### Pillar Issue

`pillar_issue` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetType` \*

 | `string` **|** `null` | Type of asset where the issue was found (`metaprompts`, `tools`). Sourced from `issues[].assetType`. |  |
| 

`currentStatus` \*

 | `string` **|** `null` | Issue status (`open`, `closed`). Sourced from `issues[].currentStatus`. |  |
| 

`evidenceCategory` \*

 | `string` **|** `null` | Category of evidence (`secret`, `pii`, `pci`, `access_capabilities`, `prompt_injection`, `evasion`). Sourced from `issues[].evidenceCategory`. |  |
| 

`evidencePath` \*

 | `string` **|** `null` | URL path to the location where the issue was found. Sourced from `issues[].evidence.path`. |  |
| 

`evidenceType` \*

 | `string` **|** `null` | Specific finding type (e.g. `github_token`, `credit_card`, `email_address`). Sourced from `issues[].evidence.finding.type`. |  |
| 

`issueDetailDescription` \*

 | `string` **|** `null` | Human-readable issue description. Sourced from `issues[].issueDetailDescription`. |  |
| 

`source` \*

 | `string` **|** `null` | Source of the discovery (e.g. `Discovery Scan`). Sourced from `issues[].source`. |  |

---

### Pillar Mcp Client

`pillar_mcp_client` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`framework` \*

 | `string` **|** `null` | Framework the MCP client was detected within. |  |
| 

`mcpName` \*

 | `string` **|** `null` | MCP client name. Sourced from `mcpClients[].name`. |  |
| 

`mcpType` \*

 | `string` **|** `null` | Pillar-side MCP type classification. |  |
| 

`transport` \*

 | `string` **|** `null` | MCP transport (e.g. `stdio`, `http`, `sse`). Sourced from `mcpClients[].transport`. |  |

---

### Pillar Platform Integration

`pillar_platform_integration` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`framework` \*

 | `string` **|** `null` | Framework Pillar attributed this integration to (e.g. `LangChain`, `OpenAI SDK`). |  |
| 

`isPureAIService` \*

 | `boolean` **|** `null` | Whether the platform is exclusively an AI service (true) or a general-purpose platform that happens to host AI (false). |  |
| 

`pillarService` \*

 | `string` **|** `null` | The Pillar-side service classification for this integration (e.g. `chat completions`, `embeddings`). Sourced from `platformIntegrations[].service`. |  |
| 

`platform` \*

 | `string` **|** `null` | Upstream AI platform (e.g. `OpenAI`, `Anthropic`, `AWS Bedrock`). Sourced from `platformIntegrations[].platform`. |  |

---

### Pillar Repository

`pillar_repository` inherits from [CodeRepo](/data-model/schemas/CodeRepo.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`codingAssistantsCount` \*

 | `number` **|** `null` | Number of distinct AI coding assistants detected in the repo (rule files, MCP configs). |  |
| 

`defaultBranch` \*

 | `string` **|** `null` | Default branch name as observed by Pillar at scan time. Sourced from Pillar `defaultBranch`. |  |
| 

`hasLlmUsage` \*

 | `boolean` **|** `null` | Whether Pillar detected LLM (generative AI) usage in the repository. |  |
| 

`hasMlUsage` \*

 | `boolean` **|** `null` | Whether Pillar detected ML (classical machine learning) usage in the repository. |  |
| 

`language` \*

 | `string` **|** `null` | Primary repository language detected by the SCM. Sourced from Pillar `language`. |  |
| 

`llmFrameworks` \*

 | `array` **|** `null` | LLM frameworks detected in the repository (e.g. `LangChain`, `LangGraph`, `OpenAI SDK`). Sourced from Pillar `llmFrameworks`. |  |
| 

`mcpClientsCount` \*

 | `number` **|** `null` | Number of MCP client configs detected in the repo. |  |
| 

`mlFrameworks` \*

 | `array` **|** `null` | ML frameworks detected in the repository (e.g. `TensorFlow`, `PyTorch`, `Scikit-learn`). Sourced from Pillar `mlFrameworks`. |  |
| 

`platformIntegrationsCount` \*

 | `number` **|** `null` | Number of AI platform integrations detected in the repo. |  |
| 

`scanId` \*

 | `string` **|** `null` | Pillar scan UUID for the most recent scan of this repo. |  |
| 

`scannedOn` \*

 | `number` **|** `null` | Epoch ms of the most recent Pillar scan. Parsed from Pillar `scanDate`. |  |
| 

`scanStatus` \*

 | `string` **|** `null` | Status of the most recent Pillar scan. |  |
| 

`scm` \*

 | `string` **|** `null` | Source-control platform that hosts the repo (`github`, `gitlab`, `azure_devops`). Sourced from Pillar `scm`. |  |
| 

`toolsCount` \*

 | `number` **|** `null` | Number of AI tool definitions detected in the repo. |  |

---

### Pillar Tool

`pillar_tool` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`fileLine` \*

 | `number` **|** `null` | Line number where the tool is defined. Sourced from `tools[].line`. |  |
| 

`filePath` \*

 | `string` **|** `null` | Repo-relative file path where the tool is defined (e.g. `src/app.py`). Sourced from `tools[].path`; null for scans predating tool-location capture. |  |
| 

`framework` \*

 | `string` **|** `null` | Framework the tool is defined in (e.g. `LangChain`, `LangGraph`). Sourced from `tools[].framework`. |  |
| 

`isPoisoned` \*

 | `boolean` **|** `null` | Whether Pillar has flagged the tool as poisoned (contains prompt-injection or other attacker-controlled content). Sourced from `tools[].postureSummary.isPoisoned`. |  |
| 

`postureCategory` \*

 | `string` **|** `null` | Pillar's posture category for the tool (e.g. `read_only`, `code_execution`). Sourced from `tools[].postureSummary.category`. |  |
| 

`postureFindingsCount` \*

 | `number` **|** `null` | Number of posture findings against the tool. Sourced from `tools[].postureSummary.findingsCount`. |  |
| 

`toolName` \*

 | `string` **|** `null` | Tool name. Sourced from `tools[].name`. |  |
| 

`toolType` \*

 | `string` **|** `null` | Pillar-side tool classification. Sourced from `tools[].type`. |  |

---

### Pillar User

`pillar_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`organization` \*

 | `string` **|** `null` | Organisation affiliation reported by Pillar for this user, when present. Sourced from the agent install's `organization` field. |  |

---

## Release Notes

-   **2026-07-13** — New Pillar Security integration: ingests the account, developer endpoints and their installed AI coding assistants, source-control repositories with their discovered AI assets (coding assistants, platform integrations, tools, and MCP clients), and security issues, and projects a SCANS relationship from Pillar repositories to native code repositories.

---

Source: /integrations/directory/pingidentity

# PingIdentity

Visualize Ping Identity users, groups, applications, and roles, map Ping Identity users to employees, and monitor changes through queries and alerts.

## Installation

To install this integration, you will need to configure settings both within PingOne and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your PingOne environment.

### Configuration in PingOne

**Create a PingOne worker application:**

1.  Sign in to the PingOne admin console.
2.  Navigate to **Connections** and click **\+ Add Application**.
3.  Select the **Worker** application type and click **Configure**.
4.  Enter the application profile details:
    -   **Application name**: a unique name for this worker app (for example, `JupiterOne Integration`).
    -   **Description** _(optional)_: a brief description.
5.  Click **Save** and close.
6.  On the Applications page, enable the new application by clicking the **Enable** toggle. The toggle turns green when the application is active.

**Grant roles to the worker application:**

JupiterOne reads environment settings, applications, users, and groups from PingOne. Assign the following roles to the worker application in the **Roles** tab:

-   **Identity Data Admin** — required to read users and groups.
-   **Environment Admin** — required to read environments, applications, and role assignments.

> **NOTE**
> 
> Assign only the minimum roles required. For more information on PingOne role assignments, see [Administrator permissions and role assignments](https://developer.pingidentity.com/pingone-api/foundations/pingone-roles-scopes-and-permissions/administrator-permissions-and-role-assignments.html).

#### Get the application access token

1.  Navigate to the application's **Configuration** tab.
2.  Expand the **General** section.
3.  Scroll to the **Advanced** section and click **Get Access Token**.
4.  Copy the access token for use in JupiterOne.

> **INFO**
> 
> For more information on creating worker app connections and retrieving access tokens, see [Create an admin Worker app](https://developer.pingidentity.com/pingone-api/getting-started/create-an-admin-worker-app.html).

#### Acquire your Environment ID

Navigate to **Environment** > **Properties** and copy the **Environment ID**.

### Configuration in JupiterOne

To install the PingIdentity integration in JupiterOne, navigate to the **Integrations** tab and select **PingIdentity**. Click **New Instance** to begin.

Creating an instance requires the following:

-   **Account Name**: a label for this PingIdentity account in JupiterOne. Ingested entities include this value in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** _(optional)_: a note to help identify this integration instance.
    
-   **Polling Interval**: how often JupiterOne should collect data. Set to `DISABLED` to run manually.
    
-   **PingOne Environment ID**: your PingOne environment ID, found under **Environment** > **Properties**.
    
-   **PingOne Location**: the region where your PingOne environment is hosted (for example, `eu` for Europe, `com` for North America). This is used to construct the API base URL (`https://api.pingone.{location}/v1/`).
    
-   **PingOne Access Token**: the access token from the worker application created above (found under **Connections** > **Applications** > your worker app > **Configuration** > **Advanced**).
    

Click **Create** to finalize the integration.

### Next steps

Once configured, the integration runs on the polling interval you set and populates data in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) for information on managing and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `pingone_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `pingone_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Ping Identity User | `pingone_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Role | `pingone_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| UserGroup | `pingone_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `pingone_account` | **HAS** | `pingone_user` |
| `pingone_account` | **HAS** | `pingone_group` |
| `pingone_account` | **HAS** | `pingone_role` |
| `pingone_account` | **HAS** | `pingone_application` |
| `pingone_application` | **ASSIGNED** | `pingone_role` |
| `pingone_group` | **HAS** | `pingone_user` |
| `pingone_group` | **HAS** | `pingone_group` |
| `pingone_user` | **ASSIGNED** | `pingone_role` |

### Pingone User

`pingone_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountCanAuthenticate` | `boolean` |  |  |
| `accountStatus` | `string` |  |  |
| `active` | `boolean` |  |  |
| `createdAt` | `string` |  |  |
| `enabled` | `boolean` |  |  |
| `environmentId` | `string` |  |  |
| `identityProviderType` | `string` |  |  |
| `isActive` | `boolean` |  |  |
| `lastSignOnAt` | `string` |  |  |
| `lastSignOnRemoteIp` | `string` |  |  |
| `lifecycleStatus` | `string` |  |  |
| `mfaEnabled` | `boolean` |  |  |
| `nameFamily` | `string` |  |  |
| `nameGiven` | `string` |  |  |
| `populationId` | `string` |  |  |
| `updatedAt` | `string` |  |  |
| `verifyStatus` | `string` |  |  |
| `webLink` | `string` |  |  |

---

---

Source: /integrations/directory/polymer

# Polymer

## Installation

> **INFO**
> 
> You will need your Polymer API token and organization name to set up this integration.

### Configuration in Polymer

1.  Log in to your Polymer instance.
2.  Navigate to the settings or API section.
3.  Create a new API token with appropriate permissions to read the resources you want to ingest into JupiterOne.
4.  Note your organization name from your Polymer URL (the subdomain before `.polymerhq.io`).

### Configuration in JupiterOne

To install the Polymer integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Polymer. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Polymer account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Polymer **API Token** used to authenticate requests.
    
-   Your Polymer **Organization** name extracted from your Polymer URL.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `polymer_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Rule | `polymer_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Violation | `polymer_violation` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `polymer_account` | **HAS** | `polymer_rule` |
| `polymer_rule` | **IDENTIFIED** | `polymer_violation` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `polymer_violation` | **HAS** | `github_user` | REVERSE |
| `polymer_violation` | **HAS** | `google_user` | REVERSE |
| `polymer_violation` | **HAS** | `slack_user` | REVERSE |
| `polymer_violation` | **HAS** | `slack_channel` | REVERSE |

---

Source: /integrations/directory/probely

# Probely

Visualize Probely targets, users, and findings, and monitor changes through queries and alerts.

## Installation

To install this integration, you will need to first create an API access token within Probely to use in JupiterOne.

### Configuration in Probely

**To create an API token:**

1.  From the Probely dashboard, go to **Overview > Target**.
2.  Navigate to the **Settings > Integrations** tab.
3.  Under **API Keys**, generate a new key for JupiterOne.

> **INFO**
> 
> For more information on creating Access Tokens on Probely, see [their documentation](https://developers.probely.com/#tag/Quickstart)

### Configuration in JupiterOne

To install the Probely integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Probely. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Probely account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The Probely **Access Token** generated for use within JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `probely_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Finding | `probely_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Target | `probely_target` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| User | `probely_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `probely_account` | **HAS** | `probely_user` |
| `probely_account` | **HAS** | `probely_target` |
| `probely_target` | **HAS** | `probely_finding` |
| `probely_user` | **ASSIGNED** | `probely_finding` |

### Probely User

`probely_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `isApiUser` | `boolean` |  |  |
| `isBillingAdmin` | `boolean` |  |  |
| `modifiedOn` | `number` |  |  |

---

---

Source: /integrations/directory/pulseway

# Pulseway

Visualize Pulseway Account, Group, Host, HostAgent, Policy changes through queries and alerts.

# Installation Guide

## Overview

Pulseway can be deployed either on-premise or in the cloud. If hosting your own server, you need to provide the Pulseway host name.

## Prerequisites

Ensure the following items are available before configuring the integration:

-   **Pulseway API Token**
-   **Pulseway API Secret**
-   **Pulseway Host Name**

## Configuring Pulseway

### Generating a Pulseway API Token and Secret

#### Authentication Method: BASIC Authentication

To authorize Pulseway APIs, this integration requires the API Token and Secret.

#### Steps to Generate an API Token and Secret

1.  **Log in** to the Pulseway web application.
2.  Navigate to **Configuration** in side pane under the **Administration**.
3.  Click on **API Access**.
4.  Under the **Third-Party Access** tab, click **Create Token**.
5.  Provide the following details:
    -   **Name:** Assign a name to the token.
    -   **Description:** Add a description for reference.
    -   **Expiration:** Set the token's expiry date.
    -   **Access:** Enable access to all organizations.
6.  Click **Edit Permissions** and select the following permissions:
    -   **Device:** Get All Devices, Get Device Applied Policies.
    -   **Asset:** Get All Devices and Asset Information.
    -   **Group:** Get All Groups.
    -   **Environment Information:** Get Environment Information.
7.  Confirm the selected permissions.
8.  Click **Create**.
9.  **Copy the Token ID and Token Secret** and save them securely.
10.  Confirm by selecting **I confirm that I saved my Token Secret code**.
11.  Close the Window.

### Get Pulseway Host Name

**Admin > Server Admin > Overview > Server Information > Name**

## Configuring in JupiterOne

1.  In the **J1 Search** homepage, navigate to the **Integrations** section from the top navigation bar.
    
2.  Search for **Pulseway** and select it.
    
3.  Click the **Add Instance** button and configure the following:
    
    -   **Pulseway API Token:** Enter the API Token generated in Pulseway.
    -   **Pulseway API Secret:** Enter the API Secret generated in Pulseway.
    -   **Pulseway Host:** Enter the host name of your Pulseway server. # e.g., test.pulseway.com
    -   **Account Name:** Assign a name to identify this Pulseway instance in JupiterOne. If the **Tag with Account Name** option is enabled, ingested entities will include this value in `tag.AccountName`.
    -   **Description:** Add a description to assist your team in identifying this integration instance.
    -   **Polling Interval (optional):** Select a polling interval appropriate for your monitoring needs. Leave this as `DISABLED` for manual execution if unsure.
4.  Click **Create Configuration** to save the settings.
    

## Next Steps

Your integration instance will now run based on the configured polling interval, populating data within JupiterOne. Refer to our [Instance Management Guide](/integrations/instance-management.md) to learn more about managing and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `pulseway_environment` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Group | `pulseway_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Host | `pulseway_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| HostAgent | `pulseway_hostagent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Policy | `pulseway_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `pulseway_environment` | **HAS** | `pulseway_group` |
| `pulseway_group` | **CONTAINS** | `pulseway_hostagent` |
| `pulseway_hostagent` | **SCANS** | `pulseway_host` |
| `pulseway_policy` | **ASSIGNED** | `pulseway_hostagent` |

### Pulseway Environment

`pulseway_environment` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `expiresOn` | `number` |  |  |
| `productVersion` | `string` |  |  |
| `serverType` | `string` |  |  |

---

### Pulseway Group

`pulseway_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `hasCustomFields` | `boolean` |  |  |
| `parentOrganizationId` | `number` |  |  |
| `parentOrganizationName` | `string` |  |  |
| `parentSiteId` | `number` |  |  |
| `parentSiteName` | `string` |  |  |
| `psaMappingId` | `number` |  |  |
| `psaMappingType` | `string` |  |  |

---

### Pulseway Host

`pulseway_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `antivirusEnabled` | `string` |  |  |
| `antivirusUpToDate` | `string` |  |  |
| `clientVersion` | `string` |  |  |
| `criticalUpdates` | `number` |  |  |
| `groupName` | `string` |  |  |
| `importantUpdates` | `number` |  |  |
| `isFirewallEnabled` | `boolean` |  |  |
| `memoryTotal` | `string` |  |  |
| `organizationId` | `number` |  |  |
| `siteId` | `number` |  |  |
| `uacEnabled` | `boolean` | A Windows security feature that prevents unauthorized changes to the operating system |  |
| `unspecifiedUpdates` | `number` |  |  |

---

### Pulseway Hostagent

`pulseway_hostagent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `groupId` | `number` |  |  |
| `groupName` | `string` |  |  |
| `hasCustomFields` | `boolean` |  |  |
| `isAgentInstalled` | `boolean` |  |  |
| `isMdmEnrolled` | `boolean` |  |  |
| `organizationId` | `number` |  |  |
| `organizationName` | `string` |  |  |
| `siteId` | `number` |  |  |
| `siteName` | `string` |  |  |

---

### Pulseway Policy

`pulseway_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `policyType` | `string` |  |  |

---

## Release Notes

-   **2025-08-22** — Improved serial number accuracy for Pulseway hosts by using an alternate BIOS field as a fallback source.
-   **2025-08-19** — Improved serial number accuracy on Pulseway host entities by reading the BIOS serial number field.

---

Source: /integrations/directory/puppet

# Puppet

Visualize Visualize Puppet infrastructure, including servers, nodes, catalog, environment, factsets, and resources, and monitor changes through queries and alerts.

# Installation Guide

> **INFO**
> 
> Puppet consists of the **Puppet Server**, which manages configurations, **Puppet Agents**, which apply them on nodes, and **PuppetDB**, which stores configuration, state, and report data. This integration connects to PuppetDB and reads node, environment, fact, resource, and catalog data from it. The integration requires client certificates signed by Puppet's Certificate Authority (CA) for mutual TLS authentication.

## Requirements

-   Network connectivity between the JupiterOne integration and **PuppetDB**.
-   PuppetDB installed and configured: [Install PuppetDB](https://help.puppet.com/pdb/current/topics/install_from_packages.htm)
-   PuppetDB connected to the Puppet Server: [Connect PuppetDB and Puppet Server](https://help.puppet.com/pdb/current/topics/connect_puppet_server.htm)
-   `client-auth` set to `need` (or `want`) in PuppetDB's `jetty.ini` so that TLS client certificates are required.

## Configuration in Puppet

### Generate a Client Certificate

1.  Connect to the Puppet Server using SSH.
    
2.  Run the following command to generate a certificate and key pair:
    
    ```bash
    puppetserver ca generate --certname <Certificate-Name>
    # For example: j1-integration-cert
    ```
    
3.  Verify that the certificate was generated and signed by the CA:
    
    ```bash
    puppetserver ca list --all
    ```
    
4.  Collect the following files — you will upload them when configuring the integration in JupiterOne:
    
    -   **Certificate Authority Certificate:** `/etc/puppetlabs/puppet/ssl/certs/ca.pem`
    -   **Client Certificate:** `/etc/puppetlabs/puppet/ssl/certs/<Certificate-Name>.pem`
    -   **Client Certificate Private Key:** `/etc/puppetlabs/puppet/ssl/private_keys/<Certificate-Name>.pem`

## Configuration in JupiterOne

1.  From the top navigation bar of the **J1 Search** homepage, go to **Integrations**.
    
2.  Search for **Puppet** and select it.
    
3.  Click **Add Instance** and configure the following settings:
    
    -   **PuppetDB URL:** The IP or hostname where PuppetDB is reachable (for example, `https://127.0.0.1`).
    -   **PuppetDB Port:** The port PuppetDB listens on for SSL connections (default: `8081`).
    -   **Certificate Authority Certificate:** The CA certificate file (`ca.pem`).
    -   **Client Certificate:** The client certificate file (for example, `j1-integration-cert.pem`).
    -   **Client Certificate Private Key:** The private key file for the client certificate.
    -   **Account Name:** A name to identify this Puppet instance in JupiterOne. When **Tag with Account Name** is enabled, ingested entities store this value in `tag.AccountName`.
    -   **Description:** An optional description to help identify this integration instance.
    -   **Polling Interval:** How frequently data is refreshed. Leave as `DISABLED` to trigger runs manually.
4.  Click **Create Configuration** to save.
    

## Data Volume Configuration

### Advanced Configuration

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Resource Types Filter** | Limits ingestion to specific Puppet resource types. When no types are selected, all resource types are ingested, including custom module-defined types not listed here (for example, `Firewall` or `Apache::Vhost`). | _(all types)_ | Package, Service, User, Group, File, Cron, Exec, Ssh\_authorized\_key, Mount, Host, Yumrepo, Scheduled\_task, Selboolean, Selmodule, Augeas |

## Troubleshooting

### BAD Certificate Error

This error occurs when the provided CA certificate is malformed or does not match the certificate chain. To regenerate certificates on the Puppet Server:

```bash
# Back up existing certificate files
cp -r /etc/puppetlabs/puppet/ssl /etc/puppetlabs/puppet/ssl_back

# Remove the existing certificates
rm -rf /etc/puppetlabs/puppet/ssl

# Regenerate the CA certificate
puppetserver ca setup

# Restart the Puppet Server
systemctl restart puppetserver
```

### No Alternative Certificate Subject Name Matches Target Hostname

This error occurs when the certificate's common name does not match the hostname in the PuppetDB URL.

1.  Open the Puppet configuration file:
    
    ```bash
    nano /etc/puppetlabs/puppet/puppet.conf
    ```
    
2.  Under the `[main]` section, set `certname` to match the hostname used in the PuppetDB URL:
    
    ```ini
    [main]
    certname = <hostname>
    ```
    
3.  Restart the Puppet Server:
    
    ```bash
    systemctl restart puppetserver
    ```
    

## Next Steps

Once the integration instance is configured, it will run on the polling interval you set and populate Puppet data in JupiterOne. Continue to the [Instance Management Guide](/integrations/instance-management.md) to learn more about working with integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (6)

-   `GET /pdb/query/v4/catalogs`
-   `GET /pdb/query/v4/environments`
-   `GET /pdb/query/v4/factsets`
-   `GET /pdb/query/v4/inventory`
-   `GET /pdb/query/v4/producers`
-   `GET /pdb/query/v4/resources`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (7)

-   [https://puppet.com/docs/puppetdb/latest/api/query/v4/catalogs.html](https://puppet.com/docs/puppetdb/latest/api/query/v4/catalogs.html)
-   [https://puppet.com/docs/puppetdb/latest/api/query/v4/environments.html](https://puppet.com/docs/puppetdb/latest/api/query/v4/environments.html)
-   [https://puppet.com/docs/puppetdb/latest/api/query/v4/factsets.html](https://puppet.com/docs/puppetdb/latest/api/query/v4/factsets.html)
-   [https://puppet.com/docs/puppetdb/latest/api/query/v4/inventory.html](https://puppet.com/docs/puppetdb/latest/api/query/v4/inventory.html)
-   [https://puppet.com/docs/puppetdb/latest/api/query/v4/producers.html](https://puppet.com/docs/puppetdb/latest/api/query/v4/producers.html)
-   [https://puppet.com/docs/puppetdb/latest/api/query/v4/resources.html](https://puppet.com/docs/puppetdb/latest/api/query/v4/resources.html)
-   [https://puppet.com/docs/puppetdb/latest/configure.html](https://puppet.com/docs/puppetdb/latest/configure.html)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | Endpoints |
| --- | --- |
| Fetch Puppet Catalogs | `GET /pdb/query/v4/catalogs` |
| Fetch Puppet Factsets | `GET /pdb/query/v4/factsets` |
| Fetch Puppet Nodes | `GET /pdb/query/v4/inventory` |
| Fetch Puppet Resources | `GET /pdb/query/v4/resources` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Catalog | `puppet_catalog` | [DataObject](https://docs.jupiterone.io/data-model/schemas/DataObject) |
| Environment | `puppet_environment` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| FactSet | `puppet_factset` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Node | `puppet_node` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Resource | `puppet_resource` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Server | `puppet_server` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `puppet_catalog` | **CONTAINS** | `puppet_resource` |
| `puppet_environment` | **HAS** | `puppet_node` |
| `puppet_node` | **USES** | `puppet_factset` |
| `puppet_node` | **HAS** | `puppet_resource` |
| `puppet_server` | **MANAGES** | `puppet_node` |
| `puppet_server` | **GENERATED** | `puppet_catalog` |

### Puppet Catalog

`puppet_catalog` inherits from [DataObject](/data-model/schemas/DataObject.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`codeId` \*

 | `string` **|** `null` |  |  |
| 

`environment` \*

 | `string` |  |  |
| `hash` | `string` |  |  |
| 

`node` \*

 | `string` |  |  |
| `replacedCatalogOn` | `number` | A string representing the time at which the replace\_catalog command for a given catalog was submitted from the Puppet Server. Origin property is producer\_timestamp. |  |
| `transactionUuid` | `string` |  |  |
| 

`version` \*

 | `string` |  |  |

---

### Puppet Environment

`puppet_environment` inherits from [Group](/data-model/schemas/Group.md)

---

### Puppet Factset

`puppet_factset` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`nodeEnvironment` \*

 | `string` |  |  |
| 

`puppetServer` \*

 | `string` |  |  |
| `submittedOn` | `number` | A string representing the timestamp at which the data was submitted to PuppetDB from Puppet Server. |  |

---

### Puppet Node

`puppet_node` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `submittedOn` | `number` | A string representing the timestamp at which the data was submitted to PuppetDB from Puppet Server. |  |

---

### Puppet Resource

`puppet_resource` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`certname` \*

 | `string` | The certname of the puppet\_node this resource belongs to. |  |
| 

`environment` \*

 | `string` |  |  |
| 

`exported` \*

 | `boolean` |  |  |
| `filePath` | `string` |  |  |
| `lines` | `number` |  |  |
| 

`resource` \*

 | `string` | The PuppetDB-assigned resource hash that uniquely identifies this resource within its catalog. |  |
| 

`title` \*

 | `string` |  |  |
| 

`type` \*

 | `string` |  |  |

---

### Puppet Server

`puppet_server` inherits from [Control](/data-model/schemas/Control.md)

---

---

Source: /integrations/directory/push-security

# Push Security

Visualize Push Security applications, employees, and findings, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need your Push Security API Key to set up this integration. You can create an API key by going to the Settings page in the Push Security admin console.

### Configuration in Push Security

1.  Log in to your Push Security admin console.
2.  Navigate to the **Settings** page.
3.  Create a new API key for JupiterOne integration.
4.  Copy the API key for use in JupiterOne configuration.

### Configuration in JupiterOne

To install the Push Security integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Push Security. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Push Security account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Push Security **API Key** created in the Settings page.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Push Security Account | `pushsecurity_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Push Security Application | `pushsecurity_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Push Security Employee | `pushsecurity_employee` | [Person](https://docs.jupiterone.io/data-model/schemas/Person) |
| Push Security Finding | `pushsecurity_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `pushsecurity_account` | **IDENTIFIED** | `pushsecurity_application` |
| `pushsecurity_application` | **HAS** | `pushsecurity_finding` |
| `pushsecurity_employee` | **HAS** | `pushsecurity_account` |
| `pushsecurity_employee` | **HAS** | `pushsecurity_finding` |
| `pushsecurity_employee` | **OWNS** | `pushsecurity_application` |

---

Source: /integrations/directory/qualys

# Qualys

Visualize Qualys scanners and findings, monitor findings and changes through queries and alerts.

## Installation

This integration connects to the Qualys API using a username and password. The Qualys user must have the **Manager** role, or a custom role with equivalent read access to the modules you want to ingest. The built-in **Reader** role is not sufficient — it does not grant access to host detection data. See the [Qualys VM and PA API documentation](https://docs.qualys.com/en/vm/qweb-all-api/get_started/get_started.htm) for details.

> **NOTE**
> 
> If you use Container Security ingestion, the Qualys user must also have the Container Security module enabled and the **CS API Access** permission assigned in your Qualys account.
> 
> If you use Certificates ingestion, your subscription must include Certificate View, and the Qualys user's role must have **API Access** plus the **CERTVIEW API Access** permission (Administration > Role Management > edit the role > Permissions > Modules: Certificate View). Without it, the Fetch Certificates step fails with `Unauthorized`.

## Configuration in JupiterOne

To add the Qualys integration, navigate to **Integrations** in JupiterOne and select **Qualys**. Click **New Instance** to begin.

Creating an instance requires the following:

-   **Qualys Username** — the username of the Qualys account used for API access. Must belong to a non-test account user.
-   **Qualys Password** — the password for the Qualys user account.
-   **API URL** — your Qualys platform API URL (for example, `https://qualysapi.qg3.apps.qualys.com`). See [Identify your Qualys platform](https://www.qualys.com/platform-identification/) to find the correct URL for your account.

Click **Create** to finalize the instance.

## Data Volume Configuration

Control how much data is ingested from Qualys.

### Ingestion Windows

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Host scan age Filter** | Process only scans completed within this many days. | 7 | Any number |
| **Findings age Filter** | Process only findings identified or updated within this many days. | 7 | Any number |
| **Images Ingestion Window** | Process only container images updated within this many days. | 90 | 90, 180, 275, 365 |
| **Fixed Host Findings Age Filter (Days)** | When **Fixed** status is selected below, only fixed host findings within this age window are ingested. Has no effect unless **Fixed** is selected under **Host Finding Statuses**. | — | 30, 90, 180, 365 |
| **Software Installed Since (Days)** | Limit installed software ingestion to items installed within this many days. | — | 30, 90, 180, 365 |

### Host Detection Filtering Options

| Field | Description | Default |
| --- | --- | --- |
| **Host Finding Severities** | Limit host findings to these severity levels (1–5, comma-separated). | 3, 4, 5 |
| **Host Finding Types** | Limit host findings to these detection types. Valid values: `Info`, `Potential`, `Confirmed`. | Potential, Confirmed |
| **Host Finding Statuses** | Limit host findings to these statuses. Options: **New**, **Active**, **Re-Opened**, **Fixed**. | New, Active, Re-Opened |
| **Include Detection Results** | When enabled, includes the first 300 bytes of raw detection result data for each host finding (such as file paths). This significantly increases run time. | Disabled |
| **Include Only Asset Tags** | Restrict host detection ingestion to hosts that match these tag names or IDs (comma-separated). Leave empty to ingest all hosts. | — |

### Web Application Scan Options

| Field | Description | Default |
| --- | --- | --- |
| **Web Application IDs** | Only ingest web applications and findings for these application IDs (comma-separated). Leave empty to ingest all scanned web applications. | — |

### Container Image Options

| Field | Description | Default |
| --- | --- | --- |
| **Container images Finding Severities** | Limit container image vulnerability findings to these severity levels (1–5, comma-separated). | 3, 4, 5 |
| **Skip Unassociated Container Images** | When enabled, skips container images that are not associated with any running or stopped container. | Disabled |

### Compliance Options

| Field | Description | Default |
| --- | --- | --- |
| **Policy IDs** | Only ingest compliance findings for these policy IDs (comma-separated). Leave empty to ingest all policies. | — |
| **Compliance Finding Statuses** | Limit compliance finding ingestion to these statuses. Options: **Passed**, **Failed**, **Error**, **Exception**. Leave empty to ingest all statuses. | — |
| **Include Evidence** | When enabled, includes evidence data in compliance findings. This significantly increases run time. | Disabled |
| **Include Cause of Failure** | When enabled, includes detailed cause-of-failure information in compliance findings. This significantly increases run time. | Disabled |

### Installed Software Options

| Field | Description | Default |
| --- | --- | --- |
| **Software Types** | Limit installed software ingestion to these types. Options: **Application**, **Unknown**, **Others**. | Application |
| **Authorization Status** | Filter installed software by authorization status. Options: **Authorized**, **Not Reviewed**, **Blacklisted**. Leave empty to include all. | — |

## Troubleshooting

If the integration fails with authorization errors, confirm that the Qualys user has the **Manager** role (or an equivalent custom role with API access). Note that a successful HTTP 200 response does not always mean access was granted — some Qualys endpoints return 200 with an `UNAUTHORIZED` body when the user lacks the required module permission. Check the integration job logs for `UNAUTHORIZED` error messages to identify which endpoint is failing.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (3)

-   `CERTVIEW API Access`
-   `CS.CONTAINER.VIEW`
-   `CS.IMAGE.VIEW`

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `Manager`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (20)

-   `GET {qualysApiUrl}/api/2.0/fo/asset/host/`
-   `GET {qualysApiUrl}/api/2.0/fo/compliance/posture/info/`
-   `GET {qualysApiUrl}/api/4.0/fo/compliance/control/`
-   `GET {qualysApiUrl}/api/4.0/fo/compliance/policy/`
-   `GET {qualysApiUrl}/api/5.0/fo/asset/host/`
-   `GET {qualysApiUrl}/csapi/v1.3/containers`
-   `GET {qualysApiUrl}/csapi/v1.3/images`
-   `GET {qualysApiUrl}/csapi/v1.3/images/{imageSha}/vuln`
-   `GET {qualysApiUrl}/qps/rest/3.0/get/was/webapp/{id}`
-   `GET {qualysApiUrl}/qps/rest/portal/version`
-   `POST {qualysApiUrl}/api/2.0/fo/asset/host/vm/detection/`
-   `POST {qualysApiUrl}/api/3.0/fo/knowledge_base/qvs/`
-   `POST {qualysApiUrl}/api/4.0/fo/knowledge_base/vuln/`
-   `POST {qualysApiUrl}/certview/v2.2/certificates`
-   `POST {qualysApiUrl}/csapi/v1.3/containers/list`
-   `POST {qualysApiUrl}/csapi/v1.3/images/list`
-   `POST {qualysApiUrl}/qps/rest/2.0/search/am/hostasset`
-   `POST {qualysApiUrl}/qps/rest/3.0/search/was/finding/`
-   `POST {qualysApiUrl}/qps/rest/3.0/search/was/webapp`
-   `POST {qualysApiUrl}/rest/2.0/search/am/asset`

### Licenses

Product licenses or SKUs required in the target environment.

Show Licenses (5)

-   `Qualys Certificate View`
-   `Qualys Container Security`
-   `Qualys Policy Compliance`
-   `Qualys VM`
-   `Qualys WAS`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (4)

-   [https://docs.qualys.com/en/certview/api/certview\_api/ch02/list\_certificates\_v2.htm](https://docs.qualys.com/en/certview/api/certview_api/ch02/list_certificates_v2.htm)
-   [https://docs.qualys.com/en/cs/api/get\_started/get\_started.htm](https://docs.qualys.com/en/cs/api/get_started/get_started.htm)
-   [https://docs.qualys.com/en/vm/qweb-all-api/get\_started/get\_started.htm](https://docs.qualys.com/en/vm/qweb-all-api/get_started/get_started.htm)
-   [https://docs.qualys.com/en/was/api/get\_started/get\_started.htm](https://docs.qualys.com/en/was/api/get_started/get_started.htm)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (12)

| Step | Permissions | Roles | Endpoints | Licenses |
| --- | --- | --- | --- | --- |
| Build Web App Finding Relationships | \- | `Manager` | \- | `Qualys WAS` |
| Fetch Compliance Policies | \- | `Manager` | `GET {qualysApiUrl}/api/4.0/fo/compliance/policy/` | `Qualys Policy Compliance` |
| Fetch Compliance Posture Information | \- | `Manager` | `GET {qualysApiUrl}/api/2.0/fo/compliance/posture/info/` | `Qualys Policy Compliance` |
| Fetch Containers | `CS.CONTAINER.VIEW` | \- | `GET {qualysApiUrl}/csapi/v1.3/containers`, `POST {qualysApiUrl}/csapi/v1.3/containers/list` | `Qualys Container Security` |
| Fetch Image Findings | `CS.IMAGE.VIEW` | \- | `GET {qualysApiUrl}/csapi/v1.3/images/{imageSha}/vuln` | `Qualys Container Security` |
| Fetch Installed Software | \- | `Manager` | `POST {qualysApiUrl}/rest/2.0/search/am/asset` | `Qualys VM` |
| Fetch Issues | \- | `Manager` | `POST {qualysApiUrl}/api/2.0/fo/asset/host/vm/detection/` | `Qualys VM` |
| Fetch Repositories | `CS.IMAGE.VIEW` | \- | \- | `Qualys Container Security` |
| Fetch Scanned Host Details | \- | `Manager` | `GET {qualysApiUrl}/api/2.0/fo/asset/host/`, `POST {qualysApiUrl}/qps/rest/2.0/search/am/hostasset` | `Qualys VM` |
| Fetch Scanned Host Findings | \- | `Manager` | `POST {qualysApiUrl}/api/2.0/fo/asset/host/vm/detection/`, `POST {qualysApiUrl}/api/4.0/fo/knowledge_base/vuln/`, `POST {qualysApiUrl}/api/3.0/fo/knowledge_base/qvs/` | `Qualys VM` |
| Fetch Scanned Web App Findings | \- | `Manager` | `POST {qualysApiUrl}/qps/rest/3.0/search/was/finding/` | `Qualys WAS` |
| Fetch Web Application Entities | \- | `Manager` | `GET {qualysApiUrl}/qps/rest/3.0/get/was/webapp/{id}` | `Qualys WAS` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `qualys_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Certificate | `qualys_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Compliance Control | `qualys_compliance_control` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Compliance Finding | `qualys_compliance_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Compliance Policy | `qualys_compliance_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Compliance Technology | `qualys_compliance_technology` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Container | `qualys_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| CSAM Tag | `qualys_tag` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Host | `qualys_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Host Detection | `qualys_host_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Host Detection | `qualys_host_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Image | `qualys_container_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Image Finding | `qualys_image_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Installed Software | `qualys_installed_software` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Issue | `qualys_issue` | [Issue](https://docs.jupiterone.io/data-model/schemas/Issue) |
| Repository | `qualys_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Vulnerability Manager | `qualys_vulnerability_manager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Web App Finding | `qualys_web_app_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Web App Finding | `qualys_web_app_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Web Application | `qualys_web_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Web Application Scanner | `qualys_web_app_scanner` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `qualys_account` | **HAS** | `qualys_web_app_scanner` |
| `qualys_account` | **HAS** | `qualys_vulnerability_manager` |
| `qualys_compliance_control` | **USES** | `qualys_compliance_technology` |
| `qualys_compliance_control` | **IDENTIFIED** | `qualys_compliance_finding` |
| `qualys_compliance_policy` | **HAS** | `qualys_compliance_control` |
| `qualys_compliance_policy` | **ENFORCES** | `qualys_host` |
| `qualys_container` | **USES** | `qualys_container_image` |
| `qualys_container_image` | **USES** | `qualys_repository` |
| `qualys_host` | **HAS** | `qualys_issue` |
| `qualys_host` | **HAS** | `qualys_host_finding` |
| `qualys_host` | **INSTALLED** | `qualys_installed_software` |
| `qualys_host` | **HAS** | `qualys_compliance_finding` |
| `qualys_host` | **USES** | `qualys_certificate` |
| `qualys_host_finding` | **HAS** | `qualys_tag` |
| `qualys_image_finding` | **IS** | `qualys_vuln` |
| `qualys_issue` | **REPORTED** | `qualys_host_finding` |
| `qualys_issue` | **HAS** | `qualys_tag` |
| `qualys_tag` | **CONTAINS** | `qualys_tag` |
| `qualys_vulnerability_manager` | **SCANS** | `qualys_host` |
| `qualys_web_app` | **HAS** | `qualys_web_app_finding` |
| `qualys_web_app_scanner` | **SCANS** | `web_app` |
| `qualys_web_app_scanner` | **IDENTIFIED** | `qualys_web_app_finding` |
| `qualys_web_app_scanner` | **SCANS** | `qualys_web_app` |

### Qualys Certificate

`qualys_certificate` inherits from [Certificate](/data-model/schemas/Certificate.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetCount` | `number` **|** `null` | Number of assets associated with the certificate |  |
| `authKeyIdentifier` | `string` **|** `null` | Authority Key Identifier extension value |  |
| 
`certhash` \*

 | `string` | SHA-256 fingerprint of the certificate |  |
| `dn` | `string` **|** `null` | Distinguished name (subject DN) of the certificate |  |
| `enhancedKeyUsage` | `array` **|** `null` | Enhanced (extended) key usage extensions on the certificate |  |
| `instanceCount` | `number` **|** `null` | Number of instances where the certificate was found |  |
| `isExtendedValidation` | `boolean` **|** `null` | Whether the certificate is an Extended Validation (EV) certificate |  |
| `isImported` | `boolean` **|** `null` | Whether the certificate was imported into Qualys |  |
| `isSelfSigned` | `boolean` **|** `null` | Whether the certificate is self-signed |  |
| `issuerCategory` | `string` **|** `null` | Category of the certificate issuer |  |
| `issuerCerthash` | `string` **|** `null` | SHA-256 fingerprint of the issuer certificate |  |
| `issuerName` | `string` **|** `null` | Name of the certificate issuer |  |
| `issuerOrganization` | `string` **|** `null` | Organization of the certificate issuer |  |
| `keySize` | `number` **|** `null` | Size of the public key in bits |  |
| `keyUsage` | `array` **|** `null` | Key usage extensions declared on the certificate |  |
| `lastFoundOn` | `number` **|** `null` | Timestamp (epoch ms) when the certificate was last found |  |
| `publicKeyAlgorithm` | `string` **|** `null` | Public key algorithm of the certificate |  |
| `revocationStatus` | `string` **|** `null` | Revocation status of the certificate |  |
| `rootIssuerCerthash` | `string` **|** `null` | SHA-256 fingerprint of the root issuer certificate |  |
| `rootIssuerName` | `string` **|** `null` | Name of the root issuer of the certificate |  |
| `serialNumber` | `string` **|** `null` | Serial number of the certificate |  |
| `signatureAlgorithm` | `string` **|** `null` | Algorithm used to sign the certificate |  |
| `sources` | `array` **|** `null` | Sources that reported the certificate |  |
| `subjectAlternativeNames` | `array` **|** `null` | Subject Alternative Names (DNS and IP) on the certificate |  |
| `subjectCountry` | `string` **|** `null` | Country named in the certificate subject |  |
| `subjectKeyIdentifier` | `string` **|** `null` | Subject Key Identifier extension value |  |
| `subjectOrganization` | `string` **|** `null` | Organization named in the certificate subject |  |
| `type` | `string` **|** `null` | Certificate type (e.g., Leaf, Root, Intermediate) |  |
| `validFromOn` | `number` **|** `null` | Timestamp (epoch ms) from which the certificate is valid |  |

---

### Qualys Compliance Control

`qualys_compliance_control` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `autoUpdates` | `boolean` |  |  |
| 
`category` \*

 | `string` |  |  |
| `checkType` | `string` |  |  |
| `comment` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `criticality` | `number` |  |  |
| `criticalityLabel` | `string` |  |  |
| `deprecatedOn` | `number` |  |  |
| `errorSetStatus` | `string` |  |  |
| `frameworks` | `array` of `string`s |  |  |
| 

`id` \*

 | `string` |  |  |
| `ignoresErrors` | `boolean` |  |  |
| `ignoresItemNotFound` | `boolean` |  |  |
| `isActive` | `boolean` | Whether Qualys has the control active at the vendor level. Distinct from isDeprecated (sunset/replaced) and from the per-policy isActive on POLICY\_HAS\_CONTROL relationships. |  |
| `isDeprecated` | `boolean` |  |  |
| 

`statement` \*

 | `string` |  |  |
| 

`subCategory` \*

 | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `usesAgentOnly` | `boolean` |  |  |

---

### Qualys Compliance Finding

`qualys_compliance_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`controlId` \*

 | `number` |  |  |
| `evaluatedOn` | `number` |  |  |
| `exceptionAssignee` | `string` |  |  |
| `exceptionCreatedBy` | `string` |  |  |
| `exceptionCreatedOn` | `number` |  |  |
| `exceptionEndsOn` | `number` |  |  |
| `exceptionLastModifiedBy` | `string` |  |  |
| `exceptionLastModifiedOn` | `number` |  |  |
| `exceptionStatus` | `string` |  |  |
| `firstFailedOn` | `number` |  |  |
| `firstPassedOn` | `number` |  |  |
| `hasException` | `boolean` |  |  |
| 

`hostId` \*

 | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| `instance` | `string` |  |  |
| `lastFailedOn` | `number` |  |  |
| `lastPassedOn` | `number` |  |  |
| `postureModifiedOn` | `number` |  |  |
| `previousStatus` | `string` |  |  |
| `remediation` | `string` |  |  |
| 

`technologyId` \*

 | `number` |  |  |

---

### Qualys Compliance Policy

`qualys_compliance_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetGroupIds` | `array` of `string`s |  |  |
| `controlCount` | `number` |  |  |
| `createdBy` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `evaluatesImmediately` | `boolean` |  |  |
| 
`id` \*

 | `string` |  |  |
| `includesAgentIps` | `boolean` |  |  |
| `isLocked` | `boolean` |  |  |
| `lastEvaluatedOn` | `number` |  |  |
| `lastModifiedBy` | `string` |  |  |
| `lastModifiedOn` | `number` |  |  |
| `status` | `string` |  |  |
| `tagExcludeSelector` | `string` |  |  |
| `tagIncludeSelector` | `string` |  |  |
| `tagSetExclude` | `array` of `string`s |  |  |
| `tagSetInclude` | `array` of `string`s |  |  |
| 

`title` \*

 | `string` |  |  |

---

### Qualys Compliance Technology

`qualys_compliance_technology` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`controlId` \*

 | `number` |  |  |
| `dataPointCardinality` | `string` |  |  |
| `dataPointOperator` | `string` |  |  |
| `description` | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| `rationale` | `string` |  |  |
| `usesScanValue` | `boolean` |  |  |

---

### Qualys Host

`qualys_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activatedModules` | `array` of `string`s |  |  |
| `agentId` | `string` | Agent ID |  |
| `agentLastCheckedInOn` | `number` | Agent last checked date |  |
| `agentStatus` | `string` | Agent Status |  |
| `agentVersion` | `string` | Agent Version |  |
| `alibabaAccountId` | `string` | Alibaba Cloud Account ID associated with the instance |  |
| `alibabaDnsServer` | `string` | DNS server used by the Alibaba Cloud instance |  |
| `alibabaFirstDiscoveredOn` | `number` | Timestamp when the Alibaba Cloud instance was first discovered |  |
| `alibabaImageId` | `string` | Image ID used to launch the Alibaba Cloud instance |  |
| `alibabaInstanceType` | `string` | Type of Alibaba Cloud instance (e.g., ecs.g6.large) |  |
| `alibabaLastUpdatedOn` | `number` | Timestamp when the Alibaba Cloud instance was last updated |  |
| `alibabaNetworkInterfaceId` | `string` | Network Interface ID associated with the instance |  |
| `alibabaNetworkType` | `string` | Network type of the Alibaba Cloud instance (e.g., VPC, Classic) |  |
| `alibabaRegion` | `string` | Region where the Alibaba Cloud instance is deployed |  |
| `alibabaState` | `string` | Current state of the Alibaba Cloud instance (e.g., Running, Stopped) |  |
| `alibabaVpcCidr` | `string` | CIDR block of the VPC associated with the instance |  |
| `alibabaVpcId` | `string` | VPC ID associated with the Alibaba Cloud instance |  |
| `alibabaVSwitchCIDR` | `string` | CIDR block of the VSwitch associated with the instance |  |
| `alibabaVSwitchId` | `string` | VSwitch ID where the Alibaba Cloud instance is deployed |  |
| `alibabaZone` | `string` | Zone where the Alibaba Cloud instance is located |  |
| `asn` | `string` | Autonomous System Number for the asset, populated by Qualys EASM module |  |
| `assignedLocation` | `string` | Physical or logical location assigned to the asset, populated by Qualys CSAM module |  |
| `azureFirstDiscoveredOn` | `number` | Timestamp when the Azure VM was first discovered |  |
| `azureLastUpdatedOn` | `number` | Timestamp when the Azure VM was last updated |  |
| `azureLocation` | `string` | Azure region where the VM is deployed |  |
| `azureOffer` | `string` | Azure offer associated with the VM |  |
| `azureOsType` | `string` | Operating system type of the Azure VM (e.g., Linux, Windows) |  |
| `azurePublisher` | `string` | Publisher of the VM image |  |
| `azureResourceGroupName` | `string` | Name of the resource group containing the Azure VM |  |
| `azureState` |  |  | `[object Object]`, `[object Object]` |
| `azureSubnet` | `string` | Subnet ID where the Azure VM is deployed |  |
| `azureSubscriptionId` | `string` | Azure Subscription ID associated with the VM |  |
| `azureVersion` | `string` | Version of the VM image |  |
| `azureVmSize` | `string` | Size of the Azure VM (e.g., Standard\_D2s\_v3) |  |
| `businessAppListData` | `string` | Serialized business application mapping for the asset, populated by Qualys CSAM module |  |
| `businessInformation` | `string` | Business information context for the asset, populated by Qualys CSAM module |  |
| `criticalityScore` | `number` | Qualys asset criticality score (typically 1-5) |  |
| `easmTags` | `string` | Comma-separated EASM tags applied by Qualys External Attack Surface Management module |  |
| `ec2AccountId` | `string` | AWS Account ID associated with the EC2 instance |  |
| `ec2AvailabilityZone` | `string` | Availability Zone where the EC2 instance is running |  |
| `ec2FirstDiscoveredOn` | `number` | Timestamp when the EC2 instance was first discovered |  |
| `ec2ImageId` | `string` | AMI ID used to launch the EC2 instance |  |
| `ec2InstanceType` | `string` | Type of EC2 instance (e.g., t2.micro, m5.large) |  |
| `ec2LastUpdatedOn` | `number` | Timestamp when the EC2 instance was last updated |  |
| `ec2PrivateDnsName` | `string` | Private DNS name assigned to the EC2 instance |  |
| `ec2PublicDnsName` | `string` | Public DNS name assigned to the EC2 instance (if applicable) |  |
| `ec2Region` | `string` | AWS Region where the EC2 instance is located |  |
| `ec2ReservationId` | `string` | Reservation ID associated with the EC2 instance |  |
| `ec2State` | `string` | Current state of the EC2 instance (e.g., running, stopped) |  |
| `ec2SubnetId` | `string` | Subnet ID where the EC2 instance is deployed |  |
| `ec2VpcId` | `string` | VPC ID associated with the EC2 instance |  |
| `firstEasmScannedOn` | `number` | Timestamp when Qualys EASM first scanned this asset |  |
| `gcpFirstDiscoveredOn` | `number` | Timestamp when the GCP instance was first discovered |  |
| `gcpImageId` | `string` | Image ID used to launch the GCP instance |  |
| `gcpLastUpdatedOn` | `number` | Timestamp when the GCP instance was last updated |  |
| `gcpMachineType` | `string` | Type of GCP machine (e.g., n1-standard-1, e2-medium) |  |
| `gcpNetwork` | `string` | Network configuration associated with the GCP instance |  |
| `gcpProjectId` | `string` | Project ID associated with the GCP instance |  |
| `gcpProjectIdNo` | `number` | Numerical Project ID associated with the GCP instance |  |
| `gcpState` | `string` | Current state of the GCP instance (e.g., RUNNING, TERMINATED) |  |
| `gcpZone` | `string` | GCP zone where the instance is deployed (e.g., us-central1-a) |  |
| `hostingCategory1` | `string` | Primary hosting category classification for the asset, populated by Qualys EASM/CSAM enrichment |  |
| `ibmDatacenterId` | `string` | Identifier for the IBM Cloud datacenter hosting the instance |  |
| `ibmDomain` | `string` | Domain name associated with the IBM Cloud instance |  |
| `ibmLocation` | `string` | Geographical location where the IBM Cloud instance is deployed |  |
| `ibmPrivateVlan` | `string` | Private VLAN ID associated with the IBM Cloud instance |  |
| `ibmPublicVlan` | `string` | Public VLAN ID associated with the IBM Cloud instance |  |
| `lastEasmScannedOn` | `number` | Timestamp when Qualys EASM last scanned this asset |  |
| `lastScannedOn` | `number` | Last scanned date |  |
| `ociAvailabilityDomain` | `string` | Availability domain where the OCI instance is located |  |
| `ociCompartmentName` | `string` | Name of the compartment containing the OCI instance |  |
| `ociDisplayName` | `string` | Display name of the OCI instance |  |
| `ociFaultDomain` | `string` | Fault domain where the OCI instance is deployed |  |
| `ociFirstDiscoveredOn` | `number` | Timestamp when the OCI instance was first discovered |  |
| `ociImage` | `string` | Image ID or name used to launch the OCI instance |  |
| `ociLastUpdatedOn` | `number` | Timestamp when the OCI instance was last updated |  |
| `ociRegion` | `string` | Region where the OCI instance is deployed |  |
| `ociShape` | `string` | Shape of the OCI instance (e.g., VM.Standard2.1) |  |
| `ociState` | `string` | Current state of the OCI instance (e.g., RUNNING, TERMINATED) |  |
| `ociTenantId` | `string` | Tenant ID associated with the OCI instance |  |
| `ociTenantName` | `string` | Tenant name associated with the OCI instance |  |
| `osCpe` | `string` | Operating system CPE reported by Qualys CSAM |  |
| `processor` | `array` of `string`s |  |  |
| `qualysAssetId` | `number` | Qualys Asset ID |  |
| `qualysCreatedOn` | `number` | Qualys created date |  |
| `qualysQwebHostId` | `number` | Qualys Qweb Host ID |  |
| `riskScore` | `number` | Qualys TruRisk Score for the asset, 0-1000 (Severe 850-1000, High 700-849, Medium 500-699, Low 0-499), derived from the asset's criticality and the QDS of its detections |  |
| `scannedBy` | `string` | Scanned by |  |
| `totalMemory` | `number` | Total amount of allocated RAM on Host |  |
| `volume` | `array` of `string`s |  |  |
| `whois` | `string` | WHOIS record data for the asset, populated by Qualys EASM module |  |

---

### Qualys Host Finding

`qualys_host_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `awsAccountId` | `string` |  |  |
| `azureSubscriptionId` | `string` |  |  |
| `azureVmSourceId` | `string` |  |  |
| `details` | `string` | Raw detection results from the Qualys scan output (truncated to 300 bytes for storage). Sourced from the Qualys VM/PC detection `HOST_DETECTION.RESULTS` field. |  |
| `ec2InstanceArn` | `string` |  |  |
| `firstFoundOn` | `number` |  |  |
| `fqdn` | `string` |  |  |
| `gcpInstanceSelfLink` | `string` |  |  |
| `gcpProjectId` | `string` |  |  |
| `hostId` | `number` |  |  |
| 
`id` \*

 | `string` |  |  |
| `isDisabled` | `number` |  |  |
| `isIgnored` | `number` |  |  |
| `isPatchable` | `boolean` | Whether a vendor patch exists for the underlying Qualys QID (KB VULN.PATCHABLE=1). Always agrees with patchStatus: true exactly when patchStatus is "patchable", false when it is "non-patchable" or "no-patch-available", and unset when patchStatus is unset. |  |
| `lastFixedOn` | `number` | Timestamp when Qualys marked the detection Fixed. Populated only when STATUS=Fixed. |  |
| `lastFoundOn` | `number` |  |  |
| `lastProcessedOn` | `number` |  |  |
| `lastTestedOn` | `number` |  |  |
| `lastUpdatedOn` | `number` |  |  |
| `numTimesFound` | `number` |  |  |
| `patchPublishedOn` | `number` | Timestamp (unix ms) when the vendor first published a patch for this QID. Sourced from the Qualys KnowledgeBase VULN.PATCH\_PUBLISHED\_DATE (KnowledgeBase API v3.0 and later, details=All); present only when a patch exists. |  |
| `patchStatus` | `string` | Patch state of the underlying Qualys QID, derived from its KnowledgeBase record. "patchable": KB PATCHABLE=1, a vendor patch exists. "no-patch-available": PATCHABLE=0 and the QID carries the No\_Patch Real-Time Threat Indicator (id 8), meaning Qualys has confirmed the vendor offers no patch. "non-patchable": PATCHABLE=0 without that indicator. Real-Time Threat Indicators are only returned when Threat Protection is enabled on the Qualys subscription; without it, every PATCHABLE=0 QID is reported as "non-patchable". Unset when the KnowledgeBase record has no PATCHABLE value or the KnowledgeBase lookup failed. | **Any of**:

-   `patchable`

-   `non-patchable`

-   `no-patch-available`

 |
| `port` | `number` |  |  |
| `protocol` | `string` |  |  |
| `qds` | `number` | Qualys Detection Score (0-100), risk-based prioritization metric incorporating QVS, CVSS, EPSS, exploit maturity, and asset-level mitigations |  |
| `qdsSeverity` | `string` | QDS severity category derived from score: Critical (90-100), High (70-89), Medium (40-69), Low (1-39) |  |
| `qid` | `string` | Qualys vulnerability identifier (QID) from the Qualys knowledge base. Stored as a string because a QID is an opaque identifier, not a quantity: as a number it renders with locale thousands separators (`385,437`). |  |
| `qualysSeverity` | `number` |  |  |
| `qvs` | `number` | Qualys Vulnerability Score (0-100), CVE-level score measuring likelihood of exploitation based on CVSS, exploit maturity, and threat intelligence |  |
| `ssl` | `number` |  |  |
| `type` | `string` |  |  |

---

### Qualys Host Finding

`qualys_host_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `awsAccountId` | `string` |  |  |
| `azureSubscriptionId` | `string` |  |  |
| `azureVmSourceId` | `string` |  |  |
| `details` | `string` | Raw detection results from the Qualys scan output (truncated to 300 bytes for storage). Sourced from the Qualys VM/PC detection `HOST_DETECTION.RESULTS` field. |  |
| `ec2InstanceArn` | `string` |  |  |
| `firstFoundOn` | `number` |  |  |
| `fqdn` | `string` |  |  |
| `gcpInstanceSelfLink` | `string` |  |  |
| `gcpProjectId` | `string` |  |  |
| `hostId` | `number` |  |  |
| 
`id` \*

 | `string` |  |  |
| `isDisabled` | `number` |  |  |
| `isIgnored` | `number` |  |  |
| `isPatchable` | `boolean` | Whether a vendor patch exists for the underlying Qualys QID (KB VULN.PATCHABLE=1). Always agrees with patchStatus: true exactly when patchStatus is "patchable", false when it is "non-patchable" or "no-patch-available", and unset when patchStatus is unset. |  |
| `lastFixedOn` | `number` | Timestamp when Qualys marked the detection Fixed. Populated only when STATUS=Fixed. |  |
| `lastFoundOn` | `number` |  |  |
| `lastProcessedOn` | `number` |  |  |
| `lastTestedOn` | `number` |  |  |
| `lastUpdatedOn` | `number` |  |  |
| `numTimesFound` | `number` |  |  |
| `patchPublishedOn` | `number` | Timestamp (unix ms) when the vendor first published a patch for this QID. Sourced from the Qualys KnowledgeBase VULN.PATCH\_PUBLISHED\_DATE (KnowledgeBase API v3.0 and later, details=All); present only when a patch exists. |  |
| `patchStatus` | `string` | Patch state of the underlying Qualys QID, derived from its KnowledgeBase record. "patchable": KB PATCHABLE=1, a vendor patch exists. "no-patch-available": PATCHABLE=0 and the QID carries the No\_Patch Real-Time Threat Indicator (id 8), meaning Qualys has confirmed the vendor offers no patch. "non-patchable": PATCHABLE=0 without that indicator. Real-Time Threat Indicators are only returned when Threat Protection is enabled on the Qualys subscription; without it, every PATCHABLE=0 QID is reported as "non-patchable". Unset when the KnowledgeBase record has no PATCHABLE value or the KnowledgeBase lookup failed. | **Any of**:

-   `patchable`

-   `non-patchable`

-   `no-patch-available`

 |
| `port` | `number` |  |  |
| `protocol` | `string` |  |  |
| `qds` | `number` | Qualys Detection Score (0-100), risk-based prioritization metric incorporating QVS, CVSS, EPSS, exploit maturity, and asset-level mitigations |  |
| `qdsSeverity` | `string` | QDS severity category derived from score: Critical (90-100), High (70-89), Medium (40-69), Low (1-39) |  |
| `qid` | `string` | Qualys vulnerability identifier (QID) from the Qualys knowledge base. Stored as a string because a QID is an opaque identifier, not a quantity: as a number it renders with locale thousands separators (`385,437`). |  |
| `qualysSeverity` | `number` |  |  |
| `qvs` | `number` | Qualys Vulnerability Score (0-100), CVE-level score measuring likelihood of exploitation based on CVSS, exploit maturity, and threat intelligence |  |
| `recommendationAction` | `string` | Remediation guidance from the Qualys knowledge base for this vulnerability. Sourced from the Qualys KB `VULN.SOLUTION` field (HTML stripped). |  |
| `ssl` | `number` |  |  |
| `threatIntel` | `array` of `string`s |  |  |
| `title` | `string` | Vulnerability title from the Qualys knowledge base. Sourced from the Qualys KB `VULN.TITLE` field. |  |
| `type` | `string` |  |  |

---

### Qualys Installed Software

`qualys_installed_software` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `architecture` | `string` | Software architecture (e.g., x86\_64) |  |
| `authorization` | `string` | Authorization status: Authorized, Not Reviewed, Blacklisted |  |
| `category` | `string` | Software category |  |
| `cpe` | `string` | Common Platform Enumeration string |  |
| `cpeId` | `string` | CPE identifier |  |
| `endOfLifeOn` | `number` | End of Life date |  |
| `endOfSupportOn` | `number` | End of Support date |  |
| `generalAvailabilityOn` | `number` | General Availability date |  |
| `licenseCategory` | `string` | License category |  |
| `publisher` | `string` | Software publisher |  |
| `softwareType` | `string` | Software type: Application, Unknown, Others |  |
| `supportStageDesc` | `string` | Support stage description |  |
| `version` | `string` | Software version |  |

---

### Qualys Issue

`qualys_issue` inherits from [Issue](/data-model/schemas/Issue.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `details` | `string` |  |  |
| `firstFoundOn` | `number` |  |  |
| `fqdn` | `string` | Fully-qualified domain name of the host this issue was detected on, lower-cased, sourced from the Qualys host asset (dnsHostName or fqdn). |  |
| `hostId` | `number` |  |  |
| `hostname` | `string` | Short DNS hostname (first label of the FQDN) of the host this issue was detected on, derived from the Qualys host asset. Omitted when the FQDN is a reverse-DNS / IP-derived name (e.g. static-216.87.37.15.primary.net), whose first label is shared across hosts. Enables correlating the issue to external asset inventories (e.g. ServiceNow vulnerable items) on hostname + QID without requiring a shared numeric asset id. |  |
| `ipAddress` | `string` | IP address of the host this issue was detected on. Populated from the Qualys detection API DetectionHost.IP. Used as a fallback correlation key with service\_now\_vulnerable\_item when the host has no hostname/FQDN (e.g. IoT devices). |  |
| `isDisabled` | `number` |  |  |
| `isIgnored` | `number` |  |  |
| `lastFixedOn` | `number` | Timestamp when Qualys marked the detection Fixed. Populated only when STATUS=Fixed. |  |
| `lastFoundOn` | `number` |  |  |
| `lastProcessedOn` | `number` |  |  |
| `lastTestedOn` | `number` |  |  |
| `lastUpdatedOn` | `number` |  |  |
| `numTimesFound` | `number` |  |  |
| `port` | `number` |  |  |
| `protocol` | `string` |  |  |
| `qds` | `number` | Qualys Detection Score (0-100), risk-based prioritization metric incorporating QVS, CVSS, EPSS, exploit maturity, and asset-level mitigations |  |
| `qdsSeverity` | `string` | QDS severity category derived from score: Critical (90-100), High (70-89), Medium (40-69), Low (1-39) |  |
| 
`qid` \*

 | `string` | Qualys vulnerability identifier (QID) from the Qualys knowledge base. Stored as a string because a QID is an opaque identifier, not a quantity: as a number it renders with locale thousands separators (`385,437`). |  |
| `severity` | `number` |  |  |
| `ssl` | `number` |  |  |
| `status` | `string` |  |  |
| `type` | `string` |  |  |
| `updatedOn` | `number` |  |  |

---

### Qualys Repository

`qualys_repository` inherits from [Repository](/data-model/schemas/Repository.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`registry` \*

 | `string` | Registry name |  |
| 

`repository` \*

 | `string` | Repository name |  |
| 

`tag` \*

 | `string` | Tag name |  |

---

### Qualys Tag

`qualys_tag` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `color` | `string` | Hex color code for tag UI display |  |
| `criticalityScore` | `number` | Qualys tag criticality score (1-5) |  |
| `ruleText` | `string` | Search query used to evaluate this dynamic tag, verbatim from Qualys. For VULN\_EXIST and ASSET\_SEARCH rules it encodes the vulnerability and asset criteria that make the tag apply. |  |
| `ruleType` | `string` | Tag rule type as answered by the Qualys Asset Management Tag API: STATIC, GROOVY, OS\_REGEX, NETWORK\_RANGE, NAME\_CONTAINS, INSTALLED\_SOFTWARE, OPEN\_PORTS, VULN\_EXIST, ASSET\_SEARCH, CLOUD\_ASSET or BUSINESS\_INFORMATION. |  |
| 
`tagId` \*

 | `number` | Qualys numeric tag ID |  |

---

### Qualys Web App

`qualys_web_app` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `defaultScannerName` | `string` **|** `null` | Name of the default scanner appliance assigned to the web application |  |
| 
`id` \*

 | `string` | Qualys WAS web application ID |  |
| `lastScanOn` | `number` **|** `null` | Timestamp when the web application was last scanned by Qualys WAS |  |
| `lastScanStatus` | `string` **|** `null` | Status of the most recent Qualys WAS scan (e.g. FINISHED, ERROR) |  |
| `lastScanType` | `string` **|** `null` | Type of the most recent Qualys WAS scan (e.g. VULNERABILITY, DISCOVERY) |  |
| `ownerUserId` | `number` **|** `null` | Qualys user ID of the owner of the web application |  |
| `riskScore` | `number` **|** `null` | Qualys WAS risk score for the web application |  |
| `tagIds` | `array` **|** `null` | Qualys tag ID applied to the web application |  |
| `tagNames` | `array` **|** `null` | Name of a tag applied to the web application |  |

---

## Release Notes

-   **2026-10-15** — Qualys host entities now include an operating system CPE field sourced from CSAM data, enabling CPE-based OS queries across discovered hosts.
    
-   **2026-10-06** — Qualys CSAM vulnerability tags are now ingested with their full tag hierarchy, and linked to host findings and issues, enabling tag-based vulnerability queries.
    
-   **2026-09-24** — Qualys web application findings now include CVE identifiers mapped from the Qualys knowledge base.
    
-   **2026-09-21** — Qualys issues now include the host IP address, enabling correlation with ServiceNow vulnerable items for hosts that have no hostname, such as IoT devices.
    
-   **2026-09-15** — Added ingestion of web application entities and their associated findings, with relationships from the scanner to web applications and from web applications to their findings.
    
-   **2026-09-14** — Added support for Qualys CertView, ingesting TLS and SSL certificate entities with fingerprint, validity dates, revocation status, and extended validation classification.
    
-   **2026-09-03** — Qualys hosts now include the TruRisk Score, a 0 to 1000 asset risk score derived from asset criticality and detection severity.
    
-   **2026-08-07** — Added ingestion of Qualys CSAM vulnerability tags as queryable entities, with optional configuration to enable tag ingestion and linking to host findings.
    
-   **2026-08-04** — Qualys vulnerability findings now consistently include a hostname property, improving cross-integration host correlation.
    
-   **2026-03-23** — Improved last seen timestamp accuracy on Qualys host entities by using the last scanned date as a fallback when agent check-in data is unavailable.
    
-   **2026-03-11** — Added ingestion of installed software as Qualys installed software entities, relating them to their host.
    
-   **2026-03-05** — Added Qualys compliance policy to host relationships, linking compliance policies to their evaluated hosts.
    
-   **2026-02-10** — Added Qualys issue entities as a new step, creating structured issue records from host vulnerability data.
    
-   **2026-02-03** — Added VMDR fixed findings since days configuration option to control how far back to ingest fixed VMDR findings.
    
-   **2026-01-29** — Added patchable and threat intelligence properties (CVSS v3 base score, exploitability) to Qualys vulnerability entities.
    
-   **2026-01-28** — Added compliance finding to host relationship for compliance findings to their associated hosts.
    
-   **2026-01-23** — Improved rendering of Qualys vulnerability solution and recommendation text by converting HTML markup to plain text.
    
-   **2025-12-02** — Added Qualys Policy Audit (PC module) support, ingesting compliance policies and compliance findings as new entity types.
    
-   **2025-11-18** — Added host finding status filter configuration option to limit findings to active, fixed, or new states.
    
-   **2025-10-27** — Normalized additional properties on Qualys host finding entities including severity override and QDS.
    
-   **2025-08-20** — Added remediation actions normalization to Qualys vulnerability entities.
    
-   **2025-07-31** — Added hostname parsing from the asset name field on global Qualys host entities.
    
-   **2025-05-05** — Added Qualys Container Security repositories as container repository entities.
    
-   **2025-04-29** — Promoted total memory, processor, and volume properties to Qualys host entities.
    
-   **2025-04-15** — Added Qualys container finding relationship linking container scan findings to their containers.

---

Source: /integrations/directory/qualys-totalcloud

# Qualys TotalCloud

Visualize Qualys TotalCloud cloud assets and CSPM control evaluations across AWS, Azure, GCP, and OCI, and monitor findings and changes through queries and alerts.

## Installation

This integration reads data from the Qualys **TotalCloud** (CloudView) module over its REST API — cloud connectors, cloud assets, controls, and control evaluations (findings) across AWS, Azure, GCP, and OCI. Because it is read-only, a Qualys user with the **Reader** role is sufficient, provided that user's role has the **TotalCloud API Access** permission enabled.

> **INFO**
> 
> You will need the following:
> 
> -   A Qualys **username** and **password** for a user whose role:
>     
>     -   Has access to the **TotalCloud** module (the predefined _TOTALCLOUD User_ role, a custom role, or **Manager**).
>     -   Has the **TotalCloud API Access** permission enabled under TotalCloud. Without it, the API responds that the user is not authorized to access the module. See [User Roles and Permissions](https://docs.qualys.com/en/cloudview/latest/users/user_roles.htm) and [Assign Role to Users](https://docs.qualys.com/en/cloudview/latest/users/assign_role.htm).
> -   Your Qualys **API URL** for the platform that hosts your account — for example, `https://qualysapi.qg3.apps.qualys.com`. Use the URL that matches your login platform. See [Qualys Platform Identification](https://www.qualys.com/platform-identification) to find yours.
>     

> **NOTE**
> 
> The integration authenticates with HTTP Basic authentication against the CloudView/TotalCloud REST API. Use a username and password associated with a non-test (subscription) account user.

## Data Volume Configuration

Control how much data is ingested from Qualys TotalCloud to manage storage and processing.

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Findings History Days** | How many days of TotalCloud control evaluations (findings) to fetch per cloud resource. | 90 | 7, 30, 90, 180, 365 |

**How it affects data volume:** Larger windows pull more evaluation history per resource and meaningfully increase the number of API calls for large multi-cloud tenants.

All ingestion sources are **disabled by default**. Enable only the providers (AWS, Azure, GCP, OCI) and data types you need from the integration instance's ingestion source settings to keep ingestion scoped to what you use.

### Configuration in JupiterOne

To install the Qualys TotalCloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Qualys TotalCloud**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Qualys TotalCloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Qualys **Username**, **Password**, and **API URL**.
    
-   Optionally, the **Findings History Days** window under the **Findings** configuration section.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (1)

-   `TotalCloud API Access`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (18)

-   `/cloudview-api/rest/v1/aws/connectors`
-   `/cloudview-api/rest/v1/aws/evaluations/{accountId}`
-   `/cloudview-api/rest/v1/aws/evaluations/{accountId}/resources/{controlId}`
-   `/cloudview-api/rest/v1/azure/connectors`
-   `/cloudview-api/rest/v1/azure/evaluations/{accountId}`
-   `/cloudview-api/rest/v1/azure/evaluations/{accountId}/resources/{controlId}`
-   `/cloudview-api/rest/v1/controls/metadata/list`
-   `/cloudview-api/rest/v1/gcp/connectors`
-   `/cloudview-api/rest/v1/gcp/evaluations/{accountId}`
-   `/cloudview-api/rest/v1/gcp/evaluations/{accountId}/resources/{controlId}`
-   `/cloudview-api/rest/v1/oci/connectors`
-   `/cloudview-api/rest/v1/oci/evaluations`
-   `/cloudview-api/rest/v1/oci/evaluations/resources/{controlId}`
-   `/cloudview-api/rest/v1/resource/{resourceType}/AWS`
-   `/cloudview-api/rest/v1/resource/{resourceType}/Azure`
-   `/cloudview-api/rest/v1/resource/{resourceType}/GCP`
-   `/cloudview-api/rest/v1/resource/{resourceType}/OCI`
-   `/cloudview-api/rest/v2/policies`

### Licenses

Product licenses or SKUs required in the target environment.

Show Licenses (1)

-   `Qualys TotalCloud (CloudView)`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (2)

-   [https://docs.qualys.com/en/cloudview/latest/users/user\_roles.htm](https://docs.qualys.com/en/cloudview/latest/users/user_roles.htm)
-   [https://docs.qualys.com/en/tc/api/](https://docs.qualys.com/en/tc/api/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (12)

| Step | Permissions | Endpoints | Licenses |
| --- | --- | --- | --- |
| Fetch AWS Cloud Assets | `TotalCloud API Access` | `/cloudview-api/rest/v1/resource/{resourceType}/AWS` | `Qualys TotalCloud (CloudView)` |
| Fetch AWS Findings | `TotalCloud API Access` | `/cloudview-api/rest/v1/aws/evaluations/{accountId}`, `/cloudview-api/rest/v1/aws/evaluations/{accountId}/resources/{controlId}` | `Qualys TotalCloud (CloudView)` |
| Fetch Azure Cloud Assets | `TotalCloud API Access` | `/cloudview-api/rest/v1/resource/{resourceType}/Azure` | `Qualys TotalCloud (CloudView)` |
| Fetch Azure Connectors | `TotalCloud API Access` | `/cloudview-api/rest/v1/azure/connectors` | `Qualys TotalCloud (CloudView)` |
| Fetch Azure Findings | `TotalCloud API Access` | `/cloudview-api/rest/v1/azure/evaluations/{accountId}`, `/cloudview-api/rest/v1/azure/evaluations/{accountId}/resources/{controlId}` | `Qualys TotalCloud (CloudView)` |
| Fetch CSPM Policies | `TotalCloud API Access` | `/cloudview-api/rest/v2/policies` | `Qualys TotalCloud (CloudView)` |
| Fetch GCP Cloud Assets | `TotalCloud API Access` | `/cloudview-api/rest/v1/resource/{resourceType}/GCP` | `Qualys TotalCloud (CloudView)` |
| Fetch GCP Connectors | `TotalCloud API Access` | `/cloudview-api/rest/v1/gcp/connectors` | `Qualys TotalCloud (CloudView)` |
| Fetch GCP Findings | `TotalCloud API Access` | `/cloudview-api/rest/v1/gcp/evaluations/{accountId}`, `/cloudview-api/rest/v1/gcp/evaluations/{accountId}/resources/{controlId}` | `Qualys TotalCloud (CloudView)` |
| Fetch OCI Cloud Assets | `TotalCloud API Access` | `/cloudview-api/rest/v1/resource/{resourceType}/OCI` | `Qualys TotalCloud (CloudView)` |
| Fetch OCI Connectors | `TotalCloud API Access` | `/cloudview-api/rest/v1/oci/connectors` | `Qualys TotalCloud (CloudView)` |
| Fetch OCI Findings | `TotalCloud API Access` | `/cloudview-api/rest/v1/oci/evaluations`, `/cloudview-api/rest/v1/oci/evaluations/resources/{controlId}` | `Qualys TotalCloud (CloudView)` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `qualys_totalcloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AWS Auto Scaling Group | `qualys_totalcloud_aws_auto_scaling_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS EBS Volume | `qualys_totalcloud_aws_ebs` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| AWS EC2 Instance | `qualys_totalcloud_aws_ec2_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS EKS Cluster | `qualys_totalcloud_aws_eks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS EKS Fargate Profile | `qualys_totalcloud_aws_eks_fargate_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS EKS Node Group | `qualys_totalcloud_aws_eks_nodegroup` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AWS IAM User | `qualys_totalcloud_aws_iam_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS Internet Gateway | `qualys_totalcloud_aws_internet_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Lambda Function | `qualys_totalcloud_aws_lambda` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS Load Balancer | `qualys_totalcloud_aws_load_balancer` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Network ACL | `qualys_totalcloud_aws_network_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS RDS Instance | `qualys_totalcloud_aws_rds` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Route Table | `qualys_totalcloud_aws_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS S3 Bucket | `qualys_totalcloud_aws_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Security Group | `qualys_totalcloud_aws_vpc_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Subnet | `qualys_totalcloud_aws_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC | `qualys_totalcloud_aws_vpc` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Azure Function App | `qualys_totalcloud_azure_function_app` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| Azure Network Security Group | `qualys_totalcloud_azure_network_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Azure Resource Group | `qualys_totalcloud_azure_resource_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Azure SQL Database | `qualys_totalcloud_azure_sql_server_database` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Azure SQL Server | `qualys_totalcloud_azure_sql_server` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Azure Virtual Machine | `qualys_totalcloud_azure_virtual_machine` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Azure Virtual Network | `qualys_totalcloud_azure_virtual_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Azure Web App | `qualys_totalcloud_azure_web_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Cloud Asset | `qualys_totalcloud_cloud_asset` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Connector | `qualys_totalcloud_connector` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Control | `qualys_totalcloud_control` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Finding | `qualys_totalcloud_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| GCP Cloud Function | `qualys_totalcloud_gcp_cloud_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| GCP Compute Firewall | `qualys_totalcloud_gcp_firewall_rules` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| GCP Compute Instance | `qualys_totalcloud_gcp_vm_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| GCP Compute Network | `qualys_totalcloud_gcp_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| GCP Compute Subnetwork | `qualys_totalcloud_gcp_subnetwork` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| OCI Block Volume | `qualys_totalcloud_oci_block_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| OCI Compute Instance | `qualys_totalcloud_oci_compute_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| OCI Database System | `qualys_totalcloud_oci_db_system` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| OCI Function | `qualys_totalcloud_oci_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| OCI Identity User | `qualys_totalcloud_oci_identity_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| OCI Load Balancer | `qualys_totalcloud_oci_load_balancer` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| OCI Network Security Group | `qualys_totalcloud_oci_network_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| OCI Object Storage Bucket | `qualys_totalcloud_oci_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| OCI Security List | `qualys_totalcloud_oci_security_list` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| OCI Subnet | `qualys_totalcloud_oci_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| OCI Virtual Cloud Network | `qualys_totalcloud_oci_vcn` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Policy | `qualys_totalcloud_policy` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `qualys_totalcloud_account` | **HAS** | `qualys_totalcloud_connector` |
| `qualys_totalcloud_cloud_asset` | **HAS** | `qualys_totalcloud_finding` |
| `qualys_totalcloud_connector` | **HAS** | `qualys_totalcloud_cloud_asset` |
| `qualys_totalcloud_control` | **IDENTIFIED** | `qualys_totalcloud_finding` |
| `qualys_totalcloud_policy` | **HAS** | `qualys_totalcloud_control` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_ebs_volume` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_s3_bucket` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_rds_instance` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_iam_user` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_lambda_function` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_vpc` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_subnet` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_internet_gateway` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_network_acl` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_route_table` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_security_group` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_lb` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_autoscaling_group` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_eks_cluster` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_eks_nodegroup` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `aws_eks_fargate_profile` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `azure_vnet` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `azure_security_group` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `azure_resource_group` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `azure_sql_database` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `azure_web_app` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `azure_function_app` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `google_compute_network` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `google_compute_subnetwork` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `google_compute_firewall` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `google_cloud_function` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_objectstorage_bucket` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_virtual_cloud_network` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_subnet` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_security_list` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_network_security_group` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_block_volume` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_user` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_load_balancer` | FORWARD |
| `qualys_totalcloud_cloud_asset` | **IS** | `oci_functions_function` | FORWARD |
| `qualys_totalcloud_connector` | **IS** | `aws_account` | FORWARD |
| `qualys_totalcloud_connector` | **IS** | `azure_subscription` | FORWARD |
| `qualys_totalcloud_connector` | **IS** | `google_cloud_project` | FORWARD |
| `qualys_totalcloud_connector` | **IS** | `oci_compartment` | FORWARD |
| `qualys_totalcloud_policy` | **EVALUATES** | `qualys_totalcloud_connector` | FORWARD |

### Qualys Totalcloud Account

`qualys_totalcloud_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Cloud Asset

`qualys_totalcloud_cloud_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessKeyAge` \*

 | `number` **|** `null` | IAM\_USER-only: age in days of the oldest access key. |  |
| 

`accountAlias` \*

 | `string` **|** `null` | Human-friendly account alias when available. |  |
| 

`arn` \*

 | `string` **|** `null` | AWS ARN of the resource when applicable. |  |
| 

`assetState` \*

 | `string` **|** `null` | Runtime state of the asset (e.g. running, stopped, available). |  |
| 

`assetStatus` \*

 | `string` **|** `null` | Runtime status code reported by the provider. |  |
| 

`availabilityDomain` \*

 | `string` **|** `null` | OCI-only: availability domain. |  |
| 

`bucketName` \*

 | `string` **|** `null` | S3 bucket name (BUCKET assets). |  |
| 

`cloudAccountId` \*

 | `string` | AWS account ID / Azure subscription / GCP project / OCI tenancy that owns the asset. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`compartmentId` \*

 | `string` **|** `null` | OCI-only: compartment OCID. |  |
| 

`controlsFailed` \*

 | `number` **|** `null` | Number of CSPM controls currently failing for this asset per Qualys last evaluation. |  |
| 

`dbInstanceIdentifier` \*

 | `string` **|** `null` | RDS-only: DB instance identifier. |  |
| 

`engine` \*

 | `string` **|** `null` | Database engine name. |  |
| 

`engineVersion` \*

 | `string` **|** `null` | Database engine version. |  |
| 

`externalIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: external IP. |  |
| 

`groupId` \*

 | `string` **|** `null` | VPC\_SECURITY\_GROUP-only: native group ID. |  |
| 

`hasAccessKey` \*

 | `boolean` **|** `null` | IAM\_USER-only: at least one access key exists. |  |
| 

`hasConsolePassword` \*

 | `boolean` **|** `null` | IAM\_USER-only: console password set. |  |
| 

`hasInboundFromAnywhere` \*

 | `boolean` **|** `null` | VPC\_SECURITY\_GROUP-only: true when an ingress rule allows 0.0.0.0/0 or ::/0. |  |
| 

`iamInstanceProfileArn` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: attached IAM instance profile ARN. |  |
| 

`imageId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: AMI ID. |  |
| 

`imageOffer` \*

 | `string` **|** `null` | Azure VM image offer. |  |
| 

`imagePublisher` \*

 | `string` **|** `null` | Azure VM image publisher. |  |
| 

`imageSku` \*

 | `string` **|** `null` | Azure VM image SKU. |  |
| 

`instanceId` \*

 | `string` **|** `null` | EC2\_INSTANCE-only: native instance ID. |  |
| 

`instanceType` \*

 | `string` **|** `null` | Compute instance type/size. |  |
| 

`isAuditingEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: auditing enabled. |  |
| 

`isBackupRetentionEnabled` \*

 | `boolean` **|** `null` | RDS-only: backup retention enabled. |  |
| 

`isDeletionProtectionEnabled` \*

 | `boolean` **|** `null` | RDS-only: deletion-protection enabled. |  |
| 

`isMfaEnabled` \*

 | `boolean` **|** `null` | IAM\_USER-only: MFA enabled. |  |
| 

`isMonitoringEnabled` \*

 | `boolean` **|** `null` | Detailed monitoring/diagnostics enabled. |  |
| 

`isMultiAz` \*

 | `boolean` **|** `null` | RDS-only: multi-AZ replication flag. |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the asset is publicly accessible. |  |
| 

`isPubliclyAccessible` \*

 | `boolean` **|** `null` | Whether the asset accepts public network traffic. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys may auto-remediate this asset. |  |
| 

`isStorageEncrypted` \*

 | `boolean` **|** `null` | Whether at-rest encryption is enabled. |  |
| 

`isTdeEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: Transparent Data Encryption enabled. |  |
| 

`isThreatDetectionEnabled` \*

 | `boolean` **|** `null` | Azure SQL-only: threat detection enabled. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | IAM\_USER-only: epoch ms of last console login. |  |
| 

`machineType` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: machine type URL. |  |
| 

`networkNames` \*

 | `array` **|** `null` | GCP VM\_INSTANCE-only: attached VPC network names. |  |
| 

`networkSecurityGroupId` \*

 | `string` **|** `null` | Azure NSG resource ID attached to the asset. |  |
| 

`osType` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: OS type. |  |
| 

`primaryPublicIPAddress` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: primary public IP. |  |
| 

`privateIpAddress` \*

 | `string` **|** `null` | GCP VM\_INSTANCE-only: primary internal IP. |  |
| 

`privateIpAddresses` \*

 | `array` **|** `null` | Private IP addresses. |  |
| 

`provisioningState` \*

 | `string` **|** `null` | Azure provisioning state. |  |
| 

`publicIpAddresses` \*

 | `array` **|** `null` | Public IP addresses. |  |
| 

`qualysConnectorId` \*

 | `string` | connectorId of the ingesting Qualys connector. Used as a stable cross-reference. |  |
| 

`qualysUuid` \*

 | `string` | Qualys-side UUID for the asset (globally unique within the tenant). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the asset lives in. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource identifier (instance ID, bucket name, full ARN, Azure resource ID, GCP resource ID, OCID). |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code, e.g. EC2\_INSTANCE, BUCKET, IAM\_USER. |  |
| 

`securityGroupIds` \*

 | `array` **|** `null` | Attached security group IDs. |  |
| 

`subnetId` \*

 | `string` **|** `null` | AWS subnet ID. |  |
| 

`tagPairs` \*

 | `array` **|** `null` | Cloud-native tags on the asset, formatted as `name=value` strings (or just `name` when the tag has no value). |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |
| 

`vmSize` \*

 | `string` **|** `null` | Azure VIRTUAL\_MACHINE-only: VM size SKU. |  |
| 

`vpcId` \*

 | `string` **|** `null` | AWS VPC ID. |  |
| 

`zone` \*

 | `string` **|** `null` | GCP-only: zone name. |  |

---

### Qualys Totalcloud Connector

`qualys_totalcloud_connector` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`awsAccountAlias` \*

 | `string` **|** `null` | AWS-only: human-readable account alias. |  |
| 

`awsAccountId` \*

 | `string` **|** `null` | AWS-only: the 12-digit AWS account ID. |  |
| 

`awsBaseAccountId` \*

 | `string` **|** `null` | AWS-only: base/payer account ID when present. |  |
| 

`awsExternalId` \*

 | `string` **|** `null` | AWS-only: external ID for the assume-role. |  |
| 

`awsRoleArn` \*

 | `string` **|** `null` | AWS-only: assumed-role ARN Qualys uses. |  |
| 

`azureApplicationId` \*

 | `string` **|** `null` | Azure-only: app registration GUID. |  |
| 

`azureSubscriptionId` \*

 | `string` **|** `null` | Azure-only: subscription GUID. |  |
| 

`azureTenantId` \*

 | `string` **|** `null` | Azure-only: tenant GUID. |  |
| 

`connectorId` \*

 | `string` | Qualys-side UUID for the connector. |  |
| 

`connectorState` \*

 | `string` **|** `null` | Connector sync state, e.g. SUCCESS, PENDING, REGIONS\_DISCOVERED, ERROR. |  |
| 

`gcpProjectId` \*

 | `string` **|** `null` | GCP-only: project ID. |  |
| 

`gcpServiceAccountEmail` \*

 | `string` **|** `null` | GCP-only: service account email Qualys impersonates. |  |
| 

`groupNames` \*

 | `array` **|** `null` | Names of Qualys connector groups this connector belongs to. |  |
| 

`isChinaRegion` \*

 | `boolean` **|** `null` | AWS-only: true for China-region connectors. |  |
| 

`isDisabled` \*

 | `boolean` **|** `null` | True when the connector is paused/disabled. |  |
| 

`isGovCloud` \*

 | `boolean` **|** `null` | AWS-only: true for GovCloud-scoped connectors. |  |
| 

`isPortalConnector` \*

 | `boolean` **|** `null` | True when managed by the new central Qualys Connectors app. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys auto-remediation is enabled for this connector. |  |
| 

`lastError` \*

 | `string` **|** `null` | Last error message reported by Qualys (null when healthy). |  |
| 

`lastSyncedOn` \*

 | `number` **|** `null` | Epoch ms of last successful sync. |  |
| 

`ociHomeRegion` \*

 | `string` **|** `null` | OCI-only: home region name. |  |
| 

`ociTenancyOcid` \*

 | `string` **|** `null` | OCI-only: tenancy OCID. |  |
| 

`ociUserOcid` \*

 | `string` **|** `null` | OCI-only: API user OCID. |  |
| 

`pollingFrequencyHours` \*

 | `number` **|** `null` | Polling interval in decimal hours (hours + minutes/60). |  |
| 

`provider` \*

 | `string` | Cloud provider: AWS, AZURE, GCP, or OCI. |  |
| 

`tagIds` \*

 | `array` **|** `null` | Ids of the Qualys asset tags associated with this connector, as strings. Matches `qualys_totalcloud_policy.tagIds` — a tag-scoped policy is evaluated against the connectors carrying its tags. |  |
| 

`tagNames` \*

 | `array` **|** `null` | Names of the Qualys asset tags associated with this connector. |  |
| 

`totalAssets` \*

 | `number` **|** `null` | Asset count Qualys observed at the last sync. |  |

---

### Qualys Totalcloud Control

`qualys_totalcloud_control` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cid` \*

 | `string` | Qualys control identifier. |  |
| 

`controlCriticality` \*

 | `string` **|** `null` | Qualys control criticality (LOW / MEDIUM / HIGH). Separate from the base-class `criticality` (numeric). |  |
| 

`controlType` \*

 | `string` **|** `null` | System Defined or User Defined. |  |
| 

`evaluationDescription` \*

 | `string` **|** `null` | Free-text description of what the control evaluates. |  |
| 

`executionType` \*

 | `string` **|** `null` | Run Time or Build Time. |  |
| 

`failMessage` \*

 | `string` **|** `null` | Message shown for FAIL. |  |
| 

`isCustomizable` \*

 | `boolean` **|** `null` | True when the control may be customized by the tenant. |  |
| 

`isQflowBased` \*

 | `boolean` **|** `null` | True for QFlow-based controls. |  |
| 

`isRemediationEnabled` \*

 | `boolean` **|** `null` | True when Qualys can auto-remediate failures. |  |
| 

`manualRemediation` \*

 | `string` **|** `null` | Manual remediation guidance. |  |
| 

`numericSeverity` \*

 | `number` **|** `null` | Numeric mapping of criticality (LOW=2, MEDIUM=5, HIGH=7, CRITICAL=10). |  |
| 

`passMessage` \*

 | `string` **|** `null` | Message shown for PASS. |  |
| 

`policyNames` \*

 | `array` **|** `null` | Framework/policy names this control belongs to. |  |
| 

`provider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`rationale` \*

 | `string` **|** `null` | Rationale text for the control. |  |
| 

`referenceText` \*

 | `string` **|** `null` | External reference URLs (raw string from Qualys references field). |  |
| 

`resourceType` \*

 | `string` **|** `null` | Provider resource-type the control evaluates. |  |
| 

`serviceType` \*

 | `string` **|** `null` | Provider service category, e.g. IAM, Azure SQL. |  |
| 

`specification` \*

 | `string` **|** `null` | Detailed specification text. |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |

---

### Qualys Totalcloud Finding

`qualys_totalcloud_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cloudAccountAlias` \*

 | `string` **|** `null` | Denormalized cloud account alias from the connector. AWS only — Qualys does not report an alias for the other providers. |  |
| 

`cloudAccountId` \*

 | `string` | Cloud account/subscription/project/tenancy ID. |  |
| 

`cloudProvider` \*

 | `string` | AWS, AZURE, GCP, or OCI. |  |
| 

`connectorGroupNames` \*

 | `array` **|** `null` | Denormalized Qualys connector group names. Use for "all findings in group X" queries without traversing to the connector. |  |
| 

`connectorName` \*

 | `string` **|** `null` | Denormalized name of the Qualys connector that produced this finding. Lets findings be scoped to a connector by name instead of by its UUID. |  |
| 

`connectorTagIds` \*

 | `array` **|** `null` | Denormalized Qualys asset tag ids from the connector that produced this finding, as strings. Matches `qualys_totalcloud_policy.tagIds`, so findings can be scoped to a tag-scoped CSPM policy by property filter instead of resolving the connector list outside the graph. Null when the connector carries no Qualys tags, or when the evaluation names a connector the connectors source did not ingest. |  |
| 

`connectorTagNames` \*

 | `array` **|** `null` | Denormalized Qualys asset tag names from the connector that produced this finding, as shown in the Qualys UI. Same tags as `connectorTagIds`, by name, for filters that should not depend on numeric tag ids. Null when the connector carries no Qualys tags, or when the evaluation names a connector the connectors source did not ingest. |  |
| 

`controlId` \*

 | `string` | Qualys control identifier (CID); numeric or alphanumeric. |  |
| 

`controlName` \*

 | `string` | Denormalized control name (joined from control metadata). |  |
| 

`evidences` \*

 | `array` **|** `null` | Qualys evidence entries supporting this finding, formatted as `settingName=actualValue` strings (or just one side when the other is missing). |  |
| 

`firstEvaluatedOn` \*

 | `number` **|** `null` | Epoch ms; first time this control was evaluated against the resource. |  |
| 

`fixedOn` \*

 | `number` **|** `null` | Epoch ms when the misconfiguration was last observed as fixed. |  |
| 

`isPassWithException` \*

 | `boolean` | True when result === PASS\_WITH\_EXCEPTION. |  |
| 

`lastEvaluatedOn` \*

 | `number` **|** `null` | Epoch ms; most recent evaluation. Null when Qualys reports neither evaluationDates.lastEvaluated nor evaluatedOn. |  |
| 

`policyName` \*

 | `string` **|** `null` | Denormalized primary framework/policy name (first of policyNames; e.g. CIS AWS Foundations). |  |
| 

`policyNames` \*

 | `array` **|** `null` | All framework/policy names the evaluated control belongs to. Use for "findings in policy X" membership queries; a control can belong to more than one policy. |  |
| 

`qualysConnectorId` \*

 | `string` | Qualys connectorId that produced this finding. |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region. |  |
| 

`reopenedOn` \*

 | `number` **|** `null` | Epoch ms when the finding most recently re-opened. |  |
| 

`resourceId` \*

 | `string` | Cloud-native resource ID the finding applies to. |  |
| 

`resourceType` \*

 | `string` | Qualys resource-type code. |  |
| 

`result` \*

 | `string` | PASS, FAIL, or PASS\_WITH\_EXCEPTION. |  |
| 

`service` \*

 | `string` **|** `null` | Qualys service code, e.g. IAM, S3, VPC. |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |

---

### Qualys Totalcloud Policy

`qualys_totalcloud_policy` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`controlCount` \*

 | `number` **|** `null` | Number of controls the policy contains. |  |
| 

`controlIds` \*

 | `array` **|** `null` | Qualys control identifiers (CIDs) that make up this policy, as strings. |  |
| 

`executionType` \*

 | `string` **|** `null` | RUN\_TIME or BUILD\_TIME. |  |
| 

`isConnectorScoped` \*

 | `boolean` | True when the policy is restricted to tagged connectors (`tagIds` is non-empty). False when it applies to every connector of its `provider`. |  |
| 

`isCustomerCreated` \*

 | `boolean` **|** `null` | True when the tenant authored or cloned this policy. |  |
| 

`policyId` \*

 | `string` | Qualys-side UUID of the policy. |  |
| 

`policyType` \*

 | `string` **|** `null` | SYSTEM\_DEFINED\_POLICY or USER\_DEFINED\_POLICY, as reported by Qualys. |  |
| 

`policyVersion` \*

 | `string` **|** `null` | Qualys policy version string, e.g. "1.0". |  |
| 

`provider` \*

 | `string` **|** `null` | Cloud provider the policy targets: AWS, AZURE, GCP, or OCI (Qualys `cloudType`). |  |
| 

`scope` \*

 | `string` **|** `null` | Visibility scope of the policy — GLOBAL (shipped by Qualys) or CUSTOMER (tenant-scoped). |  |
| 

`tagIds` \*

 | `array` **|** `null` | Qualys asset tag ids the policy is scoped to, as strings. Null when the policy is untagged, which in Qualys means it applies to every connector of its `provider`. Matches `qualys_totalcloud_connector.tagIds`. |  |
| 

`vendor` \*

 | `string` | Always "Qualys". |  |

---

## Release Notes

-   **2026-10-06** — Qualys TotalCloud findings now include connector tag names as a queryable property.
-   **2026-10-05** — The Qualys TotalCloud findings lookback window can now be configured to any number of days.
-   **2026-08-18** — Qualys TotalCloud cloud connectors are now linked to their associated cloud accounts, and control descriptions now include the full plain-text control library.
-   **2026-08-14** — Added ingestion of Qualys TotalCloud CSPM policy findings, linking findings to their controls and cloud connectors.

---

Source: /integrations/directory/rapid7

# Rapid7 Nexpose

Visualize Rapid7 Nexpose users, devices, scanners, findings, and vulnerabilities, map Rapid7 Nexpose users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to acquire and provide the following within JupiterOne:

1.  The **InsightVM Security Console Socket Address**: The publicly-accessible socket (host:port) of your InsightVM Security Console. e.g. `{hostname}:3780`.
2.  An **InsightVM Username and Password**: You will need to use an existing user or create a user that has the **Global Administrator Role**.

> **INFO**
> 
> For more information for InsightVM user management, see [Rapid7 Nexpose's documentation](https://docs.rapid7.com/insightvm/managing-users-and-authentication/#global-administrator).

### Configuration in JupiterOne

To install the Rapid7 Nexpose integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Rapid7. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Rapid7 Nexpose account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **InsightsVM Security Console Socket Address** which is publicly accessible.
    
-   The **InsightsVM Username** and **InsightsVM Password** of an admin user in the security console.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `insightvm_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Asset | `insightvm_asset` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Asset Finding | `insightvm_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Asset Vulnerability | `insightvm_finding` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Scan | `insightvm_scan` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Site | `insightvm_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| User | `insightvm_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `insightvm_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `insightvm_account` | **HAS** | `insightvm_user` |
| `insightvm_account` | **HAS** | `insightvm_asset` |
| `insightvm_account` | **HAS** | `insightvm_site` |
| `insightvm_asset` | **HAS** | `insightvm_finding` |
| `insightvm_asset` | **HAS** | `insightvm_vulnerability` |
| `insightvm_finding` | **IS** | `insightvm_vulnerability` |
| `insightvm_site` | **PERFORMED** | `insightvm_scan` |
| `insightvm_site` | **MONITORS** | `insightvm_asset` |
| `insightvm_site` | **HAS** | `insightvm_user` |
| `insightvm_user` | **OWNS** | `insightvm_asset` |

### Insightvm Asset

`insightvm_asset` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `lastScanDate` | `number` |  |  |
| `macAddress` | `string` |  |  |
| `numCriticalVulnerabilities` | `number` |  |  |
| `platform` | `string` |  |  |
| `riskScore` | `number` |  |  |
| `webLink` | `string` |  |  |

---

### Insightvm Finding

`insightvm_finding` inherits from [Finding](/data-model/schemas/Finding.md)

---

### Insightvm Finding

`insightvm_finding` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

---

### Insightvm User

`insightvm_user` inherits from [User](/data-model/schemas/User.md)

---

### Insightvm Vulnerability

`insightvm_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

---

## Release Notes

-   **2025-06-04** — Rapid7 InsightVM vulnerability findings now support the Vulnerability and Finding entity classes together, enabling cross-integration vulnerability queries, and CVE IDs are now normalized for unified querying.

---

Source: /integrations/directory/rapid7-insight

# Rapid7 Insight Platform

The Rapid7 Insight Platform is a cloud-based security solution offering integrated tools for vulnerability management, incident detection, and application security, enhanced by advanced analytics and automation for efficient threat identification and response.

## Installation

### Configuration in Rapid7 Insight Platform

1.  Go to the [Rapid7 Insight Platform](https://insight.rapid7.com/platform#/).
2.  Click in the gear icon at the top right corner and when the dropdown is opened click on API Keys.
3.  Inside API Key Management -> User Keys, click Generate New User Key. Select your Organization and create a name for your API key. `Please make sure the user that generates the API key is Platform Admin. This can be checked inside Settings -> User Management -> Click user -> Navigate to Role Management.`
4.  The created API key will be addded to the JupiterOne integration instance configuration. Your API key will be displayed only one time so make sure to copy it before closing the creation modal.

> **NOTE**
> 
> It is strongly recommended to enable the [Rapid7 Asset Correlation](https://docs.rapid7.com/insightvm/correlate-assets-with-insight-agent-uuids/) feature. This will allow JupiterOne to correlate assets across different products and services as part of the [Unified Device data model](/features/assets/device-unification.md).

### Configuration in JupiterOne

To install the Rapid7 Insight integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Rapid7 Insight Platform. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Organization ID**: this can be found in Settings -> Organization Settings.
    
-   **API Key**: the created API key should be added here.
    
-   **Insight Region**: the region to ingest Insight data from. This can be found in the top right cornet of your Rapid7 Insight Dashboard. You should be able to see something like: `United States - 2`. Valid region codes: us, us2, us3, eu, ca, au or ap.
    
-   **Product Codes to Ingest**: Here we will add the Insight product codes to ingest. Please select the products that you want to ingest. The unselected ones will be skipped in the integration steps.
    
-   The **Account Name** used to identify the Rapid7 Insight Platform account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Data Source Settigns**: here you will be able to customize the steps to be ingested. If desired, specific steps can be enabled/disabled from here.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `rapid7_insight_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Insight Service | `rapid7_insight_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| InsightAppSec App | `insightappsec_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| InsightAppSec Engine | `insightappsec_engine` | [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| InsightAppSec Engine Group | `insightappsec_engine_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| InsightAppSec Scan | `insightappsec_scan` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| InsightAppSec Scan Config | `insightappsec_scan_config` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| InsightAppSec Vulnerability | `insightappsec_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| InsightVM Device | `insightvm_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| InsightVM Host | `insightvm_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| InsightVM Site | `insightvm_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| InsightVM Vulnerability | `insightvm_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| InsightVM Vulnerability | `insightvm_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `insightappsec_app` | **HAS** | `insightappsec_vulnerability` |
| `insightappsec_engine_group` | **HAS** | `insightappsec_engine` |
| `insightappsec_engine_group` | **USES** | `insightappsec_scan_config` |
| `insightappsec_scan` | **PROTECTS** | `insightappsec_app` |
| `insightappsec_scan_config` | **PERFORMED** | `insightappsec_scan` |
| `insightvm_device` | **HAS** | `insightvm_vulnerability` |
| `insightvm_host` | **HAS** | `insightvm_vulnerability` |
| `insightvm_site` | **MONITORS** | `insightvm_device` |
| `insightvm_site` | **MONITORS** | `insightvm_host` |
| `rapid7_insight_account` | **HAS** | `rapid7_insight_service` |
| `rapid7_insight_service` | **HAS** | `insightvm_site` |
| `rapid7_insight_service` | **HAS** | `insightappsec_engine_group` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `insightvm_vulnerability` | **IS** | `cve` | FORWARD |

### Insightappsec Vulnerability

`insightappsec_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appId` | `string` |  |  |
| `blocking` | `null` |  |  |
| `id` | `string` |  |  |
| `insightUiUrl` | `string` |  |  |
| `lastDiscofirstDiscoveredvered` | `number` |  |  |
| `lastDiscovered` | `number` |  |  |
| `newlyDiscovered` | `boolean` |  |  |
| `numericSeverity` | `number` |  |  |
| `open` | `boolean` |  |  |
| `priority` | `string` |  |  |
| `production` | `boolean` |  |  |
| `public` | `boolean` |  |  |
| `rootCauseMethod` | `string` |  |  |
| `rootCauseParameter` | `string` |  |  |
| `rootCauseUrl` | `string` |  |  |
| `score` | `number` |  |  |
| `severity` | `string` |  |  |
| `status` | `string` |  |  |
| `validated` | `boolean` |  |  |
| `variances` | `array` of `string`s |  |  |
| `vector` | `string` |  |  |
| `vectorString` | `string` |  |  |
| `vulnerabilityScore` | `number` |  |  |

---

### Insightvm Device

`insightvm_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assessedForPolicies` | `boolean` |  |  |
| `assessedForVulnerabilities` | `boolean` |  |  |
| `criticalVulnerabilities` | `integer` |  |  |
| `exploits` | `integer` |  |  |
| `ip` | `string` |  |  |
| `lastAssessedForVulnerabilitiesOn` | `number` |  |  |
| `lastScanEndOn` | `number` |  |  |
| `lastScanStartOn` | `number` |  |  |
| `macAddress` | `string` |  |  |
| `malwareKits` | `integer` |  |  |
| `moderateVulnerabilities` | `integer` |  |  |
| `osArchitecture` | `string` |  |  |
| `osDescription` | `string` |  |  |
| `osFamily` | `string` |  |  |
| `osSystemName` | `string` |  |  |
| `osVendor` | `string` |  |  |
| `riskScore` | `integer` |  |  |
| `risksevereVulnerabilitiesScore` | `integer` |  |  |
| `totalVulnerabilities` | `string` |  |  |

---

### Insightvm Host

`insightvm_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assessedForPolicies` | `boolean` |  |  |
| `assessedForVulnerabilities` | `boolean` |  |  |
| `criticalVulnerabilities` | `integer` |  |  |
| `exploits` | `integer` |  |  |
| `ip` | `string` |  |  |
| `lastAssessedForVulnerabilitiesOn` | `number` |  |  |
| `lastScanEndOn` | `number` |  |  |
| `lastScanStartOn` | `number` |  |  |
| `macAddress` | `string` |  |  |
| `malwareKits` | `integer` |  |  |
| `moderateVulnerabilities` | `integer` |  |  |
| `osArchitecture` | `string` |  |  |
| `osDescription` | `string` |  |  |
| `osFamily` | `string` |  |  |
| `osSystemName` | `string` |  |  |
| `osVendor` | `string` |  |  |
| `physical` | `boolean` |  |  |
| `publicIpAddress` | `string` |  |  |
| `riskScore` | `integer` |  |  |
| `risksevereVulnerabilitiesScore` | `integer` |  |  |
| `totalVulnerabilities` | `string` |  |  |

---

### Insightvm Vulnerability

`insightvm_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

---

### Insightvm Vulnerability

`insightvm_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

---

## Release Notes

-   **2026-04-08** — Improved OS name and OS type accuracy on Rapid7 InsightVM host and device entities, using human-readable OS names for macOS and accurate OS type classification.
-   **2025-08-22** — Added additional properties to Rapid7 InsightVM asset vulnerability relationships, including solution details, port, protocol, first and last found timestamps, and remediation status.
-   **2025-06-05** — Added unified vulnerability ingestion for Rapid7 InsightVM, supporting both vulnerability and finding entity classes.

---

Source: /integrations/directory/reco

# Reco

Visualize changes to Reco Accounts, Users, Identity Users, Identity Accounts, Policies, Devices, Applications, and Alerts through queries and alerts.

## Installation

The Reco integration collects accounts, users, identities, devices, applications, policies, alerts, and AI agents from your Reco environment using the Reco API.

### Prerequisites

-   An active Reco account with Admin-level access.
-   Permission to manage API keys in the Reco portal.

### Creating an API key in Reco

1.  Log in to your Reco portal.
2.  Navigate to **Integrations**.
3.  Navigate to **API Access Keys**.
4.  Click **Add API Access Key** to generate a new key.
5.  Provide a descriptive name for the key (for example, `JupiterOne Integration`) and click **Add**.
6.  Copy the generated API key and store it securely.

> **NOTE**
> 
> You cannot view the full key again after navigating away from the page.

### Configuration in JupiterOne

To install the Reco integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Reco**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Account Name** — A label used to identify this integration instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName** toggle is enabled.
    
-   **Description** — An optional description to help distinguish this instance from others.
    
-   **Polling Interval** — How often JupiterOne should collect data from Reco. You may leave this as `DISABLED` and trigger the integration manually.
    
-   **API Key** — The API key generated in the Reco integrations tab (required).
    
-   **Reco Host URL** — The URL of your Reco instance (for example, `https://your-company.reco.ai`) (required).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Once your integration instance is configured, it will begin running on the polling interval you selected. Continue on to our [instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (1)

-   `PERM_AI_AGENTS_READ`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (5)

-   `https://<reco-host>/api/v1/asset-management`
-   `https://<reco-host>/api/v1/asset-management/query`
-   `https://<reco-host>/api/v1/external-api/ai-agents/list`
-   `https://<reco-host>/api/v1/policy-subsystem/alert-inbox/table`
-   `https://<reco-host>/api/v1/users`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://readme.reco.ai/reference](https://readme.reco.ai/reference)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (4)

| Step | Endpoints |
| --- | --- |
| Build Identity Account Has Applications Relationships | `https://<reco-host>/api/v1/asset-management/query` |
| Fetch Alerts | `https://<reco-host>/api/v1/policy-subsystem/alert-inbox/table` |
| Fetch Devices | `https://<reco-host>/api/v1/asset-management` |
| Fetch Identity Account | `https://<reco-host>/api/v1/asset-management/query` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account User | `reco_account_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Alert | `reco_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Application | `reco_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device | `reco_device` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Policy | `reco_policy` | [Policy](https://docs.jupiterone.io/data-model/schemas/Policy) |
| Reco Account | `reco_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Reco AI Agent | `reco_ai_agent` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Reco Identity Account | `reco_identity_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Reco Identity User | `reco_identity_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `reco_account` | **HAS** | `reco_account_user` |
| `reco_account` | **HAS** | `reco_ai_agent` |
| `reco_identity_account` | **HAS** | `reco_application` |
| `reco_identity_user` | **OWNS** | `reco_device` |
| `reco_identity_user` | **HAS** | `reco_identity_account` |
| `reco_policy` | **TRIGGERS** | `reco_alert` |

### Reco Account

`reco_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Reco Account User

`reco_account_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isSingleSignOn` | `boolean` |  |  |
| `lastLoggedInOn` | `number` |  |  |
| `roles` | `array` of `string`s |  |  |
| `ssoAppIds` | `array` of `string`s |  |  |

---

### Reco Ai Agent

`reco_ai_agent` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountsCount` | `number` | Number of accounts touched by the agent. |  |
| `agentType` | `string` | Reco-assigned agent kind (open string — e.g. OAuth app, automation, copilot). |  |
| `aiModel` | `string` | Underlying AI model the agent uses (e.g. gpt-4). The AIASM-33 `nhiAi` enricher may use this as an additional platform signal. |  |
| `appDisplayName` | `string` | Human-readable name of the AI agent application. |  |
| `appId` | `string` | Reco identifier for the AI agent. Mirrored on `clientId` to maximise the AIASM-33 enricher match surface. |  |
| `authorization` | `string` | Authorisation mechanism for the agent (open string — e.g. oauth, api\_key, service\_account). |  |
| `clientId` | `string` | Reco identifier for the AI agent (alias of `appId`). |  |
| `connections` | `number` | Number of other resources / SaaS apps the agent is connected to. |  |
| `instance` | `string` | Identifier of the connected SaaS instance the AI agent runs in (e.g. M365 tenant, Slack workspace). |  |
| `owner` | `string` | Identifier of the human owner Reco has associated with the agent (often an email address). |  |
| `risk` | `number` | Reco's risk score for the agent. |  |
| `tools` | `array` of `string`s | Tools and APIs the agent has access to. |  |
| `visibility` | `string` | Whether the agent is internal- or external-facing (open string). |  |

---

### Reco Alert

`reco_alert` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `extractionSource` | `string` |  |  |
| `instanceId` | `string` |  |  |
| `lastExtractedOn` | `number` |  |  |
| `lastScannedOn` | `number` |  |  |
| `tenantId` | `string` |  |  |
| `totalComments` | `number` |  |  |

---

### Reco Application

`reco_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `appCreatedAt` | `number` |  |  |
| `appGroups` | `array` of `string`s |  |  |
| `applicationInstances` | `array` of `string`s |  |  |
| `applicationName` | `string` |  |  |
| `appOwner` | `array` of `string`s |  |  |
| `authorizationStatus` | `string` |  |  |
| `authTypes` | `array` of `string`s |  |  |
| `bkBreachIndex` | `number` |  |  |
| `bkBreachIndexLastUpdatedOn` | `number` |  |  |
| `bkCyberRating` | `number` |  |  |
| `bkCyberRatingLastUpdatedOn` | `number` |  |  |
| `bkGradeLetter` | `string` |  |  |
| `bkRansomwareIndex` | `number` |  |  |
| `bkRansomwareIndexLastUpdatedAt` | `number` |  |  |
| `category` | `string` |  |  |
| `companySize` | `string` |  |  |
| `firstUsedOn` | `number` |  |  |
| `isShadow` | `boolean` |  |  |
| `isSsoEnabled` | `boolean` |  |  |
| `lastThirtyDaysScore` | `number` |  |  |
| `lastUsedOn` | `number` |  |  |
| `logo` | `string` |  |  |
| `numberOfUsers` | `number` |  |  |
| `overrodeUsage` | `string` |  |  |
| `securityScore` | `number` |  |  |
| `securityScoreLetter` | `string` |  |  |
| `securityScoreUrl` | `string` |  |  |
| `tenantId` | `string` |  |  |
| `typeUsage` | `string` |  |  |
| `unusedApp` | `boolean` |  |  |
| `usesAI` | `boolean` |  |  |
| `vendor` | `string` |  |  |
| `website` | `string` |  |  |

---

### Reco Device

`reco_device` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| `hasIdentity` | `boolean` |  |  |
| `instanceId` | `string` |  |  |
| `isRegistered` | `boolean` |  |  |
| `lastApiMessageId` | `string` |  |  |
| `managementStatus` | `string` |  |  |

---

### Reco Identity Account

`reco_identity_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountType` | `string` |  |  |
| `adminLabel` | `string` |  |  |
| `adminLabelUpdatedAt` | `number` |  |  |
| `alerts30Days` | `number` |  |  |
| `alertsCount` | `number` |  |  |
| `deactivatedOn` | `number` |  |  |
| `domainType` | `string` |  |  |
| `email` | `string` |  |  |
| `hasMfa` | `boolean` |  |  |
| `instanceId` | `string` |  |  |
| `isActive` | `boolean` |  |  |
| `isAdmin` | `boolean` |  |  |
| `isGuest` | `boolean` |  |  |
| `isInternal` | `boolean` |  |  |
| `isPrivileged` | `boolean` |  |  |
| `isServiceAccount` | `boolean` |  |  |
| `isStandard` | `boolean` |  |  |
| `lastLoggedInOn` | `number` |  |  |
| `lastSeenOn` | `number` |  |  |
| `location` | `string` |  |  |
| `locationAnalysis` | `array` of `string`s |  |  |
| `numGroups` | `number` |  |  |
| `permissions` | `array` of `string`s |  |  |
| `permissionSets` | `array` of `string`s |  |  |
| `photo` | `string` |  |  |
| `relatedEmails` | `array` of `string`s |  |  |
| `roles` | `array` of `string`s |  |  |
| `tenantId` | `string` |  |  |
| `userTypeDisplay` | `string` |  |  |
| `workspaceId` | `string` |  |  |

---

### Reco Identity User

`reco_identity_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alertsCount` | `number` |  |  |
| `appInstanceIds` | `array` of `string`s |  |  |
| `departments` | `array` of `string`s |  |  |
| `hasAccess` | `boolean` |  |  |
| `isFormerUser` | `boolean` |  |  |
| `jobTitles` | `array` of `string`s |  |  |
| `labelNames` | `array` of `string`s |  |  |
| `lastLoginOn` | `number` |  |  |
| `lastSeenOn` | `number` |  |  |
| `relatedAccountCount` | `number` |  |  |

---

### Reco Policy

`reco_policy` inherits from [Policy](/data-model/schemas/Policy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `openAlerts` | `number` |  |  |
| `policyType` | `string` |  |  |
| `riskLevel` | `string` |  |  |
| `sources` | `array` of `string`s |  |  |
| `status` | `string` |  |  |
| `tags` | `array` of `string`s |  |  |
| `totalAlerts` | `number` |  |  |

---

## Release Notes

-   **2025-06-11** — Added Reco identity user and identity account entity ingestion, with relationships linking users to accounts and applications, and devices to their owning users.
-   **2025-06-10** — Added initial Reco integration, ingesting users, policies, and alert entities with policy-to-alert trigger relationships.

---

Source: /integrations/directory/red-hat-quay

# Red Hat Quay

Visualize Red Hat Quay accounts and repositories, map Red Hat Quay users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an OAuth Access key on Red Hat Quay. See [their documentation](https://access.redhat.com/documentation/en-us/red_hat_quay/3/html/red_hat_quay_api_guide/using_the_red_hat_quay_api#create_oauth_access_token) for more information.

### Configuration in JupiterOne

To install the Red Hat Quay integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Red Hat Quay. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Red Hat Quay account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Red Hat Quay **Hostname** and **Access Token** generated for use in JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `red_hat_quay_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Organization | `red_hat_quay_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| OrganizationMember | `red_hat_quay_organization_member` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Repository | `red_hat_quay_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Team | `red_hat_quay_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `red_hat_quay_account` | **HAS** | `red_hat_quay_organization` |
| `red_hat_quay_organization` | **HAS** | `red_hat_quay_organization_member` |
| `red_hat_quay_organization` | **HAS** | `red_hat_quay_team` |
| `red_hat_quay_organization` | **HAS** | `red_hat_quay_repository` |
| `red_hat_quay_team` | **HAS** | `red_hat_quay_organization_member` |

---

Source: /integrations/directory/rippling

# Rippling

Visualize Rippling users, workers, and organizational structure, map workers to employees and managers, and monitor changes through queries and alerts.

## Installation

### Configuration In Rippling

For this integration, you will need to [generate an API Token in Rippling](https://developer.rippling.com/documentation/rest-api).

1.  Log in to your Rippling account.
2.  Navigate to Company Settings > Developer.
3.  Select the **API Tokens** tab.
4.  Create an API Token.
5.  Copy and securely save the generated API Token for use in JupiterOne.

> **INFO**
> 
> As described in the Rippling documentation, API tokens use the permissions of the owner, so they should be treated as if they were a password. The user must have sufficient permissions to create an API token and access user and worker data. API tokens expire after 30 days of inactivity, or when the user is no longer active with the company. You will need to regenerate the token if it expires.

### Configuration in JupiterOne

To complete the Rippling integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Rippling. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Rippling account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The Rippling **API Token** generated for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Organization | `rippling_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| User | `rippling_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Worker | `rippling_worker` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `rippling_organization` | **HAS** | `rippling_user` |
| `rippling_organization` | **HAS** | `rippling_worker` |
| `rippling_user` | **IS** | `rippling_worker` |
| `rippling_worker` | **MANAGES** | `rippling_worker` |

### Rippling Organization

`rippling_organization` inherits from [Account](/data-model/schemas/Account.md)

---

### Rippling User

`rippling_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `locale` | `string` |  |  |
| `number` | `string` |  |  |
| `preferredFamilyName` | `string` |  |  |
| `preferredGivenName` | `string` |  |  |
| `preferredLanguage` | `string` |  |  |
| `timezone` | `string` |  |  |

---

### Rippling Worker

`rippling_worker` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `country` | `string` |  |  |
| `departmentId` | `string` |  |  |
| `employmentTypeId` | `string` |  |  |
| `endedOn` | `number` |  |  |
| `isManager` | `boolean` |  |  |
| `legalEntityId` | `string` |  |  |
| `levelId` | `string` |  |  |
| `overtimeExemption` | `string` |  |  |
| `startedOn` | `number` |  |  |
| `status` | `string` |  | **Any of**:
-   `INIT`

-   `HIRED`

-   `ACCEPTED`

-   `ACTIVE`

-   `TERMINATED`

 |
| `teamsId` | `string` |  |  |
| `title` | `string` |  |  |
| `titleEffectiveOn` | `number` |  |  |

---

## Release Notes

-   **2025-10-23** — New Rippling integration: ingests users and workers with manager hierarchy relationships.

---

Source: /integrations/directory/riskrecon

# RiskRecon

Bring your RiskRecon third-party risk portfolio into JupiterOne. Track the cyber and privacy ratings of the vendors you monitor, review their open critical and high findings, and keep an inventory of RiskRecon portal users through queries and alerts.

## Installation

This integration connects to the **RiskRecon API** (`https://api.riskrecon.com/v1`, or `https://api.sandbox.riskrecon.com/v1` for the sandbox) and ingests the third parties (Targets Of Evaluation, or TOEs) in your RiskRecon portfolio with their ratings, the open findings of the latest analysis of each third party, and the users of your RiskRecon portal. It authenticates with a RiskRecon API bearer token and only reads data. The integration is managed by JupiterOne and runs in the JupiterOne cloud, so no collector is needed.

### Prerequisites

-   A **RiskRecon** subscription with API access and a portfolio of monitored third parties.
-   A RiskRecon API bearer token.
-   Access to **JupiterOne** with permission to configure integrations.

### Configuration in RiskRecon

Generate an API bearer token (a JWT) as described in [Generate a Bearer Token](https://developer.mastercard.com/riskrecon-api/tutorial/generate-oauth-bearer-tokens/). Copy the token and store it somewhere safe. Tokens can be valid for up to one year; when the token expires, the integration stops ingesting until you add a new token to the instance.

### Configuration in JupiterOne

To install the RiskRecon integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **RiskRecon**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the RiskRecon account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **API Token** fields and the **Findings** setting below.
    

#### Configuration fields

| Field | Required | Description |
| --- | --- | --- |
| **API Token** | Yes | The RiskRecon API bearer token. It is masked in JupiterOne and sent in the `Authorization: Bearer` header. |
| **Environment** | No | **Production** (default) or **Sandbox**. |
| **Finding Severities** | No | Which finding severities to ingest: **Critical**, **Critical and High** (default), **Critical, High and Medium**, or **All severities**. |

When you save the instance, JupiterOne checks the settings and reads one vendor from the RiskRecon API. An invalid or expired token fails the check.

Click **Create** once all values are provided to finalize the integration.

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default**, so a new instance ingests only the `riskrecon_account` entity until you enable the ones you want. To enable them, open the instance, turn on the data sources under **Data Sources**, and save. They are ingested on the next run.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Vendors** | Third parties (TOEs) in your RiskRecon portfolio, with their overall cyber rating (letter and numeric), privacy rating when RiskRecon reports one, the rating of each security domain, subscription level, scan frequency, your internal IDs and names, and seed hostnames. | `riskrecon_vendor` |
| **Findings** | Open findings from the latest analysis of each vendor, limited to the **Finding Severities** setting, with severity, priority, security domain and criteria, asset value, CVE IDs, affected host and IP address, first and last seen dates, and remediation guidance. Requires **Vendors**. | `riskrecon_finding` |
| **Users** | Users of your RiskRecon portal, with their name, email, status, scopes and last sign-in. | `riskrecon_user` |

Relationships are built only when the data source they need is enabled:

| Relationship | Requires |
| --- | --- |
| `riskrecon_account` **HAS** `riskrecon_vendor` | **Vendors** |
| `riskrecon_vendor` **HAS** `riskrecon_finding` | **Vendors** and **Findings** |
| `riskrecon_account` **HAS** `riskrecon_user` | **Users** |

#### Notes

-   **Findings volume.** The integration makes one paginated request per vendor and severity. Large portfolios with **All severities** selected can take noticeably longer to ingest; the default, **Critical and High**, keeps the volume bounded.
-   **Vendors without findings access are skipped.** If RiskRecon denies findings for a vendor (for example, because of its subscription level) or no longer has the vendor, the integration skips that vendor's findings and continues. If your token is denied findings for every vendor, the Findings data source fails so previously ingested findings are kept.
-   **Only open findings of the latest analysis are ingested.** Findings that RiskRecon no longer reports are removed from the graph on the next run.
-   **Vendor findings are not linked to your own assets.** RiskRecon findings describe your third parties' internet-facing systems, so `riskrecon_finding` entities connect to the `riskrecon_vendor` they belong to, not to hosts in your environment.
-   **Personal data.** User phone numbers returned by RiskRecon are not ingested.
-   **Every run is a full sync.** Vendors, findings and users that RiskRecon no longer reports are removed from the graph on the next run.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [RiskRecon API reference](https://developer.mastercard.com/riskrecon-api/documentation/api-reference/)
-   [Generate a Bearer Token](https://developer.mastercard.com/riskrecon-api/tutorial/generate-oauth-bearer-tokens/)
-   [RiskRecon API specification](https://static.developer.mastercard.com/content/riskrecon-api/swagger/riskrecon.yaml)

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (3)

-   `https://api.riskrecon.com/v1/findings_paginated/{toe_id}`
-   `https://api.riskrecon.com/v1/toes_paginated`
-   `https://api.riskrecon.com/v1/user_mgmt`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://developer.mastercard.com/riskrecon-api/documentation/api-reference/index.md](https://developer.mastercard.com/riskrecon-api/documentation/api-reference/index.md)
-   [https://developer.mastercard.com/riskrecon-api/tutorial/generate-oauth-bearer-tokens/](https://developer.mastercard.com/riskrecon-api/tutorial/generate-oauth-bearer-tokens/)
-   [https://static.developer.mastercard.com/content/riskrecon-api/swagger/riskrecon.yaml](https://static.developer.mastercard.com/content/riskrecon-api/swagger/riskrecon.yaml)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (1)

| Step | Endpoints |
| --- | --- |
| Fetch Findings | `https://api.riskrecon.com/v1/findings_paginated/{toe_id}` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `riskrecon_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Finding | `riskrecon_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| User | `riskrecon_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vendor | `riskrecon_vendor` | [Vendor](https://docs.jupiterone.io/data-model/schemas/Vendor) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `riskrecon_account` | **HAS** | `riskrecon_vendor` |
| `riskrecon_account` | **HAS** | `riskrecon_user` |
| `riskrecon_vendor` | **HAS** | `riskrecon_finding` |

### Riskrecon Account

`riskrecon_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`environment` \*

 | `string` | RiskRecon API environment: production or sandbox. |  |

---

### Riskrecon Finding

`riskrecon_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `analysisId` | `string` **|** `null` | Id of the analysis the finding belongs to. |  |
| `assetValue` | `string` **|** `null` | Value of the affected asset: high, medium, low, idle or key. |  |
| `cveIds` | `array` **|** `null` | CVE ids associated with the finding. |  |
| `domainName` | `string` **|** `null` | Domain name associated with the finding. |  |
| `findingDataDescription` | `string` **|** `null` | Description of the data observed for the finding. |  |
| `findingDataValue` | `string` **|** `null` | Data observed for the finding. |  |
| 
`findingId` \*

 | `string` | RiskRecon finding id. |  |
| `firstSeenOn` | `number` **|** `null` | When the finding was first seen. |  |
| `hostingProvider` | `string` **|** `null` | Hosting provider of the affected host. |  |
| `hostName` | `string` **|** `null` | Name of the affected host. |  |
| `howToFixIt` | `string` **|** `null` | RiskRecon remediation guidance. |  |
| `ipAddress` | `string` **|** `null` | IP address of the affected host. |  |
| `lastSeenOn` | `number` **|** `null` | When the finding was last seen. |  |
| `privacyCriteria` | `string` **|** `null` | Privacy criteria of the finding, when it matches the privacy risk dimension. |  |
| `securityCriteria` | `string` **|** `null` | Security criteria of the finding (e.g. patching\_app\_server). |  |
| `securityDomain` | `string` **|** `null` | Security domain of the finding (e.g. software\_patching). |  |
| `supportSite` | `string` **|** `null` | Support site referenced for the fix. |  |
| `vendorSeverity` | `string` **|** `null` | Severity as reported by RiskRecon: critical, high, medium or low. |  |
| `whoShouldFixIt` | `string` **|** `null` | Who RiskRecon recommends should fix it. |  |

---

### Riskrecon User

`riskrecon_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `eulaAcceptedOn` | `number` **|** `null` | When the user accepted the EULA. |  |
| `lastSignInOn` | `number` **|** `null` | When the user last signed in to the RiskRecon portal. |  |
| `primaryUserId` | `number` **|** `null` | Id of the primary user when this is a secondary account of the same person. |  |
| `scopeNames` | `array` **|** `null` | RiskRecon scopes granted to the user. |  |

---

### Riskrecon Vendor

`riskrecon_vendor` inherits from [Vendor](/data-model/schemas/Vendor.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `analysisId` | `string` **|** `null` | Id of the most recent RiskRecon analysis. |  |
| `cyberRating` | `string` **|** `null` | Overall cyber rating label of the latest analysis (A to F). |  |
| `cyberRatingNumeric` | `number` **|** `null` | Overall numeric cyber rating of the latest analysis (0 to 10). |  |
| `dunsNumbers` | `array` **|** `null` | DUNS numbers of the TOE, when known. |  |
| `frequency` | `string` **|** `null` | Scan frequency: one\_time or continuous. |  |
| `inherentRisks` | `array` **|** `null` | Inherent risk levels assigned to the TOE in the customer portfolio. |  |
| `internalIds` | `array` **|** `null` | Customer-defined identifiers for the TOE. |  |
| `internalNames` | `array` **|** `null` | Customer-defined names for the TOE. |  |
| `privacyRating` | `string` **|** `null` | Overall privacy rating label, for customers with a privacy license. |  |
| `privacyRatingNumeric` | `number` **|** `null` | Overall numeric privacy rating, for customers with a privacy license. |  |
| `privacySubscriptionLevel` | `string` **|** `null` | RiskRecon privacy subscription level for this TOE. |  |
| `riskRelationships` | `array` **|** `null` | Custom categories (risk relationships) the TOE is filed under in the customer portfolio. |  |
| `securityDomainNumericRatings` | `array` **|** `null` | Rated security domains with their numeric rating, formatted as `dimension.security_domain=rating` (e.g. `cyber.software_patching=7.2`). |  |
| `securityDomainRatings` | `array` **|** `null` | Rated security domains with their rating label, formatted as `dimension.security_domain=rating` (e.g. `cyber.software_patching=B`). |  |
| `seedHostnames` | `array` **|** `null` | Hostnames used to start the RiskRecon scan (not every hostname found). |  |
| `subscriptionLevel` | `string` **|** `null` | RiskRecon subscription level for this TOE. |  |
| `tickerSymbols` | `array` **|** `null` | Stock ticker symbols of the TOE, formatted as `EXCHANGE:SYMBOL` (or just `SYMBOL` when no exchange is given). |  |
| 
`toeId` \*

 | `string` | RiskRecon Target Of Evaluation (TOE) id (UUID). |  |
| `unratedSecurityDomains` | `array` **|** `null` | Security domains that are not rated for this TOE, formatted as `dimension.security_domain`. |  |

---

---

Source: /integrations/directory/rumble

# Rumble

Visualize runZero (previously called Rumble) organizations, users, and assets, map users to employees, discover vulnerable OS assets, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> For this integration, you can configure the runZero integration using either an Account API Key or a single Export Token. The Export Token has more limited read-only permissions which will limit the data that is collected in JupiterOne.

### Configuration in runZero

For this integration, you can configure the runZero integration using either an Account API Key or a single Export Token. The Export Token has more limited read-only permissions which will limit the data that is collected in JupiterOne.

### API Key method

This method is recommended for instances where there are multiple organizations that you wish to ingest data into JupiterOne. It also provides a larger set of ingested entities than solely using an Export Token. You must have a runZero Enterprise License to utilize this method.

To configure this integration via API key, follow the below instructions:

#### Account API Key Generation

1.  Navigate to the [runZero Console](https://console.runzero.com).
2.  In the navigation bar, go to `Account`.
3.  On the Account page under the Account API keys section, click **Generate API Key**.
4.  A new **Account API Key** will be created. Copy this key as it will be used in JupiterOne.

#### Export Token Generation

Next, you'll need to generate an export token for each organization whose assets, services, and wireless data you want to include in the JupiterOne graph. The integration will automatically collect these tokens if they are present. Organizations _without_ export tokens _will not_ have assets, services, or wireless data ingested.

1.  Navigate to the [runZero Console](https://console.runzero.com)
2.  In the navigation bar, go to `Organizations`
3.  Click on the organization in which you want to create an `Export Token`
4.  Press the **Generate Export Token** button.
5.  Repeat for all organizations whose data you want to ingest.

### Export Token method

This method is typically suggested if there is only a single organization for which you intend to populate data into JupiterOne.

If you wish to utilize an Export Token rather than use API credentials, ensure that you have admin access to the runZero organization and follow the below steps for obtaining your Export Token for use with JupiterOne.

**To generate the Export Token:**

1.  Navigate to the [runZero Console](https://console.runzero.com)
2.  In the navigation bar, go to `Organizations`
3.  Click on the organization in which you want to create an `Export Token`
4.  Press the **Generate Export Token** button.
5.  Copy your `Export Token` for use in JupiterOne

### Configuration in JupiterOne

To install the runZero integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select runZero. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the runZero account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Lastly, depending on your authentication preference, input either of the following credentials:
    
    -   For configuring the integration with an Account API Key then put the key in the runZero **Account API Key** field.
    -   For configuring the integration with an Export Token, provide the token in the **Export Token** field.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `rumble_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Asset | `rumble_asset` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Organization | `rumble_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Site | `rumble_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| User | `rumble_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `rumble_account` | **HAS** | `rumble_organization` |
| `rumble_account` | **HAS** | `rumble_user` |
| `rumble_account` | **HAS** | `rumble_site` |
| `rumble_organization` | **HAS** | `rumble_site` |
| `rumble_site` | **HAS** | `rumble_asset` |
| `rumble_user` | **ASSIGNED** | `rumble_organization` |

### Rumble Account

`rumble_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Rumble Asset

`rumble_asset` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `alive` | `boolean` |  |  |
| `createdAt` | `number` |  |  |
| `detectedBy` | `string` | **Examples**: icmp |  |
| `firstSeen` | `number` |  |  |
| `hardware` | `string` | **Examples**: Dell PowerEdge 2500 |  |
| `ipAddress` | `array` of `string`s |  | **Examples**: 192.158.1.38 |
| `ipAddresses` | `array` of `string`s |  | **Examples**: 192.158.1.38 |
| `lastAgentId` | `string` |  |  |
| `lastSeen` | `number` |  |  |
| `lastTaskId` | `string` |  |  |
| `macAddress` | `array` of `string`s |  | **Examples**: 11:22:33:44:55:66 |
| `newestMacAddress` | `string` |  |  |
| `newestMacVendor` | `string` | **Examples**: Intel Corporate |  |
| `orgName` | `string` |  |  |
| `osVendor` | `string` |  |  |
| `scanned` | `boolean` |  |  |
| `serviceCount` | `number` |  |  |
| `siteName` | `string` | **Examples**: Primary |  |
| `softwareCount` | `number` |  |  |
| `type` | `string` | **Examples**: Server |  |
| `updatedAt` | `number` |  |  |
| `vulnerabilityCount` | `number` |  |  |

---

### Rumble Organization

`rumble_organization` inherits from [Organization](/data-model/schemas/Organization.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetCount` \*

 | `number` |  |  |
| 

`clientId` \*

 | `string` |  | 

**Format**: `uuid`

  
 |
| `createdAt` | `number` |  |  |
| `deactivatedAt` | `number` |  |  |
| 

`demo` \*

 | `boolean` | Whether the organization is a demo org |  |
| `description` | `string` |  |  |
| `downloadTokenCreatedAt` | `number` |  |  |
| `expirationAssetsOffline` | `number` |  |  |
| `expirationAssetsStale` | `number` |  |  |
| `expirationScans` | `number` |  |  |
| `expirationWarningLastSent` | `number` |  |  |
| `exportTokenCounter` | `number` |  |  |
| `exportTokenCreatedAt` | `number` |  |  |
| `exportTokenLastUsedAt` | `number` |  |  |
| `exportTokenLastUsedBy` | `string` | **Examples**: 127.0.0.1 |  |
| 

`inactive` \*

 | `boolean` |  |  |
| 

`liveAssetCount` \*

 | `number` |  |  |
| 

`parentId` \*

 | `string` |  | 

**Format**: `uuid`

  
 |
| 

`project` \*

 | `boolean` |  |  |
| 

`recentAssetCount` \*

 | `number` |  |  |
| 

`serviceCount` \*

 | `number` |  |  |
| 

`serviceCountARP` \*

 | `number` |  |  |
| 

`serviceCountICMP` \*

 | `number` |  |  |
| 

`serviceCountTCP` \*

 | `number` |  |  |
| 

`serviceCountUDP` \*

 | `number` |  |  |
| 

`softwareCount` \*

 | `number` |  |  |
| `updatedAt` | `number` |  |  |
| 

`vulnerabilityCount` \*

 | `number` |  |  |

---

### Rumble Site

`rumble_site` inherits from [Site](/data-model/schemas/Site.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetAddressCount` | `number` |  |  |
| `assetAddressExtraCount` | `number` |  |  |
| `assetCount` | `number` |  |  |
| `clientId` | `string` |  |  |
| `createdAt` | `number` |  |  |
| `deactivatedAt` | `number` |  |  |
| `excludes` | `string` | **Examples**: "192.168.0.5" |  |
| `inactive` | `boolean` |  |  |
| `lastTaskAt` | `number` |  |  |
| `lastTaskBy` | `string` |  |  |
| `lastTaskDuration` | `number` |  |  |
| `lastTaskId` | `string` |  |  |
| `liveAssetCount` | `number` |  |  |
| `organizationId` | `string` |  |  |
| `recentAssetCount` | `number` |  |  |
| `scope` | `string` |  |  |
| `serviceCount` | `number` |  |  |
| `serviceCountARP` | `number` |  |  |
| `serviceCountICMP` | `number` |  |  |
| `serviceCountTCP` | `number` |  |  |
| `serviceCountUDP` | `number` |  |  |
| `softwareCount` | `number` |  |  |
| `updatedAt` | `number` |  |  |
| `vulnerabilityCount` | `number` |  |  |

---

### Rumble User

`rumble_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `actions` | `number` |  |  |
| 
`admin` \*

 | `boolean` | Derived by client\_admin or org\_default\_role properties from |  |
| `inviteTokenExpiration` | `number` |  |  |
| `lastActionAt` | `number` |  |  |
| `lastActivityAt` | `number` |  |  |
| `lastLoginAt` | `number` |  |  |
| `lastLoginIP` | `string` |  |  |
| `lastLoginUa` | `string` | **Examples**: curl/1.0 |  |
| `loginFailures` | `number` |  |  |
| `orgDefaultRole` | `string` |  |  |
| `resetTokenExpiration` | `number` |  |  |
| `ssoOnly` | `boolean` |  |  |

---

---

Source: /integrations/directory/sailpoint-iiq

# Sailpoint IdentityIQ

Visualize Sailpoint IdentityIQ accounts, users, applications, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need your SailPoint IdentityIQ instance hostname, and a service account username and password with read access to the SCIM v2 API to set up this integration.

### Configuration in SailPoint IdentityIQ

Before configuring this integration in JupiterOne, you need to create API credentials in SailPoint IdentityIQ:

**Required in SailPoint IdentityIQ:**

-   Your SailPoint IdentityIQ instance hostname
-   A service account username and password for API access
-   The service account must have read access to the SCIM v2 API endpoints

**Authentication:** This integration uses HTTP Basic authentication to connect to the SailPoint IdentityIQ SCIM v2 API.

**API Endpoints Used:** The integration accesses the following SCIM v2 endpoints:

-   `/identity/scim/v2/Users` - to retrieve user data
-   `/identity/scim/v2/Accounts` - to retrieve account data
-   `/identity/scim/v2/Applications` - to retrieve application data

**Permissions:** The service account needs read-only access to users, accounts, and applications through the SCIM API. We recommend creating a dedicated service account for JupiterOne rather than using an administrator's personal credentials.

### Configuration in JupiterOne

To install the Sailpoint IdentityIQ integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Sailpoint IdentityIQ. Click **New Instance** to begin configuring your integration, providing the following:

-   **Account Name** used to identify the Sailpoint IdentityIQ account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName** option is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Hostname** of your Sailpoint IdentityIQ organization.
    
-   **Username** used to authenticate with Sailpoint IdentityIQ.
    
-   **Password** associated with the username.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `sailpoint_iiq_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `sailpoint_iiq_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| User | `sailpoint_iiq_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sailpoint_iiq_account` | **HAS** | `sailpoint_iiq_application` |
| `sailpoint_iiq_account` | **HAS** | `sailpoint_iiq_user` |

### Sailpoint Iiq Account

`sailpoint_iiq_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `hasEntitlements` | `boolean` |  |  |
| `instance` | `string` |  |  |
| `lastRefresh` | `number` |  |  |
| `lastTargetAggregation` | `number` |  |  |
| `locked` | `boolean` |  |  |
| `manuallyCorrelated` | `boolean` |  |  |
| `nativeIdentity` | `string` |  |  |
| `uuid` | `string` |  |  |

---

### Sailpoint Iiq Application

`sailpoint_iiq_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `type` | `string` |  |  |

---

### Sailpoint Iiq User

`sailpoint_iiq_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `capabilities` | `array` of `string`s |  |  |
| `department` | `string` |  |  |
| `employeeId` | `string` |  |  |
| `isManager` | `boolean` |  |  |
| `jobTitle` | `string` |  |  |
| `location` | `string` |  |  |
| `region` | `string` |  |  |
| `riskScore` | `number` |  |  |
| `sailpoint_iiq_user` | `boolean` |  |  |
| `userType` | `string` |  |  |

---

---

Source: /integrations/directory/sailpoint-isc

# SailPoint Identity Security Cloud (IdentityNow)

Visualize SailPoint Identity Security Cloud identities, sources, accounts, roles, access profiles and entitlements in JupiterOne. Trace each person to every account they hold, find orphan accounts and privileged entitlements, and monitor changes through queries and alerts.

## Installation

### Prerequisites

-   A **SailPoint Identity Security Cloud** tenant. ISC was previously branded IdentityNow; the separate [SailPoint IdentityIQ](/integrations/directory/sailpoint-iiq.md) integration covers the on-premise IdentityIQ product instead.
-   A **Personal Access Token** (Client ID and Client Secret) created by a user whose user level covers the data you want to ingest.
-   Access to **JupiterOne** with permission to configure integrations.

### Create a Personal Access Token

The integration authenticates using **OAuth 2.0 (client credentials)**, exchanging a Personal Access Token for a bearer token against `https://{tenant}.api.identitynow.com/oauth/token`.

To create the token:

1.  Sign in to `https://{tenant}.identitynow.com`.
2.  Open the user menu and go to **Preferences → Personal Access Tokens**.
3.  Select **New Token** and give it a name that identifies JupiterOne.
4.  Copy the **Client ID** and **Client Secret**. The secret is shown only once.

The token inherits the authority of the user who created it, so create it as a user whose level covers the collections you intend to ingest.

The integration issues read-only requests.

> **NOTE**
> 
> ISC grants API authority by **user level** — `ORG_ADMIN`, `SOURCE_ADMIN`, `SOURCE_SUBADMIN`, `CERT_ADMIN`, `HELPDESK` and so on — rather than by granular scope, and the level required differs per endpoint. `ORG_ADMIN` covers everything this integration reads. A token created by a narrower user level still works: the collections it cannot read are skipped with a warning on the job, and the rest are ingested normally. See the [Authorization](/integrations/directory/sailpoint-isc.md?integration-docs=authorization) tab for the user levels, scopes and endpoints each step uses.

### Configure the integration in JupiterOne

To install the SailPoint Identity Security Cloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **SailPoint Identity Security Cloud (IdentityNow)**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the SailPoint Identity Security Cloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Personal Access Token** fields below.
    

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **API URL** | Yes | Your ISC API host — for example `https://acme.api.identitynow.com`. |
| **Client ID** | Yes | Client ID of the Personal Access Token. |
| **Client Secret** | Yes | Client Secret paired with the Client ID. Shown only once when the token is created. |

#### Optional settings

| Field | Required | Description |
| --- | --- | --- |
| **Additional Identity Attributes To Ingest** | No | Comma-separated list of extra identity attribute keys to add to each identity as properties — for example `businessUnit,costCenter`. Leave empty to ingest only `department`, `jobTitle`, `location` and `country`. |

Use the attribute's technical key as it appears in the identity's attributes in ISC (`businessUnit`), not its display name (`Business Unit`). Each key becomes a property of the same name on `sailpoint_isc_identity`. Keys that match a property the integration already sets are ignored.

Click **Create** once all values are provided to finalize the integration.

> **NOTE**
> 
> The **API URL** is the `api.` host, not the tenant UI URL. The tenant name alone (`acme`) and the UI host (`acme.identitynow.com`) are both accepted and converted to the API host for you, as are trailing slashes and a pasted `/v2025` suffix. The scheme is always set to `https`, since the token secret is sent in the request body.

#### Data sources

You can narrow what the integration collects from the instance's ingestion source settings.

| Ingestion source | Default | Data collected |
| --- | --- | --- |
| **Identities** | Enabled | ISC identities — the correlated representation of each person across every connected source — and their manager hierarchy. |
| **Sources** | Enabled | Connected systems aggregated by ISC, such as Active Directory or Workday, with connector, health and owner detail. |
| **Identity Profiles** | Enabled | Configuration that maps an authoritative source into identities, and the source each profile derives from. |
| **Governance Groups** | Enabled | Governance groups (workgroups) and their identity membership, used to assign shared ownership and approval duties. |
| **Access Profiles** | Enabled | Access profiles, which bundle entitlements drawn from a single source, and their source and owner. |
| **Roles** | Enabled | Business roles, the access profiles they bundle, their owners, and the identities assigned to them. |
| **Separation of Duties Policies** | Enabled | Separation-of-duties policies defining combinations of access that must not be held together. |
| **Certification Campaigns** | Enabled | Access certification campaigns and their completion progress. |
| **Entitlements** | Disabled | Fine-grained access grants on each connected source, such as Active Directory group memberships, including which are flagged privileged. |
| **Source Accounts** | Disabled | Accounts on each connected source and their correlation to identities. |
| **Account Entitlement Grants** | Disabled | Which entitlements each source account actually holds. |

The three disabled sources are the large ones. A sizeable ISC tenant holds over a million entitlements and several million accounts, so they are opt-in rather than on by default.

**Account Entitlement Grants** is the most expensive to enable: ISC exposes an account's entitlements only one account at a time, so it costs one API request per account. It requires both **Source Accounts** and **Entitlements** to be enabled, and it covers at most 500,000 accounts in a single run — if your tenant has more, the job records that the limit was reached.

**Entitlements** requires **Sources** to be enabled, because entitlements are collected source by source.

Relationships that span two of these sources are only created when both are enabled. Disabling **Identities**, for example, does not stop sources, roles or access profiles being collected — it removes the edges that connect them to identities.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [SailPoint API authentication](https://developer.sailpoint.com/docs/api/authentication/) — creating a Personal Access Token and the client credentials flow
-   [Identity Security Cloud V2025 API](https://developer.sailpoint.com/docs/api/v2025/) — the API version this integration reads
-   [Standard collection parameters](https://developer.sailpoint.com/docs/api/standard-collection-parameters/) — paging, filtering and sorting behaviour

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (7)

-   `CERT_ADMIN`
-   `HELPDESK`
-   `ORG_ADMIN`
-   `REPORT_ADMIN`
-   `ROLE_SUBADMIN`
-   `SOURCE_ADMIN`
-   `SOURCE_SUBADMIN`

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (10)

-   `idn:accounts:read`
-   `idn:campaign:read`
-   `idn:entitlement:read`
-   `idn:identity:read`
-   `idn:role-checked:read`
-   `idn:role-unchecked:read`
-   `idn:sod-policy:read`
-   `idn:sources:read`
-   `idn:workgroup:read`
-   `sp:tenant:read`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (14)

-   `GET /v2025/access-profiles`
-   `GET /v2025/accounts`
-   `GET /v2025/campaigns`
-   `GET /v2025/entitlements`
-   `GET /v2025/entitlements?account-id={id}`
-   `GET /v2025/identities`
-   `GET /v2025/identity-profiles`
-   `GET /v2025/roles`
-   `GET /v2025/roles/{id}/assigned-identities`
-   `GET /v2025/sod-policies`
-   `GET /v2025/sources`
-   `GET /v2025/tenant`
-   `GET /v2025/workgroups`
-   `GET /v2025/workgroups/{workgroupId}/members`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (14)

-   [https://developer.sailpoint.com/docs/api/authentication/](https://developer.sailpoint.com/docs/api/authentication/)
-   [https://developer.sailpoint.com/docs/api/v2025/get-active-campaigns](https://developer.sailpoint.com/docs/api/v2025/get-active-campaigns)
-   [https://developer.sailpoint.com/docs/api/v2025/get-role-assigned-identities](https://developer.sailpoint.com/docs/api/v2025/get-role-assigned-identities)
-   [https://developer.sailpoint.com/docs/api/v2025/get-tenant](https://developer.sailpoint.com/docs/api/v2025/get-tenant)
-   [https://developer.sailpoint.com/docs/api/v2025/list-access-profiles](https://developer.sailpoint.com/docs/api/v2025/list-access-profiles)
-   [https://developer.sailpoint.com/docs/api/v2025/list-accounts](https://developer.sailpoint.com/docs/api/v2025/list-accounts)
-   [https://developer.sailpoint.com/docs/api/v2025/list-entitlements](https://developer.sailpoint.com/docs/api/v2025/list-entitlements)
-   [https://developer.sailpoint.com/docs/api/v2025/list-identities](https://developer.sailpoint.com/docs/api/v2025/list-identities)
-   [https://developer.sailpoint.com/docs/api/v2025/list-identity-profiles](https://developer.sailpoint.com/docs/api/v2025/list-identity-profiles)
-   [https://developer.sailpoint.com/docs/api/v2025/list-roles](https://developer.sailpoint.com/docs/api/v2025/list-roles)
-   [https://developer.sailpoint.com/docs/api/v2025/list-sod-policies](https://developer.sailpoint.com/docs/api/v2025/list-sod-policies)
-   [https://developer.sailpoint.com/docs/api/v2025/list-sources](https://developer.sailpoint.com/docs/api/v2025/list-sources)
-   [https://developer.sailpoint.com/docs/api/v2025/list-workgroup-members](https://developer.sailpoint.com/docs/api/v2025/list-workgroup-members)
-   [https://developer.sailpoint.com/docs/api/v2025/list-workgroups](https://developer.sailpoint.com/docs/api/v2025/list-workgroups)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (9)

| Step | Roles | OAuth Scopes | Endpoints |
| --- | --- | --- | --- |
| Build Access Profile Entitlement Relationships | `ORG_ADMIN`, `ROLE_SUBADMIN`, `SOURCE_SUBADMIN` | \- | `GET /v2025/access-profiles` |
| Build Access Profile Relationships | `ORG_ADMIN`, `ROLE_SUBADMIN`, `SOURCE_SUBADMIN` | \- | `GET /v2025/access-profiles` |
| Build Account Entitlement Relationships | \- | `idn:entitlement:read` | `GET /v2025/entitlements?account-id={id}` |
| Build Governance Group Membership | `ORG_ADMIN` | `idn:workgroup:read` | `GET /v2025/workgroups/{workgroupId}/members` |
| Build Identity Profile Relationships | `ORG_ADMIN` | \- | `GET /v2025/identity-profiles` |
| Build Role Entitlement Relationships | \- | `idn:role-unchecked:read`, `idn:role-checked:read` | `GET /v2025/roles` |
| Build Role Relationships | \- | `idn:role-unchecked:read`, `idn:role-checked:read` | `GET /v2025/roles`, `GET /v2025/roles/{id}/assigned-identities` |
| Build Source Relationships | \- | `idn:sources:read` | `GET /v2025/sources` |
| Fetch Entitlements | \- | `idn:entitlement:read` | `GET /v2025/entitlements` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| AccessProfile | `sailpoint_isc_access_profile` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Account | `sailpoint_isc_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Campaign | `sailpoint_isc_campaign` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Entitlement | `sailpoint_isc_entitlement` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| GovernanceGroup | `sailpoint_isc_governance_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Identity | `sailpoint_isc_identity` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| IdentityProfile | `sailpoint_isc_identity_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Role | `sailpoint_isc_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| SodPolicy | `sailpoint_isc_sod_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Source | `sailpoint_isc_source` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| SourceAccount | `sailpoint_isc_source_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sailpoint_isc_access_profile` | **HAS** | `sailpoint_isc_entitlement` |
| `sailpoint_isc_account` | **HAS** | `sailpoint_isc_source` |
| `sailpoint_isc_account` | **HAS** | `sailpoint_isc_identity_profile` |
| `sailpoint_isc_account` | **HAS** | `sailpoint_isc_governance_group` |
| `sailpoint_isc_account` | **HAS** | `sailpoint_isc_sod_policy` |
| `sailpoint_isc_account` | **HAS** | `sailpoint_isc_campaign` |
| `sailpoint_isc_governance_group` | **HAS** | `sailpoint_isc_identity` |
| `sailpoint_isc_identity` | **MANAGES** | `sailpoint_isc_identity` |
| `sailpoint_isc_identity` | **OWNS** | `sailpoint_isc_source` |
| `sailpoint_isc_identity` | **OWNS** | `sailpoint_isc_access_profile` |
| `sailpoint_isc_identity` | **OWNS** | `sailpoint_isc_role` |
| `sailpoint_isc_identity` | **ASSIGNED** | `sailpoint_isc_role` |
| `sailpoint_isc_identity` | **OWNS** | `sailpoint_isc_entitlement` |
| `sailpoint_isc_identity` | **HAS** | `sailpoint_isc_source_account` |
| `sailpoint_isc_identity_profile` | **USES** | `sailpoint_isc_source` |
| `sailpoint_isc_role` | **HAS** | `sailpoint_isc_access_profile` |
| `sailpoint_isc_role` | **HAS** | `sailpoint_isc_entitlement` |
| `sailpoint_isc_source` | **HAS** | `sailpoint_isc_entitlement` |
| `sailpoint_isc_source` | **HAS** | `sailpoint_isc_access_profile` |
| `sailpoint_isc_source` | **HAS** | `sailpoint_isc_source_account` |
| `sailpoint_isc_source_account` | **ASSIGNED** | `sailpoint_isc_entitlement` |

### Sailpoint Isc Access Profile

`sailpoint_isc_access_profile` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`entitlementCount` \*

 | `number` **|** `null` | The number of entitlements bundled by the access profile. A count rather than a reference: the entitlements themselves are modelled as relationships, and this stays accurate even when the entitlements step is disabled. |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` | Whether the access profile is enabled. A disabled profile grants nothing even where it is assigned. |  |
| 

`isRequestable` \*

 | `boolean` **|** `null` | Whether the access profile can be requested through access request. |  |
| 

`ownerName` \*

 | `string` **|** `null` | The display name of the access profile owner. The owning identity is expressed by the OWNS relationship. |  |
| 

`segmentIds` \*

 | `array` **|** `null` | The IDs of the access segments this access profile is assigned to. |  |
| 

`sourceName` \*

 | `string` **|** `null` | The display name of the access profile source. |  |

---

### Sailpoint Isc Account

`sailpoint_isc_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiUrl` \*

 | `string` | The API base URL used to collect from this tenant. |  |
| 

`pod` \*

 | `string` **|** `null` | The SailPoint deployment pod hosting the tenant (e.g. 'stg01-useast1'). |  |
| 

`region` \*

 | `string` **|** `null` | The SailPoint deployment region hosting the tenant (e.g. 'us-east-1'). |  |
| 

`tenantId` \*

 | `string` **|** `null` | The unique identifier of the ISC tenant. |  |
| 

`tenantName` \*

 | `string` **|** `null` | The abbreviated tenant name, which is the tenant slug in the API hostname (e.g. 'acme' in acme.api.identitynow.com). |  |

---

### Sailpoint Isc Campaign

`sailpoint_isc_campaign` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`campaignStatus` \*

 | `string` **|** `null` | The campaign status: PENDING, STAGED, CANCELING, ACTIVATING, ACTIVE, COMPLETING, COMPLETED, ERROR, or ARCHIVED. |  |
| 

`campaignType` \*

 | `string` **|** `null` | The campaign type: MANAGER, SOURCE\_OWNER, SEARCH, ROLE\_COMPOSITION, or MACHINE\_ACCOUNT. |  |
| 

`completedCertifications` \*

 | `number` **|** `null` | The number of certifications in the campaign that reviewers have signed off. |  |
| 

`correlatedStatus` \*

 | `string` **|** `null` | Whether the campaign covers correlated or uncorrelated accounts. Only SOURCE\_OWNER campaigns can be UNCORRELATED. |  |
| 

`deadlineOn` \*

 | `number` **|** `null` | The completion deadline for the campaign. |  |
| 

`isAutoRevokeAllowed` \*

 | `boolean` **|** `null` | Whether access is revoked automatically when a reviewer fails to act before the deadline. |  |
| 

`isEmailNotificationEnabled` \*

 | `boolean` **|** `null` | Whether reviewers are emailed about the campaign. |  |
| 

`isRecommendationsEnabled` \*

 | `boolean` **|** `null` | Whether SailPoint AI-driven identity security recommendations are shown to reviewers. |  |
| 

`isSunsetCommentsRequired` \*

 | `boolean` **|** `null` | Whether reviewers must comment when they change a sunset date. |  |
| 

`mandatoryCommentRequirement` \*

 | `string` **|** `null` | Which review decisions require a comment (e.g. all decisions, revoke-only, or none). |  |
| 

`totalCertifications` \*

 | `number` **|** `null` | The total number of certifications in the campaign. |  |

---

### Sailpoint Isc Entitlement

`sailpoint_isc_entitlement` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`attribute` \*

 | `string` **|** `null` | The source schema attribute the entitlement is carried on (e.g. 'memberOf'). |  |
| 

`isCloudGoverned` \*

 | `boolean` **|** `null` | Whether the entitlement is governed by ISC rather than only by the source system. |  |
| 

`isPrivileged` \*

 | `boolean` **|** `null` | Whether ISC flags this entitlement as privileged. This is the primary signal for locating privileged access across all connected sources. |  |
| 

`isRequestable` \*

 | `boolean` **|** `null` | Whether the entitlement can be requested directly through access request. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The ISC identity ID of the entitlement owner. Retained alongside the OWNS relationship because that relationship is built on a later pass over persisted entities. |  |
| 

`ownerName` \*

 | `string` **|** `null` | The display name of the entitlement owner. The owning identity is expressed by the OWNS relationship. |  |
| 

`segmentIds` \*

 | `array` **|** `null` | The IDs of the access segments this entitlement is assigned to. Segments are not ingested as entities, so the ids stay queryable here. |  |
| 

`sourceName` \*

 | `string` **|** `null` | The display name of the source that owns the entitlement. |  |
| 

`sourceSchemaObjectType` \*

 | `string` **|** `null` | The object type of the entitlement in the source schema (e.g. 'group'). |  |
| 

`value` \*

 | `string` **|** `null` | The raw entitlement value on the source (e.g. an Active Directory group distinguished name). |  |

---

### Sailpoint Isc Governance Group

`sailpoint_isc_governance_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`connectionCount` \*

 | `number` **|** `null` | The number of objects (sources, roles, policies) that reference the group as an owner or approver. |  |
| 

`memberCount` \*

 | `number` **|** `null` | The number of identities that belong to the group. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The ISC identity ID of the governance group owner. |  |
| 

`ownerName` \*

 | `string` **|** `null` | The display name of the governance group owner. |  |

---

### Sailpoint Isc Identity

`sailpoint_isc_identity` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`country` \*

 | `string` **|** `null` | The identity's country, read from the tenant's `country` identity attribute when present. |  |
| 

`department` \*

 | `string` **|** `null` | The identity's department, read from the tenant's `department` identity attribute when present. |  |
| 

`identityStatus` \*

 | `string` **|** `null` | The identity's registration status in ISC: UNREGISTERED, REGISTERED, PENDING, WARNING, DISABLED, ACTIVE, DEACTIVATED, TERMINATED, ERROR, or LOCKED. |  |
| 

`isLifecycleStateManuallySet` \*

 | `boolean` **|** `null` | Whether the identity's lifecycle state was set manually rather than derived automatically. |  |
| 

`isManager` \*

 | `boolean` **|** `null` | Whether this identity is the manager of another identity. |  |
| 

`jobTitle` \*

 | `string` **|** `null` | The identity's job title, read from the tenant's `jobTitle` identity attribute when present. |  |
| 

`lastRefreshedOn` \*

 | `number` **|** `null` | When ISC last refreshed this identity from its authoritative source. |  |
| 

`lifecycleStateName` \*

 | `string` **|** `null` | The name of the identity's current lifecycle state (e.g. 'active', 'terminated'). Lifecycle states are tenant-defined. |  |
| 

`location` \*

 | `string` **|** `null` | The identity's location, read from the tenant's `location` identity attribute when present. |  |
| 

`managerId` \*

 | `string` **|** `null` | The ISC identity ID of this identity's manager. Retained alongside the MANAGES relationship because the relationship is built on a second pass over persisted entities. |  |
| 

`managerName` \*

 | `string` **|** `null` | The display name of this identity's manager. |  |
| 

`processingState` \*

 | `string` **|** `null` | The identity's processing state as reported by ISC: ERROR or OK. |  |

---

### Sailpoint Isc Identity Profile

`sailpoint_isc_identity_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authoritativeSourceName` \*

 | `string` **|** `null` | The display name of the authoritative source this profile derives identities from. |  |
| 

`hasTimeBasedAttribute` \*

 | `boolean` **|** `null` | Whether the profile has a time-based attribute, which forces periodic refreshes. |  |
| 

`identityCount` \*

 | `number` **|** `null` | The number of identities belonging to this profile. |  |
| 

`isIdentityRefreshRequired` \*

 | `boolean` **|** `null` | Whether a source change has left this profile needing an identity refresh. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The ISC identity ID of the identity profile owner. |  |
| 

`ownerName` \*

 | `string` **|** `null` | The display name of the identity profile owner. |  |
| 

`priority` \*

 | `number` **|** `null` | The evaluation priority of the profile. Lower values win when an account matches more than one profile. |  |

---

### Sailpoint Isc Role

`sailpoint_isc_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessProfileCount` \*

 | `number` **|** `null` | The number of access profiles bundled by the role. A count rather than a reference: the access profiles themselves are modelled as relationships. |  |
| 

`entitlementCount` \*

 | `number` **|** `null` | The number of entitlements granted directly by the role. A count rather than a reference: the entitlements themselves are modelled as relationships. |  |
| 

`isDimensional` \*

 | `boolean` **|** `null` | Whether the role is dimensional, meaning its grants vary by dimension rather than being fixed. |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` | Whether the role is enabled. A disabled role grants nothing even where it is assigned. |  |
| 

`isRequestable` \*

 | `boolean` **|** `null` | Whether the role can be requested through access request. |  |
| 

`membershipType` \*

 | `string` **|** `null` | How role membership is determined: 'STANDARD' (criteria-based) or 'IDENTITY\_LIST' (explicit list). |  |
| 

`ownerName` \*

 | `string` **|** `null` | The display name of the role owner. The owning identity is expressed by the OWNS relationship. |  |
| 

`privilegeLevel` \*

 | `string` **|** `null` | The privilege level assigned to the role, when the tenant classifies roles by privilege. |  |
| 

`segmentIds` \*

 | `array` **|** `null` | The IDs of the access segments this role is assigned to. |  |

---

### Sailpoint Isc Sod Policy

`sailpoint_isc_sod_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`compensatingControls` \*

 | `string` **|** `null` | Mitigating controls documented for identities that violate the policy. |  |
| 

`correctionAdvice` \*

 | `string` **|** `null` | Guidance shown to reviewers on how to remediate a violation of this policy. |  |
| 

`externalPolicyReference` \*

 | `string` **|** `null` | A reference to the corresponding policy in an external governance system. |  |
| 

`isEnforced` \*

 | `boolean` **|** `null` | Whether the policy is enforced. A policy in NOT\_ENFORCED state is evaluated but does not block access. |  |
| 

`isScheduled` \*

 | `boolean` **|** `null` | Whether the policy has a scheduled violation report configured. |  |
| 

`ownerId` \*

 | `string` **|** `null` | The ISC identity or governance group ID of the policy owner. |  |
| 

`ownerName` \*

 | `string` **|** `null` | The display name of the policy owner. |  |
| 

`ownerType` \*

 | `string` **|** `null` | The type of the policy owner: 'IDENTITY' or 'GOVERNANCE\_GROUP'. |  |
| 

`policyQuery` \*

 | `string` **|** `null` | The search query defining the policy, for query-based policies. |  |
| 

`policyTags` \*

 | `array` **|** `null` | Tags applied to the policy in ISC. Named `policyTags` because `tags` on the base entity carries JupiterOne tags. |  |
| 

`policyType` \*

 | `string` **|** `null` | How the policy expresses conflict: 'GENERAL' (search-query based) or 'CONFLICTING\_ACCESS\_BASED' (two access sets). |  |

---

### Sailpoint Isc Source

`sailpoint_isc_source` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`clusterId` \*

 | `string` **|** `null` | The identifier of the virtual appliance cluster that services the source. |  |
| 

`clusterName` \*

 | `string` **|** `null` | The name of the virtual appliance cluster that services the source. |  |
| 

`connectionType` \*

 | `string` **|** `null` | The connection type: 'direct' or 'file'. |  |
| 

`connector` \*

 | `string` **|** `null` | The connector script name used to reach the source. |  |
| 

`connectorId` \*

 | `string` **|** `null` | The identifier of the connector used by the source. |  |
| 

`connectorName` \*

 | `string` **|** `null` | The display name of the connector chosen at source creation. |  |
| 

`deleteThreshold` \*

 | `number` **|** `null` | The percentage of deleted accounts (0-100) above which ISC skips the delete phase of aggregation. |  |
| 

`features` \*

 | `array` **|** `null` | Optional capabilities supported by the source (e.g. 'AUTHENTICATE', 'PROVISIONING', 'PASSWORD', 'SEARCH'). |  |
| 

`healthCheckedOn` \*

 | `number` **|** `null` | When the source health check was last performed. |  |
| 

`healthStatus` \*

 | `string` **|** `null` | The detailed source health status (e.g. 'SOURCE\_STATE\_HEALTHY', 'SOURCE\_STATE\_ERROR\_VA'). |  |
| 

`isAuthoritative` \*

 | `boolean` **|** `null` | Whether the source is authoritative, meaning an identity profile derives identities from it. |  |
| 

`isCredentialProviderEnabled` \*

 | `boolean` **|** `null` | Whether a credential provider is enabled for the source. |  |
| 

`isHealthy` \*

 | `boolean` **|** `null` | Whether the source passed its most recent ISC health check. |  |
| 

`managementWorkgroupId` \*

 | `string` **|** `null` | The identifier of the governance group that manages the source. |  |
| 

`managementWorkgroupName` \*

 | `string` **|** `null` | The name of the governance group that manages the source. |  |
| 

`ownerName` \*

 | `string` **|** `null` | The display name of the source owner. The owning identity is expressed by the OWNS relationship. |  |
| 

`sourceCategory` \*

 | `string` **|** `null` | The source category as reported by ISC (e.g. 'CredentialProvider'). Named `sourceCategory` because `category` is not part of the Application class. |  |
| 

`sourceType` \*

 | `string` **|** `null` | The managed system type (e.g. 'Active Directory', 'Workday'). |  |

---

### Sailpoint Isc Source Account

`sailpoint_isc_source_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountUuid` \*

 | `string` **|** `null` | The account UUID as determined by the source account schema. |  |
| 

`cloudLifecycleState` \*

 | `string` **|** `null` | The lifecycle state of the correlated identity. |  |
| 

`connectionType` \*

 | `string` **|** `null` | The connection type of the source this account came from. |  |
| 

`hasEntitlements` \*

 | `boolean` **|** `null` | Whether the account holds any entitlements. |  |
| 

`identityId` \*

 | `string` **|** `null` | The ISC identity ID this account is correlated to, or null when uncorrelated. Retained alongside the IDENTITY\_HAS\_ACCOUNT relationship for the same reason as sourceId. |  |
| 

`identityName` \*

 | `string` **|** `null` | The display name of the correlated identity, or null when the account is uncorrelated. |  |
| 

`identityState` \*

 | `string` **|** `null` | The identity state of the correlated identity. |  |
| 

`isAuthoritative` \*

 | `boolean` **|** `null` | Whether the account comes from an authoritative source. |  |
| 

`isDisabled` \*

 | `boolean` **|** `null` | Whether the account is currently disabled on the source. |  |
| 

`isLocked` \*

 | `boolean` **|** `null` | Whether the account is currently locked on the source. |  |
| 

`isMachine` \*

 | `boolean` **|** `null` | Whether ISC classifies the account as a machine account rather than a human one. |  |
| 

`isManuallyCorrelated` \*

 | `boolean` **|** `null` | Whether the account was correlated to its identity by hand rather than by a correlation rule. |  |
| 

`isSystemAccount` \*

 | `boolean` **|** `null` | Whether this is an IdentityNow user account rather than an account on an external source system. |  |
| 

`isUncorrelated` \*

 | `boolean` **|** `null` | Whether the account could not be correlated to any identity. Uncorrelated accounts are a common orphan-account finding. |  |
| 

`nativeIdentity` \*

 | `string` | The unique account identifier assigned by the source system. |  |
| 

`origin` \*

 | `string` **|** `null` | How the account came to exist in ISC: 'AGGREGATED' (read from the source) or 'PROVISIONED' (created by ISC). |  |
| 

`sourceId` \*

 | `string` **|** `null` | The ID of the source this account belongs to. Retained alongside the SOURCE\_HAS\_ACCOUNT relationship because that relationship is built on a later pass over persisted entities. |  |
| 

`sourceName` \*

 | `string` **|** `null` | The display name of the source this account belongs to. |  |

---

---

Source: /integrations/directory/salesforce

# Salesforce

Visualize Salesforce users, roles, groups, policies, and permissions, map Salesforce users to employees, and monitor changes through queries and alerts.

## Installation

### Configuration in JupiterOne

To install the Salesforce integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Salesforce. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Salesforce account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to initialize the OAuth flow with Salesforce.

You are then redirected to Salesforce to log in and authorize J1 to access your Salesforce organization data based on the user identity you log in with.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Group | `salesforce_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| PermissionSet | `salesforce_permission_set` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| Profile | `salesforce_profile` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| User | `salesforce_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| UserRole | `salesforce_user_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `salesforce_group` | **ASSIGNED** | `salesforce_user_role` |
| `salesforce_group` | **HAS** | `salesforce_user` |
| `salesforce_group` | **HAS** | `salesforce_group` |
| `salesforce_profile` | **HAS** | `salesforce_permission_set` |
| `salesforce_user` | **ASSIGNED** | `salesforce_user_role` |
| `salesforce_user` | **HAS** | `salesforce_profile` |
| `salesforce_user` | **ASSIGNED** | `salesforce_permission_set` |
| `salesforce_user_role` | **CONTAINS** | `salesforce_user_role` |

### Salesforce User

`salesforce_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` | Please use `isActive` instead | **deprecated**: true |
| `createdBy` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `lastLoginDate` | `number` |  |  |
| `lastPasswordChangeDate` | `number` |  |  |
| `profileId` | `string` |  |  |
| `roleId` | `string` |  |  |
| `updatedBy` | `string` |  |  |
| `updatedOn` | `number` |  |  |
| `userEmail` | `string` |  |  |
| `userPermissionsAvantgoUser` | `boolean` |  |  |
| `userPermissionsCallCenterAutoLogin` | `boolean` |  |  |
| `userPermissionsInteractionUser` | `boolean` |  |  |
| `userPermissionsKnowledgeUser` | `boolean` |  |  |
| `userPermissionsMarketingUser` | `boolean` |  |  |
| `userPermissionsOfflineUser` | `boolean` |  |  |
| `userPermissionsSFContentUser` | `boolean` |  |  |
| `userPermissionsSupportUser` | `boolean` |  |  |
| `userType` | `string` |  |  |

---

---

Source: /integrations/directory/sbom

# SBOM

Gain visibility into your container images and the software packages they include. The SBOM integration scans images for software components and known vulnerabilities, enabling you to query, monitor, and alert on changes in your software supply chain.

## Installation

For this integration, you will need access to your container registry and a list of container images that you want to scan for SBOM (Software Bill of Materials) ingestion. If your registry is private, you will also need to provide authentication credentials.

### Configuration in JupiterOne

To install the SBOM integration in JupiterOne, navigate to the Integrations tab and select SBOM. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

-   The **Registry URL**, such as `ghcr.io` or `ghcr.io/jupiterone`, which specifies the location of your container images.
-   A list of **Images** to scan. Each image should be provided in the format `<image>:<tag>`. If no tag is provided, the integration will default to using the latest tag.

If your container registry is private, you must also provide the following credentials:

-   **Registry Username** – The username for accessing the container registry.
-   **Registry Password** – The corresponding password. This field is encrypted and stored securely.

Click **Create** once all required values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Container Image | `sbom_container_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Software Package | `sbom_software_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Vulnerability | `sbom_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Vulnerability | `sbom_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sbom_container_image` | **CONTAINS** | `sbom_software_package` |
| `sbom_software_package` | **USES** | `sbom_software_package` |
| `sbom_software_package` | **HAS** | `sbom_vulnerability` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `sbom_container_image` | **IS** | `image` | FORWARD |

### Sbom Container Image

`sbom_container_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`digest` \*

 | `string` |  |  |
| `imagePlatform` | `string` |  |  |
| 

`imageTag` \*

 | `string` |  |  |
| 

`imageType` \*

 | `string` |  |  |
| `repository` | `string` |  |  |
| `size` | `number` |  |  |
| `version` | `string` |  |  |

---

### Sbom Software Package

`sbom_software_package` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cpe` \*

 | `array` **|** `null` |  |  |
| 

`license` \*

 | `array` **|** `null` |  |  |
| 

`modulePackageManager` \*

 | `string` |  |  |
| `purl` | `string` |  |  |
| `repositoryType` | `string` |  |  |
| `size` | `number` |  |  |
| `type` | `string` |  |  |
| `version` | `string` |  |  |

---

### Sbom Vulnerability

`sbom_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fixAvailable` | `boolean` |  |  |
| `fixedInVersion` | `string` |  |  |
| `publishedOn` | `number` |  |  |

---

### Sbom Vulnerability

`sbom_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fixAvailable` | `boolean` |  |  |
| `fixedInVersion` | `string` |  |  |
| `publishedOn` | `number` |  |  |

---

## Release Notes

-   **2026-02-03** — Added Amazon ECR image scanning to the SBOM integration, ingesting ECR repositories and container images via AWS IAM role authentication.
-   **2025-07-25** — Added vulnerability scanning to the SBOM integration using Grype, ingesting software package vulnerabilities as finding and vulnerability entities.
-   **2025-07-23** — Added software package dependency relationships in the SBOM integration, linking packages that depend on other packages.
-   **2025-07-22** — Added Software Bill of Materials (SBOM) integration, ingesting container images and their software packages as queryable entities.

---

Source: /integrations/directory/sbom-ecr

# SBOM for AWS ECR

Gain visibility into the container images stored in your Amazon Elastic Container Registry (ECR) and the software packages they include. The SBOM for AWS ECR integration assumes an IAM role in your AWS account, discovers repositories by tag, and scans your most recent images for software components and known vulnerabilities, enabling you to query, monitor, and alert on changes in your software supply chain.

## Installation

For this integration, you will need an AWS account with one or more images stored in Amazon Elastic Container Registry (ECR), and an IAM role that your JupiterOne Collector can assume to read from your registry. The integration authenticates by assuming this role with an auto-generated **External ID**, discovers repositories by tag, and scans the most recent images in each matching repository for SBOM (Software Bill of Materials) ingestion.

> **NOTE**
> 
> SBOM for AWS ECR runs on a [JupiterOne Collector](/integrations/development/collector.md) — it does **not** run on JupiterOne-managed infrastructure. The Collector pulls and unpacks your image layers and scans them locally for packages and vulnerabilities, so it needs the compute, disk, and network reach to your registry. You must have a Collector enrolled before configuring this integration, and the Collector is the identity that assumes the IAM role described below.

### Set permissions in AWS

Create an IAM role in the AWS account that hosts your ECR registry, and configure its trust policy to allow **your Collector's AWS identity** to assume it, using the **External ID** that is auto-generated when you create the integration instance (see below).

Because this integration runs on a Collector, the role is assumed by the AWS identity the Collector process runs as — **not** by any JupiterOne-managed AWS account. Set the trust policy `Principal` to your Collector's identity:

-   If your Collector runs on **EC2**, use its instance-profile role ARN. When the Collector runs in the **same** AWS account as the ECR registry, you may trust the account root (`arn:aws:iam::<account-id>:root`) instead.
-   If your Collector runs elsewhere with configured AWS credentials, use the ARN of that principal.

Do **not** add the JupiterOne AWS account IDs from the managed AWS integration's CloudFormation template — those apply to the managed AWS integration, not to this Collector-run integration. Always keep the `sts:ExternalId` condition.

> **CAUTION**
> 
> On a [Kubernetes-based Collector](/integrations/development/collector/kubernetes.md), the integration runs in a **job pod** that the operator spawns — and that pod is the identity assuming your role. A job pod with **no AWS credentials** cannot sign the `sts:AssumeRole` call, and the job fails with a `Configuration failure`.
> 
> Running SBOM for AWS ECR on a Kubernetes Collector **requires** the operator chart `jupiterone-integration-operator` **1.4.0+** (operator **v0.4.0+**). Upgrade the chart before configuring the integration. The chart provisions a dedicated ServiceAccount for integration job pods and annotates it for [IRSA](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html), so only those pods receive the AWS identity; this requires an [IAM OIDC provider](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) on the cluster.
> 
> 1.  Create a **base role** whose trust policy federates that provider for the job ServiceAccount (`jupiterone-integration-job` in the runner's namespace):
>     
>     ```json
>     {
>       "Version": "2012-10-17",
>       "Statement": [
>         {
>           "Effect": "Allow",
>           "Principal": { "Federated": "arn:aws:iam::<account-id>:oidc-provider/oidc.eks.<region>.amazonaws.com/id/<oidc-id>" },
>           "Action": "sts:AssumeRoleWithWebIdentity",
>           "Condition": {
>             "StringEquals": {
>               "oidc.eks.<region>.amazonaws.com/id/<oidc-id>:sub": "system:serviceaccount:jupiterone:jupiterone-integration-job",
>               "oidc.eks.<region>.amazonaws.com/id/<oidc-id>:aud": "sts.amazonaws.com"
>             }
>           }
>         }
>       ]
>     }
>     ```
>     
> 2.  Give that base role permission to `sts:AssumeRole` the ECR role below, then enable and annotate the job ServiceAccount in the chart values:
>     
>     ```yaml
>     integration:
>       jobServiceAccount:
>         create: true
>         annotations:
>           eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<collector-base-role>
>     ```
>     
> 
> The chart creates the ServiceAccount and annotates it. The operator reconciles the `IntegrationInstance` and runs each integration's job pod under that ServiceAccount, so the pod picks up the IRSA annotation and its AWS identity. Set the ECR role's trust `Principal` to this **base role ARN**.
> 
> This base role lives in the AWS account where your EKS cluster runs. When the ECR registry is in that **same** account, the ECR role's trust `Principal` is simply this base role's ARN; when the registry is in a **different** account, the ECR role (created in the registry's account) trusts the base role's ARN cross-account. Either way the `Principal` is your collector's base role — **not** any JupiterOne-managed AWS account.

For example, when the Collector runs in the same account as the registry:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::<account-id>:root" },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": { "sts:ExternalId": "<auto-generated-external-id>" }
      }
    }
  ]
}
```

Attach a policy granting the following read-only Amazon ECR permissions:

-   `ecr:GetAuthorizationToken`
-   `ecr:DescribeRepositories`
-   `ecr:ListTagsForResource`
-   `ecr:DescribeImages`
-   `ecr:BatchCheckLayerAvailability`
-   `ecr:GetDownloadUrlForLayer`
-   `ecr:BatchGetImage`

`ecr:GetAuthorizationToken`, `ecr:BatchCheckLayerAvailability`, `ecr:GetDownloadUrlForLayer`, and `ecr:BatchGetImage` allow the integration to authenticate to the registry and pull image layers for scanning. `ecr:DescribeRepositories` and `ecr:ListTagsForResource` are used to discover repositories by tag, and `ecr:DescribeImages` to select the most recent images per repository.

### Configuration in JupiterOne

To install the SBOM for AWS ECR integration in JupiterOne, navigate to the **Integrations** tab and select **SBOM for AWS ECR**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **Registry** – The URL of your ECR registry, such as `<account-id>.dkr.ecr.<region>.amazonaws.com` for a private registry or `public.ecr.aws/<namespace>` for a public registry.
-   **Role ARN** – The ARN of the IAM role the Collector assumes to authenticate with AWS.
-   **External ID** – Auto-generated by JupiterOne. Use this value when configuring the trust policy of the IAM role. You may change it, but doing so is against Amazon's security recommendations.
-   **Region** – (Optional) The AWS region where the registry is located. Defaults to `us-east-1` and is **not** inferred from the Registry URL — if your registry is in any other region, set this explicitly or the integration will silently target `us-east-1` and fail to reach your repositories.

#### Data filters

-   **Tag** – Filter which repositories to ingest SBOMs from using AWS resource tags. Use the format `tag-key:tag-value` (for example, `environment:production`), or specify only the tag key to match any value (for example, `environment`). Only repositories carrying a matching tag are processed.
-   **Images to Scan** – The number of most recent images to scan per repository (`1`, `2`, or `3`). Defaults to `1`.

If your registry is served behind an internal or self-signed certificate, you can optionally provide a **Certificate Authority Certificate** (PEM format, full CA chain) under **TLS / Certificate Settings** to verify the TLS connection to the registry.

Click **Create** once all required values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Container Image | `sbom_container_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Software Package | `sbom_software_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Vulnerability | `sbom_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Vulnerability | `sbom_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sbom_container_image` | **CONTAINS** | `sbom_software_package` |
| `sbom_software_package` | **USES** | `sbom_software_package` |
| `sbom_software_package` | **HAS** | `sbom_vulnerability` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `sbom_container_image` | **IS** | `image` | FORWARD |

### Sbom Container Image

`sbom_container_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`digest` \*

 | `string` |  |  |
| `imagePlatform` | `string` |  |  |
| 

`imageTag` \*

 | `string` |  |  |
| 

`imageType` \*

 | `string` |  |  |
| `repository` | `string` |  |  |
| `size` | `number` |  |  |
| `version` | `string` |  |  |

---

### Sbom Software Package

`sbom_software_package` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cpe` \*

 | `array` **|** `null` |  |  |
| 

`license` \*

 | `array` **|** `null` |  |  |
| 

`modulePackageManager` \*

 | `string` |  |  |
| `purl` | `string` |  |  |
| `repositoryType` | `string` |  |  |
| `size` | `number` |  |  |
| `type` | `string` |  |  |
| `version` | `string` |  |  |

---

### Sbom Vulnerability

`sbom_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fixAvailable` | `boolean` |  |  |
| `fixedInVersion` | `string` |  |  |
| `publishedOn` | `number` |  |  |

---

### Sbom Vulnerability

`sbom_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `fixAvailable` | `boolean` |  |  |
| `fixedInVersion` | `string` |  |  |
| `publishedOn` | `number` |  |  |

---

---

Source: /integrations/directory/security-scorecard

# SecurityScorecard

Visualize SecurityScorecard portfolios, monitored vendor companies, and active security findings, and monitor changes through queries and alerts.

## Installation

To use this integration, you must have a SecurityScorecard account and an API token. SecurityScorecard recommends issuing the token to a **Bot (service account) user** so the credential is decoupled from any individual and does not expire when a person leaves the organization.

### Configuration in SecurityScorecard

Creating a Bot user and generating an API token requires administrator permissions in SecurityScorecard. If you do not have administrator access, ask an administrator to complete these steps for you.

1.  Log in to the [SecurityScorecard platform](https://platform.securityscorecard.io) and open **My Settings** from your profile avatar.
    
2.  In **Admin Settings**, open the **People Management** tab and click **Invite People**.
    
3.  Provide a name for the new user and mark the account as a **Bot**. Bot accounts do not expire, which prevents integration outages caused by token rotation on a personal user.
    
4.  Choose an access level for the bot. **Read Only** is sufficient for this integration. Click **Add User**.
    
5.  From the new bot user's actions, select **Create API token** and click **Confirm**.
    
6.  Copy the generated API token and store it securely. The token is only displayed once.
    

> **NOTE**
> 
> If you prefer not to create a bot user, an administrator can also retrieve a personal API key from **My Settings > API**. API tokens do not expire and are nearly as powerful as passwords — store them only in secret managers and never in source code or shared channels.

### Configuration in JupiterOne

To install the SecurityScorecard integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **SecurityScorecard**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the SecurityScorecard account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your SecurityScorecard **API Key** — the token generated in the previous section.
    
-   **Issue Types** — a comma-separated list of issue type slugs (for example, `cookie_missing_http_only,patching_cadence_high`) used to scope the findings the integration ingests. A maximum of 12 slugs is supported per instance. This value is required: the SecurityScorecard API returns an error when the `issue_types` filter is omitted. You can list available slugs via the SecurityScorecard [Issue Types metadata endpoint](https://securityscorecard.readme.io/reference/get_metadata-issue-types-1).
    
-   **Portfolio IDs** _(optional)_ — a comma-separated list of SecurityScorecard portfolio IDs to limit ingestion to specific portfolios. Leave empty to ingest all portfolios the API token can access.
    
-   **Issue Severity Threshold** _(optional)_ — minimum severity of findings to ingest (for example, `medium`). Findings below the threshold are skipped.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (5)

-   `https://api.securityscorecard.io/companies/{domain}/active-issues`
-   `https://api.securityscorecard.io/me`
-   `https://api.securityscorecard.io/metadata/issue-types`
-   `https://api.securityscorecard.io/portfolios`
-   `https://api.securityscorecard.io/portfolios/{id}/companies`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (5)

-   [https://securityscorecard.readme.io/reference/get\_companies-scorecard-identifier-active-issues](https://securityscorecard.readme.io/reference/get_companies-scorecard-identifier-active-issues)
-   [https://securityscorecard.readme.io/reference/get\_metadata-issue-types-1](https://securityscorecard.readme.io/reference/get_metadata-issue-types-1)
-   [https://securityscorecard.readme.io/reference/get\_portfolios](https://securityscorecard.readme.io/reference/get_portfolios)
-   [https://securityscorecard.readme.io/reference/get\_portfolios-portfolio-id-companies](https://securityscorecard.readme.io/reference/get_portfolios-portfolio-id-companies)
-   [https://support.securityscorecard.com/hc/en-us/articles/9738347291931-Create-API-tokens-for-the-SecurityScorecard-platform](https://support.securityscorecard.com/hc/en-us/articles/9738347291931-Create-API-tokens-for-the-SecurityScorecard-platform)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (3)

| Step | Endpoints |
| --- | --- |
| Fetch Companies | `https://api.securityscorecard.io/portfolios/{id}/companies` |
| Fetch Findings | `https://api.securityscorecard.io/companies/{domain}/active-issues`, `https://api.securityscorecard.io/metadata/issue-types` |
| Fetch Portfolios | `https://api.securityscorecard.io/portfolios` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `securityscorecard_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Company | `securityscorecard_company` | [Vendor](https://docs.jupiterone.io/data-model/schemas/Vendor) |
| Finding | `securityscorecard_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Portfolio | `securityscorecard_portfolio` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Service | `securityscorecard_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `securityscorecard_account` | **PROVIDES** | `securityscorecard_service` |
| `securityscorecard_account` | **HAS** | `securityscorecard_portfolio` |
| `securityscorecard_company` | **HAS** | `securityscorecard_finding` |
| `securityscorecard_portfolio` | **HAS** | `securityscorecard_company` |
| `securityscorecard_service` | **MONITORS** | `securityscorecard_company` |
| `securityscorecard_service` | **IDENTIFIED** | `securityscorecard_finding` |

### Securityscorecard Account

`securityscorecard_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`email` \*

 | `string` | Email address of the authenticated account |  |
| 

`username` \*

 | `string` | Username of the authenticated account |  |

---

### Securityscorecard Company

`securityscorecard_company` inherits from [Vendor](/data-model/schemas/Vendor.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainName` \*

 | `string` | Primary domain of the company (unique identifier) |  |
| 

`grade` \*

 | `string` **|** `null` | SSC security grade: A/B/C/D/F |  |
| 

`industry` \*

 | `string` **|** `null` | Industry identifier from SSC |  |
| 

`last30DaysScoreChange` \*

 | `number` **|** `null` | Score change delta over the last 30 days |  |
| 

`score` \*

 | `number` **|** `null` | Security score 0–100 |  |
| 

`size` \*

 | `string` **|** `null` | Estimated company size |  |

---

### Securityscorecard Finding

`securityscorecard_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`firstSeenOn` \*

 | `number` **|** `null` | Timestamp (ms) when this issue was first seen |  |
| 

`issueType` \*

 | `string` | Issue type slug (e.g. cookie\_missing\_http\_only) |  |
| 

`lastSeenOn` \*

 | `number` **|** `null` | Timestamp (ms) when this issue was last seen |  |
| 

`port` \*

 | `number` **|** `null` | Network port associated with this finding, if applicable |  |

---

### Securityscorecard Portfolio

`securityscorecard_portfolio` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`portfolioId` \*

 | `string` | Unique portfolio ID from SSC |  |
| 

`privacy` \*

 | `string` **|** `null` | Portfolio privacy setting (public, private, shared) |  |

---

### Securityscorecard Service

`securityscorecard_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`vendor` \*

 | `string` | Vendor name, always SecurityScorecard |  |

---

---

Source: /integrations/directory/semaphore

# Semaphore

Visualize Semaphore CI accounts, jobs, pipelines, and workflows, map Semaphore CI users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to copy your **Semaphore CI API Token** from within your **Organization's settings** in Semaphore CI.

### Configuration in JupiterOne

To install the Semaphore CI integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Semaphore CI. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Semaphore CI account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Semaphore CI **API Token** and **Organization name**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `semaphore_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Job | `semaphore_job` | [Entity](https://docs.jupiterone.io/data-model/schemas/Entity) |
| Pipeline | `semaphore_pipeline` | [Entity](https://docs.jupiterone.io/data-model/schemas/Entity) |
| Project | `semaphore_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Workflow | `semaphore_workflow` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `semaphore_account` | **HAS** | `semaphore_project` |
| `semaphore_pipeline` | **HAS** | `semaphore_job` |
| `semaphore_project` | **HAS** | `semaphore_workflow` |
| `semaphore_project` | **HAS** | `semaphore_pipeline` |

---

Source: /integrations/directory/semgrep

# Semgrep

Visualize Semgrep deployments, projects, code findings, secrets, and supply chain vulnerabilities. Map code security findings to projects and repositories, and monitor application security issues through queries and alerts.

## Installation

Semgrep is a static application security testing (SAST) tool that helps you find bugs and enforce code standards. The JupiterOne integration ingests findings, repositories, and rule data from your Semgrep account.

> **INFO**
> 
> You will need a Semgrep API Token with the **Web API** scope to set up this integration. This requires a Team or Enterprise tier account.

### Configuration in Semgrep

To create an API token for JupiterOne:

1.  Log in to your Semgrep web application at [https://semgrep.dev](https://semgrep.dev).
2.  Navigate to **Settings > Tokens** (Admin access required).
3.  Create a new API token or edit an existing one.
4.  Under **Token scopes**, ensure **Web API** is enabled.
    -   Tokens with only the **Agent (CI)** scope cannot access the Web API endpoints required by this integration.
5.  Copy the API token for use in JupiterOne configuration.

**Required API Access:**

The integration uses the following Semgrep API endpoints and requires read access to:

-   Deployments (`/api/v1/deployments`)
-   Projects (`/api/v1/deployments/{slug}/projects`)
-   Findings (`/api/v1/deployments/{slug}/findings`)
-   Secrets (`/api/v1/deployments/{id}/secrets`)
-   Supply Chain Vulnerabilities (`/api/v1/deployments/{id}/ssc-vulns`)

See [Semgrep's API documentation](https://semgrep.dev/docs/semgrep-appsec-platform/semgrep-api) for more information about token scopes.

### Configuration in JupiterOne

To install the Semgrep integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Semgrep. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Semgrep account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your **Semgrep API Token** that was generated in the Semgrep web app.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (5)

-   `/api/v1/deployments`
-   `/api/v1/deployments/{deploymentId}/secrets`
-   `/api/v1/deployments/{deploymentId}/ssc-vulns`
-   `/api/v1/deployments/{deploymentSlug}/findings`
-   `/api/v1/deployments/{deploymentSlug}/projects`

### Licenses

Product licenses or SKUs required in the target environment.

Show Licenses (1)

-   `Team or Enterprise`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (4)

-   [https://semgrep.dev/api/v1/docs/#operation/DeploymentsService\_ListDeployments](https://semgrep.dev/api/v1/docs/#operation/DeploymentsService_ListDeployments)
-   [https://semgrep.dev/api/v1/docs/#operation/FindingsService\_ListFindings](https://semgrep.dev/api/v1/docs/#operation/FindingsService_ListFindings)
-   [https://semgrep.dev/api/v1/docs/#operation/ProjectsService\_ListProjects](https://semgrep.dev/api/v1/docs/#operation/ProjectsService_ListProjects)
-   [https://semgrep.dev/api/v1/docs/#operation/SecretsService\_ListSecretsPath](https://semgrep.dev/api/v1/docs/#operation/SecretsService_ListSecretsPath)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Deployment | `semgrep_deployment` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Finding | `semgrep_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Project | `semgrep_project` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Secret | `semgrep_secret` | [Secret](https://docs.jupiterone.io/data-model/schemas/Secret) |
| Supply Chain Vulnerability | `semgrep_supply_chain_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `semgrep_deployment` | **HAS** | `semgrep_project` |
| `semgrep_deployment` | **HAS** | `semgrep_finding` |
| `semgrep_deployment` | **HAS** | `semgrep_secret` |
| `semgrep_deployment` | **HAS** | `semgrep_supply_chain_vulnerability` |
| `semgrep_project` | **HAS** | `semgrep_secret` |
| `semgrep_project` | **HAS** | `semgrep_supply_chain_vulnerability` |

### Semgrep Deployment

`semgrep_deployment` inherits from [Organization](/data-model/schemas/Organization.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`slug` \*

 | `string` |  |  |

---

### Semgrep Finding

`semgrep_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `categories` | `array` of `string`s |  |  |
| `confidence` | `string` |  |  |
| `createdAt` | `number` |  |  |
| `firstSeenScanId` | `number` |  |  |
| 
`id` \*

 | `string` |  |  |
| `lineOfCodeUrl` | `string` |  |  |
| 

`locationColumn` \*

 | `number` |  |  |
| 

`locationEndColumn` \*

 | `number` |  |  |
| 

`locationEndLine` \*

 | `number` |  |  |
| 

`locationFilePath` \*

 | `string` |  |  |
| 

`locationLine` \*

 | `number` |  |  |
| 

`matchBasedId` \*

 | `string` |  |  |
| `ref` | `string` |  |  |
| `relevantSince` | `number` |  |  |
| `repositoryName` | `string` |  |  |
| `repositoryUrl` | `string` |  |  |
| 

`ruleMessage` \*

 | `string` |  |  |
| 

`ruleName` \*

 | `string` |  |  |
| 

`severity` \*

 | `string` |  |  |
| `sourcingPolicyId` | `string` |  |  |
| `sourcingPolicyName` | `string` |  |  |
| `sourcingPolicySlug` | `string` |  |  |
| 

`state` \*

 | `string` |  |  |
| `stateUpdatedAt` | `number` |  |  |
| 

`syntacticId` \*

 | `string` |  |  |
| `triageComment` | `string` |  |  |
| `triagedAt` | `number` |  |  |
| `triageReason` | `string` |  |  |
| 

`triageState` \*

 | `string` |  |  |

---

### Semgrep Project

`semgrep_project` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Semgrep Secret

`semgrep_secret` inherits from [Secret](/data-model/schemas/Secret.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `confidence` | `string` |  |  |
| `createdAt` | `number` |  |  |
| `externalTicketExternalSlug` | `string` |  |  |
| `externalTicketUrl` | `string` |  |  |
| `findingPath` | `string` |  |  |
| `findingPathUrl` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| `mode` | `string` |  |  |
| `ref` | `string` |  |  |
| `refUrl` | `string` |  |  |
| `repositoryName` | `string` |  |  |
| `repositoryScmType` | `string` |  |  |
| `repositoryUrl` | `string` |  |  |
| `repositoryVisibility` | `string` |  |  |
| `ruleHashId` | `string` |  |  |
| `severity` | `string` |  |  |
| `status` | `string` |  |  |
| `type` | `string` |  |  |
| `updatedAt` | `number` |  |  |
| `validationState` | `string` |  |  |

---

### Semgrep Supply Chain Vulnerability

`semgrep_supply_chain_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `advisoryCreatedOn` | `number` |  |  |
| `closestSafeDependencyName` | `string` |  |  |
| `closestSafeDependencyVersion` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `cveIds` | `array` of `string`s |  |  |
| `cweIds` | `array` of `string`s |  |  |
| `dependencyFileLocationPath` | `string` |  |  |
| `dependencyFileLocationUrl` | `string` |  |  |
| `description` | `string` |  |  |
| 
`displayName` \*

 | `string` |  |  |
| `ecosystem` | `string` |  |  |
| `exposureType` | `string` |  |  |
| `firstTriagedAt` | `number` |  |  |
| 

`groupKey` \*

 | `string` |  |  |
| `matchedDependencyName` | `string` |  |  |
| `matchedDependencyVersion` | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| `owaspIds` | `array` of `string`s |  |  |
| `packageManager` | `string` |  |  |
| `repositoryId` | `string` |  |  |
| `repositoryName` | `string` |  |  |
| `ruleId` | `string` |  |  |
| 

`severity` \*

 | `string` |  |  |
| `subdirectory` | `string` |  |  |
| `transitivity` | `string` |  |  |
| `triageDismissReason` | `string` |  |  |
| `triageIssueUrl` | `string` |  |  |
| `triagePrUrl` | `string` |  |  |
| `triageStatus` | `string` |  |  |
| `urls` | `array` of `string`s |  |  |

---

## Release Notes

-   **2025-06-05** — Promoted Semgrep supply chain vulnerability findings to carry both the Vulnerability and Finding entity classes, enabling cross-integration vulnerability queries.

---

Source: /integrations/directory/sentinelone

# SentinelOne

Visualize SentinelOne endpoint agents and devices, map SentinelOne agents to devices and owners, and monitor changes through queries and alerts.

## Installation

For this integration, you will first need to acquire an API Token in SentinelOne.

### Configuration in SentinelOne

**To create an API Token**:

1.  In your SentinelOne Management Console, click **Settings** > **USERS**
2.  Select your username and navigate to **Edit User** > **API Token** > **Generate**
3.  Generate a token for use within JupiterOne.

> **NOTE**
> 
> If you see _Revoke_ and _Regenerate_ actions, you already have an existing token. Revoking or regenerating the existing token will break any scripts currently utilizing the revoked/regenerated token:
> 
> -   **Revoke** removes the token authorization, and there is no confirmation on this action.
> -   **Regenerate** revokes the token and generates a new token. If you click Generate or Regenerate, a message shows the token string and the date that the token expires.

5.  Click **DOWNLOAD** for use in JupiterOne.

### Configuration in JupiterOne

To install the SentinelOne integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select SentinelOne. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the SentinelOne account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your SentinelOne **Management Server Hostname/URL** and **API Token**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `sentinelone_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Agent | `sentinelone_agent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Application | `sentinelone_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Group | `sentinelone_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Host | `sentinelone_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| User | `sentinelone_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `sentinelone_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sentinelone_account` | **HAS** | `sentinelone_group` |
| `sentinelone_account` | **HAS** | `sentinelone_user` |
| `sentinelone_agent` | **INSTALLED** | `sentinelone_application` |
| `sentinelone_agent` | **IDENTIFIED** | `sentinelone_vulnerability` |
| `sentinelone_application` | **HAS** | `sentinelone_vulnerability` |
| `sentinelone_group` | **HAS** | `sentinelone_agent` |
| `sentinelone_host` | **PROTECTS** | `sentinelone_agent` |
| `sentinelone_host` | **HAS** | `sentinelone_vulnerability` |
| `sentinelone_user` | **ASSIGNED** | `sentinelone_group` |

### Sentinelone Account

`sentinelone_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Sentinelone Agent

`sentinelone_agent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeThreats` | `number` |  |  |
| `activeThreatsCount` | `number` |  |  |
| `adComputerDistinguishedName` | `string` |  |  |
| `agentVersion` | `string` |  |  |
| `allowRemoteShell` | `boolean` |  |  |
| `appsVulnerabilityStatus` | `string` |  |  |
| `computerName` | `string` |  |  |
| `consoleMigrationStatus` | `string` |  |  |
| `coreCount` | `number` |  |  |
| `cpuCount` | `number` |  |  |
| `cpuId` | `string` |  |  |
| `createdAt` | `number` | Please use createdOn instead | **deprecated**: true |
| `domain` | `string` |  |  |
| `encryptedApplications` | `boolean` |  |  |
| `externalIp` | `string` |  |  |
| 
`groupId` \*

 | `string` |  |  |
| `groupIp` | `string` |  |  |
| `groupName` | `string` |  |  |
| `groupUpdatedAt` | `number` | Please use groupUpdatedOn instead | **deprecated**: true |
| `groupUpdatedOn` | `number` |  |  |
| `infected` | `boolean` | Please use isInfected instead | **deprecated**: true |
| `inRemoteShellSession` | `boolean` | Please use isInRemoteShellSession instead | **deprecated**: true |
| `isActive` | `boolean` |  |  |
| `isDecommissioned` | `boolean` |  |  |
| `isInfected` | `boolean` |  |  |
| `isInRemoteShellSession` | `boolean` |  |  |
| `isPendingUninstall` | `boolean` |  |  |
| `isUninstalled` | `boolean` |  |  |
| `isUpToDate` | `boolean` |  |  |
| `lastActiveDate` | `number` |  |  |
| `lastLoggedInUserName` | `string` |  |  |
| `macAddress` | `array` of `string`s |  |  |
| `macAddresses` | `array` of `string`s |  |  |
| `machineType` | `string` |  |  |
| `missingPermissions` | `array` of `string`s |  |  |
| `mitigationMode` | `string` |  |  |
| `mitigationModeSuspicious` | `string` |  |  |
| `modelName` | `string` |  |  |
| `networkStatus` | `string` |  |  |
| `osArch` | `string` |  |  |
| `osName` | `string` |  |  |
| `osRevision` | `string` |  |  |
| `osStartTime` | `number` |  |  |
| `osType` | `string` |  |  |
| `osUsername` | `string` |  |  |
| `policyUpdatedAt` | `number` | Please use policyUpdatedOn instead | **deprecated**: true |
| `policyUpdatedOn` | `number` |  |  |
| `registeredAt` | `number` | Please use registeredOn instead | **deprecated**: true |
| `registeredOn` | `number` |  |  |
| `scanAbortedAt` | `number` | Please use scanAbortedOn instead | **deprecated**: true |
| `scanAbortedOn` | `number` |  |  |
| `scanFinishedAt` | `number` | Please use scanFinishedOn instead | **deprecated**: true |
| `scanFinishedOn` | `number` |  |  |
| `scanStartedAt` | `number` | Please use scanStartedOn instead | **deprecated**: true |
| `scanStartedOn` | `number` |  |  |
| `scanStatus` | `string` |  |  |
| `serial` | `string` |  |  |
| `siteId` | `string` |  |  |
| `siteName` | `string` |  |  |
| `totalMemory` | `number` |  |  |
| `updatedAt` | `number` | Please use updatedOn instead | **deprecated**: true |
| `uuid` | `string` |  |  |

---

### Sentinelone Application

`sentinelone_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `osType` | `string` |  |  |
| `riskLevel` | `string` |  |  |
| `signed` | `boolean` |  |  |
| `size` | `number` |  |  |
| `type` | `string` |  |  |
| `vendor` | `string` |  |  |
| `version` | `string` |  |  |

---

### Sentinelone Group

`sentinelone_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` | Please use createdOn instead | **deprecated**: true |
| `creator` | `string` |  |  |
| `creatorId` | `string` |  |  |
| `filterId` | `string` |  |  |
| `filterName` | `string` |  |  |
| `inherits` | `boolean` |  |  |
| `isDefault` | `boolean` |  |  |
| `rank` | `number` |  |  |
| 
`siteId` \*

 | `string` |  |  |
| `totalAgents` | `number` |  |  |
| `type` | `string` |  |  |
| `updatedAt` | `number` | Please use updatedOn instead | **deprecated**: true |

---

### Sentinelone Host

`sentinelone_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `activeCoverage` | `array` of `string`s | Active SentinelOne coverage modules (e.g. EPP, EDR). |  |
| `adMachineDistinguishedName` | `string` | The Active Directory machine distinguished name. |  |
| `adsEnabled` | `boolean` | Whether Application Detection & Security is enabled. |  |
| `adUserDistinguishedName` | `string` | The Active Directory user distinguished name. |  |
| `agentId` | `string` | Id of the SentinelOne agent installed on this host. |  |
| `agentUuid` | `string` | UUID of the SentinelOne agent installed on this host. |  |
| `architecture` | `string` | The CPU architecture of the device. |  |
| `assetContactEmail` | `string` | The asset contact email. |  |
| `assetCriticality` | `string` | The criticality assigned to the asset. |  |
| `assetEnvironment` | `string` | The environment the asset exists in (AWS, Azure, GCP, AD). |  |
| `assetStatus` | `string` | The status of the asset. |  |
| `coreCount` | `number` | The number of CPU cores. |  |
| `cpu` | `string` | The CPU model of the device. |  |
| `detectedFromSite` | `string` | The site from which the device was detected. |  |
| `domain` | `string` | The network domain of the device. |  |
| `firstSeenOn` | `number` | When the asset was first seen (epoch ms). |  |
| `groupId` | `string` | The SentinelOne group id. |  |
| `groupName` | `string` | The SentinelOne group name. |  |
| `infectionStatus` | `string` | The infection/alert status of the asset. |  |
| `instanceId` | `string` | The cloud instance id of the device, when applicable. |  |
| `isAdConnector` | `boolean` | Whether the device is an Active Directory connector. |  |
| `isDcServer` | `boolean` | Whether the device is a domain controller. |  |
| `isVm` | `boolean` | Whether the device is a virtual machine. |  |
| `lastActiveOn` | `number` | When the asset was last active (epoch ms). |  |
| `lastApplicationScanOn` | `number` | When applications were last scanned (epoch ms). |  |
| `lastRebootOn` | `number` | When the device last rebooted (epoch ms). |  |
| `lastUpdateOn` | `number` | When the asset record was last updated (epoch ms). |  |
| `memoryReadable` | `string` | Human-readable total memory (e.g. "16 GB"). |  |
| `missingCoverage` | `array` of `string`s | SentinelOne coverage modules that are missing. |  |
| `modelName` | `string` | The hardware model name. |  |
| `osFamily` | `string` | The operating system family. |  |
| `osUsername` | `string` | The last logged-in OS username on the device. |  |
| `resourceType` | `string` | The canonical resource type of the asset. |  |
| `riskFactors` | `array` of `string`s | Risk factors associated with the asset. |  |
| `s1AccountId` | `string` | The SentinelOne account id. |  |
| `s1AccountName` | `string` | The SentinelOne account name. |  |
| `s1ActiveProtection` | `array` of `string`s | Active SentinelOne protection modes. |  |
| `s1ManagementId` | `number` | The SentinelOne management id. |  |
| `s1ScopeId` | `string` | The SentinelOne scope id. |  |
| `s1ScopeLevel` | `string` | The SentinelOne scope level. |  |
| `s1ScopePath` | `string` | The SentinelOne scope path. |  |
| `s1ScopeType` | `number` | The SentinelOne scope type. |  |
| `s1UpdatedOn` | `number` | When SentinelOne last updated the asset (epoch ms). |  |
| `siteId` | `string` | The SentinelOne site id. |  |
| `siteName` | `string` | The SentinelOne site name. |  |
| `subCategory` | `string` | The asset sub-category (e.g. Laptop, Server). |  |
| `surfaces` | `array` of `string`s | The surfaces the asset belongs to. |  |
| `totalMemory` | `number` | Total physical memory in megabytes. |  |

---

### Sentinelone User

`sentinelone_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agreedEula` | `boolean` |  |  |
| `agreedEulaVersion` | `string` |  |  |
| `canGenerateApiToken` | `boolean` |  |  |
| `dateJoinedOn` | `number` |  |  |
| `firstLoginOn` | `number` |  |  |
| `fullName` | `string` |  |  |
| `lastLoginOn` | `number` |  |  |
| `lowestRole` | `string` |  |  |
| `primaryTwoFaMethod` | `string` |  |  |
| `scope` | `string` |  |  |
| `source` | `string` |  |  |
| `twoFaConfigured` | `boolean` |  |  |
| `twoFaEnabled` | `boolean` |  |  |
| `twoFaStatus` | `string` |  |  |

---

### Sentinelone Vulnerability

`sentinelone_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `applicationName` | `string` |  |  |
| `applicationVendor` | `string` |  |  |
| `applicationVersion` | `string` |  |  |
| `cvssVersion` | `string` |  |  |
| `publishedOn` | `number` |  |  |
| `riskLevel` | `string` |  |  |

---

## Release Notes

-   **2026-10-05** — Added a configuration option to scope installed application ingestion to active agents only, reducing data volume for large ephemeral fleets.
-   **2026-07-10** — SentinelOne endpoints now include cloud instance IDs in their device identifier, enabling unified device correlation with cloud provider integrations.
-   **2026-03-19** — Improved hostname and FQDN accuracy on SentinelOne host entities by parsing fully qualified domain names from computer names.
-   **2026-02-10** — Added two-factor authentication configuration status and admin role indicator to SentinelOne user entities.
-   **2026-01-29** — Added SentinelOne user ingestion as new entities, including role, two-factor authentication status, and login timestamps.
-   **2026-01-20** — Added SentinelOne installed application and vulnerability ingestion with host relationships.
-   **2026-01-12** — Added normalized host properties to SentinelOne agent entities including OS, hardware, and network details.

---

Source: /integrations/directory/sentry

# Sentry

Visualize Sentry services, teams, and users, map Sentry users to employees, and monitor changes through queries and alerts.

## Installation

To configure this integration, you will need to create an Auth Token in Sentry and provide it in your JupiterOne integration instance.

### Configuration in Sentry

**To create an API Token**:

1.  Navigate to the [Auth Tokens page](https://sentry.io/settings/account/api/auth-tokens/) in your Sentry Settings.
    
2.  Select **Create New Token** in the top right corner.
    
3.  Allow the following scopes for the token:
    
    -   `project:read`
    -   `team:read`
    -   `org:read`
    -   `event:read`
    -   `member:read`
4.  Click **Create Token**
    

### Configuration in JupiterOne

To install the Sentry integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Sentry. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Sentry account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Sentry **API Token** generated for use in JupiterOne.
    
-   For **Organization**, enter your Sentry Organization's slug. This is the URL safe version of your organization and can be found in your Sentry URL at `_sentry.io/organizations/{organization-slug}/...`.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Finding | `sentry_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Member | `sentry_member` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Organization | `sentry_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Project | `sentry_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Role | `sentry_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Service | `sentry_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Team | `sentry_team` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sentry_member` | **ASSIGNED** | `sentry_role` |
| `sentry_organization` | **HAS** | `sentry_service` |
| `sentry_organization` | **HAS** | `sentry_project` |
| `sentry_organization` | **HAS** | `sentry_team` |
| `sentry_organization` | **HAS** | `sentry_member` |
| `sentry_organization` | **HAS** | `sentry_role` |
| `sentry_project` | **HAS** | `sentry_finding` |
| `sentry_team` | **ASSIGNED** | `sentry_project` |
| `sentry_team` | **HAS** | `sentry_member` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `sentry_organization` | **HAS** | `repository` | FORWARD |

### Sentry Member

`sentry_member` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dateJoined` | `integer` |  |  |
| `isManaged` | `boolean` |  |  |
| `isStaff` | `boolean` |  |  |
| `isSuperuser` | `boolean` |  |  |
| `lastActive` | `integer` |  |  |
| `lastLogin` | `integer` |  |  |
| `role` | `string` |  |  |

---

---

Source: /integrations/directory/servicenow

# ServiceNow

Visualize ServiceNow resources and monitor them through queries and alerts.

## Installation

> **INFO**
> 
> Before configuring this integration in JupiterOne, you need to create a dedicated service account with appropriate permissions in ServiceNow:
> 
> **Required in ServiceNow:**
> 
> -   A dedicated user account (e.g., `JupiterOne`)
> -   A custom role with read-only access (e.g., `jupiterone_reader`)
> -   Access Control Lists (ACLs) configured for the required tables
> -   Your ServiceNow instance hostname (e.g., `yourcompany.service-now.com`)
> 
> **Authentication:** This integration uses HTTP Basic authentication with username and password.
> 
> **Required Table Access:** The service account must have read access to these tables:
> 
> -   `sys_user` - for user data
> -   `sys_user_group` - for group data
> -   `sys_user_grmember` - for group membership data
> -   `incident` - for incident data
> -   `sys_db_object` - for database object information
> -   CMDB tables (if ingesting CMDB data) - requires the `cmdb_reader` role
> 
> **Optional Permissions:** If you want JupiterOne to create ServiceNow incidents from alert rules, create an additional `jupiterone_incident_creator` role with write access to the `incident` table.
> 
> Detailed setup instructions are provided in the Configuration in ServiceNow section below.

In order to allow JupiterOne to fetch data from your ServiceNow account, we recommend creating a new ServiceNow role with read-only access to your account and assigning that read-only role to a dedicated ServiceNow user.

### Configuration in ServiceNow

1.  Follow the ServiceNow documentation to [create a new ServiceNow role](https://docs.servicenow.com/bundle/utah-platform-administration/page/administer/roles/task/t_CreateARole.html) called `jupiterone_reader`.
    
2.  Create a [new access control rule (ACL)](https://docs.servicenow.com/bundle/utah-it-service-management/page/product/change-management/task/t_CreateNewACL.html) to allow access to the `jupiterone_reader` role with `Type: Record`, `Operation: Read`, and `Role: jupiterone_reader`. This should be enabled for the following tables (`Name` field):
    
    -   `sys_user`
    -   `sys_user_group`
    -   `sys_user_grmember`
    -   `incident`
    -   `sys_db_object`
3.  Create a [new ServiceNow User](https://docs.servicenow.com/bundle/utah-platform-administration/page/administer/users-and-groups/task/t_CreateAUser.html) called `JupiterOne`. Make a note of the new username/password; you'll need it when configuring your integration in JupiterOne.
    
4.  Open the `JupiterOne` user and [assign the `jupiterone_reader` role](https://docs.servicenow.com/bundle/utah-platform-administration/page/administer/users-and-groups/task/t_AssignARoleToAUser.html) to your newly created user. **Note**: if ingesting any part of the cmdb, also add the `cmdb_reader` role. See [this link](https://docs.servicenow.com/bundle/utah-platform-administration/page/administer/roles/reference/r_BaseSystemRoles.html) for more information.
    
5.  (**OPTIONAL**) For JupiterOne users who wish to create ServiceNow incidents based on JupiterOne alert rules, we suggest creating a `jupiterone_incident_creator` role. Repeat steps 1, 2, and 4 above with the following parameters:
    
    **1\. ServiceNow Role**: `name: jupiterone_incident_creator`
    
    **2\. Access Control Rule (ACL)** : `Type: Record` , `Operation: Create` , `Name(table): incident`, `Name(fields): *` , `Role: jupiterone_incident_creator`
    
    **4\. Role Assignment**: Assign `jupiterone_incident_creator` role to `JupiterOne` user
    

### Configuration in JupiterOne

To install the ServiceNow integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select ServiceNow. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the ServiceNow account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your ServiceNow **Hostname** (e.g., `j1.service-now.com`), **Username**, and **Password**.
    
-   Your ServiceNow **CMDB Classes** to ingest, a comma separated value of classes.
    

Click **Create** once all values are provided to finalize the integration.

### Advanced Options

Additional configuration can be set to customize the ingested data:

-   **User Configuration: Custom Fields** allows for custom fields to be added to the user entity.
-   **User Configuration: Excluded User Classes** allows for some users to be excluded based on their sysClassName.
-   **Host Configuration: Host Classes** allows for specific sysClassNames to be mapped to the JupiterOne Device data model.
-   **CMDB host names field** relates CMDB items to the hosts named in one of their text fields. See [Relating CMDB items to hosts by name](#relating-cmdb-items-to-hosts-by-name).

#### Relating CMDB items to hosts by name

Some ServiceNow instances record which servers an application owns or uses in a text field on the CMDB item, such as a custom **Owns or Uses Servers** column on `cmdb_ci_business_app`, rather than (or as well as) in CI relationships. Set **CMDB host names field** to that field's key (for example `u_owns_or_uses_servers`) to turn those names into relationships.

-   The field must hold host names separated by commas. Spaces around the names are ignored.
-   Each name is matched case-insensitively against the `name` of the ingested `service_now_cmdb_host` entities, so the host classes must be listed in **Host Classes** and included in the CMDB classes.
-   Each match creates a `service_now_cmdb_object` **USES** `service_now_cmdb_host` relationship. These are added alongside the relationships from the CI relationship table (`cmdb_rel_ci`) and do not replace them.
-   A name that matches more than one host is skipped, because there is no way to tell which host is meant. Names that match no host are also skipped.
-   Leave the field empty to turn this off.

After a run, this query lists the applications and the hosts they were related to:

`FIND service_now_cmdb_object THAT USES service_now_cmdb_host RETURN service_now_cmdb_object.name, service_now_cmdb_host.name`

> **NOTE**
> 
> Excluded User Classes configuration option:
> 
> This J1QL Query can be executed to determine which system class names (sysClassName) of users exist within ServiceNow, after a successful job run without any User Class Exclusions:
> 
> `FIND service_now_user RETURN count(service_now_user), service_now_user.sysClassName`

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `service_now_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| CMDB Host Object | `service_now_cmdb_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| CMDB Object | `service_now_cmdb_object` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Company | `service_now_company` | [Vendor](https://docs.jupiterone.io/data-model/schemas/Vendor) |
| Configuration Compliance Test Result | `service_now_config_test_result` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Database View Record | `service_now_view_record` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Incident | `service_now_incident` | [Incident](https://docs.jupiterone.io/data-model/schemas/Incident) |
| User | `service_now_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `service_now_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Vulnerable Item | `service_now_vulnerable_item` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `service_now_account` | **HAS** | `service_now_user` |
| `service_now_account` | **HAS** | `service_now_group` |
| `service_now_cmdb_object` | **ASSIGNED** | `service_now_user` |
| `service_now_cmdb_object` | **ASSIGNED** | `service_now_group` |
| `service_now_cmdb_object` | **HAS** | `service_now_view_record` |
| `service_now_cmdb_object` | **USES** | `service_now_cmdb_host` |
| `service_now_cmdb_object` | **CONNECTS** | `service_now_cmdb_object` |
| `service_now_company` | **HAS** | `service_now_company` |
| `service_now_group` | **HAS** | `service_now_group` |
| `service_now_group` | **HAS** | `service_now_user` |
| `service_now_group` | **MANAGES** | `service_now_cmdb_object` |
| `service_now_group` | **USES** | `service_now_cmdb_object` |
| `service_now_group` | **ASSIGNED** | `service_now_vulnerable_item` |
| `service_now_group` | **ASSIGNED** | `service_now_config_test_result` |
| `service_now_incident` | **ASSIGNED** | `service_now_user` |
| `service_now_user` | **MANAGES** | `service_now_group` |
| `service_now_user` | **MANAGES** | `service_now_user` |
| `service_now_user` | **MANAGES** | `service_now_cmdb_object` |
| `service_now_user` | **OWNS** | `service_now_cmdb_object` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `service_now_cmdb_object` | **CONNECTS** | `service_now_cmdb_object` | FORWARD |
| `service_now_cmdb_object` | **HAS** | `service_now_vulnerable_item` | FORWARD |
| `service_now_cmdb_object` | **HAS** | `service_now_config_test_result` | FORWARD |
| `service_now_config_test_result` | **IS** | `qualys_compliance_finding` | FORWARD |
| `service_now_vulnerable_item` | **IS** | `qualys_issue` | FORWARD |

### Service Now Cmdb Host

`service_now_cmdb_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetFunction` | `string` | Derived from the property named: "asset\_function" |  |
| `assetTag` | `string` | Derived from the property named: "asset\_tag" |  |
| `assignedTo` | `string` | Derived from the property named: "assigned\_to.value" |  |
| `attributes` | `string` | Derived from the property named: "attributes" |  |
| `businessUnit` | `string` | Derived from the property named: "business\_unit.value" |  |
| `comments` | `string` | Derived from the property named: "comments" |  |
| `correlationId` | `string` | Derived from the property named: "correlation\_id" |  |
| `department` | `string` | Derived from the property named: "department.value" |  |
| `discoverySource` | `string` | Derived from the property named: "discovery\_source" |  |
| `dnsDomain` | `string` | Derived from the property named: "dns\_domain" |  |
| `environment` | `string` | Derived from the property named: "environment" |  |
| `hardwareStatus` | `string` | Derived from the property named: "hardware\_status" |  |
| `hardwareSubStatus` | `string` | Derived from the property named: "hardware\_substatus" |  |
| `installDate` | `number` | Derived from the property named: "install\_date" |  |
| `installStatus` | `string` | Derived from the property named: "install\_status". This property shows the recovered label. |  |
| `location` | `string` | Derived from the property named: "location.value" |  |
| `managedBy` | `string` | Derived from the property named: "managed\_by.value" |  |
| `managedByGroup` | `string` | Derived from the property named: "managed\_by\_group.value" |  |
| `mode` | `string` | Derived from the property named: "mode" |  |
| `numericInstallStatus` | `string` | Derived from the property named: "install\_status". This property shows the raw value. |  |
| `numericOperationalStatus` | `string` | Derived from the property named: "operational\_status". This property shows the raw value. |  |
| `operationalStatus` | `string` | Derived from the property named: "operational\_status". This property shows the recovered label. |  |
| `orderDate` | `number` | Derived from the property named: "order\_date" |  |
| `ownedBy` | `string` | Derived from the property named: "owned\_by.value" |  |
| `subcategory` | `string` | Derived from the property named: "subcategory" |  |
| `substatus` | `string` | Derived from the property named: "substatus" |  |
| 
`sysClassNames` \*

 | `array` of `string`s |  |  |
| `warrantyExpiration` | `number` | Derived from the property named: "warranty\_expiration" |  |

---

### Service Now Company

`service_now_company` inherits from [Vendor](/data-model/schemas/Vendor.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `city` | `string` **|** `null` | Mailing address city. Derived from the property named: "city". |  |
| `contactId` | `string` | sys\_id of the primary contact (sys\_user). Derived from the property named: "contact.value". |  |
| `country` | `string` **|** `null` | Mailing address country. Derived from the property named: "country". |  |
| `discount` | `number` | Negotiated discount. Derived from the property named: "discount". |  |
| `isCustomer` | `boolean` | Whether this company is a customer. Derived from the property named: "customer". |  |
| `isManufacturer` | `boolean` | Whether this company is a manufacturer. Derived from the property named: "manufacturer". |  |
| `isPrimary` | `boolean` | Whether this is the instance's own/primary company. Derived from the property named: "primary". |  |
| `isVendor` | `boolean` | Whether this company is a vendor. Derived from the property named: "vendor". |  |
| `marketCap` | `number` | Market capitalization. Derived from the property named: "market\_cap". |  |
| `numEmployees` | `number` | Number of employees. Derived from the property named: "num\_employees". |  |
| `state` | `string` **|** `null` | Mailing address state. Derived from the property named: "state". |  |
| `stockSymbol` | `string` **|** `null` | Ticker symbol. Derived from the property named: "stock\_symbol". |  |
| `vendorType` | `string` **|** `null` | Vendor classification. Derived from the property named: "vendor\_type". |  |
| `zip` | `string` **|** `null` | Mailing address postal code. Derived from the property named: "zip". |  |

---

### Service Now Config Test Result

`service_now_config_test_result` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `actualValues` | `string` **|** `null` | The values the scanner actually observed on the configuration item. Derived from the property named: "actual\_values". |  |
| `assignedToId` | `string` **|** `null` | sys\_id of the individual working on this test result. Derived from the property named: "assigned\_to.value". |  |
| `closedOn` | `number` | Timestamp at which the test result transitioned to closed. Derived from the property named: "closed". |  |
| `controlId` | `string` **|** `null` | The identifier assigned to the configuration test by the SCA scanner. For Qualys Policy Compliance this is the Qualys Control ID. Derived from the property named: "test.source\_id". |  |
| `expectedValues` | `string` **|** `null` | The values the scanner expected the configuration item to report for a passing result. Derived from the property named: "expected\_values". |  |
| `firstSeenOn` | `number` | Timestamp of the first import of this test result into Configuration Compliance. Derived from the property named: "first\_seen". |  |
| `isActive` | `boolean` | Whether the test result is still active, i.e. has not been closed. Derived from the property named: "active". |  |
| `lastPassedOn` | `number` | Timestamp of the most recent date on which this test result passed. Derived from the property named: "last\_pass". |  |
| `lastSeenOn` | `number` | Timestamp of the most recent import of this test result. Derived from the property named: "last\_seen". |  |
| `number` | `string` **|** `null` | The number assigned to the test result during the import process (e.g. "CTR19994689"). Derived from the property named: "number". |  |
| `resolution` | `string` **|** `null` | Resolution calculated from the associated remediation task groups (e.g. "Stale"). Derived from the property named: "resolution". |  |
| `result` | `string` **|** `null` | Outcome of the configuration test as reported by the scanner: Passed, Failed, Error or Unknown. Derived from the property named: "result". |  |
| `riskRating` | `string` **|** `null` | Raw numeric risk rating (1-5) reported by ServiceNow, where 1 is the most severe. Derived from the property named: "risk\_rating". |  |
| `riskScore` | `number` | Score derived from the criticality of the configuration test. Derived from the property named: "risk\_score". |  |
| `source` | `string` **|** `null` | System name of the third-party SCA integration that produced the result (e.g. "Qualys"). Derived from the property named: "source". |  |
| `sourceId` | `string` **|** `null` | The identifier assigned to this test result by the third-party SCA scanner. For Qualys Policy Compliance this is the Qualys Posture ID, which is what joins the result to a qualys\_compliance\_finding. |  |
| `state` | `string` **|** `null` | Raw state value, calculated by ServiceNow from the remediation tasks the test result belongs to. Derived from the property named: "state". |  |
| `stateLabel` | `string` **|** `null` | Human-readable label for the numeric state value, when ServiceNow reports state numerically (e.g. "1" resolves to "Open"). |  |
| `technology` | `string` **|** `null` | The technology the test was evaluated against (e.g. "Windows 2019 Server"). Derived from the property named: "technology". |  |
| `testId` | `string` **|** `null` | sys\_id of the configuration test (sn\_vulc\_test) this result evaluates. Derived from the property named: "test.value". |  |
| `testName` | `string` **|** `null` | Name of the configuration test, i.e. the control statement. Derived from the property named: "test.name". |  |

---

### Service Now User

`service_now_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `employeeNumber` | `string` |  |  |
| `sysClassName` | `string` |  |  |
| `title` | `string` |  |  |

---

### Service Now View Record

`service_now_view_record` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`rowKeyValues` \*

 | `array` of `string`s |  |  |
| 

`sysClassNames` \*

 | `array` of `string`s |  |  |
| 

`viewName` \*

 | `string` | Name of the ServiceNow database view this row was read from, e.g. "u\_app\_portfolio" |  |

---

## Release Notes

-   **2026-10-19** — Added support for linking user groups to CMDB objects via configurable reference fields, creating group-to-CI usage relationships.
    
-   **2026-10-19** — ServiceNow CMDB database view records now include human-readable display names alongside system IDs for reference columns.
    
-   **2026-10-15** — The ServiceNow Configuration Compliance ingestion default query now limits results to failing tests, reducing ingested data volume and focusing on actionable findings.
    
-   **2026-09-25** — ServiceNow database view rows are now ingested as individual entities, linked to the CMDB objects each row joins, enabling SQL-view-level queries.
    
-   **2026-09-04** — ServiceNow CMDB objects can now be linked to their owners via configurable reference field paths, creating user-to-CI ownership relationships.
    
-   **2026-09-04** — CMDB entities without a primary name field can now be identified using a configurable set of fallback name fields.
    
-   **2026-08-31** — Added ingestion of ServiceNow Configuration Compliance test results, linked to assigned groups, CMDB objects, and Qualys compliance findings.
    
-   **2026-08-04** — ServiceNow incidents now include a direct web link property for quick navigation to the record in the ServiceNow portal.
    
-   **2026-08-03** — ServiceNow incident entities now include a direct web link for quick navigation to the incident in ServiceNow.
    
-   **2026-07-30** — Added ingestion of ServiceNow company records as vendor entities, including parent-company hierarchy relationships.
    
-   **2026-07-13** — Added support for ingesting custom CMDB fields via a new configuration option, and linked Wiz integration assets to CMDB records via mapped relationships.
    
-   **2026-03-31** — Added additional vulnerability states to ServiceNow vulnerable item ingestion, supporting Awaiting Implementation, Resolved, and Deferred states.
    
-   **2026-03-24** — Added configurable default filtering for ServiceNow vulnerability ingestion, defaulting to open and under-investigation states and critical, high, and medium severities.
    
-   **2026-03-23** — Added Vulnerable Items ingestion step, bringing in ServiceNow vulnerable item entities from the vulnerable items table with host and vulnerability relationships.
    
-   **2026-02-24** — Added configuration field to specify custom fields for special handling during CMDB object ingestion.
    
-   **2026-02-18** — Added user to group manager relationships for ServiceNow, linking the manager of each user group to the groups they manage.
    
-   **2025-11-14** — Added ServiceNow user manages user relationship for assignment group managers.
    
-   **2025-10-22** — Added strict filtering on sys class names configuration, improving CMDB object ingestion accuracy.
    
-   **2025-10-02** — Added ServiceNow user manages user relationship derived from manager field.
    
-   **2025-10-01** — Added integration filters for ServiceNow CMDB object entities, enabling subset ingestion by sys class name.
    
-   **2025-08-27** — Added host custom fields configuration option for promoting custom CMDB host fields (mirrors existing user custom fields behavior).
    
-   **2025-06-09** — Added ingestion of CMDB configuration item relationships as graph relationships between CMDB objects.

---

Source: /integrations/directory/shodan

# Shodan

Visualize Shodan Organization, Alert, Host, Scan, and User changes through queries and alerts.

# Installation Guide

## Prerequisites

To use this integration, you will need an enterprise license.

## Configuring Shodan

#### Authentication

Collect **API key** to authorize API requests.

#### Collect API Key

1.  Log in to your [Shodan](https://www.shodan.io) account.
2.  Click on **Account** in the top-right corner.
3.  Click **Show API Key**.
4.  Copy the API key and store it in a safe location.

## Configuring in JupiterOne

1.  In the **J1 Search** homepage, navigate to the **Integrations** section from the top navigation bar.
    
2.  Search for **Shodan** and select it.
    
3.  Click the **Add Instance** button and configure the following:
    
    -   **Shodan API Key:** Enter the API Token generated in Shodan.
    -   **Account Name:** Assign a name to identify this Shodan instance in JupiterOne. If the **Tag with Account Name** option is enabled, ingested entities will include this value in `tag.AccountName`.
    -   **Description:** Add a description to assist your team in identifying this integration instance.
    -   **Polling Interval (optional):** Select a polling interval appropriate for your monitoring needs. Leave this as `DISABLED` for manual execution if unsure.
4.  Click **Create Configuration** to save the settings.
    

## Next Steps

Your integration instance will now run based on the configured polling interval, populating data within JupiterOne. Refer to our [Instance Management Guide](/integrations/instance-management.md) to learn more about managing and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Alert | `shodan_alert` | [Alert](https://docs.jupiterone.io/data-model/schemas/Alert) |
| Host | `shodan_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Organization | `shodan_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Scan | `shodan_scan` | [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| User | `shodan_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `shodan_organization` | **HAS** | `shodan_user` |
| `shodan_organization` | **HAS** | `shodan_scan` |
| `shodan_scan` | **SCANS** | `shodan_host` |

### Shodan Alert

`shodan_alert` inherits from [Alert](/data-model/schemas/Alert.md)

---

### Shodan Host

`shodan_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `asn` | `string` |  |  |
| `bannerId` | `string` |  |  |
| `hash` | `number` |  |  |
| `hostnames` | `array` of `string`s |  |  |
| `internetServiceProvider` | `string` |  |  |
| `location` | `string` |  |  |
| `organization` | `string` |  |  |
| `product` | `string` |  |  |
| `shodanCrawler` | `string` |  |  |
| `shodanScanId` | `string` |  |  |
| `transportLayerProtocol` | `string` |  |  |

---

### Shodan Organization

`shodan_organization` inherits from [Account](/data-model/schemas/Account.md)

---

### Shodan Scan

`shodan_scan` inherits from [Scanner](/data-model/schemas/Scanner.md)

---

### Shodan User

`shodan_user` inherits from [User](/data-model/schemas/User.md)

---

---

Source: /integrations/directory/signal-sciences

# Signal Sciences (Fastly)

Visualize Signal Sciences corps and users, and monitor changes through queries and alerts.

## Installation

For this integration, JupiterOne requires a Signal Sciences API Access Token. This can be created by navigating to your user profile within Signal Sciences. See [their documentation](https://docs.fastly.com/signalsciences/developer/using-our-api/#managing-api-access-tokens) for additional information on managing API Access Tokens. Once created, save the key to a secure location for use in JupiterOne.

> **NOTE**
> 
> The API Access Token generated on Signal Sciences will inherit the same role as the user that generated it. For this integration, the role of _Observer_ is sufficient for the ingestion of corps and users.

### Configuration in JupiterOne

To install the Signal Sciences integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Signal Sciences. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Signal Sciences account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Signal Sciences **user**(the email associated to the Signal Sciences account that created the API access token).
    
-   The **API access token** generated in Signal Sciences for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Agent | `sigsci_agent` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Cloud WAF | `sigsci_cloudwaf` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| Corp | `sigsci_corp` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Site | `sigsci_site` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| User | `sigsci_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sigsci_agent` | **PROTECTS** | `sigsci_site` |
| `sigsci_corp` | **HAS** | `sigsci_user` |
| `sigsci_corp` | **HAS** | `sigsci_cloudwaf` |
| `sigsci_corp` | **HAS** | `sigsci_site` |

### Sigsci Agent

`sigsci_agent` inherits from [Firewall](/data-model/schemas/Firewall.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`active` \*

 | `boolean` | Whether agent was seen in past 5 minutes |  |
| 

`address` \*

 | `string` | RPC Address |  |
| 

`arguments` \*

 | `string` | Command line arguments |  |
| 

`buildId` \*

 | `string` | Commit SHA of current build |  |
| 

`enabled` \*

 | `boolean` | Configuration flag for on/off |  |
| `lastRuleUpdatedOn` | `number` | Timestamp of last rules update |  |
| `lastSeenOn` | `number` | Timestamp of last heartbeat |  |
| 

`maxProcs` \*

 | `number` | GOMAXPROCS setting |  |
| 

`name` \*

 | `string` |  |  |
| 

`ruleUpdates` \*

 | `number` | Counter of rule updates |  |
| 

`status` \*

 | `string` |  | **Any of**:

-   `online`

-   `offline`

 |
| 

`uptime` \*

 | `number` | Counter of uptime in seconds |  |
| 

`version` \*

 | `string` |  |  |

---

### Sigsci Cloudwaf

`sigsci_cloudwaf` inherits from [Firewall](/data-model/schemas/Firewall.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`createdBy` \*

 | `string` |  |  |
| 

`deployment.DnsEntry` \*

 | `string` | Please use deploymentDnsEntry | **deprecated**: true |
| 

`deployment.EgressIps` \*

 | `array` of `string`s |  |  |
| `deployment.Message` | `string` | Please use deploymentMessage | **deprecated**: true |
| 

`deployment.Status` \*

 | `string` | Please use deploymentStatus | **deprecated**: true |
| 

`deploymentDnsEntry` \*

 | `string` |  |  |
| 

`deploymentEgressIps` \*

 | `array` of `string`s |  |  |
| `deploymentMessage` | `string` |  |  |
| 

`deploymentStatus` \*

 | `string` |  |  |
| 

`description` \*

 | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`siteNames` \*

 | `array` of `string`s |  |  |
| 

`tlsMinVersion` \*

 | `string` |  |  |
| 

`updatedBy` \*

 | `string` |  |  |
| 

`useUploadedCertificates` \*

 | `boolean` |  |  |

---

### Sigsci Corp

`sigsci_corp` inherits from [Organization](/data-model/schemas/Organization.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiTokenMaxAge` \*

 | `number` |  |  |
| 

`authType` \*

 | `string` |  |  |
| 

`logoutURI` \*

 | `string` |  |  |
| 

`restrictedAccessTokens` \*

 | `boolean` |  |  |
| 

`samlCert` \*

 | `string` |  |  |
| 

`samlRequestCert` \*

 | `string` |  |  |
| 

`sessionMaxAgeDashboard` \*

 | `number` |  |  |
| 

`signRequestsUsingStoredCert` \*

 | `boolean` |  |  |
| 

`siteLimit` \*

 | `number` |  |  |
| `sitesUri` | `string` |  |  |
| 

`smallIconURI` \*

 | `string` |  |  |
| 

`ssoProvisioningConfigured` \*

 | `boolean` |  |  |

---

### Sigsci Site

`sigsci_site` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentLevel` \*

 | `string` |  |  |
| 

`blockDurationSeconds` \*

 | `number` |  |  |
| 

`blockHttpCode` \*

 | `number` |  |  |

---

### Sigsci User

`sigsci_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`role` \*

 | `string` |  |  |

---

---

Source: /integrations/directory/simplemdm

# SimpleMDM

Visualize SimpleMDM accounts, apps, devices, and users, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to add an API key within your SimpleMDM account to communicate with JupiterOne.

### Configuration in SimpleMDM

**To create your SimpleMDM API Key:**

1.  Navigate to **Account > API** from the SimpleMDM dashboard.
2.  Click **Add API Key** and provide a name for the key.
3.  When configuring the API key, provide the following roles with `read` permissions:
    -   Account
    -   Apps
    -   Devices
4.  Leave all other role permissions as `none` and press **Save**.
5.  Under **Secret Access Key**, click **Reveal** and copy the key for use in JupiterOne.

> **INFO**
> 
> For additional information on API key retrieval and authentication, see [SimpleMDM's documentation](https://api.simplemdm.com/#authentication).

### Configuration in JupiterOne

To install the SimpleMDM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select SimpleMDM. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the SimpleMDM account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Lastly, your SimpleMDM **API Key** generated for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `simplemdm_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `simplemdm_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Device | `simplemdm_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| User | `simplemdm_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `simplemdm_account` | **HAS** | `simplemdm_application` |
| `simplemdm_account` | **HAS** | `simplemdm_device` |
| `simplemdm_device` | **INSTALLED** | `simplemdm_application` |
| `simplemdm_user` | **OWNS** | `simplemdm_device` |

### Simplemdm Device

`simplemdm_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `autoAdminName` | `string` **|** `null` | Short name of the local admin account SimpleMDM created during enrollment. |  |
| `availableDeviceCapacity` | `number` **|** `null` | Free storage on the device, in GB. |  |
| `batteryLevel` | `number` **|** `null` | Battery charge level, as a percentage. |  |
| `bluetoothMac` | `string` **|** `null` | Bluetooth MAC address. |  |
| `buildVersion` | `string` **|** `null` | Operating system build version. |  |
| `deviceCapacity` | `number` **|** `null` | Total storage on the device, in GB. |  |
| `deviceName` | `string` **|** `null` | Name the device reports for itself. |  |
| `enrolledOn` | `number` **|** `null` | When the device enrolled in SimpleMDM. |  |
| `enrollmentChannels` | `array` of `string`s | Channels the device is enrolled through. |  |
| `enrollmentStatus` | `string` **|** `null` | Enrollment status reported by SimpleMDM, such as enrolled, awaiting enrollment or unenrolled. |  |
| `ethernetMacs` | `array` **|** `null` | Ethernet MAC addresses. |  |
| `ipv4Addresses` | `array` **|** `null` | IPv4 addresses of the device. |  |
| `ipv6Addresses` | `array` **|** `null` | IPv6 addresses of the device. |  |
| `isActivationLockEnabled` | `boolean` **|** `null` | Whether Activation Lock is on. |  |
| `isCloudBackupEnabled` | `boolean` **|** `null` | Whether iCloud backup is on. |  |
| `isDdmEnabled` | `boolean` **|** `null` | Whether Declarative Device Management is enabled for the device. |  |
| `isDepEnrolled` | `boolean` **|** `null` | Whether the device enrolled through Automated Device Enrollment (DEP). |  |
| `isFileVaultEnabled` | `boolean` **|** `null` | Whether FileVault disk encryption is on. |  |
| `isFirewallBlockingAllIncoming` | `boolean` **|** `null` | Whether the firewall blocks all incoming connections. |  |
| `isFirewallEnabled` | `boolean` **|** `null` | Whether the macOS firewall is on. |  |
| `isFirewallStealthModeEnabled` | `boolean` **|** `null` | Whether firewall stealth mode is on. |  |
| `isFirmwarePasswordEnabled` | `boolean` **|** `null` | Whether a firmware password is set. The password itself is never ingested. |  |
| `isLostModeEnabled` | `boolean` **|** `null` | Whether the device is in Lost Mode. |  |
| `isPasscodeCompliant` | `boolean` **|** `null` | Whether the passcode meets the device passcode requirements. |  |
| `isPasscodeCompliantWithProfiles` | `boolean` **|** `null` | Whether the passcode meets the requirements of installed profiles. |  |
| `isPasscodePresent` | `boolean` **|** `null` | Whether a passcode is set. |  |
| `isRecoveryLockPasswordEnabled` | `boolean` **|** `null` | Whether a Recovery Lock password is set. The password itself is never ingested. |  |
| `isRemoteDesktopEnabled` | `boolean` **|** `null` | Whether Remote Desktop is on. |  |
| `isSupervised` | `boolean` **|** `null` | Whether the device is supervised. |  |
| `isSystemIntegrityProtectionEnabled` | `boolean` **|** `null` | Whether System Integrity Protection is on. |  |
| `isUserApprovedEnrollment` | `boolean` **|** `null` | Whether the MDM enrollment was approved by the user. |  |
| `isUserEnrollment` | `boolean` **|** `null` | Whether this is a User Enrollment (BYOD) rather than a device enrollment. |  |
| `lastCloudBackupOn` | `number` **|** `null` | When the device last completed an iCloud backup. |  |
| `lastSeenAt` | `number` **|** `null` | When SimpleMDM last heard from the device. Same value as lastSeenOn. |  |
| `lastSeenIp` | `string` **|** `null` | IP address the device was last seen from. |  |
| `modelName` | `string` **|** `null` | Marketing name of the device model. |  |
| `processorArchitecture` | `string` **|** `null` | Processor architecture. |  |
| `productName` | `string` **|** `null` | Apple product identifier of the device. |  |
| `supplementalBuildVersion` | `string` **|** `null` | Rapid Security Response build version installed on the device. |  |
| `timeZone` | `string` **|** `null` | Time zone configured on the device. |  |
| `uniqueIdentifier` | `string` **|** `null` | UDID of the device. |  |
| `wifiMac` | `string` **|** `null` | Wi-Fi MAC address. |  |

---

### Simplemdm User

`simplemdm_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `dataQuota` | `number` |  |  |
| `dataToSync` | `boolean` |  |  |
| `dataUsed` | `number` |  |  |
| `loggedIn` | `boolean` |  |  |
| `mobileAccount` | `boolean` |  |  |
| `secureToken` | `boolean` |  |  |
| `uid` | `integer` |  |  |

---

---

Source: /integrations/directory/slack

# Slack

Visualize Slack teams, channels, and users, map Slack users to employees, monitor changes through alerts and queries, and create issues within Slack channels.

## Installation

To install this integration, you will need to add the [JupiterOne Slack App](https://rhythmchat.slack.com/apps/A0146KZJJUQ-jupiterone) to the Slack workspace you wish to use with JupiterOne.

### Configuration in JupiterOne

You can add the JupiterOne Slack application through the JupiterOne dashboard. Navigate to the **Integrations** tab in JupiterOne and select Addigy. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Addigy account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Slack OAuth Scopes** are pre-populated. You can adjust as desired by selecting/de-selecting from the drop-down.
    
    > **NOTE**
    > 
    > All read scopes are used to ingest data into the JupiterOne graph and the write scopes are used for enabling the ability to send notifications to channels in the configured Slack team. [`chat:write`](https://api.slack.com/scopes/chat:write) is required to post messages in channels & conversations that the `@JupiterOne` bot is a member of and [`chat:write.public`](https://api.slack.com/scopes/chat:write.public) is required to post messages to channels that the `@JupiterOne` bot isn't a member of. Without one or both of `chat:write` and `chat:write.public` scopes, users _will not_ be able to configure JupiterOne alert rules with a Slack notification.
    

Once the integration instance settings have been defined, press **Save**. This will initiate an OAuth flow with Slack. Press **Begin Authorization** to initiate the process. During the flow, you will be need to specify the Slack workspace for which you wish to use the JupiterOne integration. **Allow** access to the workspace to conclude the OAuth flow and finalize the integration.

### JupiterOne Alert Rule Slack Notifications

JupiterOne can deliver Slack messages directly to any channel or specific users in a Slack Workspace once the JupiterOne Slack integration has been configured.

Be sure to specify the channel in the format `#channel`. You can have alerts sent to private channels as well if you have invited the JupiterOne Slack app to the private channel.

> **INFO**
> 
> For more detailed instructions on how to configure JupiterOne Alert Rules, please see the [JupiterOne Alert Rule configuration documentation](/features/insights-and-alerts/insights.md). Additionally, see the [JupiterOne Alert Rule Schema documentation](/api/alert-rules.md#rule-definition-reference) for technical details on alert rule/action properties.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Channel | `slack_channel` | [Channel](https://docs.jupiterone.io/data-model/schemas/Channel) |
| NHI User | `slack_user` | [User](https://docs.jupiterone.io/data-model/schemas/User), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Team | `slack_team` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| User | `slack_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `slack_channel` | **HAS** | `slack_user` |
| `slack_team` | **HAS** | `slack_user` |

### Slack User

`slack_user` inherits from [User](/data-model/schemas/User.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `admin` | `boolean` |  |  |
| `apiAppId` | `string` | Slack App ID that owns this bot user (`profile.api_app_id`). Join key against the Slack app catalog. |  |
| `appUser` | `boolean` |  |  |
| `bot` | `boolean` |  |  |
| `botId` | `string` | Slack Bot ID for the bot user (`profile.bot_id`); identifies the bot installation distinct from the underlying app. |  |
| `mfaEnabled` | `boolean` |  |  |
| 
`nhiType` \*

 | `string` |  | **const**: bot |
| `primaryTeamOwner` | `boolean` |  |  |
| `realName` | `string` |  |  |
| `restricted` | `boolean` |  |  |
| `teamAdmin` | `boolean` |  |  |
| `teamOwner` | `boolean` |  |  |
| `ultraRestricted` | `boolean` |  |  |
| `updatedOn` | `number` |  |  |
| `userId` | `string` |  |  |
| `userType` | `string` |  |  |

---

### Slack User

`slack_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `admin` | `boolean` |  |  |
| `appUser` | `boolean` |  |  |
| `bot` | `boolean` |  |  |
| `mfaEnabled` | `boolean` |  |  |
| `primaryTeamOwner` | `boolean` |  |  |
| `realName` | `string` |  |  |
| `restricted` | `boolean` |  |  |
| `teamAdmin` | `boolean` |  |  |
| `teamOwner` | `boolean` |  |  |
| `ultraRestricted` | `boolean` |  |  |
| `updatedOn` | `number` |  |  |
| `userId` | `string` |  |  |
| `userType` | `string` |  |  |

---

---

Source: /integrations/directory/snipe-it

# Snipe-IT

Visualizes Snipe-IT information, map Snipe-IT users to hardware, and monitors changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create a read-access Snipe-IT API key for this integration. See [their documentation](https://snipe-it.readme.io/reference) for more information on obtaining your key for use with JupiterOne.

### Configuration in JupiterOne

To install the Snipe-IT integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Snipe-IT. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Snipe-IT account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Snipe-IT **Hostname** and **API Token** (configured for read access).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `snipeit_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Consumable | `snipeit_consumable_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Hardware | `snipeit_hardware` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| License | `snipeit_licensed_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Location | `snipeit_location` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| Service | `snipeit_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `snipeit_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `snipeit_account` | **PROVIDES** | `snipeit_service` |
| `snipeit_account` | **MANAGES** | `snipeit_location` |
| `snipeit_account` | **MANAGES** | `snipeit_hardware` |
| `snipeit_account` | **HAS** | `snipeit_consumable_resource` |
| `snipeit_account` | **HAS** | `snipeit_licensed_application` |
| `snipeit_account` | **HAS** | `snipeit_user` |
| `snipeit_hardware` | **INSTALLED** | `snipeit_licensed_application` |
| `snipeit_user` | **HAS** | `snipeit_hardware` |
| `snipeit_user` | **USES** | `snipeit_consumable_resource` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `snipeit_location` | **HAS** | `snipeit_hardware` | FORWARD |
| `snipeit_user` | **IS** | `snipeit_person` | FORWARD |

### Snipeit Account

`snipeit_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` |  |  |
| 
`displayName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`vendor` \*

 | `string` |  |  |

---

### Snipeit Consumable Resource

`snipeit_consumable_resource` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availableActions.checkin` | `boolean` | Please use isCheckinActionAvailable instead. | **deprecated**: true |
| `availableActions.checkout` | `boolean` | Please use isCheckoutActionAvailable instead. | **deprecated**: true |
| `availableActions.delete` | `boolean` | Please use isDeleteActionAvailable instead. | **deprecated**: true |
| `availableActions.update` | `boolean` | Please use isUpdateActionAvailable instead. | **deprecated**: true |
| `category.id` | `number` | Please use categoryId instead. | **deprecated**: true |
| `category.name` | `string` | Please use categoryName instead. | **deprecated**: true |
| `categoryId` | `number` |  |  |
| `categoryName` | `string` |  |  |
| `company.id` | `number` | Please use companyId instead. | **deprecated**: true |
| `company.name` | `string` | Please use companyName instead. | **deprecated**: true |
| `companyId` | `number` |  |  |
| `companyName` | `string` |  |  |
| 
`consumableId` \*

 | `number` |  |  |
| `image` | `string` **|** `null` |  |  |
| `isCheckinActionAvailable` | `boolean` |  |  |
| `isCheckoutActionAvailable` | `boolean` |  |  |
| `isDeleteActionAvailable` | `boolean` |  |  |
| `isUpdateActionAvailable` | `boolean` |  |  |
| `isUserAbleToCheckout` | `boolean` |  |  |
| `itemNo` | `string` |  |  |
| `location.id` | `number` | Please use locationId instead. | **deprecated**: true |
| `location.name` | `string` | Please use locationName instead. | **deprecated**: true |
| `locationId` | `number` |  |  |
| `locationName` | `string` |  |  |
| `manufacturer.id` | `number` | Please use manufacturerId instead. | **deprecated**: true |
| `manufacturer.name` | `string` | Please use manufacturerName instead. | **deprecated**: true |
| `manufacturerId` | `number` |  |  |
| `manufacturerName` | `string` |  |  |
| `minAmt` | `number` |  |  |
| `modelNumber` | `string` **|** `null` |  |  |
| `notes` | `array` of `string`s |  |  |
| `orderNumber` | `string` |  |  |
| `purchaseCost` | `string` **|** `null` |  |  |
| `purchaseDate` | `number` | Please use purchasedOn instead. | **deprecated**: true |
| `purchasedOn` | `number` |  |  |
| `qty` | `number` |  |  |
| `remaining` | `number` |  |  |
| `userCanCheckout` | `boolean` | Please use isUserAbleToCheckout instead. | **deprecated**: true |

---

### Snipeit Hardware

`snipeit_hardware` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assignedName` | `string` |  |  |
| `assignedType` | `string` |  | **Any of**:
-   `user`

-   `asset`

-   `location`

 |
| 

`byod` \*

 | `boolean` | Please use BYOD instead. | **deprecated**: true |
| `company` | `string` **|** `null` |  |  |
| 

`EOL` \*

 | `boolean` |  |  |
| `locationId` | `number` |  |  |
| `purchaseCost` | `string` **|** `null` |  |  |
| 

`statusMeta` \*

 | `string` |  |  |
| 

`statusName` \*

 | `string` |  |  |
| `supplier` | `string` |  |  |

---

### Snipeit Licensed Application

`snipeit_licensed_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `availableActions.checkin` | `boolean` | Please use availableActionsCheckin instead. | **deprecated**: true |
| `availableActions.checkout` | `boolean` | Please use availableActionsCheckout instead. | **deprecated**: true |
| `availableActions.delete` | `boolean` | Please use availableActionsDelete instead. | **deprecated**: true |
| `availableActions.update` | `boolean` | Please use availableActionsUpdate instead. | **deprecated**: true |
| `availableActionsCheckin` | `boolean` |  |  |
| `availableActionsCheckout` | `boolean` |  |  |
| `availableActionsDelete` | `boolean` |  |  |
| `availableActionsUpdate` | `boolean` |  |  |
| `category.id` | `number` | Please use categoryId instead. | **deprecated**: true |
| `category.name` | `string` | Please use categoryName instead. | **deprecated**: true |
| `categoryId` | `number` |  |  |
| `categoryName` | `string` |  |  |
| `company` | `string` |  |  |
| `depreciation` | `string` |  |  |
| `expirationDate` | `number` | Please use expirationOn instead. | **deprecated**: true |
| `expirationOn` | `number` |  |  |
| `freeSeatsCount` | `number` |  |  |
| `licenseEmail` | `string` |  |  |
| `licenseId` | `number` |  |  |
| `licenseName` | `string` |  |  |
| `maintained` | `boolean` |  |  |
| `manufacturer.id` | `number` | Please use manufacturerId instead. | **deprecated**: true |
| `manufacturer.name` | `string` | Please use manufacturerName instead. | **deprecated**: true |
| `manufacturerId` | `number` |  |  |
| `manufacturerName` | `string` |  |  |
| `notes` | `array` of `string`s |  |  |
| `orderNumber` | `string` |  |  |
| `productKey` | `string` |  |  |
| `purchaseCost` | `string` **|** `null` |  |  |
| `purchaseDate` | `number` | Please use purchasedOn instead. | **deprecated**: true |
| `purchasedOn` | `number` |  |  |
| `purchaseOrder` | `string` |  |  |
| `reassignable` | `boolean` |  |  |
| `seats` | `number` |  |  |
| `supplier.id` | `number` | Please use supplierId instead. | **deprecated**: true |
| `supplier.name` | `string` | Please use supplierName instead. | **deprecated**: true |
| `supplierId` | `number` |  |  |
| `supplierName` | `string` |  |  |
| `terminationDate` | `number` | Please use terminationOn instead. | **deprecated**: true |
| `terminationOn` | `number` |  |  |
| `userCanCheckout` | `boolean` |  |  |

---

### Snipeit Location

`snipeit_location` inherits from [Site](/data-model/schemas/Site.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `address` | `string` **|** `null` |  |  |
| `address2` | `string` **|** `null` |  |  |
| 
`assetsCount` \*

 | `number` |  |  |
| 

`assignedAssetsCount` \*

 | `number` |  |  |
| 

`city` \*

 | `string` |  |  |
| 

`country` \*

 | `string` |  |  |
| `currency` | `string` **|** `null` |  |  |
| `image` | `string` **|** `null` |  |  |
| `isCloneActionAvailable` | `boolean` |  |  |
| `isDeleteActionAvailable` | `boolean` |  |  |
| `isUpdateActionAvailable` | `boolean` |  |  |
| 

`locationId` \*

 | `number` |  |  |
| 

`rtdAssetsCount` \*

 | `number` |  |  |
| `state` | `string` **|** `null` |  |  |
| 

`usersCount` \*

 | `number` |  |  |
| `zip` | `string` **|** `null` |  |  |

---

### Snipeit Service

`snipeit_service` inherits from [Service](/data-model/schemas/Service.md)

---

### Snipeit User

`snipeit_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessoriesCount` | `number` |  |  |
| `address` | `string` **|** `null` |  |  |
| `assetsCount` | `number` |  |  |
| `avatar` | `string` |  |  |
| `city` | `string` **|** `null` |  |  |
| `company.id` | `number` | Please use companyId instead. | **deprecated**: true |
| `company.name` | `string` | Please use companyName instead. | **deprecated**: true |
| `companyId` | `number` |  |  |
| `companyName` | `string` |  |  |
| `consumablesCount` | `number` |  |  |
| `country` | `string` **|** `null` |  |  |
| `createdBy.id` | `number` | Please use createdById instead. | **deprecated**: true |
| `createdBy.name` | `string` | Please use createdByName instead. | **deprecated**: true |
| `createdById` | `number` |  |  |
| `createdByName` | `string` |  |  |
| `deletedAt` | `number` |  |  |
| `department.id` | `number` | Please use departmentId instead. | **deprecated**: true |
| `department.name` | `string` | Please use departmentName instead. | **deprecated**: true |
| `departmentId` | `number` |  |  |
| `departmentName` | `string` |  |  |
| `employeeNum` | `string` **|** `null` |  |  |
| `isLdapImport` | `boolean` |  |  |
| `jobtitle` | `string` **|** `null` |  |  |
| `lastLogin` | `number` |  |  |
| `ldapImport` | `boolean` | Please use isLdapImport instead. | **deprecated**: true |
| `licensesCount` | `number` |  |  |
| `locale` | `string` |  |  |
| `location.id` | `number` | Please use locationId instead. | **deprecated**: true |
| `location.name` | `string` | Please use locationName instead. | **deprecated**: true |
| `locationId` | `number` |  |  |
| `locationName` | `string` |  |  |
| `manager.id` | `number` | Please use managerId instead. | **deprecated**: true |
| `manager.name` | `string` | Please use managerName instead. | **deprecated**: true |
| `managerId` | `number` |  |  |
| `managerName` | `string` |  |  |
| `permissions.accessories.checkin` | `string` |  |  |
| `permissions.accessories.checkout` | `string` |  |  |
| `permissions.accessories.create` | `string` |  |  |
| `permissions.accessories.delete` | `string` |  |  |
| `permissions.accessories.edit` | `string` |  |  |
| `permissions.accessories.view` | `string` |  |  |
| `permissions.admin` | `string` |  |  |
| `permissions.assets.audit` | `string` |  |  |
| `permissions.assets.checkin` | `string` |  |  |
| `permissions.assets.checkout` | `string` |  |  |
| `permissions.assets.create` | `string` |  |  |
| `permissions.assets.delete` | `string` |  |  |
| `permissions.assets.edit` | `string` |  |  |
| `permissions.assets.view` | `string` |  |  |
| `permissions.assets.view.requestable` | `string` |  |  |
| `permissions.categories.create` | `string` |  |  |
| `permissions.categories.delete` | `string` |  |  |
| `permissions.categories.edit` | `string` |  |  |
| `permissions.categories.view` | `string` |  |  |
| `permissions.companies.create` | `string` |  |  |
| `permissions.companies.delete` | `string` |  |  |
| `permissions.companies.edit` | `string` |  |  |
| `permissions.companies.view` | `string` |  |  |
| `permissions.components.checkin` | `string` |  |  |
| `permissions.components.checkout` | `string` |  |  |
| `permissions.components.create` | `string` |  |  |
| `permissions.components.delete` | `string` |  |  |
| `permissions.components.edit` | `string` |  |  |
| `permissions.components.view` | `string` |  |  |
| `permissions.consumables.checkout` | `string` |  |  |
| `permissions.consumables.create` | `string` |  |  |
| `permissions.consumables.delete` | `string` |  |  |
| `permissions.consumables.edit` | `string` |  |  |
| `permissions.consumables.view` | `string` |  |  |
| `permissions.customfields.create` | `string` |  |  |
| `permissions.customfields.delete` | `string` |  |  |
| `permissions.customfields.edit` | `string` |  |  |
| `permissions.customfields.view` | `string` |  |  |
| `permissions.departments.create` | `string` |  |  |
| `permissions.departments.delete` | `string` |  |  |
| `permissions.departments.edit` | `string` |  |  |
| `permissions.departments.view` | `string` |  |  |
| `permissions.depreciations.create` | `string` |  |  |
| `permissions.depreciations.delete` | `string` |  |  |
| `permissions.depreciations.edit` | `string` |  |  |
| `permissions.depreciations.view` | `string` |  |  |
| `permissions.import` | `string` |  |  |
| `permissions.kits.create` | `string` |  |  |
| `permissions.kits.delete` | `string` |  |  |
| `permissions.kits.edit` | `string` |  |  |
| `permissions.kits.view` | `string` |  |  |
| `permissions.licenses.checkout` | `string` |  |  |
| `permissions.licenses.create` | `string` |  |  |
| `permissions.licenses.delete` | `string` |  |  |
| `permissions.licenses.edit` | `string` |  |  |
| `permissions.licenses.files` | `string` |  |  |
| `permissions.licenses.keys` | `string` |  |  |
| `permissions.licenses.view` | `string` |  |  |
| `permissions.locations.create` | `string` |  |  |
| `permissions.locations.delete` | `string` |  |  |
| `permissions.locations.edit` | `string` |  |  |
| `permissions.locations.view` | `string` |  |  |
| `permissions.manufacturers.create` | `string` |  |  |
| `permissions.manufacturers.delete` | `string` |  |  |
| `permissions.manufacturers.edit` | `string` |  |  |
| `permissions.manufacturers.view` | `string` |  |  |
| `permissions.models.create` | `string` |  |  |
| `permissions.models.delete` | `string` |  |  |
| `permissions.models.edit` | `string` |  |  |
| `permissions.models.view` | `string` |  |  |
| `permissions.reports.view` | `string` |  |  |
| `permissions.self.api` | `string` |  |  |
| `permissions.self.checkoutAssets` | `string` |  |  |
| `permissions.self.editLocation` | `string` |  |  |
| `permissions.self.twoFactor` | `string` |  |  |
| `permissions.statuslabels.create` | `string` |  |  |
| `permissions.statuslabels.delete` | `string` |  |  |
| `permissions.statuslabels.edit` | `string` |  |  |
| `permissions.statuslabels.view` | `string` |  |  |
| `permissions.superuser` | `string` **|** `integer` |  |  |
| `permissions.suppliers.create` | `string` |  |  |
| `permissions.suppliers.delete` | `string` |  |  |
| `permissions.suppliers.edit` | `string` |  |  |
| `permissions.suppliers.view` | `string` |  |  |
| `permissions.users.create` | `string` |  |  |
| `permissions.users.delete` | `string` |  |  |
| `permissions.users.edit` | `string` |  |  |
| `permissions.users.view` | `string` |  |  |
| `phone` | `string` **|** `null` |  |  |
| 
`remote` \*

 | `boolean` |  |  |
| `state` | `string` **|** `null` |  |  |
| 

`twoFactorEnrolled` \*

 | `boolean` |  |  |
| `userId` | `number` |  |  |
| `website` | `string` **|** `null` |  |  |
| `zip` | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-01-14** — Added hardware category filtering to the Snipe-IT integration, allowing ingestion to be limited to assets matching specific configured category IDs.
-   **2025-07-24** — Added configuration option to include Snipe-IT custom fields as properties on hardware asset entities.

---

Source: /integrations/directory/snowflake

# Snowflake

Visualize Snowflake cloud resources, map Snowflake users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> This integration reads from your Snowflake account using `SHOW` commands run under the connecting user's current role. Each `SHOW` command only returns objects the current role has at least one access privilege on, unless the role holds the **MANAGE GRANTS** privilege. By default, only the **ACCOUNTADMIN** and **SECURITYADMIN** roles hold **MANAGE GRANTS**, which lets them see every object in the account. To ingest a complete inventory, connect with a role that holds **MANAGE GRANTS** (or the equivalent broad grants).

### Prerequisites

Before you begin, make sure you have:

-   A Snowflake user that the integration can connect as, with its **account name** (for example, `xy12345.us-east-2.aws`).
-   A role for that user that can run `SHOW` commands across the objects you want to ingest. `SHOW USERS` only fills in user details (beyond the name) for a role that owns the user or holds **MANAGE GRANTS**, so use the **ACCOUNTADMIN** or **SECURITYADMIN** role, or a role that has been granted **MANAGE GRANTS**, for a complete inventory.
-   For the optional **Organization** and **Accounts** ingestion sources (disabled by default), the **Accounts** source runs `SHOW ACCOUNTS`, which only an organization administrator (the **ORGADMIN** role, in an ORGADMIN-enabled account) can run. Leave the **Accounts** source disabled if the integration's role is not an organization administrator.

### Choose an authentication method

This integration supports two authentication methods:

-   **Key Pair Authentication** (recommended)
-   **Basic Authentication**

Key pair authentication is recommended because it does not store a password in the integration configuration.

#### Create a key pair (Key Pair Authentication)

1.  Generate at least a 2048-bit RSA key pair in PEM format, following the [Snowflake key-pair authentication guide](https://docs.snowflake.com/en/user-guide/key-pair-auth). Encrypted private keys are supported; if you encrypt the key, note its passphrase.
2.  Assign the public key to the Snowflake user the integration will connect as.
3.  Set that user's `DEFAULT_ROLE` to the role described in the prerequisites. Key pair authentication has no **Role** field, so the integration runs under the user's default role.
4.  Keep the private key file available for the integration configuration in JupiterOne.

### Configuration in JupiterOne

To configure the Snowflake integration in JupiterOne:

1.  Navigate to the **Integrations** tab and select **Snowflake**.
2.  Click **New Instance** to begin the setup.
3.  Choose either **Key Pair Authentication - Recommended** or **Basic Authentication**.

Every integration instance also requires the following:

-   The **Account Name** used to identify the Snowflake account in JupiterOne. Ingested entities have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
-   A **Description** to assist in identifying the integration instance, if desired.
-   A **Polling Interval** that fits your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.

#### Key Pair Authentication (Recommended)

Creating an instance requires:

-   **Snowflake Account Name**: The full name of your account (for example, `xy12345.us-east-2.aws`).
-   **Username**: The Snowflake user login name to connect with.
-   **Private Key**: The Snowflake user's private key file. Encrypted and unencrypted keys are both supported.
-   **Private Key Passphrase**: The passphrase used to encrypt the private key file. Leave this empty when the private key is unencrypted.

#### Basic Authentication

Creating an instance requires:

-   **Snowflake Account Name**: The full name of your account (for example, `xy12345.us-east-2.aws`).
-   **Username**: The Snowflake user login name to connect with.
-   **Password**: The password for the Snowflake user.
-   **Role**: The default security role to use for the session after connecting.

Once all the values are provided, click **Create** to complete the integration setup.

### Next Steps

With your integration instance configured, it will start running based on the polling interval you selected, ingesting data into JupiterOne. For further details on managing your integration instance, refer to our [Instance Management Guide](/integrations/instance-management.md).

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (2)

-   `MANAGE GRANTS (ACCOUNTADMIN or SECURITYADMIN)`
-   `ORGADMIN (organization administrator)`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (11)

-   `SELECT CURRENT_ACCOUNT_NAME()`
-   `SELECT CURRENT_ORGANIZATION_NAME()`
-   `SHOW ACCOUNTS`
-   `SHOW DATABASES`
-   `SHOW GRANTS OF ROLE`
-   `SHOW GRANTS ON DATABASE`
-   `SHOW ROLES`
-   `SHOW SCHEMAS IN DATABASE`
-   `SHOW TABLES IN SCHEMA`
-   `SHOW USERS`
-   `SHOW WAREHOUSES`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (8)

-   [https://docs.snowflake.com/en/sql-reference/functions/current\_organization\_name](https://docs.snowflake.com/en/sql-reference/functions/current_organization_name)
-   [https://docs.snowflake.com/en/sql-reference/sql/show-accounts](https://docs.snowflake.com/en/sql-reference/sql/show-accounts)
-   [https://docs.snowflake.com/en/sql-reference/sql/show-databases](https://docs.snowflake.com/en/sql-reference/sql/show-databases)
-   [https://docs.snowflake.com/en/sql-reference/sql/show-roles](https://docs.snowflake.com/en/sql-reference/sql/show-roles)
-   [https://docs.snowflake.com/en/sql-reference/sql/show-schemas](https://docs.snowflake.com/en/sql-reference/sql/show-schemas)
-   [https://docs.snowflake.com/en/sql-reference/sql/show-tables](https://docs.snowflake.com/en/sql-reference/sql/show-tables)
-   [https://docs.snowflake.com/en/sql-reference/sql/show-users](https://docs.snowflake.com/en/sql-reference/sql/show-users)
-   [https://docs.snowflake.com/en/sql-reference/sql/show-warehouses](https://docs.snowflake.com/en/sql-reference/sql/show-warehouses)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (6)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Build Database Roles Relationships | `MANAGE GRANTS (ACCOUNTADMIN or SECURITYADMIN)` | `SHOW GRANTS ON DATABASE` |
| Build User Roles Relationships | `MANAGE GRANTS (ACCOUNTADMIN or SECURITYADMIN)` | `SHOW GRANTS OF ROLE` |
| Fetch Databases | `MANAGE GRANTS (ACCOUNTADMIN or SECURITYADMIN)` | `SHOW DATABASES` |
| Fetch Organization Accounts | `ORGADMIN (organization administrator)` | `SELECT CURRENT_ACCOUNT_NAME()`, `SHOW ACCOUNTS` |
| Fetch Schemas | `MANAGE GRANTS (ACCOUNTADMIN or SECURITYADMIN)` | `SHOW SCHEMAS IN DATABASE` |
| Fetch Tables | `MANAGE GRANTS (ACCOUNTADMIN or SECURITYADMIN)` | `SHOW TABLES IN SCHEMA` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `snowflake_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Database | `snowflake_database` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Organization | `snowflake_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Role | `snowflake_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Schema | `snowflake_schema` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| Table | `snowflake_table` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| User | `snowflake_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Warehouse | `snowflake_warehouse` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Database](https://docs.jupiterone.io/data-model/schemas/Database) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `snowflake_account` | **HAS** | `snowflake_user` |
| `snowflake_database` | **ALLOWS** | `snowflake_role` |
| `snowflake_database` | **HAS** | `snowflake_schema` |
| `snowflake_organization` | **HAS** | `snowflake_account` |
| `snowflake_schema` | **HAS** | `snowflake_table` |
| `snowflake_user` | **ASSIGNED** | `snowflake_role` |
| `snowflake_warehouse` | **HAS** | `snowflake_database` |

### Snowflake User

`snowflake_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `comment` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `defaultNamespace` | `string` |  |  |
| `defaultRole` | `string` |  |  |
| `defaultWarehouse` | `string` |  |  |
| `disabled` | `boolean` |  |  |
| `expiresAtTime` | `number` |  |  |
| `externalAuthDuoEnabled` | `boolean` |  |  |
| `externalAuthUid` | `string` |  |  |
| `fullName` | `string` |  |  |
| `hasPassword` | `boolean` |  |  |
| `hasRsaPublicKey` | `boolean` |  |  |
| `lastLogin` | `number` |  |  |
| `lockedUntilTime` | `number` |  |  |
| `loginName` | `string` |  |  |
| `minsToUnlock` | `string` |  |  |
| `mustChangePassword` | `boolean` |  |  |
| `owner` | `string` |  |  |
| `snowflakeLock` | `boolean` |  |  |

---

## Release Notes

-   **2025-02-28** — Added normalized email, email domain, and short login ID properties to Snowflake user entities.
-   **2024-10-11** — Added key-pair authentication support as an alternative to password-based authentication for Snowflake connections.
-   **2024-09-12** — Added Snowflake organization and account entities, enabling visibility into Snowflake organizational structure and account membership.

---

Source: /integrations/directory/snyk

# Snyk

Visualize Snyk code repositories and findings, and monitor changes through queries and alerts.

## Installation

To use this integration, JupiterOne requires a Snyk API token with at minimum **Org Viewer** access to the Snyk organization you want to ingest. If you are integrating at the group level (to ingest multiple organizations), the token must have **Group Viewer** access to the Snyk group.

> **INFO**
> 
> For more information on Snyk API authentication, refer to the [Snyk authentication documentation](https://docs.snyk.io/snyk-api/authentication-for-api).

### Prerequisites

1.  **Snyk API token** — Obtain your API token from Snyk:
    
    1.  Click your profile avatar in the upper-right corner of the Snyk dashboard.
    2.  Select **Account Settings**.
    3.  Under **General**, click **click to show** next to **Auth Token** and copy the value.
2.  **Organization ID or Group ID** — Provide one of the following:
    
    -   **Organization ID** — Found in Snyk under **Settings > General** for the organization. Required if ingesting a single organization.
    -   **Group ID** — Found in Snyk under **Group Settings > General**. Required if ingesting all organizations within a group.

### Configuration in JupiterOne

To install the Snyk integration in JupiterOne, navigate to the **Integrations** tab and select **Snyk**. Click **New Instance** to begin configuring your integration, providing the following:

-   **Account Name** — A label used to identify this integration instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the **AccountName** toggle is enabled.
    
-   **Description** — An optional description to help distinguish this instance from others.
    
-   **Polling Interval** — How often JupiterOne should collect data from Snyk. You may leave this as `DISABLED` and trigger the integration manually.
    
-   **API Key** — Your Snyk API token.
    
-   **Organization ID or Group ID** — Enter either your **Organization ID** (to ingest a single Snyk organization) or your **Group ID** (to ingest all organizations within a Snyk group). Exactly one of these is required.
    

Click **Create** after all values are provided.

## Data Volume Configuration

### Data Filtering Options

These optional settings control which findings are ingested. Reducing the scope can significantly lower the number of entities stored in JupiterOne.

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Issue Types** | The types of issues to fetch. When nothing is selected, all issue types are fetched. | All | Package Vulnerabilities, License Issues, Cloud Configuration Issues, Code Quality Issues, Custom Issues, Configuration Issues |
| **Severity Levels** | The severity levels of issues to fetch. When nothing is selected, all severity levels are fetched. | All | Critical, High, Medium, Low |
| **Include Resolved Findings** | When enabled, resolved findings are included alongside open findings. | Disabled | — |
| **Include Ignored Findings** | When enabled, ignored findings are included alongside non-ignored findings. | Disabled | — |

### Next steps

Once your integration instance is configured, it will begin running on the polling interval you selected. Continue on to our [instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (5)

-   `Group Viewer`
-   `Org Viewer`
-   `View Organization`
-   `View Project`
-   `View Project History`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (8)

-   `https://api.snyk.io/rest/orgs/{orgId}/issues`
-   `https://api.snyk.io/rest/orgs/{orgId}/projects`
-   `https://api.snyk.io/rest/orgs/{orgId}/projects/{projectId}/sbom`
-   `https://snyk.io/api/v1/group/{groupId}/orgs`
-   `https://snyk.io/api/v1/group/{groupId}/roles`
-   `https://snyk.io/api/v1/org/{orgId}/members`
-   `https://snyk.io/api/v1/org/{orgId}/project/{projectId}/history`
-   `https://snyk.io/api/v1/orgs`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (10)

-   [https://apidocs.snyk.io/?version=2023-05-29#get-/orgs/-org\_id-/projects](https://apidocs.snyk.io/?version=2023-05-29#get-/orgs/-org_id-/projects)
-   [https://apidocs.snyk.io/?version=2024-06-21#get-/orgs/-org\_id-/issues](https://apidocs.snyk.io/?version=2024-06-21#get-/orgs/-org_id-/issues)
-   [https://docs.snyk.io/snyk-admin/user-roles-and-permissions](https://docs.snyk.io/snyk-admin/user-roles-and-permissions)
-   [https://docs.snyk.io/snyk-api/authentication-for-api](https://docs.snyk.io/snyk-api/authentication-for-api)
-   [https://docs.snyk.io/snyk-api/reference/sbom](https://docs.snyk.io/snyk-api/reference/sbom)
-   [https://snyk.docs.apiary.io/#reference/groups/list-all-organisations-in-a-group/list-all-organisations-in-a-group](https://snyk.docs.apiary.io/#reference/groups/list-all-organisations-in-a-group/list-all-organisations-in-a-group)
-   [https://snyk.docs.apiary.io/#reference/groups/list-all-roles-in-a-group/list-all-roles-in-a-group](https://snyk.docs.apiary.io/#reference/groups/list-all-roles-in-a-group/list-all-roles-in-a-group)
-   [https://snyk.docs.apiary.io/#reference/organisations/members-in-organisation/list-members](https://snyk.docs.apiary.io/#reference/organisations/members-in-organisation/list-members)
-   [https://snyk.docs.apiary.io/#reference/orgs/the-snyk-organisation-for-a-request/list-all-the-organisations-a-user-belongs-to](https://snyk.docs.apiary.io/#reference/orgs/the-snyk-organisation-for-a-request/list-all-the-organisations-a-user-belongs-to)
-   [https://snyk.docs.apiary.io/#reference/projects/all-projects/list-all-projects](https://snyk.docs.apiary.io/#reference/projects/all-projects/list-all-projects)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (11)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Build Account and Organizations Relationship | \- | \- |
| Build Finding Coordinates | \- | \- |
| Build Group and Organizations Relationship | \- | \- |
| Build Project SCM Repo Relationships | \- | \- |
| Build User and Group Role Relationship | \- | \- |
| Build User and Role Relationship | \- | \- |
| Fetch Dependencies | `View Organization`, `View Project`, `View Project History` | `https://api.snyk.io/rest/orgs/{orgId}/projects/{projectId}/sbom` |
| Fetch findings | `Org Viewer` | `https://api.snyk.io/rest/orgs/{orgId}/issues` |
| Fetch Issues | \- | \- |
| Fetch Organization Members | `Org Viewer` | `https://snyk.io/api/v1/org/{orgId}/members` |
| Fetch Projects | `Org Viewer` | `https://api.snyk.io/rest/orgs/{orgId}/projects`, `https://snyk.io/api/v1/org/{orgId}/project/{projectId}/history` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Snyk Account | `snyk_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Snyk Coordinate | `snyk_finding_coordinate` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Snyk Coordinate Location | `snyk_finding_coordinate_location` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Snyk Dependency | `snyk_dependency` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Snyk Finding | `snyk_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Snyk Finding | `snyk_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Snyk Finding | `snyk_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Weakness](https://docs.jupiterone.io/data-model/schemas/Weakness) |
| Snyk Group | `snyk_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Snyk Issue | `snyk_issue` | [Issue](https://docs.jupiterone.io/data-model/schemas/Issue) |
| Snyk Organization | `snyk_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Snyk Project | `snyk_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Snyk Role | `snyk_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Snyk Service | `snyk_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Snyk User | `snyk_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `snyk_account` | **HAS** | `snyk_service` |
| `snyk_account` | **HAS** | `snyk_group` |
| `snyk_account` | **HAS** | `snyk_organization` |
| `snyk_finding` | **IDENTIFIED** | `snyk_finding_coordinate` |
| `snyk_finding_coordinate` | **HAS** | `snyk_finding_coordinate_location` |
| `snyk_group` | **HAS** | `snyk_organization` |
| `snyk_group` | **HAS** | `snyk_role` |
| `snyk_issue` | **REPORTED** | `snyk_finding` |
| `snyk_organization` | **HAS** | `snyk_project` |
| `snyk_organization` | **HAS** | `snyk_user` |
| `snyk_organization` | **HAS** | `snyk_role` |
| `snyk_project` | **HAS** | `snyk_finding` |
| `snyk_project` | **HAS** | `snyk_issue` |
| `snyk_project` | **HAS** | `snyk_dependency` |
| `snyk_service` | **SCANS** | `snyk_project` |
| `snyk_user` | **ASSIGNED** | `snyk_role` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `snyk_finding` | **IS** | `cve` | FORWARD |
| `snyk_finding` | **EXPLOITS** | `cwe` | FORWARD |
| `snyk_project` | **SCANS** | `github_repo` | FORWARD |
| `snyk_project` | **SCANS** | `bitbucket_repo` | FORWARD |
| `snyk_project` | **SCANS** | `azure_devops_repo` | FORWARD |
| `snyk_project` | **SCANS** | `gitlab_project` | FORWARD |

### Snyk Dependency

`snyk_dependency` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `bomRef` | `string` **|** `null` | The CycloneDX bom-ref uniquely identifying the component within its SBOM document. |  |
| `group` | `string` **|** `null` | The grouping name or namespace of the dependency (e.g. a Maven groupId). |  |
| `licenses` | `array` **|** `null` | The license identifiers or SPDX expressions declared for the dependency. |  |
| `packageType` | `string` **|** `null` | The CycloneDX component type of the dependency (e.g. library, framework, application). |  |
| `purl` | `string` **|** `null` | The Package URL (purl) identifying the dependency, e.g. pkg:npm/lodash@4.17.21. |  |
| `scope` | `string` **|** `null` | The scope of the dependency as declared in the SBOM (e.g. required, optional, excluded). |  |
| `version` | `string` **|** `null` | The version of the dependency. |  |

---

### Snyk Finding

`snyk_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cve` \*

 | `array` **|** `null` |  |  |
| 

`cvssScore` \*

 | `number` **|** `null` |  |  |
| 

`cwe` \*

 | `array` **|** `null` |  |  |
| `ignored` | `boolean` |  |  |
| `resolvedOn` | `number` | Timestamp when Snyk marked the finding resolved. Populated from attributes.resolution.resolved\_at; present only when status=resolved. |  |

---

### Snyk Finding

`snyk_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cve` \*

 | `array` **|** `null` |  |  |
| 

`cvssScore` \*

 | `number` **|** `null` |  |  |
| 

`cwe` \*

 | `array` **|** `null` |  |  |
| `ignored` | `boolean` |  |  |
| `resolvedOn` | `number` | Timestamp when Snyk marked the finding resolved. Populated from attributes.resolution.resolved\_at; present only when status=resolved. |  |

---

### Snyk Finding

`snyk_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Weakness](/data-model/schemas/Weakness.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cve` \*

 | `array` **|** `null` |  |  |
| 

`cvssScore` \*

 | `number` **|** `null` |  |  |
| 

`cwe` \*

 | `array` **|** `null` |  |  |
| `ignored` | `boolean` |  |  |
| `resolvedOn` | `number` | Timestamp when Snyk marked the finding resolved. Populated from attributes.resolution.resolved\_at; present only when status=resolved. |  |

---

### Snyk Finding Coordinate Location

`snyk_finding_coordinate_location` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`commitId` \*

 | `string` |  |  |
| 

`endColumn` \*

 | `number` |  |  |
| 

`endLine` \*

 | `number` |  |  |
| 

`file` \*

 | `string` |  |  |
| 

`rawPath` \*

 | `string` |  |  |
| 

`startColumn` \*

 | `number` |  |  |
| 

`startLine` \*

 | `number` |  |  |

---

### Snyk Issue

`snyk_issue` inherits from [Issue](/data-model/schemas/Issue.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`active` \*

 | `boolean` |  |  |
| `category` | `string` |  |  |
| `ignored` | `boolean` |  |  |
| 

`issueId` \*

 | `string` |  |  |
| `issueKey` | `string` |  |  |
| `issueType` | `string` |  |  |
| `numericSeverity` | `number` |  |  |
| `references` | `array` of `string`s |  |  |
| `resolutionDetails` | `string` | Free-form remediation context for the resolution. From attributes.resolution.details. May describe fix method (e.g., upgrade or patch) when available; often empty. |  |
| `resolutionType` | `string` | How Snyk resolved the issue. From attributes.resolution.type. Known values: "fixed" (remediated and no longer present), "disappeared" (no longer detected in latest scan), "ignored" (intentionally suppressed), "patched" (remediated via Snyk patch). |  |
| `resolvedOn` | `number` | Timestamp when Snyk marked the issue resolved. Populated from attributes.resolution.resolved\_at; present only when status=resolved. |  |
| `severity` | `string` |  |  |
| `status` | `string` |  |  |

---

### Snyk User

`snyk_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `active` | `boolean` |  |  |
| `admin` | `boolean` |  |  |
| `role` | `string` |  |  |

---

## Release Notes

-   **2026-10-08** — Snyk findings now include a resolution timestamp and last-updated timestamp, and the open status accurately reflects whether the finding has been resolved.
    
-   **2026-10-05** — Added ingestion of Snyk project dependencies from SBOM data, exposing the packages and libraries each project depends on.
    
-   **2026-07-09** — Snyk projects now link to their source code repositories in GitHub, Bitbucket, Azure DevOps, and GitLab via mapped relationships.
    
-   **2026-02-04** — Added ignored property to Snyk finding entities, indicating whether the finding has been suppressed.
    
-   **2026-01-14** — Added configuration options to include resolved and ignored Snyk findings in ingestion, in addition to the default open-only behavior.
    
-   **2025-11-18** — Added CVE ID to Snyk finding entities for unified vulnerability querying.
    
-   **2025-11-06** — Added repository full name property to Snyk finding entities.
    
-   **2025-09-09** — Added configuration options to filter Snyk finding ingestion by issue type and severity level.
    
-   **2025-08-11** — Added Snyk finding coordinate location entities, exposing source code file path, commit, and line and column positions for each finding.
    
-   **2025-06-13** — Added branch name and branch file path to Snyk finding entities for dependency context.

---

Source: /integrations/directory/socket

# Socket

Monitor your open source supply chain security with Socket. This integration ingests organizations, repositories, software packages and their dependency trees, security alerts, and vulnerability findings to provide visibility into supply chain risks, malware, typosquatting, and known CVEs across your dependencies.

## Installation

> **INFO**
> 
> You will need a Socket.dev API key to configure this integration. API keys can be created in the Socket dashboard under **Settings > API Keys**. See the [Socket API documentation](https://docs.socket.dev/reference/introduction-to-socket-api) for more information.

To install the Socket integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Socket. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **API Key** - Your Socket.dev API key (Bearer token) used to authenticate requests.
    
-   **Polling Interval** - Select a frequency that meets your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

### Configuration options

#### Alerts

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **Alert Severities** | Multi-select | Select which alert severities to ingest | Critical, High |
| **Alert Statuses** | Multi-select | Select which alert statuses to ingest | Open |
| **Alerts Since Days** | Select | Only ingest alerts created in the last N days | 90 |

#### Packages

| Field | Type | Description | Default |
| --- | --- | --- | --- |
| **Include Transitive Dependencies** | Boolean | Whether to ingest transitive (indirect) dependencies from full scans. Enabling this can produce very large graphs. | Enabled |
| **Repositories** | String | Comma-separated list of repository names to ingest. Leave empty to ingest all repositories. | All |

### What data is ingested?

| Data | Description |
| --- | --- |
| **Organizations** | Your Socket.dev organization account |
| **Repositories** | Code repositories monitored by Socket, with mapped relationships to GitHub repos when the GitHub App is installed |
| **Packages** | Software packages and dependencies discovered via full scans, including health scores (overall, license, maintenance, quality, supply chain, vulnerability) |
| **Dependency Trees** | Package-to-package USES relationships representing the dependency graph within each repository |
| **Alerts** | Security alerts for non-CVE issues (malware, typosquatting, install scripts, etc.) |
| **Vulnerability Findings** | CVE-linked vulnerability findings with CVSS scores, CWE IDs, EPSS scores, and KEV status |

### Required API scopes

The following Socket.dev API scopes are required for full ingestion:

| Scope | Used by |
| --- | --- |
| _(no extra scope)_ | Listing organizations |
| `repo:list` | Listing repositories |
| `full-scans:list` | Streaming package data from full scans |
| `alerts:list` | Listing security alerts |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (3)

-   `alerts:list`
-   `full-scans:list`
-   `repo:list`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (4)

-   `https://api.socket.dev/v0/organizations`
-   `https://api.socket.dev/v0/orgs/{org_slug}/alerts`
-   `https://api.socket.dev/v0/orgs/{org_slug}/full-scans/{full_scan_id}`
-   `https://api.socket.dev/v0/orgs/{org_slug}/repos`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (4)

-   [https://docs.socket.dev/reference/get-full-scan](https://docs.socket.dev/reference/get-full-scan)
-   [https://docs.socket.dev/reference/get-org-alerts](https://docs.socket.dev/reference/get-org-alerts)
-   [https://docs.socket.dev/reference/get-organizations](https://docs.socket.dev/reference/get-organizations)
-   [https://docs.socket.dev/reference/get-repositories](https://docs.socket.dev/reference/get-repositories)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (3)

| Step | OAuth Scopes | Endpoints |
| --- | --- | --- |
| Fetch Alerts | `alerts:list` | `https://api.socket.dev/v0/orgs/{org_slug}/alerts` |
| Fetch Packages | `full-scans:list` | `https://api.socket.dev/v0/orgs/{org_slug}/full-scans/{full_scan_id}` |
| Fetch Repositories | `repo:list` | `https://api.socket.dev/v0/orgs/{org_slug}/repos` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Alert | `socket_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Organization | `socket_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Package | `socket_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Repository | `socket_repository` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Service | `socket_supply_chain_scanner` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Vulnerability Finding | `socket_vulnerability_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `socket_organization` | **HAS** | `socket_supply_chain_scanner` |
| `socket_organization` | **HAS** | `socket_repository` |
| `socket_package` | **USES** | `socket_package` |
| `socket_package` | **HAS** | `socket_alert` |
| `socket_package` | **HAS** | `socket_vulnerability_finding` |
| `socket_repository` | **HAS** | `socket_package` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `socket_repository` | **IS** | `github_repo` | FORWARD |

### Socket Alert

`socket_alert` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alertKey` \*

 | `string` | Unique alert instance key |  |
| 

`alertType` \*

 | `string` | Type of alert (e.g. typosquat, malware, install, phantom, obfuscatedCode) |  |
| 

`clearedOn` \*

 | `number` **|** `null` | Timestamp when the alert was cleared |  |
| 

`fixDescription` \*

 | `string` **|** `null` | Recommended fix description |  |
| 

`fixType` \*

 | `string` **|** `null` | Recommended fix type (e.g. upgrade, remove) |  |
| 

`webLink` \*

 | `string` | URL to the alert dashboard |  |

---

### Socket Organization

`socket_organization` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`logoUrl` \*

 | `string` **|** `null` | URL of the organization logo |  |
| 

`plan` \*

 | `string` | Subscription plan name |  |
| 

`slug` \*

 | `string` | Organization slug identifier |  |
| 

`vendor` \*

 | `string` | Vendor name |  |

---

### Socket Package

`socket_package` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`author` \*

 | `array` **|** `null` | Package authors or maintainers |  |
| 

`isDead` \*

 | `boolean` | Whether this package is deprecated or abandoned |  |
| 

`isDev` \*

 | `boolean` | Whether this is a development-only dependency |  |
| 

`isDirect` \*

 | `boolean` | Whether this is a direct dependency |  |
| 

`license` \*

 | `string` **|** `null` | SPDX license identifier |  |
| 

`namespace` \*

 | `string` | Package namespace or scope |  |
| 

`packageType` \*

 | `string` | Package ecosystem type (e.g. npm, pypi, maven) |  |
| 

`size` \*

 | `number` **|** `null` | Total size of the package in bytes |  |
| 

`socketScoreLicense` \*

 | `number` **|** `null` | Socket license score (0.0–1.0) |  |
| 

`socketScoreMaintenance` \*

 | `number` **|** `null` | Socket maintenance score (0.0–1.0) |  |
| 

`socketScoreOverall` \*

 | `number` **|** `null` | Socket overall score (0.0–1.0) |  |
| 

`socketScoreQuality` \*

 | `number` **|** `null` | Socket quality score (0.0–1.0) |  |
| 

`socketScoreSupplyChain` \*

 | `number` **|** `null` | Socket supply chain score (0.0–1.0) |  |
| 

`socketScoreVulnerability` \*

 | `number` **|** `null` | Socket vulnerability score (0.0–1.0) |  |
| 

`version` \*

 | `string` | Package version string |  |

---

### Socket Repository

`socket_repository` inherits from [CodeRepo](/data-model/schemas/CodeRepo.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`defaultBranch` \*

 | `string` **|** `null` | Default branch name |  |
| 

`githubRepoName` \*

 | `string` **|** `null` | Associated GitHub repository name (owner/repo) when GitHub App is installed |  |
| 

`headFullScanId` \*

 | `string` **|** `null` | ID of the most recent full scan for this repository |  |
| 

`isArchived` \*

 | `boolean` | Whether the repository is archived |  |
| 

`isPublic` \*

 | `boolean` | Whether the repository is publicly visible |  |
| 

`slug` \*

 | `string` | Repository slug identifier |  |
| 

`workspace` \*

 | `string` | Workspace this repository belongs to |  |

---

### Socket Supply Chain Scanner

`socket_supply_chain_scanner` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s | Service categories |  |
| 

`vendor` \*

 | `string` | Vendor name |  |

---

### Socket Vulnerability Finding

`socket_vulnerability_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alertKey` \*

 | `string` | Unique alert instance key |  |
| 

`alertType` \*

 | `string` | Type of alert |  |
| 

`clearedOn` \*

 | `number` **|** `null` | Timestamp when the finding was cleared |  |
| 

`cveId` \*

 | `string` **|** `null` | CVE identifier |  |
| 

`cvssScore` \*

 | `number` **|** `null` | CVSS base score |  |
| 

`cvssVector` \*

 | `string` **|** `null` | CVSS vector string |  |
| 

`cweIds` \*

 | `array` **|** `null` | CWE identifiers |  |
| 

`epssPercentile` \*

 | `number` **|** `null` | EPSS percentile ranking |  |
| 

`epssScore` \*

 | `number` **|** `null` | EPSS probability score |  |
| 

`fixedVersion` \*

 | `string` **|** `null` | First patched version identifier |  |
| 

`ghsaIds` \*

 | `array` **|** `null` | GitHub Security Advisory identifiers |  |
| 

`isKev` \*

 | `boolean` **|** `null` | Whether this is a CISA Known Exploited Vulnerability |  |
| 

`webLink` \*

 | `string` | URL to the alert dashboard |  |

---

---

Source: /integrations/directory/sonarcloud

# SonarCloud

Visualize SonarCloud data, map SonarCloud users to employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an API key on SonarCloud for this integration. See [their documentation](https://docs.sonarcloud.io/advanced-setup/user-accounts/) for more information.

### Configuration in JupiterOne

To install the SonarCloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select SonarCloud. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the SonarCloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your SonarCloud **API Token** and **Organization Keys** to be ingested. For instances that wish to ingest multiple SonarCloud organizations, be sure to separate each organization key with a comma.
    

The organization key can be found at: [https://sonarcloud.io/organizations/YOUR-ORGANIZATION/edit](https://sonarcloud.io/organizations/YOUR-ORGANIZATION/edit). At the bottom of the page, you will find the "Edit organization key" section, which displays the exact organization key. You can also find it by clicking your user icon in the top right corner and selecting your organization. Once selected, a label such as "Key: YOUR-ORG-KEY" will appear in the same corner.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Issue | `sonarcloud_issue` | [Issue](https://docs.jupiterone.io/data-model/schemas/Issue) |
| Organization | `sonarcloud_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Project | `sonarcloud_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| User | `sonarcloud_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| UserGroup | `sonarcloud_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sonarcloud_group` | **HAS** | `sonarcloud_user` |
| `sonarcloud_organization` | **HAS** | `sonarcloud_group` |
| `sonarcloud_organization` | **HAS** | `sonarcloud_project` |
| `sonarcloud_project` | **HAS** | `sonarcloud_issue` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `sonarcloud_project` | **SCANS** | `CodeRepo` | FORWARD |

### Sonarcloud User

`sonarcloud_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `organizationAdmin` | `boolean` |  |  |

---

---

Source: /integrations/directory/sonarqube

# SonarQube

Visualize Sonarqube projects and users, map Sonarqube users to employees, and monitor user changes through queries and alerts.

## Installation

The SonarQube integration ingests projects, users, user groups, and code findings using the SonarQube REST API. Before configuring the integration in JupiterOne, create a SonarQube API token for a user with the required permissions.

### Prerequisites

The API token must belong to a user with the **Administer System** global permission. This permission allows the integration to enumerate all projects, users, and user groups across your SonarQube instance. See [Managing permissions](https://docs.sonarsource.com/sonarqube-server/instance-administration/user-management/user-permissions/) in the SonarQube documentation for details on setting global permissions.

### Creating an API token in SonarQube

1.  Log in to SonarQube as a user with the **Administer System** permission.
2.  Click your avatar in the top-right corner and select **My Account**.
3.  Go to the **Security** tab.
4.  Under **Tokens**, enter a descriptive name (for example, `JupiterOne`) and click **Generate**.
5.  Copy the generated token — it is shown only once.

See [Managing your tokens](https://docs.sonarsource.com/sonarqube-server/user-guide/managing-tokens/) for further guidance.

> **NOTE**
> 
> If connecting to SonarQube from JupiterOne-hosted infrastructure, the SonarQube instance must be reachable at a public URL (for example, `https://sonarqube.example.com`).

### Configuration in JupiterOne

To install the SonarQube integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select SonarQube. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the SonarQube account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Base Url**: The URL of your SonarQube instance (for example, `https://sonarqube.example.com`).
    
-   **API Token**: The token generated in the previous step.
    

Click **Create** once all values are provided to finalize the integration.

### Data Volume Configuration

The following optional settings control the scope and volume of findings data ingested. Narrowing these filters reduces the number of entities created in JupiterOne.

#### Ingestion Windows

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| Findings Ingestion Window | Limits findings ingestion to those created within the specified number of days. | 90 | 90, 180, 275, 365 |

#### Data Filtering Options

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| Findings Severities | Limits findings ingestion to the selected severity levels. Values in parentheses apply to SonarQube 10.4 and later. | MAJOR (MEDIUM), CRITICAL (HIGH), BLOCKER (HIGH) | INFO (LOW), MINOR (LOW), MAJOR (MEDIUM), CRITICAL (HIGH), BLOCKER (HIGH) |
| Findings Statuses | Limits findings ingestion to the selected issue statuses. Values in parentheses apply to SonarQube 10.4 and later. | All statuses enabled | OPEN, CONFIRMED, REOPENED (FALSE\_POSITIVE), RESOLVED (ACCEPTED), CLOSED (FIXED) |
| Findings Types | Limits findings ingestion to the selected finding types. Values in parentheses apply to SonarQube 10.4 and later. | VULNERABILITY (SECURITY) | CODE\_SMELL (MAINTAINABILITY), BUG (RELIABILITY), VULNERABILITY (SECURITY) |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (2)

-   `Administer System`
-   `Browse (on each project)`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (8)

-   `GET {baseUrl}/api/issues/search`
-   `GET {baseUrl}/api/projects/search`
-   `GET {baseUrl}/api/user_groups/search`
-   `GET {baseUrl}/api/users/groups`
-   `GET {baseUrl}/api/users/search`
-   `GET {baseUrl}/api/v2/authorizations/group-memberships`
-   `GET {baseUrl}/api/v2/authorizations/groups`
-   `GET {baseUrl}/api/v2/users-management/users`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (4)

-   [https://docs.sonarsource.com/sonarqube-server/extension-guide/web-api/](https://docs.sonarsource.com/sonarqube-server/extension-guide/web-api/)
-   [https://docs.sonarsource.com/sonarqube-server/instance-administration/user-management/user-permissions/](https://docs.sonarsource.com/sonarqube-server/instance-administration/user-management/user-permissions/)
-   [https://docs.sonarsource.com/sonarqube-server/project-administration/setting-project-permissions/](https://docs.sonarsource.com/sonarqube-server/project-administration/setting-project-permissions/)
-   [https://docs.sonarsource.com/sonarqube-server/user-guide/managing-tokens/](https://docs.sonarsource.com/sonarqube-server/user-guide/managing-tokens/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Build user group user relationship | `Administer System` | `GET {baseUrl}/api/users/groups`, `GET {baseUrl}/api/v2/authorizations/group-memberships` |
| Fetch Project Findings | `Browse (on each project)` | `GET {baseUrl}/api/issues/search` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `sonarqube_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Finding | `sonarqube_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Project | `sonarqube_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| User | `sonarqube_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| UserGroup | `sonarqube_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sonarqube_account` | **HAS** | `sonarqube_project` |
| `sonarqube_account` | **HAS** | `sonarqube_user_group` |
| `sonarqube_account` | **HAS** | `sonarqube_user` |
| `sonarqube_project` | **HAS** | `sonarqube_finding` |
| `sonarqube_user_group` | **HAS** | `sonarqube_user` |

---

Source: /integrations/directory/sophos

# Sophos

Visualize Sophos endpoint agents and protected devices, map agents to devices and their respective owners, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need to create an API credential in the Sophos Central Admin console. See the [Sophos Getting Started (Tenant)](https://developer.sophos.com/getting-started-tenant/) documentation for details.

### Prerequisites

-   A Sophos Central (Sophos Fusion) **tenant** account. This integration only accepts tenant credentials; partner and organization credentials are rejected.
-   The person creating the API credential must hold the **Super Admin** role in Sophos Central. While the Sophos APIs are in Preview, all access runs at the Super Admin level.

### Create the API credential

1.  Sign in to Sophos Central Admin at [https://central.sophos.com/manage](https://central.sophos.com/manage).
2.  Click **Global Settings**, then **API Credentials**.
3.  Click **Add**, supply a name and a description, then click **Add**.
4.  Copy the **Client ID**, then reveal and copy the **Client Secret**.

Keep the Client ID and Client Secret available for the next step.

### Configuration in JupiterOne

To install the Sophos integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Sophos**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Sophos tenant account in JupiterOne.
    
-   An optional **Description** to help identify the integration instance.
    
-   A **Polling Interval** for how frequently data is refreshed. Leave this as `DISABLED` to trigger runs manually.
    
-   Your Sophos **Client ID** to authenticate with the Sophos Central API.
    
-   Your Sophos **Client Secret** that pairs with the Client ID.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `Super Admin`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (8)

-   `https://api-{dataRegion}.central.sophos.com/common/v1/alerts`
-   `https://api-{dataRegion}.central.sophos.com/common/v1/directory/user-groups`
-   `https://api-{dataRegion}.central.sophos.com/common/v1/directory/users`
-   `https://api-{dataRegion}.central.sophos.com/common/v1/roles`
-   `https://api-{dataRegion}.central.sophos.com/endpoint/v1/endpoint-groups`
-   `https://api-{dataRegion}.central.sophos.com/endpoint/v1/endpoints`
-   `https://api-{dataRegion}.central.sophos.com/endpoint/v1/policies`
-   `https://api.central.sophos.com/whoami/v1`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (9)

-   [https://developer.sophos.com/concepts/authentication/](https://developer.sophos.com/concepts/authentication/)
-   [https://developer.sophos.com/getting-started-tenant/](https://developer.sophos.com/getting-started-tenant/)
-   [https://developer.sophos.com/reference/common-v1/alerts/get-alerts/](https://developer.sophos.com/reference/common-v1/alerts/get-alerts/)
-   [https://developer.sophos.com/reference/common-v1/directory-management/list-tenant-user-groups/](https://developer.sophos.com/reference/common-v1/directory-management/list-tenant-user-groups/)
-   [https://developer.sophos.com/reference/common-v1/directory-management/list-tenant-users/](https://developer.sophos.com/reference/common-v1/directory-management/list-tenant-users/)
-   [https://developer.sophos.com/reference/common-v1/tenant-role-management/list-tenant-roles/](https://developer.sophos.com/reference/common-v1/tenant-role-management/list-tenant-roles/)
-   [https://developer.sophos.com/reference/endpoint-v1/endpoint-groups-management/list-tenant-endpoint-groups/](https://developer.sophos.com/reference/endpoint-v1/endpoint-groups-management/list-tenant-endpoint-groups/)
-   [https://developer.sophos.com/reference/endpoint-v1/endpoints/list-endpoints-by-tenant-id/](https://developer.sophos.com/reference/endpoint-v1/endpoints/list-endpoints-by-tenant-id/)
-   [https://developer.sophos.com/reference/endpoint-v1/policy-management/get-policies/](https://developer.sophos.com/reference/endpoint-v1/policy-management/get-policies/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (7)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Fetch Alerts | `Super Admin` | `https://api-{dataRegion}.central.sophos.com/common/v1/alerts` |
| Fetch Endpoints | `Super Admin` | `https://api-{dataRegion}.central.sophos.com/endpoint/v1/endpoints` |
| Fetch Endpoints Groups | `Super Admin` | `https://api-{dataRegion}.central.sophos.com/endpoint/v1/endpoint-groups` |
| Fetch Policies | `Super Admin` | `https://api-{dataRegion}.central.sophos.com/endpoint/v1/policies` |
| Fetch Roles | `Super Admin` | `https://api-{dataRegion}.central.sophos.com/common/v1/roles` |
| Fetch User Groups | `Super Admin` | `https://api-{dataRegion}.central.sophos.com/common/v1/directory/user-groups` |
| Fetch Users | `Super Admin` | `https://api-{dataRegion}.central.sophos.com/common/v1/directory/users` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Alert | `sophos_alert` | [Alert](https://docs.jupiterone.io/data-model/schemas/Alert) |
| Device | `sophos_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Endpoint | `sophos_endpoint` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Endpoint Group | `sophos_endpoint_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Policy | `sophos_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Role | `sophos_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Sophos Account | `sophos_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Sophos Common | `sophos_common` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Sophos Endpoint Protection | `sophos_endpoint_protection` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Sophos User | `sophos_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| User Group | `sophos_user_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sophos_account` | **HAS** | `sophos_common` |
| `sophos_account` | **HAS** | `sophos_endpoint_protection` |
| `sophos_alert` | **ASSIGNED** | `sophos_user` |
| `sophos_alert` | **ASSIGNED** | `sophos_user_group` |
| `sophos_alert` | **ASSIGNED** | `sophos_endpoint` |
| `sophos_alert` | **ASSIGNED** | `sophos_endpoint_group` |
| `sophos_common` | **HAS** | `sophos_role` |
| `sophos_common` | **HAS** | `sophos_user_group` |
| `sophos_endpoint` | **PROTECTS** | `sophos_device` |
| `sophos_endpoint` | **IDENTIFIED** | `sophos_alert` |
| `sophos_endpoint_group` | **HAS** | `sophos_endpoint` |
| `sophos_endpoint_protection` | **HAS** | `sophos_endpoint` |
| `sophos_user` | **HAS** | `sophos_endpoint` |
| `sophos_user_group` | **HAS** | `sophos_user` |

### Sophos Account

`sophos_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`id` \*

 | `string` |  |  |
| 

`idType` \*

 | `string` |  | **const**: tenant |

---

### Sophos Alert

`sophos_alert` inherits from [Alert](/data-model/schemas/Alert.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allowedActions` \*

 | `array` of `string`s |  |  |
| 

`category` \*

 | `string` |  | **Any of**:

-   `azure`

-   `adSync`

-   `applicationControl`

-   `appReputation`

-   `blockListed`

-   `connectivity`

-   `cwg`

-   `denc`

-   `downloadReputation`

-   `endpointFirewall`

-   `fenc`

-   `forensicSnapshot`

-   `general`

-   `isolation`

-   `malware`

-   `mtr`

-   `mobiles`

-   `policy`

-   `protection`

-   `pua`

-   `runtimeDetections`

-   `security`

-   `smc`

-   `systemHealth`

-   `uav`

-   `uncategorized`

-   `updating`

-   `utm`

-   `virt`

-   `wireless`

-   `xgEmail`

-   `ztnaAuthentication`

-   `ztnaGateway`

-   `ztnaResource`

 |
| `createdAt` | `number` |  |  |
| 

`description` \*

 | `string` |  |  |
| 

`groupKey` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `product` | `string` |  | **Any of**:

-   `other`

-   `endpoint`

-   `server`

-   `mobile`

-   `encryption`

-   `emailGateway`

-   `webGateway`

-   `phishThreat`

-   `wireless`

-   `firewall`

-   `ztna`

 |
| `raisedAt` | `string` |  | 

**Format**: `date-time`

  
 |
| `severity` | `string` |  | **Any of**:

-   `high`

-   `medium`

-   `low`

 |
| `type` | `string` |  |  |

---

### Sophos Common

`sophos_common` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`principal` \*

 | `string` |  |  |

---

### Sophos Device

`sophos_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `online` | `boolean` |  |  |
| `platform` | `string` |  |  |
| `tamperProtectionEnabled` | `boolean` |  |  |
| `type` | `string` |  |  |

---

### Sophos Endpoint

`sophos_endpoint` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` | Uses the endpoint's hostname if available. Uses associated person's name or "viaLogin" property as a fall back |  |
| 

`hostname` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `ipv4Addresses` | `array` of `string`s |  | 

**Format**: `ipv4`

  
 |
| `ipv6Addresses` | `array` of `string`s |  | 

**Format**: `ipv6`

  
 |
| 

`lastSeenOn` \*

 | `number` |  |  |
| `macAddresses` | `array` of `string`s |  |  |
| 

`name` \*

 | `string` | Uses the endpoint's hostname if available. Uses associated person's name or "viaLogin" property as a fall back |  |
| `online` | `boolean` |  |  |
| `tamperProtectionEnabled` | `boolean` |  |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `computer`

-   `server`

-   `securityVm`

 |

---

### Sophos Endpoint Group

`sophos_endpoint_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` |  |  |
| `description` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `computer`

-   `server`

 |
| `updatedAt` | `number` |  |  |

---

### Sophos Endpoint Protection

`sophos_endpoint_protection` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accountId` \*

 | `string` |  |  |
| 

`principal` \*

 | `string` |  |  |

---

### Sophos Policy

`sophos_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` |  |  |
| `disableAt` | `number` | When the policy should be turned off. |  |
| 
`enabled` \*

 | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lockedByManagingAccount` \*

 | `boolean` | Whether the policy is managed by a partner or organization, 'true' mean yes. |  |
| 

`name` \*

 | `string` |  |  |
| 

`priority` \*

 | `number` |  |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `threat-protection`

-   `peripheral-control`

-   `application-control`

-   `data-loss-prevention`

-   `web-control`

-   `agent-updating`

-   `windows-firewall`

-   `device-encryption`

-   `server-threat-protection`

-   `server-peripheral-control`

-   `server-application-control`

-   `server-web-control`

-   `server-lockdown`

-   `server-data-loss-prevention`

-   `server-agent-updating`

-   `server-windows-firewall`

-   `server-file-integrity-monitoring`

-   `server-linux-runtime-detection`

 |
| `updatedAt` | `number` |  |  |

---

### Sophos Role

`sophos_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` |  |  |
| `description` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`permissionSets` \*

 | `array` of `string`s |  |  |
| 

`principalType` \*

 | `string` |  | **Any of**:

-   `user`

-   `service`

 |
| 

`systemRole` \*

 | `boolean` | Indicates that this role is a system role, not a custom user-defined role. True if `type == 'predefined'` |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `predefined`

-   `custom`

 |
| `updatedAt` | `number` |  |  |

---

### Sophos User

`sophos_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` |  |  |
| `domain` | `string` |  |  |
| `exchangeLogin` | `string` |  |  |
| `updatedAt` | `number` |  |  |

---

### Sophos User Group

`sophos_user_group` inherits from [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdAt` | `number` |  |  |
| `description` | `string` |  |  |
| `domain` | `string` |  |  |
| 
`id` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |
| `source` | `string` |  | **Any of**:

-   `custom`

-   `activeDirectory`

-   `azureActiveDirectory`

 |
| `updatedAt` | `number` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS details display for Sophos endpoint entities to include OS name and build number.

---

Source: /integrations/directory/spektion

# Spektion

Visualize the devices running the Spektion sensor and the CVEs Spektion observes through runtime telemetry, enriched with CVSS, EPSS, CISA KEV and the Spektion runtime risk score. Map vulnerabilities to the devices they affect, and monitor changes through queries and alerts.

## Installation

This integration connects to the **Spektion Public API** (`https://api.spektion.com/v1`) and ingests the devices the Spektion sensor reports on (assets) and the CVEs present in your organization (vulnerability findings). Every request is a read-only `GET`. The integration is managed by JupiterOne and runs in the JupiterOne cloud, so no collector is needed.

### Prerequisites

-   A **Spektion** organization with the Spektion sensor deployed to your devices.
-   A Spektion **administrator** account, to create an API key in the Admin Console.
-   Access to **JupiterOne** with permission to configure integrations.

### Configuration in Spektion

The integration authenticates with a Spektion Public API key, sent as `Authorization: Bearer <key>` on every request. An API key grants read access to your organization's security data, so treat it as a credential.

#### Create the API key

1.  Sign in to the Spektion console as an administrator.
2.  Open the **Admin Console** (gear icon, top right), then go to **Connect** > **API Keys**.
3.  Create a key, give it a descriptive name such as `JupiterOne`, and set an expiration date.
4.  Copy the key right away and store it somewhere safe. It is shown only once, and you will paste it into JupiterOne.

Spektion recommends one key per integration. Note the expiration date: when the key expires, the integration stops ingesting until you add a new key to the instance.

### Configuration in JupiterOne

To install the Spektion integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Spektion**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Spektion account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Authentication** field below.
    

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **API Key** | Yes | The Spektion Public API key created above. It is sent as `Authorization: Bearer <key>`. |

When you save the instance, JupiterOne checks the key by requesting one asset from the Spektion API. An invalid or expired key is reported as an authentication error.

#### Vulnerability Filters

All filters are optional and apply only to vulnerability findings. They are sent to the Spektion API, so findings outside the filters are never read and do not count against the API rate limit. Leave them empty to ingest every CVE in your organization. Assets are not filtered.

| Field | Default | Description |
| --- | --- | --- |
| **Severities** | Empty (all severities) | Ingest only findings with these severities. Options are **Critical**, **High**, **Medium**, **Low**, **Informational** and **Unknown**. |
| **CISA KEV only** | Off | Ingest only CVEs in the CISA Known Exploited Vulnerabilities catalog. When off, KEV and non-KEV CVEs are both ingested. |
| **SLA Statuses** | Empty (all SLA statuses) | Ingest only findings with these SLA statuses, as computed from your Spektion SLA policy. Options are **Overdue**, **Due today**, **Due soon** and **On track**. |
| **Exploit Maturity** | Empty (all exploit maturities) | Ingest only findings at exactly this exploit maturity. Options are **None (no known exploit data)**, **Proof of concept**, **Weaponized PoC** and **Exploited in the wild**. |
| **EPSS Minimum** | Empty (0) | Inclusive lower bound on the EPSS score. Options are **0**, **0.01**, **0.05**, **0.1**, **0.2**, **0.3**, **0.5**, **0.7**, **0.9** and **1**. |
| **EPSS Maximum** | Empty (1) | Inclusive upper bound on the EPSS score, with the same options as **EPSS Minimum**. |

**EPSS Minimum** must be less than or equal to **EPSS Maximum**: an instance with a minimum greater than the maximum is rejected when you save it.

Click **Create** once all values are provided to finalize the integration.

> **CAUTION**
> 
> Narrowing a filter later removes findings from JupiterOne. Findings that no longer match the **Vulnerability Filters** on the next run are deleted from the graph, together with their relationships to assets.

#### Data Sources

Each data source can be enabled or disabled on its own. **All data sources are disabled by default**, so enable the ones you want to ingest. The `spektion_account` and `spektion_service` entities are always created.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Assets** | Devices the Spektion sensor reports on, ingested for device unification, with their hostname, IP address, operating system, sensor version, online state and last-seen date. | `spektion_asset` |
| **Vulnerability Findings** | CVEs present in the organization, limited by the **Vulnerability Filters**, with CVSS, EPSS, CISA KEV, exploit maturity, SLA status, the Spektion risk score and the affected software products and versions. | `spektion_finding` |

To ingest everything the integration supports, enable both **Assets** and **Vulnerability Findings**.

Each finding represents one CVE across your organization. The devices it affects are linked to it by relationships, so a CVE found on many devices is a single `spektion_finding` with one relationship per affected device.

Relationships are built only when every data source they need is enabled:

| Relationship | Requires |
| --- | --- |
| `spektion_account` **PROVIDES** `spektion_service` | Always created |
| `spektion_service` **IDENTIFIED** `spektion_finding` | **Vulnerability Findings** |
| `spektion_asset` **HAS** `spektion_finding` (with the affected software version and first-seen date for that device) | **Assets** and **Vulnerability Findings** |

> **CAUTION**
> 
> **Enable Assets together with Vulnerability Findings to link findings to devices.** If **Assets** is disabled, findings are still ingested but no `spektion_asset` **HAS** `spektion_finding` relationships are created, so you cannot see which devices each CVE affects.

#### Device unification

Spektion assets are ingested with the `Device` and `Host` classes and correlate with the same device from other integrations by **hostname**, **IP address** and **FQDN** only. When Spektion reports a fully qualified hostname, the short hostname and the FQDN are both stored. The Spektion API does not expose a serial number or MAC address, so these are not available for correlation.

#### Notes

-   **Every run is a full sync.** Each run reads all assets and every finding that matches the filters. Assets and findings that Spektion no longer reports are removed from the graph on the next run.
-   **Detections are not ingested yet.** Spektion runtime risk detections and the activities feed are not collected. Findings carry the Spektion risk score and risk severity for each CVE.
-   **Devices correlate by hostname, IP address and FQDN only.** Spektion exposes no serial number or MAC address. See **Device unification** above.

#### Rate limits

The Spektion API rate-limits requests per API key. The integration paces itself to a fixed rate of 5 requests per second across the whole run and, when Spektion answers with `429 Too Many Requests`, waits for the time given in the `Retry-After` header before retrying. Besides listing assets and CVEs, the integration makes one request per ingested CVE to read its affected software, and, when **Assets** is enabled, one request per affected software product to find the devices it is installed on. In large environments, use the **Vulnerability Filters** to ingest the CVEs you act on so each run finishes sooner.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Spektion](https://spektion.com/) — for API keys and API access questions, contact your Spektion team or [support@spektion.com](mailto:support@spektion.com)
-   [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
-   [Exploit Prediction Scoring System (EPSS)](https://www.first.org/epss/)

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (4)

-   `/assets`
-   `/vulnerabilities`
-   `/vulnerabilities/{id}/software`
-   `/vulnerabilities/{id}/software/{software_id}/assets`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://docs.jupiterone.io/integrations/directory/spektion](https://docs.jupiterone.io/integrations/directory/spektion)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | Endpoints |
| --- | --- |
| Build Asset Has Finding Relationships | `/vulnerabilities/{id}/software/{software_id}/assets` |
| Build Service Identified Finding Relationships | \- |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `spektion_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Asset | `spektion_asset` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Service | `spektion_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Vulnerability Finding | `spektion_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `spektion_account` | **PROVIDES** | `spektion_service` |
| `spektion_asset` | **HAS** | `spektion_finding` |
| `spektion_service` | **IDENTIFIED** | `spektion_finding` |

### Spektion Account

`spektion_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Spektion Asset

`spektion_asset` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentVersion` | `string` **|** `null` | Installed Spektion sensor version reported by the asset. |  |
| `domain` | `string` **|** `null` | Windows/AD domain the asset belongs to, when reported. |  |
| `importance` | `number` **|** `null` | Spektion business-impact tier (1–5, 1 = most critical). Stored as reported; never mapped into J1 asset criticality (R6). |  |
| `ipAddress` | `string` **|** `null` | IP address reported by the Spektion sensor (IPv4 or IPv6); also routed by family into ipv4Addresses / ipv6Addresses. |  |
| `isOnline` | `boolean` **|** `null` | Whether Spektion reported the asset as online when the integration ran (`is_online`). An offline asset is still an active, monitored device. |  |
| `lastLoggedInUser` | `string` **|** `null` | Username from the asset’s most recent sensor check-in. Not reported on Linux; may trail a logon by up to ~20 minutes. |  |

---

### Spektion Finding

`spektion_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cvssVersion` | `string` **|** `null` | CVSS specification version string (e.g. "3.1"). |  |
| `epssScore` | `number` **|** `null` | EPSS exploit-prediction probability score (0–1). |  |
| `exploitMaturity` | `string` **|** `null` | Exploit maturity classification (none, poc, poc-weaponized, wild). |  |
| `firstSeenOn` | `number` **|** `null` | When this CVE was first detected in the environment (epoch ms). |  |
| `kev` | `boolean` **|** `null` | Whether this CVE is in the CISA KEV catalog. |  |
| `kevAddedOn` | `number` **|** `null` | When the CVE was added to CISA KEV (epoch ms). |  |
| `kevDueOn` | `number` **|** `null` | CISA KEV remediation due date (epoch ms). |  |
| `kevRansomwareCampaignUse` | `boolean` **|** `null` | Whether CISA flagged this CVE as used in a ransomware campaign. |  |
| `publishedOn` | `number` **|** `null` | When this CVE was published (epoch ms). |  |
| `riskScore` | `number` **|** `null` | Maximum Spektion runtime risk score for this CVE across the organization. |  |
| `riskSeverity` | `string` **|** `null` | Severity associated with the Spektion risk score. |  |
| `slaDueOn` | `number` **|** `null` | Earliest SLA due date across affected endpoints (epoch ms). |  |
| `slaStatus` | `string` **|** `null` | SLA status computed from the organization’s SLA policy (overdue, due\_today, due\_soon, on\_track). |  |
| `softwareName` | `array` **|** `null` | Names of the affected software products carrying this CVE (R4). |  |
| `softwareVersion` | `array` **|** `null` | Affected software versions carrying this CVE (R4), aligned to softwareName. |  |

---

### Spektion Service

`spektion_service` inherits from [Service](/data-model/schemas/Service.md)

---

---

Source: /integrations/directory/splunk

# Splunk

Visualize your Splunk deployment in JupiterOne: the Splunk instance itself, its indexes (size, retention, event range and whether each is enabled), and the forwarders that phone home to your deployment server, with their host, IP, build and the apps deployed to them. Monitor index retention and forwarder coverage through queries and alerts. A separate JupiterOne app for Splunk also lets you send JupiterOne alerts into Splunk; see the end of the installation guide.

## Installation

This integration reads your Splunk deployment through the [Splunk REST API](https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.6/introspection-endpoints/introspection-endpoint-descriptions) on the `splunkd` management port. It only sends `GET` requests and never changes your Splunk configuration. It doesn't read search results, events or audit data, and it doesn't touch Splunk Enterprise Security.

### Prerequisites

-   A Splunk Enterprise instance, or a Splunk Cloud Platform deployment with REST API access. Free trial Splunk Cloud Platform accounts can't access the REST API.
-   The management URL, including the scheme and port:
    -   **Splunk Enterprise**: for example `https://splunk.example.com:8089`.
    -   **Splunk Cloud Platform**: `https://<deployment-name>.splunkcloud.com:8089`. If port 8089 isn't open on your deployment yet, open a case with Splunk Support to enable it.
-   A Splunk user or authentication token with the capabilities below.
-   Access to JupiterOne with permission to configure integrations.

> **NOTE**
> 
> Splunk Enterprise instances usually sit inside a private network that the internet can't reach. In that case, run this integration through a [JupiterOne Collector](/integrations/development/collector.md) inside your network.

### Configuration in Splunk

Create a dedicated role for JupiterOne, and give a user or token that role:

-   `list_settings`: reads the instance details (`server/info`).
-   `list_deployment_server`: lists forwarders (`deployment/server/clients`). This is only needed if the instance is a deployment server.
-   `indexes_list_all`: lists indexes (`data/indexes`). This is only needed when `indexes_list_all` is enforced in `authorize.conf`, because by default every user can list indexes.

The integration supports two authentication methods. Pick one when you create the instance in JupiterOne.

-   **Username and password**: a local Splunk user with the role above.
-   **Authentication token**: recommended for Splunk Cloud Platform and for users who sign in with SSO. Token authentication must be enabled, and you create the token under **Settings > Tokens** for a user with the role above. See [Create authentication tokens](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.0/authenticate-into-the-splunk-platform-with-tokens/create-authentication-tokens).

> **NOTE**
> 
> Splunk documents its introspection endpoints, which include `server/info` and `data/indexes`, as not applicable to Splunk Cloud Platform, and deployment server endpoints as generally not accessible there. Index and forwarder data may therefore be limited on Splunk Cloud Platform.

### Configuration in JupiterOne

To install the Splunk integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Splunk**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Splunk account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
-   **Description** to assist in identifying the integration instance, if desired.
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
-   The **Splunk Management URL**, for example `https://splunk.example.com:8089`.
-   The authentication method and its fields:
    -   **Authentication**: the **Username** and **Password**.
    -   **API Token**: the **Authentication Token**.
-   Optionally, a **CA Certificate** (PEM) when `splunkd` presents a self-signed or internal-CA certificate. **Disable TLS Verification** is also available, but it isn't recommended.

Click **Create** once all values are provided to finalize the integration.

#### Data sources

Both data sources are off by default. Turn on the ones you want in the instance's ingestion source settings.

| Ingestion source | Data collected |
| --- | --- |
| **Indexes** | Splunk indexes, with type, current and maximum size, retention, oldest and newest event, and whether each is internal or enabled. |
| **Forwarders** | Deployment clients that phone home to the deployment server, with hostname, DNS name, IP, machine type, build, server classes, deployed app names and last phone-home time. |

The instance itself (`splunk_account`) is always collected.

### Send JupiterOne alerts to Splunk

This is a separate JupiterOne app for Splunk that works the other way around: it brings JupiterOne alert data into Splunk.

To send JupiterOne alerts to Splunk, you will first need to obtain your JupiterOne `accountId` and generate an API Key in JupiterOne:

-   Generate your API Key: Create your API Key by following instructions on our [API Key Access guide](https://support.jupiterone.io/hc/en-us/articles/360025847594-Enable-API-Key-Access).
-   Obtaining your JupiterOne `accountId`: Run this query within the JupiterOne search on the app's home view: `find jupiterone_account`. The results column will display the value within the `accountId` column.

#### Add JupiterOne to Splunk

With both the API Key and `accountId` from JupiterOne, proceed to Splunk to add JupiterOne to your Splunk workspace. This can be done either by:

1.  **Installing the JupiterOne app directly from the Splunk dashboard:**
    
    1.  On the Splunk home dashboard, use the **Find More Apps** link to find and install the **JupiterOne Add-on** and the **JupiterOne app**.
2.  **Downloading the JupiterOne [add-on](https://splunkbase.splunk.com/app/6138) and [app package](https://splunkbase.splunk.com/app/6139) from the Splunkbase marketplace:**
    
    1.  In Splunk navigate to **Apps > Manage Apps** by clicking the gear icon in the upper-left corner.
    2.  Select **Install app from file** in the top-right.
    3.  **Choose File** and select the JupiterOne add-on package or app package.
    4.  Click **Upload** and follow the prompts to complete the process.

##### Configure the JupiterOne Add-on in Splunk

Now that JupiterOne has been added to Splunk, the last step is to finalize the configuration and input your JupiterOne credentials.

1.  In Splunk, navigate to the **JupiterOne Add-on for Splunk**, and click **Configuration**.
2.  Click **Add** to create a new JupiterOne account configuration on the add-on.
3.  Enter your JupiterOne **Account Name**, `accountId`, and **API Key**. Click **Add** when finished.
    -   _Optional_: You can add a proxy under the **Proxy** tab, or change the log level on the **Logging** tab. By default the log level is `INFO`.
4.  Next, go to the **Inputs** tab, and choose **Create New Input**.
5.  Enter the desired values for the input, and press **Add** once done.

This concludes the setup for the Add-on. With the Add-on configured, the JupiterOne app within Splunk will start working without additional setup.

> **INFO**
> 
> More details are available on the Splunkbase marketplace for the [add-on](https://splunkbase.splunk.com/app/6138) and the [App](https://splunkbase.splunk.com/app/6139).

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Splunk REST API reference: introspection endpoints](https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.6/introspection-endpoints/introspection-endpoint-descriptions)
-   [Splunk REST API reference: deployment endpoints](https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.6/deployment-endpoints/deployment-endpoint-descriptions)

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (3)

-   `indexes_list_all`
-   `list_deployment_server`
-   `list_settings`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (3)

-   `https://<splunk-host>:8089/services/data/indexes`
-   `https://<splunk-host>:8089/services/deployment/server/clients`
-   `https://<splunk-host>:8089/services/server/info`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (2)

-   [https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.6/deployment-endpoints/deployment-endpoint-descriptions](https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.6/deployment-endpoints/deployment-endpoint-descriptions)
-   [https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.6/introspection-endpoints/introspection-endpoint-descriptions](https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.6/introspection-endpoints/introspection-endpoint-descriptions)

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `splunk_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Forwarder | `splunk_forwarder` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Index | `splunk_index` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Service | `splunk_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `splunk_account` | **PROVIDES** | `splunk_service` |
| `splunk_account` | **HAS** | `splunk_index` |

### Splunk Account

`splunk_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`guid` \*

 | `string` **|** `null` | Globally unique identifier for the Splunk instance. |  |
| 

`hostname` \*

 | `string` **|** `null` | Fully qualified domain name of the Splunk server. |  |
| 

`isForwarding` \*

 | `boolean` **|** `null` | Whether the instance is forwarding data. |  |
| 

`licenseState` \*

 | `string` **|** `null` | Status of the Splunk license (OK or Expired). |  |
| 

`osName` \*

 | `string` **|** `null` | Operating system the splunkd process runs on. |  |
| 

`productType` \*

 | `string` **|** `null` | Splunk software product type (e.g. enterprise, lite, splunk). |  |
| 

`serverRoles` \*

 | `array` **|** `null` | Server roles the instance holds (e.g. indexer, deployment\_server, universal\_forwarder). |  |
| 

`startedOn` \*

 | `number` **|** `null` | Timestamp (ms since epoch) when the Splunk platform last started. |  |
| 

`version` \*

 | `string` **|** `null` | Splunk platform version, including build number. |  |

---

### Splunk Forwarder

`splunk_forwarder` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`appNames` \*

 | `array` **|** `null` | Names of the applications deployed to this client (names only, not the app payload). |  |
| 

`averagePhoneHomeIntervalSeconds` \*

 | `number` **|** `null` | Average phone-home interval of the client, in seconds. |  |
| 

`build` \*

 | `string` **|** `null` | Splunk build number running on the deployment client. |  |
| 

`dnsName` \*

 | `string` **|** `null` | DNS lookup name of the deployment-client server. |  |
| 

`hasDeploymentError` \*

 | `boolean` **|** `null` | Whether the client has a deployment-error indication. |  |
| 

`hostname` \*

 | `string` **|** `null` | Host name of the deployment-client server. |  |
| 

`ipAddress` \*

 | `string` **|** `null` | IP address of the client reported to the deployment server. |  |
| 

`machineType` \*

 | `string` **|** `null` | OS/architecture (utsname) of the deployment client. |  |
| 

`managementPort` \*

 | `string` **|** `null` | Management port of the deployment client. |  |
| 

`serverClasses` \*

 | `array` **|** `null` | Server classes the deployment client is configured to receive apps from. |  |

---

### Splunk Index

`splunk_index` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`currentDBSizeMB` \*

 | `number` **|** `null` | Total size, in MB, of data currently stored in the index (home, cold and thawed paths). |  |
| 

`datatype` \*

 | `string` **|** `null` | The type of index (event or metric). |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` | Whether the index is enabled (derived by inverting the Splunk `disabled` flag). |  |
| 

`isInternal` \*

 | `boolean` **|** `null` | Whether this is an internal index (e.g. \_internal, \_audit). |  |
| 

`maxTotalDataSizeMB` \*

 | `number` **|** `null` | The configured maximum size of the index, in MB. |  |
| 

`newestEventOn` \*

 | `number` **|** `null` | Timestamp (ms since epoch) of the newest event stored in the index. |  |
| 

`oldestEventOn` \*

 | `number` **|** `null` | Timestamp (ms since epoch) of the oldest event stored in the index. |  |

---

### Splunk Service

`splunk_service` inherits from [Service](/data-model/schemas/Service.md)

---

---

Source: /integrations/directory/stackhawk

# StackHawk

Visualize StackHawk Organization, User, Application, Code Repository, and Application Findings, and monitor changes through queries and alerts.

## Installation

### Requirements

-   User must have the Admin access to StackHawk account.
-   User must have permission in JupiterOne to install new integrations.

### Configuration in StackHawk

#### Generate API Key and collect Organization ID from StackHawk

1.  Sign in to your StackHawk account at [https://app.stackhawk.com](https://app.stackhawk.com).
2.  Navigate to **Settings > API Keys** under **Profile Settings**.
3.  Create a new API key and store it securely.
4.  Find your **Organization ID** under **Settings > Organization Details** in **ORG Settings**.

### Configuration in JupiterOne

1.  From the top navigation of the J1 Search homepage, select **Integrations**
2.  Search for the **StackHawk** and select it.
3.  Click on the **Add Instance** button and configure the following settings:

-   Enter the **StackHawk API Key** generated for use by JupiterOne.
-   Enter the **StackHawk Organization ID** generated for use by JupiterOne.
-   Enter the **Account Name** by which you'd like to identify this StackHawk Cloud instance in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when **Tag with Account Name** is checked.
-   Enter a **Description** that will further assist your team when identifying the integration instance.
-   Select a **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.

4.  Click **Create Instance** once all values are provided.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Application | `stackhawk_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| CodeRepo | `stackhawk_code_repo` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Finding | `stackhawk_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Organization | `stackhawk_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| User | `stackhawk_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `stackhawk_account` | **HAS** | `stackhawk_user` |
| `stackhawk_account` | **HAS** | `stackhawk_application` |
| `stackhawk_application` | **HAS** | `stackhawk_code_repo` |
| `stackhawk_application` | **HAS** | `stackhawk_finding` |

### Stackhawk Account

`stackhawk_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`orgId` \*

 | `string` |  |  |

---

### Stackhawk Application

`stackhawk_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`environment` \*

 | `string` |  |  |
| 

`environmentId` \*

 | `string` |  |  |
| 

`organizationId` \*

 | `string` |  |  |
| `riskLevel` | `string` |  |  |

---

### Stackhawk Code Repo

`stackhawk_code_repo` inherits from [CodeRepo](/data-model/schemas/CodeRepo.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `apiDiscoveryScore` | `number` | The StackHawk API Discovery Score. |  |
| `apiDiscoveryStatus` | `string` | The StackHawk API Discovery Status. |  |
| `archived` | `boolean` |  |  |
| `commitCount` | `number` |  |  |
| `frameworkNames` | `array` of `string`s |  |  |
| `hasGeneratedOpenApiSpec` | `boolean` |  |  |
| `hidden` | `boolean` | Whether or not this repository is hidden. |  |
| `integrationId` | `string` | The Integration Id this repository is associated to. |  |
| `isFork` | `boolean` | Whether or not this repository is a fork. |  |
| `isInAttackSurface` | `boolean` |  |  |
| `isNewRepository` | `boolean` |  |  |
| `isNewToAttackSurface` | `boolean` |  |  |
| `lastCommitBranch` | `string` |  |  |
| `lastCommitTimestamp` | `number` |  |  |
| `namespace` | `string` | Provider dependent, namespace/group/subgroup/folder the repository belongs to. |  |
| `namespaceId` | `string` |  |  |
| `providerOrgId` | `string` |  |  |
| `providerOrgName` | `string` | The repository providers top level entity this repository is associated with. |  |
| `repoSource` | `string` | The source of the repository. e.i. UNKNOWN, GITHUB, AZURE\_DEVOPS, BITBUCKET, GITLAB. |  |

---

### Stackhawk Finding

`stackhawk_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `applicationId` | `string` |  |  |
| `applicationName` | `string` |  |  |
| `cweId` | `string` |  |  |
| `environmentId` | `string` |  |  |
| `environmentName` | `string` |  |  |
| `findingEvidence` | `string` |  |  |
| `findingMethod` | `string` |  |  |
| `findingOtherInfo` | `string` |  |  |
| `findingUrl` | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| `lastSeenOn` | `number` |  |  |
| `pluginId` | `string` |  |  |
| `pluginName` | `string` |  |  |
| `remediationAdvice` | `string` |  |  |
| `risk` | `string` |  |  |
| `scanDuration` | `number` |  |  |
| `scanId` | `string` |  |  |
| `scanUserName` | `string` |  |  |
| `team` | `string` |  |  |

---

### Stackhawk User

`stackhawk_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessProvider` | `string` | User access provider. For example: GITHUB, GOOGLE, STACKHAWK, SAMLIDP |  |
| `applicationIds` | `array` of `string`s |  |  |
| `avatarUrl` | `string` |  |  |
| `providerClientId` | `string` |  |  |

---

## Release Notes

-   **2025-04-10** — Added StackHawk integration, ingesting applications, scans, and vulnerability findings with organization and user relationships.

---

Source: /integrations/directory/sysdig

# Sysdig

Visualize Sysdig account, teams, and users, and monitor changes through queries and alerts.

## Installation

To use the Sysdig integration, you need a Sysdig API token and your account region. The token must belong to a user with **Administrator** privileges so the integration can enumerate all users, teams, agents, and cluster data across the organization.

### Prerequisites

1.  Obtain your **API Token** from Sysdig: log in to Sysdig Monitor or Sysdig Secure, go to **Settings > User Profile**, and copy the token shown. See [Retrieve the Sysdig API Token](https://docs.sysdig.com/en/administration/retrieve-the-sysdig-api-token/) for details.
2.  Confirm your **Region** code. This is the short identifier for your Sysdig SaaS endpoint, such as `us2` or `eu1`. See [SaaS Regions and IP Ranges](https://docs.sysdig.com/en/administration/saas-regions-and-ip-ranges/) for the full list.

### Configuration in JupiterOne

Navigate to **Integrations** in JupiterOne, select **Sysdig**, and click **New Instance**.

Creating an instance requires the following:

-   **API Token** — Your Sysdig account API token.
-   **Region** — Your Sysdig SaaS region code (for example, `us2`).

Click **Create** to finish. The integration will begin running on the polling interval you selected, or you can trigger it manually at any time.

### Next steps

Once configured, your Sysdig data will populate in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) to learn how to edit, disable, or re-run your integration instance.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `sysdig_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Agent | `sysdig_agent` | [Scanner](https://docs.jupiterone.io/data-model/schemas/Scanner) |
| Cluster | `sysdig_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Finding | `sysdig_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Finding | `sysdig_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| Image Scan | `sysdig_image_scan` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Scanner | `sysdig_scanner` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Team | `sysdig_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `sysdig_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `sysdig_account` | **HAS** | `sysdig_user` |
| `sysdig_account` | **HAS** | `sysdig_team` |
| `sysdig_account` | **HAS** | `sysdig_image_scan` |
| `sysdig_account` | **HAS** | `sysdig_scanner` |
| `sysdig_account` | **HAS** | `sysdig_cluster` |
| `sysdig_account` | **HAS** | `sysdig_agent` |
| `sysdig_agent` | **SCANS** | `sysdig_cluster` |
| `sysdig_image_scan` | **IDENTIFIED** | `sysdig_finding` |
| `sysdig_scanner` | **PERFORMED** | `sysdig_image_scan` |
| `sysdig_team` | **HAS** | `sysdig_user` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `sysdig_finding` | **IS** | `cve` | FORWARD |

### Sysdig Finding

`sysdig_finding` inherits from [Finding](/data-model/schemas/Finding.md)

---

### Sysdig Finding

`sysdig_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

---

### Sysdig User

`sysdig_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admin` | `boolean` |  |  |
| `enabled` | `boolean` |  |  |
| `lastSeenOnSecure` | `integer` |  |  |
| `products` | `array` of `string`s |  |  |
| `systemRole` | `string` |  |  |
| `version` | `integer` |  |  |

---

## Release Notes

-   **2025-06-05** — Promoted Sysdig finding entities to carry both the Vulnerability and Finding entity classes, enabling broader vulnerability query compatibility.

---

Source: /integrations/directory/taegis

# Secureworks Taegis

Visualize assets, users, and evaluations in Taegis while monitoring changes through advanced queries and automated alerts.

## Installation

To authenticate with Secureworks Taegis XDR, you'll need to configure certain credentials such as TENANT\_ID, BASE\_URL, CLIENT\_ID, and CLIENT\_SECRET. Here's how you can obtain these values and set them in your environment variables for secure and effective authentication:

TENANT\_ID: A unique identifier for your Taegis XDR tenant, required for API requests. To find it, log in to the XDR Console, go to Tenant Settings → Subscriptions.

CLIENT\_ID & CLIENT\_SECRET: Follow this document to create the necessary credentials for this integration: [Create Client Credentials](https://docs.ctpx.secureworks.com/apis/api_authenticate/#part-1-create-client-credentials).

BASE\_URL: You can find the appropriate BASE\_URL in your Taegis console under Web URL. Select the correct URL based on your deployment region:

US1: [https://api.ctpx.secureworks.com](https://api.ctpx.secureworks.com) US2: [https://api.delta.taegis.secureworks.com](https://api.delta.taegis.secureworks.com) US3: [https://api.foxtrot.taegis.secureworks.com](https://api.foxtrot.taegis.secureworks.com) EU: [https://api.echo.taegis.secureworks.com](https://api.echo.taegis.secureworks.com)

### Configuration in JupiterOne

To install the SecureWorks Taegis integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select SecureWorks Taegis Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the SecureWorks Taegis account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your SecureWorks Taegis **Tenant ID** ,**Client ID**, **Client Secret**, **BaseUrl**.
    
-   Designate the desired **Included Vulnerability Severities** and **Included Vulnerability States**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Host | `secureworks_taegis_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Vulnerability | `secureworks_taegis_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `secureworks_taegis_host` | **HAS** | `secureworks_taegis_vulnerability` |

### Secureworks Taegis Host

`secureworks_taegis_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `architecture` | `string` |  |  |
| `biosSerial` | `string` |  |  |
| `createdAt` | `number` |  |  |
| `endpointPlatform` | `string` |  |  |
| `endpointType` | `string` |  |  |
| `firstDiskSerial` | `string` |  |  |
| 
`hostId` \*

 | `string` |  |  |
| 

`id` \*

 | `string` |  |  |
| `ingestTime` | `number` |  |  |
| `kernelRelease` | `string` |  |  |
| `kernelVersion` | `string` |  |  |
| `osKernel` | `string` |  |  |
| 

`rn` \*

 | `string` |  |  |
| 

`sensorId` \*

 | `string` |  |  |
| 

`sensorTenant` \*

 | `string` |  |  |
| `sensorVersion` | `string` |  |  |
| `status` | `string` |  |  |
| `systemVolumeSerial` | `string` |  |  |
| 

`tenantId` \*

 | `string` |  |  |
| `updatedAt` | `number` |  |  |
| `users` | `array` of `string`s |  |  |

---

### Secureworks Taegis Vulnerability

`secureworks_taegis_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`attackTechniqueIds` \*

 | `array` **|** `null` |  |  |
| 

`blocking` \*

 | `boolean` **|** `null` |  |  |
| 

`confidence` \*

 | `number` **|** `null` |  |  |
| 

`createdAt` \*

 | `number` **|** `null` |  |  |
| 

`detectorId` \*

 | `string` **|** `null` |  |  |
| 

`detectorVersion` \*

 | `string` **|** `null` |  |  |
| 

`displayName` \*

 | `string` **|** `null` |  |  |
| 

`engineName` \*

 | `string` **|** `null` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`investigationIds` \*

 | `array` **|** `null` |  |  |
| 

`resolutionReason` \*

 | `string` **|** `null` |  |  |
| 

`ruleId` \*

 | `string` **|** `null` |  |  |
| 

`ruleVersion` \*

 | `string` **|** `null` |  |  |
| 

`sensorTypes` \*

 | `array` **|** `null` |  |  |
| 

`status` \*

 | `string` **|** `null` |  |  |
| 

`suppressed` \*

 | `boolean` **|** `null` |  |  |
| 

`tenantId` \*

 | `string` **|** `null` |  |  |

---

## Release Notes

-   **2026-03-31** — Added OS kernel version property to SecureWorks Taegis host entities.
-   **2025-06-04** — Taegis vulnerability entities now support the Finding entity class alongside the Vulnerability class for improved data model compatibility.

---

Source: /integrations/directory/tanium

# Tanium

Visualize Tanium assets, users, and evaluations in JupiterOne, and monitor changes through queries and alerts.

## Installation

To set up this integration, you need access to the **Administration** module in Tanium to create API tokens.

An API token has the permissions of the user or persona that created it. That user or persona needs:

-   The `API Gateway User` role, for access to the API Gateway GraphQL endpoint.
-   The `Asset Report Reader` role (**Asset Report Read**), for endpoints and applications, which come from Tanium Asset.
-   **Sensor Read** on the content sets that hold the installed applications, installed patches and applicable patches sensors.
-   **User Read**, to ingest Tanium users.
-   Management rights on the computer groups you want to ingest. Endpoints outside those computer groups are not returned.

Your Tanium environment must also have the latest API Gateway solution imported, since several steps query Tanium's API Gateway GraphQL endpoint.

### Configuration in Tanium

Before setting up the integration instance in JupiterOne, generate your Tanium API token:

1.  In your Tanium console, from the top bar, navigate to **Administration > Permissions > API Tokens**.
2.  Click **New API Token**.
3.  Set the desired number of days until your token expires.
4.  If you are running the integration in JupiterOne, add the following IPs to the token's Trusted IP list based on your region:
    -   Running in US Region:
        -   18.219.33.157/0
        -   18.218.86.86/0
        -   52.14.136.234/0
    -   Running in Cisco US Region:
        -   34.233.148.77/0
        -   44.199.84.191/0
        -   52.21.5.206/0
    -   Running in EU Region:
        -   3.67.240.226/0
        -   52.28.3.30/0
        -   3.121.249.173/0
5.  Copy your API token for use in JupiterOne.

Once you have generated your API token, retain the value and have it ready when configuring the integration within JupiterOne.

For more detail on creating API tokens, see Tanium's [API Tokens documentation](https://help.tanium.com/bundle/ug_console_cloud/page/platform_user/console_api_tokens.html).

### Configuration in JupiterOne

To install the Tanium integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Tanium. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Tanium account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   A **Description** to assist in identifying the integration instance, if desired.
    
-   A **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Tanium **API Token**.
    
-   Your **Base URL**, the base URL for your Tanium instance's API. The endpoint will look like `https://<customer-name>-api.cloud.tanium.com`.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `tanium_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `tanium_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Application Version | `tanium_application_version` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Available Patch | `tanium_available_patch` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Endpoint | `tanium_endpoint` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Installed Application | `tanium_installed_application` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Installed Patch | `tanium_installed_patch` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| User | `tanium_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `tanium_account` | **HAS** | `tanium_endpoint` |
| `tanium_account` | **HAS** | `tanium_user` |
| `tanium_account` | **HAS** | `tanium_application` |
| `tanium_application` | **HAS** | `tanium_application_version` |
| `tanium_endpoint` | **HAS** | `tanium_installed_application` |
| `tanium_endpoint` | **HAS** | `tanium_installed_patch` |
| `tanium_endpoint` | **HAS** | `tanium_available_patch` |
| `tanium_installed_application` | **IS** | `tanium_application_version` |

### Tanium User

`tanium_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deleted` | `boolean` |  |  |
| `domain` | `string` |  |  |
| `external` | `boolean` |  |  |
| `lastLoginAt` | `integer` |  |  |
| `lockedOut` | `boolean` |  |  |

---

## Release Notes

-   **2026-04-08** — Improved OS name, type, and version parsing for Tanium endpoint entities.

---

Source: /integrations/directory/teleport

# Teleport

Visualize Teleport users, roles, and access lists, map role assignments and access list membership across your infrastructure, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> This integration authenticates to the Teleport auth service over gRPC with **mutual TLS**. No passwords, API keys, or OAuth tokens are used — all traffic is authenticated with a client certificate issued by the cluster's own CA and delivered to JupiterOne as a single **identity file** (a PEM bundle containing the private key, TLS client certificate, and cluster CA certificates).

### Prerequisites

-   A Teleport cluster (Cloud or self-hosted) reachable on port `443`.
-   The [`tctl` and `tsh`](https://goteleport.com/docs/installation/) CLI tools, running as a cluster administrator that has permission to create roles, create local users, and impersonate the service user you are about to create.

### Configuration in Teleport

#### 1\. Log in to the cluster as an administrator

```shell
tsh login --proxy=<cluster>.teleport.sh:443 --user=<admin-user>
```

#### 2\. Create the read-only role for JupiterOne

Save the following to `jupiterone-role.yaml`:

```yaml
kind: role
version: v7
metadata:
  name: jupiterone-reader
spec:
  allow:
    rules:
      - resources:
          [user, role, access_list, access_list_member, access_list_review]
        verbs: [list, read]
```

Then apply it:

```shell
tctl create -f jupiterone-role.yaml
```

#### 3\. Grant your admin user permission to sign an identity for the service user

`tctl auth sign --user=<other-user>` requires explicit **impersonation** rights, which the preset `editor` role does not include. Create this role and attach it to your admin user:

```yaml
kind: role
version: v7
metadata:
  name: jupiterone-impersonator
spec:
  allow:
    impersonate:
      users: ['jupiterone']
      roles: ['jupiterone-reader']
```

```shell
tctl create -f jupiterone-impersonator.yaml
tctl users update <admin-user> --set-roles=<existing-roles>,jupiterone-impersonator
tsh logout && tsh login --proxy=<cluster>.teleport.sh:443 --user=<admin-user>
```

Re-logging in is required so the admin's session certificate picks up the new role.

#### 4\. Create the local service user and finish its invite

```shell
tctl users add jupiterone --roles=jupiterone-reader
```

This prints a one-hour invite URL. Open it in a browser and complete password + MFA setup for the `jupiterone` user. Local authentication with MFA is required — SSO users cannot be used to sign identity files because `tctl auth sign` needs a password-backed user.

#### 5\. Sign the identity file

```shell
tctl auth sign \
  --user=jupiterone \
  --format=file \
  --out=jupiterone-identity.pem \
  --ttl=24h
```

The PEM bundle written to `jupiterone-identity.pem` is what you will upload to JupiterOne in the next step.

### Authentication and certificate lifetime

Teleport enforces a hard **~30 hour** upper bound on user-certificate TTL (`apidefaults.MaxCertDuration` in the Teleport source; `max_session_ttl` on roles cannot push past this ceiling — see [this discussion](https://github.com/gravitational/teleport/discussions/30213)). A `--ttl=24h` identity is fine for a trial, one-off ingestion, or demo, but the integration will stop authenticating once the certificate expires.

For any long-running deployment, follow Teleport's recommendation and provision credentials through **[Machine ID (`tbot`)](https://goteleport.com/docs/machine-workload-identity/introduction/)** rather than a static `tctl auth sign` identity. `tbot` joins the cluster with a delegated token (AWS IAM, GCP, Kubernetes, static token, etc.), continuously renews short-lived certificates, and writes a fresh identity file to disk that can be fed back into the integration on each run. This is the only approach that supports unattended operation beyond the 30h cap.

### Configuration in JupiterOne

1.  Navigate to the **Integrations** tab in JupiterOne and select **Teleport**.
2.  Click **New Instance** to begin configuring your integration and provide the following:
    -   **Account Name** used to identify the Teleport cluster in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    -   **Description** to assist in identifying the integration instance, if desired.
    -   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    -   **Proxy Address** — the public address of the Teleport Proxy Service with the port, e.g. `cluster.teleport.sh:443`.
    -   **Identity File** — upload `jupiterone-identity.pem` from the previous step. JupiterOne stores the full PEM bundle as a masked secret.

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (6)

-   `/proto.AuthService/ListRoles`
-   `/proto.AuthService/Ping`
-   `/teleport.accesslist.v1.AccessListService/ListAccessListMembers`
-   `/teleport.accesslist.v1.AccessListService/ListAccessListReviews`
-   `/teleport.accesslist.v1.AccessListService/ListAccessListsV2`
-   `/teleport.users.v1.UsersService/ListUsers`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://goteleport.com/docs/admin-guides/access-controls/access-lists/](https://goteleport.com/docs/admin-guides/access-controls/access-lists/)
-   [https://goteleport.com/docs/reference/access-controls/roles/](https://goteleport.com/docs/reference/access-controls/roles/)
-   [https://goteleport.com/docs/reference/architecture/api-architecture/](https://goteleport.com/docs/reference/architecture/api-architecture/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (8)

| Step | Endpoints |
| --- | --- |
| Fetch Access List Members | `/teleport.accesslist.v1.AccessListService/ListAccessListMembers` |
| Fetch Access List Owners | \- |
| Fetch Access List Reviews | `/teleport.accesslist.v1.AccessListService/ListAccessListReviews` |
| Fetch Access List Role Grants | \- |
| Fetch Access Lists | `/teleport.accesslist.v1.AccessListService/ListAccessListsV2` |
| Fetch Roles | `/proto.AuthService/ListRoles` |
| Fetch User Role Assignments | \- |
| Fetch Users | `/teleport.users.v1.UsersService/ListUsers` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| AccessList | `teleport_access_list` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| AccessListReview | `teleport_access_list_review` | [Review](https://docs.jupiterone.io/data-model/schemas/Review) |
| Account | `teleport_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Role | `teleport_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| User | `teleport_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `teleport_access_list` | **ASSIGNED** | `teleport_role` |
| `teleport_access_list` | **HAS** | `teleport_user` |
| `teleport_access_list` | **HAS** | `teleport_access_list_review` |
| `teleport_account` | **HAS** | `teleport_user` |
| `teleport_account` | **HAS** | `teleport_role` |
| `teleport_account` | **HAS** | `teleport_access_list` |
| `teleport_user` | **ASSIGNED** | `teleport_role` |
| `teleport_user` | **MANAGES** | `teleport_access_list` |
| `teleport_user` | **REVIEWED** | `teleport_access_list_review` |

### Teleport Access List

`teleport_access_list` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accessListType` | `string` |  |  |
| `auditFrequency` | `string` |  |  |
| `grantedRoles` | `array` **|** `null` |  |  |
| `memberCount` | `number` |  |  |
| `nextAuditOn` | `number` |  |  |
| `ownerGrantedRoles` | `array` **|** `null` |  |  |
| `ownerNames` | `array` **|** `null` |  |  |
| `requiredMembershipRoles` | `array` **|** `null` |  |  |
| `requiredOwnershipRoles` | `array` **|** `null` |  |  |
| `title` | `string` |  |  |

---

### Teleport Access List Review

`teleport_access_list_review` inherits from [Review](/data-model/schemas/Review.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessListName` \*

 | `string` |  |  |
| `notes` | `string` |  |  |
| `removedMembers` | `array` **|** `null` |  |  |
| `reviewedOn` | `number` |  |  |
| 

`reviewers` \*

 | `array` of `string`s |  |  |

---

### Teleport Account

`teleport_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`clusterName` \*

 | `string` |  |  |
| `licenseExpiresOn` | `number` |  |  |
| `proxyPublicAddr` | `string` |  |  |
| `serverVersion` | `string` |  |  |

---

### Teleport Role

`teleport_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `allowedAWSRoleARNs` | `array` **|** `null` |  |  |
| `allowedDatabaseNames` | `array` **|** `null` |  |  |
| `allowedDatabaseUsers` | `array` **|** `null` |  |  |
| `allowedKubeGroups` | `array` **|** `null` |  |  |
| `allowedKubeUsers` | `array` **|** `null` |  |  |
| `allowedLogins` | `array` **|** `null` |  |  |
| `forwardAgent` | `boolean` |  |  |
| `lockMode` | `string` |  |  |
| `maxSessionTTL` | `string` |  |  |
| `portForwarding` | `boolean` |  |  |
| `requestAccess` | `string` |  |  |

---

### Teleport User

`teleport_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `connectorId` | `string` |  |  |
| `connectorType` | `string` |  |  |
| `createdBy` | `string` |  |  |
| `locked` | `boolean` |  |  |
| `lockedMessage` | `string` |  |  |
| `mfaWeakestDevice` | `string` |  |  |
| `passwordState` | `string` |  |  |
| 
`roles` \*

 | `array` of `string`s |  |  |

---

---

Source: /integrations/directory/teleskope

# Teleskope

Visualize Teleskope S3 buckets and RDS clusters with data classification and sensitivity metadata, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need the following parameters from Teleskope:
> 
> -   **API Key** — used to authenticate requests to the Teleskope Metadata API. Contact your Teleskope administrator or refer to [their documentation](https://docs.teleskope.ai/the-platform/api-service) to obtain an API key for your tenant.
> -   **Metadata API Base URL** — the base URL for your Teleskope tenant, in the format `https://api.metadata.<your-tenant>.teleskope.ai`.

### Configuration in JupiterOne

To install the Teleskope integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Teleskope. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Teleskope account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Teleskope **API Key**.
    
-   Your Teleskope **Metadata API Base URL** (e.g. `https://api.metadata.<your-tenant>.teleskope.ai`).
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `teleskope_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| RDS Cluster | `teleskope_rds_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| S3Bucket | `teleskope_s3_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `teleskope_account` | **HAS** | `teleskope_s3_bucket` |
| `teleskope_account` | **HAS** | `teleskope_rds_cluster` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `teleskope_rds_cluster` | **IS** | `aws_rds_cluster` | FORWARD |
| `teleskope_s3_bucket` | **IS** | `aws_s3_bucket` | FORWARD |

### Teleskope Account

`teleskope_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Teleskope Rds Cluster

`teleskope_rds_cluster` inherits from [Database](/data-model/schemas/Database.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`awsAccountId` \*

 | `number` |  |  |
| 

`awsAccountIdentifier` \*

 | `string` |  |  |
| `awsAccountName` | `string` |  |  |
| 

`backupRetentionPeriod` \*

 | `number` |  |  |
| 

`databaseCount` \*

 | `number` |  |  |
| `dataElementCategories` | `array` of `string`s |  |  |
| `dataElements` | `array` of `string`s |  |  |
| 

`deletionProtection` \*

 | `boolean` |  |  |
| 

`engineType` \*

 | `string` |  |  |
| 

`engineVersion` \*

 | `string` |  |  |
| 

`iamAuthenticationEnabled` \*

 | `boolean` |  |  |
| 

`identifier` \*

 | `string` |  |  |
| 

`multiAz` \*

 | `boolean` |  |  |
| 

`openToTheWorld` \*

 | `boolean` |  |  |
| `personas` | `array` of `string`s |  |  |
| 

`publiclyAccessible` \*

 | `boolean` |  |  |
| `readEndpoint` | `string` |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`tableCount` \*

 | `number` |  |  |
| `writeEndpoint` | `string` |  |  |

---

### Teleskope S3 Bucket

`teleskope_s3_bucket` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`awsAccountId` \*

 | `number` |  |  |
| 

`awsAccountIdentifier` \*

 | `string` |  |  |
| 

`bucketName` \*

 | `string` |  |  |
| `dataElements` | `array` of `string`s |  |  |
| `personas` | `array` of `string`s |  |  |
| 

`region` \*

 | `string` |  |  |
| 

`versioning` \*

 | `boolean` |  |  |

---

## Release Notes

-   **2026-03-13** — New Teleskope integration: discovers S3 buckets and RDS clusters with data element classifications, security configurations, and mapped relationships to underlying AWS resources.

---

Source: /integrations/directory/tenable-cloud

# Tenable.io

Visualize Tenable.io scans, findings, vulnerabilities, and container findings, map Tenable.io users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need an **Access Key** and **Secret Key** from Tenable Vulnerability Management. The API key owner must have the **Administrator** role to use the bulk export APIs that power this integration.

> **INFO**
> 
> See [Generate API Keys](https://docs.tenable.com/vulnerability-management/Content/Settings/my-account/GenerateAPIKey.htm) in the Tenable documentation for instructions on generating your access and secret keys.

### Configuration in JupiterOne

To install the Tenable integration in JupiterOne, navigate to the **Integrations** tab and select **Tenable**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   Your **Access Key** and **Secret Key** from Tenable Vulnerability Management.

Optionally, to enable container image scanning via the Tenable Cloud Security API, provide a **Cloud Security API Key** (see [Data Volume Configuration](#data-volume-configuration) below).

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

## Data Volume Configuration

The following settings control which data the integration collects and over what time range.

### Data Filtering Options

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Included Vulnerability Severities** | Vulnerability severity levels to include in ingestion. | Medium, High, Critical | Info, Low, Medium, High, Critical |
| **Included Vulnerability Modification Types** | Filters vulnerabilities by whether their state has been modified by a rule (recasted or accepted). Select "None" to include only unmodified findings. | All modification types | None, Recasted, Accepted |
| **Included Vulnerability States** | Lifecycle states of vulnerability findings to include. | All states | Open, Reopened, Fixed |
| **Compliance Findings - Results** | Compliance check result statuses to include in the ingestion. | All results | PASSED, FAILED, WARNING, SKIPPED, ERROR, UNKNOWN |
| **Compliance Findings - States** | Lifecycle states of compliance findings to include. | All states | OPEN, REOPENED, FIXED |
| **Assets - Licensed Filter** | Restricts asset export to licensed or non-licensed assets only. Leave at "No filter" to export all assets. | No filter | No filter, Include only licensed, Include only non-licensed |

### Ingestion Windows

| Field | Description | Default |
| --- | --- | --- |
| **Vulnerabilities - Last Seen (days)** | Number of days back to include vulnerability findings that were last seen. | 35 |
| **Compliance Findings - Last Seen (days)** | Number of days back to include compliance findings that were last seen. | 15 |

### Advanced Configuration

| Field | Description | Default |
| --- | --- | --- |
| **Base URL** | The base URL for the Tenable Vulnerability Management API. Change this only if you use a regional or on-premises endpoint. | [https://cloud.tenable.com](https://cloud.tenable.com) |
| **Cloud Security API Key** | API key for the Tenable Cloud Security (formerly Ermetic) GraphQL API. Required to ingest container images and reports. If not provided, the integration falls back to the main Access Key. | — |
| **Cloud Security Base URL** | The base URL for the Tenable Cloud Security API. Use a regional value such as `us.app.ermetic.com` or `eu.app.ermetic.com` if applicable. | [https://global.app.ermetic.com](https://global.app.ermetic.com) |

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (2)

-   `Administrator`
-   `Scan Manager`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `https://cloud.tenable.com/assets/export`
-   `https://cloud.tenable.com/compliance/export`
-   `https://cloud.tenable.com/scanners`
-   `https://cloud.tenable.com/scanners/{scannerId}/agents`
-   `https://cloud.tenable.com/users`
-   `https://cloud.tenable.com/vulns/export`
-   `https://global.app.ermetic.com/api/graph`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (9)

-   [https://developer.tenable.com/reference/agents-list](https://developer.tenable.com/reference/agents-list)
-   [https://developer.tenable.com/reference/export-assets-v1](https://developer.tenable.com/reference/export-assets-v1)
-   [https://developer.tenable.com/reference/export-assets-v2](https://developer.tenable.com/reference/export-assets-v2)
-   [https://developer.tenable.com/reference/exports-vulns-request-export](https://developer.tenable.com/reference/exports-vulns-request-export)
-   [https://developer.tenable.com/reference/io-exports-compliance-create](https://developer.tenable.com/reference/io-exports-compliance-create)
-   [https://developer.tenable.com/reference/scanners-list](https://developer.tenable.com/reference/scanners-list)
-   [https://developer.tenable.com/reference/users-list](https://developer.tenable.com/reference/users-list)
-   [https://docs.tenable.com/vulnerability-management/Content/Settings/my-account/GenerateAPIKey.htm](https://docs.tenable.com/vulnerability-management/Content/Settings/my-account/GenerateAPIKey.htm)
-   [https://docs.tenable.com/vulnerability-management/best-practices/RBAC/Content/tenable-role-privileges.htm](https://docs.tenable.com/vulnerability-management/best-practices/RBAC/Content/tenable-role-privileges.htm)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (12)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Build Asset -> Vulnerability Relationships | \- | \- |
| Build Asset Has Compliance Finding Relationship | \- | \- |
| Build Host Agent Protects Agents Relationship | \- | \- |
| Build Repository Images Relationships | \- | \- |
| Build Vulnerability -> CVE Mapped Relationships | \- | \- |
| Fetch Agents | `Administrator`, `Scan Manager` | `https://cloud.tenable.com/scanners/{scannerId}/agents` |
| Fetch Assets | `Administrator` | `https://cloud.tenable.com/assets/export` |
| Fetch Container Images | \- | `https://global.app.ermetic.com/api/graph` |
| Fetch Container Reports | \- | `https://global.app.ermetic.com/api/graph` |
| Fetch Container Repositories | \- | `https://global.app.ermetic.com/api/graph` |
| Fetch Service Details | \- | \- |
| Fetch Users | `Administrator` | `https://cloud.tenable.com/users` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `tenable_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Agent | `tenable_agent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Asset | `tenable_asset` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Compliance Finding | `tenable_compliance_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Container Finding | `tenable_container_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Container Image | `tenable_container_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Container Malware | `tenable_container_malware` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Container Report | `tenable_container_report` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Container Repository | `tenable_container_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Container Unwanted Program | `tenable_container_unwanted_program` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Service | `tenable_scanner` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `tenable_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vulnerability | `tenable_vulnerability_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `tenable_account` | **PROVIDES** | `tenable_scanner` |
| `tenable_account` | **HAS** | `tenable_container_repository` |
| `tenable_account` | **HAS** | `tenable_container_image` |
| `tenable_account` | **MANAGES** | `tenable_asset` |
| `tenable_account` | **HAS** | `tenable_user` |
| `tenable_account` | **HAS** | `tenable_agent` |
| `tenable_agent` | **PROTECTS** | `tenable_asset` |
| `tenable_asset` | **HAS** | `tenable_vulnerability_finding` |
| `tenable_asset` | **HAS** | `tenable_compliance_finding` |
| `tenable_container_image` | **HAS** | `tenable_container_report` |
| `tenable_container_image` | **HAS** | `tenable_container_finding` |
| `tenable_container_image` | **HAS** | `tenable_container_malware` |
| `tenable_container_image` | **HAS** | `tenable_container_unwanted_program` |
| `tenable_container_report` | **IDENTIFIED** | `tenable_container_finding` |
| `tenable_container_report` | **IDENTIFIED** | `tenable_container_malware` |
| `tenable_container_report` | **IDENTIFIED** | `tenable_container_unwanted_program` |
| `tenable_container_repository` | **HAS** | `tenable_container_image` |
| `tenable_scanner` | **SCANS** | `tenable_container_image` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `tenable_asset` | **IS** | `aws_instance` | FORWARD |
| `tenable_asset` | **IS** | `azure_vm` | FORWARD |
| `tenable_asset` | **IS** | `google_compute_instance` | FORWARD |
| `tenable_vulnerability_finding` | **HAS** | `aws_instance` | REVERSE |
| `tenable_vulnerability_finding` | **HAS** | `azure_vm` | REVERSE |
| `tenable_vulnerability_finding` | **HAS** | `google_compute_instance` | REVERSE |
| `tenable_vulnerability_finding` | **IS** | `cve` | FORWARD |

### Tenable Account

`tenable_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Tenable Agent

`tenable_agent` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentId` \*

 | `number` |  |  |
| 

`coreBuild` \*

 | `string` |  |  |
| 

`coreVersion` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`ipAddress` \*

 | `string` |  |  |
| `lastConnectedOn` | `number` |  |  |
| `lastScannedOn` | `number` |  |  |
| `linkedOn` | `number` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`platform` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`supportsRemoteLogs` \*

 | `boolean` |  |  |

---

### Tenable Asset

`tenable_asset` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentNames` | `array` of `string`s |  |  |
| `agentUuid` | `string` |  |  |
| `awsAvailabilityZone` | `string` |  |  |
| `awsEc2InstanceAmiId` | `string` |  |  |
| `awsEc2InstanceGroupName` | `string` |  |  |
| `awsEc2InstanceId` | `string` |  |  |
| `awsEc2InstanceState` | `string` |  |  |
| `awsEc2InstanceType` | `string` |  |  |
| `awsEc2Name` | `string` |  |  |
| `awsEc2ProductCode` | `string` |  |  |
| `awsOwnerId` | `string` |  |  |
| `awsRegion` | `string` |  |  |
| `awsSubnetId` | `string` |  |  |
| `awsVpcId` | `string` |  |  |
| `azureResourceId` | `string` |  |  |
| `azureVmId` | `string` |  |  |
| `bigfixAssetId` | `string` |  |  |
| `biosUuid` | `string` |  |  |
| `coreVersion` | `string` |  |  |
| `deletedBy` | `string` |  |  |
| `deletedOn` | `number` |  |  |
| `firstScanTimeOn` | `number` |  |  |
| `firstSeenOn` | `number` |  |  |
| `fqdns` | `array` of `string`s |  |  |
| 
`function` \*

 | `string` |  | **const**: vulnerability-detection |
| `gcpInstanceId` | `string` |  |  |
| `gcpProjectId` | `string` |  |  |
| `gcpZone` | `string` |  |  |
| `hasAgent` | `boolean` |  |  |
| `hasPluginResults` | `boolean` |  |  |
| `installedSoftware` | `array` of `string`s |  |  |
| `ipv4s` | `array` of `string`s |  |  |
| `ipv6s` | `array` of `string`s |  |  |
| `lastAuthenticatedScanDateOn` | `number` |  |  |
| `lastLicensedScanDateOn` | `number` |  |  |
| `lastScanId` | `string` |  |  |
| `lastScanTimeOn` | `number` |  |  |
| `lastScheduleId` | `string` |  |  |
| `mcafeeEpoAgentId` | `string` |  |  |
| `mcafeeEpoGuid` | `string` |  |  |
| `netbiosNames` | `array` of `string`s |  |  |
| `networkId` | `string` |  |  |
| `networkName` | `string` |  |  |
| `operatingSystems` | `array` of `string`s |  |  |
| `servicenowSysid` | `string` |  |  |
| `systemType` | `string` |  |  |
| `terminatedBy` | `string` |  |  |
| `terminatedOn` | `number` |  |  |

---

### Tenable Compliance Finding

`tenable_compliance_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`actualValue` \*

 | `string` |  |  |
| 

`agentId` \*

 | `string` |  |  |
| 

`asset.agent_name` \*

 | `string` |  |  |
| 

`asset.agent_uuid` \*

 | `string` |  |  |
| `asset.fqdns` | `array` of `string`s |  |  |
| 

`asset.id` \*

 | `string` |  |  |
| `asset.ipv4Addresses` | `array` of `string`s |  |  |
| `asset.ipv6_addresses` | `array` of `string`s |  |  |
| `asset.mac_addresses` | `array` of `string`s |  |  |
| 

`asset.name` \*

 | `string` |  |  |
| 

`asset.netbios_name` \*

 | `string` |  |  |
| 

`asset.network_id` \*

 | `string` |  |  |
| `asset.operating_systems` | `array` of `string`s |  |  |
| 

`asset.system_type` \*

 | `string` |  |  |
| 

`assetUuid` \*

 | `string` |  |  |
| 

`auditFile` \*

 | `string` |  |  |
| 

`checkId` \*

 | `string` |  |  |
| 

`checkInfo` \*

 | `string` |  |  |
| 

`checkName` \*

 | `string` |  |  |
| 

`complianceFunctionalId` \*

 | `string` |  |  |
| 

`complianceInformationalId` \*

 | `string` |  |  |
| 

`createdOn` \*

 | `number` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`expectedValue` \*

 | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| 

`id` \*

 | `string` |  |  |
| `indexedOn` | `number` |  |  |
| `lastFixed` | `number` |  |  |
| `lastObservedOn` | `number` |  |  |
| `lastSeenOn` | `number` |  |  |
| 

`metadataId` \*

 | `string` |  |  |
| 

`pluginName` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`synopsis` \*

 | `string` |  |  |
| 

`unameOutput` \*

 | `string` |  |  |

---

### Tenable Container Image

`tenable_container_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`createdOn` \*

 | `number` |  |  |
| 

`digest` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`finishedOn` \*

 | `number` |  |  |
| 

`hasInventory` \*

 | `boolean` |  |  |
| 

`hasReport` \*

 | `boolean` |  |  |
| 

`imageHash` \*

 | `string` |  |  |
| 

`lastJobStatus` \*

 | `string` |  |  |
| 

`lastScannedOn` \*

 | `number` |  |  |
| `layers.digest` | `array` of `string`s |  |  |
| `layers.size` | `array` of `number`s |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`numberOfMalware` \*

 | `number` |  |  |
| 

`numberOfVulns` \*

 | `number` |  |  |
| 

`os` \*

 | `string` |  |  |
| 

`osVersion` \*

 | `string` |  |  |
| 

`pullCount` \*

 | `string` |  |  |
| 

`pushCount` \*

 | `string` |  |  |
| 

`repoId` \*

 | `string` |  |  |
| 

`repoName` \*

 | `string` |  |  |
| 

`reportUrl` \*

 | `string` |  |  |
| 

`score` \*

 | `number` |  |  |
| 

`size` \*

 | `string` |  |  |
| 

`source` \*

 | `string` |  |  |
| 

`status` \*

 | `string` |  |  |
| 

`tag` \*

 | `string` |  |  |
| 

`updatedOn` \*

 | `number` |  |  |
| 

`uploadedOn` \*

 | `number` |  |  |

---

### Tenable Container Repository

`tenable_container_repository` inherits from [Repository](/data-model/schemas/Repository.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` |  |  |
| 

`imagesCount` \*

 | `number` |  |  |
| 

`labelsCount` \*

 | `number` |  |  |
| 

`malwareCount` \*

 | `number` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`pullCount` \*

 | `number` |  |  |
| 

`pushCount` \*

 | `number` |  |  |
| 

`totalBytes` \*

 | `number` |  |  |
| 

`vulnerabilitiesCount` \*

 | `number` |  |  |

---

### Tenable Scanner

`tenable_scanner` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`displayName` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Tenable User

`tenable_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`containerUuid` \*

 | `string` |  |  |
| 

`displayName` \*

 | `string` |  |  |
| 

`enabled` \*

 | `boolean` |  |  |
| 

`id` \*

 | `string` |  |  |
| 

`lastlogin` \*

 | `number` |  |  |
| 

`loginFailCount` \*

 | `number` |  |  |
| 

`loginFailTotal` \*

 | `number` |  |  |
| 

`name` \*

 | `string` |  |  |
| 

`permissions` \*

 | `number` |  |  |
| 

`type` \*

 | `string` |  |  |
| 

`userName` \*

 | `string` |  | **deprecated**: true |
| 

`uuid` \*

 | `string` |  |  |
| 

`uuidId` \*

 | `string` |  | **deprecated**: true |

---

### Tenable Vulnerability Finding

`tenable_vulnerability_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentId` | `string` |  |  |
| 
`asset.uuid` \*

 | `string` |  |  |
| 

`assetDeviceType` \*

 | `string` |  |  |
| 

`assetHostname` \*

 | `string` |  |  |
| `assetIpv4` | `string` |  |  |
| `assetMacAddress` | `string` |  |  |
| `cpe` | `array` of `string`s |  |  |
| `cve` | `array` of `string`s |  |  |
| `cvss3BaseScore` | `number` |  |  |
| `cvss3TemporalScore` | `string` |  |  |
| `cvss3Vector` | `string` |  |  |
| `cvssBaseScore` | `number` |  |  |
| `cvssTemporalScore` | `string` |  |  |
| `cvssVector` | `string` |  |  |
| `description` | `string` |  |  |
| `exploitabilityEase` | `string` |  |  |
| `exploitAvailable` | `boolean` |  |  |
| `exploitedByMalware` | `boolean` |  |  |
| `exploitedByNessus` | `boolean` |  |  |
| `exploitFrameworkCanvas` | `boolean` |  |  |
| `exploitFrameworkCore` | `boolean` |  |  |
| `exploitFrameworkD2Elliot` | `boolean` |  |  |
| `exploitFrameworkExploithub` | `boolean` |  |  |
| `exploitFrameworkMetasploit` | `boolean` |  |  |
| `firstFoundOn` | `number` |  |  |
| `firstSeenOn` | `number` |  |  |
| 

`hasPatch` \*

 |  |  |  |
| `impact` | `string` |  |  |
| `lastFixedOn` | `number` |  |  |
| `lastFoundOn` | `number` |  |  |
| `lastSeenOn` | `number` |  |  |
| 

`name` \*

 | `string` |  |  |
| `numericPriority` | `number` |  | **deprecated**: true |
| `numericSeverity` | `number` |  | **deprecated**: true |
| `patchPublishedOn` | `number` |  |  |
| 

`plugin.id` \*

 | `number` |  |  |
| 

`port.port` \*

 | `number` |  |  |
| 

`port.protocol` \*

 | `string` |  |  |
| `port.service` | `string` |  |  |
| `recommendation` | `string` |  |  |
| `references` | `array` of `string`s |  |  |
| `riskFactor` | `string` |  |  |
| `scan.completedOn` | `number` |  |  |
| `scan.startedOn` | `number` |  |  |
| 

`scan.uuid` \*

 | `string` |  |  |
| `severityDefaultId` | `number` |  |  |
| `severityId` | `number` |  |  |
| `severityModificationType` | `string` |  |  |
| 

`state` \*

 | `string` |  |  |
| `stigSeverity` | `string` |  |  |
| 

`targets` \*

 | `array` **|** `null` |  |  |
| `unsupportedByVendor` | `boolean` |  |  |
| `vprScore` | `number` |  |  |
| 

`vulnerabilityAge` \*

 | `number` **|** `null` |  |  |
| `vulnPublishedOn` | `number` |  |  |

---

## Release Notes

-   **2026-02-13** — Migrated Container Security ingestion from the deprecated REST API to GraphQL for improved reliability.
-   **2025-11-05** — Added configuration option to filter Tenable vulnerability findings by severity modification type.
-   **2025-09-08** — Added vulnerability publication date and patch publication date to Tenable vulnerability entities.
-   **2025-07-02** — Added vulnerability age property to Tenable vulnerability findings, calculated from first detection date.

---

Source: /integrations/directory/terraform-cloud

# HCP Terraform

Visualize Terraform Cloud data, map Terraform Cloud users to employees, and monitor changes through queries and alerts.

## Installation

To add this integration within your JupiterOne workspace, you will need to create an API Token on Terraform Cloud.

> **INFO**
> 
> See [Terraform Cloud's documentation](https://www.terraform.io/cloud-docs/api-docs#authentication) for more information.

### Configuration in JupiterOne

To install the Terraform Cloud integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Terraform Cloud. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Terraform Cloud account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Terraform Cloud **API Key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `tfe_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Entitlement Set | `tfe_entitlement_set` | [Entity](https://docs.jupiterone.io/data-model/schemas/Entity) |
| NHI User | `tfe_user` | [User](https://docs.jupiterone.io/data-model/schemas/User), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Organization | `tfe_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Resource | `tfe_workspace_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Team | `tfe_team` | [Team](https://docs.jupiterone.io/data-model/schemas/Team) |
| User | `tfe_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Workspace | `tfe_workspace` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `tfe_account` | **HAS** | `tfe_organization` |
| `tfe_organization` | **HAS** | `tfe_user` |
| `tfe_organization` | **HAS** | `tfe_workspace` |
| `tfe_organization` | **HAS** | `tfe_entitlement_set` |
| `tfe_organization` | **HAS** | `tfe_team` |
| `tfe_workspace` | **HAS** | `tfe_workspace_resource` |

### Tfe User

`tfe_user` inherits from [User](/data-model/schemas/User.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `avatarUrl` | `string` |  |  |
| `isServiceAccount` | `boolean` |  |  |
| `mfaVerified` | `boolean` |  |  |
| 
`nhiType` \*

 | `string` |  | **const**: service\_account |
| `permissions.canAccessViaTeams` | `boolean` |  |  |
| `permissions.canChangeEmail` | `boolean` |  |  |
| `permissions.canChangeUsername` | `boolean` |  |  |
| `permissions.canCreateModule` | `boolean` |  |  |
| `permissions.canCreateOrganizations` | `boolean` |  |  |
| `permissions.canCreateProvider` | `boolean` |  |  |
| `permissions.canCreateStateVersions` | `boolean` |  |  |
| `permissions.canCreateTeam` | `boolean` |  |  |
| `permissions.canCreateWorkspace` | `boolean` |  |  |
| `permissions.canDestroy` | `boolean` |  |  |
| `permissions.canForceUnlock` | `boolean` |  |  |
| `permissions.canLock` | `boolean` |  |  |
| `permissions.canManageCustomProviders` | `boolean` |  |  |
| `permissions.canManagePublicModules` | `boolean` |  |  |
| `permissions.canManagePublicProviders` | `boolean` |  |  |
| `permissions.canManageSso` | `boolean` |  |  |
| `permissions.canManageSubscription` | `boolean` |  |  |
| `permissions.canManageTags` | `boolean` |  |  |
| `permissions.canManageUsers` | `boolean` |  |  |
| `permissions.canManageUserTokens` | `boolean` |  |  |
| `permissions.canManageVarsets` | `boolean` |  |  |
| `permissions.canQueueApply` | `boolean` |  |  |
| `permissions.canQueueDestroy` | `boolean` |  |  |
| `permissions.canQueueRun` | `boolean` |  |  |
| `permissions.canReadSettings` | `boolean` |  |  |
| `permissions.canReadStateVersions` | `boolean` |  |  |
| `permissions.canReadVariable` | `boolean` |  |  |
| `permissions.canReadVarsets` | `boolean` |  |  |
| `permissions.canStartTrial` | `boolean` |  |  |
| `permissions.canTraverse` | `boolean` |  |  |
| `permissions.canUnlock` | `boolean` |  |  |
| `permissions.canUpdate` | `boolean` |  |  |
| `permissions.canUpdateAgentPools` | `boolean` |  |  |
| `permissions.canUpdateApiToken` | `boolean` |  |  |
| `permissions.canUpdateOauth` | `boolean` |  |  |
| `permissions.canUpdateSentinel` | `boolean` |  |  |
| `permissions.canUpdateSshKeys` | `boolean` |  |  |
| `permissions.canUpdateVariable` | `boolean` |  |  |

---

### Tfe User

`tfe_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `avatarUrl` | `string` |  |  |
| `isServiceAccount` | `boolean` |  |  |
| `mfaVerified` | `boolean` |  |  |
| `permissions.canAccessViaTeams` | `boolean` |  |  |
| `permissions.canChangeEmail` | `boolean` |  |  |
| `permissions.canChangeUsername` | `boolean` |  |  |
| `permissions.canCreateModule` | `boolean` |  |  |
| `permissions.canCreateOrganizations` | `boolean` |  |  |
| `permissions.canCreateProvider` | `boolean` |  |  |
| `permissions.canCreateStateVersions` | `boolean` |  |  |
| `permissions.canCreateTeam` | `boolean` |  |  |
| `permissions.canCreateWorkspace` | `boolean` |  |  |
| `permissions.canDestroy` | `boolean` |  |  |
| `permissions.canForceUnlock` | `boolean` |  |  |
| `permissions.canLock` | `boolean` |  |  |
| `permissions.canManageCustomProviders` | `boolean` |  |  |
| `permissions.canManagePublicModules` | `boolean` |  |  |
| `permissions.canManagePublicProviders` | `boolean` |  |  |
| `permissions.canManageSso` | `boolean` |  |  |
| `permissions.canManageSubscription` | `boolean` |  |  |
| `permissions.canManageTags` | `boolean` |  |  |
| `permissions.canManageUsers` | `boolean` |  |  |
| `permissions.canManageUserTokens` | `boolean` |  |  |
| `permissions.canManageVarsets` | `boolean` |  |  |
| `permissions.canQueueApply` | `boolean` |  |  |
| `permissions.canQueueDestroy` | `boolean` |  |  |
| `permissions.canQueueRun` | `boolean` |  |  |
| `permissions.canReadSettings` | `boolean` |  |  |
| `permissions.canReadStateVersions` | `boolean` |  |  |
| `permissions.canReadVariable` | `boolean` |  |  |
| `permissions.canReadVarsets` | `boolean` |  |  |
| `permissions.canStartTrial` | `boolean` |  |  |
| `permissions.canTraverse` | `boolean` |  |  |
| `permissions.canUnlock` | `boolean` |  |  |
| `permissions.canUpdate` | `boolean` |  |  |
| `permissions.canUpdateAgentPools` | `boolean` |  |  |
| `permissions.canUpdateApiToken` | `boolean` |  |  |
| `permissions.canUpdateOauth` | `boolean` |  |  |
| `permissions.canUpdateSentinel` | `boolean` |  |  |
| `permissions.canUpdateSshKeys` | `boolean` |  |  |
| `permissions.canUpdateVariable` | `boolean` |  |  |

---

## Release Notes

-   **2025-07-02** — Added support for Terraform Enterprise self-hosted deployments by allowing configuration of a custom host URL.

---

Source: /integrations/directory/threat-ng

# ThreatNG

Discover and monitor your external attack surface with ThreatNG. This integration ingests exposure scores, subdomains, DNS permutations, cloud assets, SaaS vendor identification, code secrets, and TLS/SSL certificate findings to provide visibility into your organization's digital risk posture.

## Installation

> **INFO**
> 
> You will need a ThreatNG API key to configure this integration. API keys are provisioned by ThreatNG for your organization. Contact your ThreatNG account representative or reach out to [info@threatngsecurity.com](mailto:info@threatngsecurity.com) to request API access.

To install the ThreatNG integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select ThreatNG. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   **API Key** - Your ThreatNG API key used to authenticate requests. This key is sent via the `ApiKey` header to the ThreatNG Public API.
    
-   **Domain** - The domain you want to monitor (e.g., `example.com`). ThreatNG scans this domain for external attack surface findings including subdomains, cloud assets, DNS permutations, code secrets, SaaS identification, and TLS/SSL certificates.
    
-   **Polling Interval** - Select a frequency that meets your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration.

### What data is ingested?

| Data | Description |
| --- | --- |
| **Exposure Score** | Overall ThreatNG exposure grade and per-category scores (Cyber Risk, BEC & Phishing Susceptibility, Brand Damage, etc.) |
| **Subdomains** | Discovered subdomains for the monitored domain |
| **DNS Permutations** | Typosquatting and look-alike domains that are registered (taken), with or without MX records |
| **Code Secrets** | Exposed secrets and credentials found in public code repositories |
| **Cloud Discovery** | Cloud assets discovered across AWS, GCP, and other providers, including S3 buckets and storage containers |
| **SaaS Identification** | Third-party SaaS vendors identified as being used by the organization |
| **TLS/SSL Certificates** | Summary of TLS/SSL certificate status (total, valid, invalid) |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `https://api.threatngsecurity.com/v1/Job/GetAllJobs`
-   `https://api.threatngsecurity.com/v2/exposurePriority/{rating}/{domain}`
-   `https://api.threatngsecurity.com/v2/exposureScore/Grade/{domain}`
-   `https://api.threatngsecurity.com/v2/exposureSummary/module/SaaSIdentification/{domain}`
-   `https://api.threatngsecurity.com/v2/exposureSummary/module/Subdomains/{domain}`
-   `https://api.threatngsecurity.com/v2/exposureSummary/module/{module}/{domain}`
-   `https://api.threatngsecurity.com/v2/summary/DomainIntelligence/TLSSSLCertificates/{domain}`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://www.threatngsecurity.com/](https://www.threatngsecurity.com/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (7)

| Step | Endpoints |
| --- | --- |
| Fetch Certificate Findings | `https://api.threatngsecurity.com/v2/summary/DomainIntelligence/TLSSSLCertificates/{domain}` |
| Fetch Cloud Discovery Findings | `https://api.threatngsecurity.com/v2/exposureSummary/module/{module}/{domain}` |
| Fetch Code Secret Findings | `https://api.threatngsecurity.com/v2/exposurePriority/{rating}/{domain}` |
| Fetch DNS Permutation Findings | `https://api.threatngsecurity.com/v2/exposurePriority/{rating}/{domain}` |
| Fetch SaaS Identified Findings | `https://api.threatngsecurity.com/v2/exposureSummary/module/SaaSIdentification/{domain}` |
| Fetch Service | `https://api.threatngsecurity.com/v2/exposureScore/Grade/{domain}` |
| Fetch Subdomain Findings | `https://api.threatngsecurity.com/v2/exposureSummary/module/Subdomains/{domain}` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `threatng_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Certificate Finding | `threatng_certificate_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Cloud Discovery Asset | `threatng_cloud_discovery_asset` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Cloud Discovery Bucket | `threatng_cloud_discovery_bucket` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Cloud Discovery Finding | `threatng_cloud_discovery_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Code Secret Finding | `threatng_code_secret_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| DNS Permutation Finding | `threatng_dns_permutation_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| SaaS Identified Finding | `threatng_saas_identified_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Service | `threatng_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Subdomain Finding | `threatng_subdomain_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `threatng_account` | **HAS** | `threatng_service` |
| `threatng_cloud_discovery_finding` | **HAS** | `threatng_cloud_discovery_bucket` |
| `threatng_cloud_discovery_finding` | **HAS** | `threatng_cloud_discovery_asset` |
| `threatng_service` | **IDENTIFIED** | `threatng_dns_permutation_finding` |
| `threatng_service` | **IDENTIFIED** | `threatng_code_secret_finding` |
| `threatng_service` | **IDENTIFIED** | `threatng_cloud_discovery_finding` |
| `threatng_service` | **IDENTIFIED** | `threatng_certificate_finding` |
| `threatng_service` | **IDENTIFIED** | `threatng_subdomain_finding` |
| `threatng_service` | **IDENTIFIED** | `threatng_saas_identified_finding` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `threatng_cloud_discovery_bucket` | **IS** | `aws_s3_bucket` | FORWARD |
| `threatng_cloud_discovery_bucket` | **IS** | `azure_storage_container` | FORWARD |
| `threatng_cloud_discovery_bucket` | **IS** | `google_storage_bucket` | FORWARD |
| `threatng_code_secret_finding` | **HAS** | `github_repo` | REVERSE |
| `threatng_dns_permutation_finding` | **CONNECTS** | `Domain` | FORWARD |
| `threatng_saas_identified_finding` | **IDENTIFIED** | `jupiterone_integration` | FORWARD |

### Threatng Account

`threatng_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`vendor` \*

 | `string` | The vendor name for the account |  |

---

### Threatng Certificate Finding

`threatng_certificate_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`commonName` \*

 | `string` | The common name (CN) of the certificate |  |
| 

`isExpired` \*

 | `boolean` **|** `null` | Whether the certificate is expired |  |
| 

`issuer` \*

 | `string` **|** `null` | The issuer of the certificate |  |
| 

`isWildcard` \*

 | `boolean` **|** `null` | Whether the certificate is a wildcard certificate |  |
| 

`serialNumber` \*

 | `string` **|** `null` | The serial number of the certificate |  |
| 

`signatureAlgorithm` \*

 | `string` **|** `null` | The signature algorithm used |  |
| `source` | `string` | The source of this finding |  |
| 

`subjectAltNames` \*

 | `array` **|** `null` | Subject alternative names on the certificate |  |

---

### Threatng Cloud Discovery Asset

`threatng_cloud_discovery_asset` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetName` \*

 | `string` **|** `null` | The name of the cloud asset |  |
| 

`assetType` \*

 | `string` **|** `null` | The type of cloud asset |  |
| 

`cloudProvider` \*

 | `string` **|** `null` | The cloud provider of the asset |  |
| 

`isPublic` \*

 | `boolean` **|** `null` | Whether the cloud asset is publicly accessible |  |
| 

`region` \*

 | `string` **|** `null` | The cloud region where the asset is located |  |
| `source` | `string` | The source of this finding |  |
| 

`url` \*

 | `string` **|** `null` | URL of the cloud asset |  |

---

### Threatng Cloud Discovery Bucket

`threatng_cloud_discovery_bucket` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`bucketAccessType` \*

 | `string` **|** `null` | The access type key from ThreatNG (e.g. 'S3 Bucket Open') |  |
| 

`bucketName` \*

 | `string` | The name/identifier of the cloud bucket |  |
| 

`bucketUrl` \*

 | `string` **|** `null` | The URL of the cloud bucket, used for mapped relationship matching |  |
| 

`cloudProvider` \*

 | `string` **|** `null` | The cloud provider of the bucket (e.g. Amazon Web Services, Microsoft Azure) |  |
| `source` | `string` | The source of this finding |  |

---

### Threatng Cloud Discovery Finding

`threatng_cloud_discovery_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cloudProvider` \*

 | `string` | The cloud provider name (e.g. Amazon Web Services, Microsoft Azure, Google Cloud Platform) |  |
| `source` | `string` | The source of this finding |  |
| 

`totalAssets` \*

 | `number` **|** `null` | Total number of cloud assets discovered |  |
| 

`totalBuckets` \*

 | `number` **|** `null` | Total number of cloud buckets discovered |  |

---

### Threatng Code Secret Finding

`threatng_code_secret_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`author` \*

 | `string` **|** `null` | The author of the commit containing the secret |  |
| 

`branch` \*

 | `string` **|** `null` | The branch where the secret was found |  |
| 

`commitHash` \*

 | `string` **|** `null` | The commit hash where the secret was introduced |  |
| 

`filePath` \*

 | `string` **|** `null` | The file path where the secret was found |  |
| 

`repository` \*

 | `string` | The repository name where the secret was found |  |
| 

`secretType` \*

 | `string` **|** `null` | The type of secret found (e.g. API key, credential) |  |
| `source` | `string` | The source of this finding |  |

---

### Threatng Dns Permutation Finding

`threatng_dns_permutation_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainPermutation` \*

 | `string` | The permuted domain name |  |
| 

`ipv4` \*

 | `string` **|** `null` | IPv4 address of the permuted domain |  |
| 

`ipv6` \*

 | `string` **|** `null` | IPv6 address of the permuted domain |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the permuted domain is actively resolving |  |
| 

`isRegistered` \*

 | `boolean` **|** `null` | Whether the permuted domain is registered |  |
| 

`mxRecords` \*

 | `array` **|** `null` | MX records for the permuted domain |  |
| 

`nameServers` \*

 | `array` **|** `null` | Name servers for the permuted domain |  |
| 

`permutationType` \*

 | `string` **|** `null` | The type of permutation (e.g. homoglyph, insertion) |  |
| `source` | `string` | The source of this finding |  |

---

### Threatng Saas Identified Finding

`threatng_saas_identified_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`saasCategory` \*

 | `string` | The functional category of the SaaS product (e.g. Issue trackers, Live chat, Analytics) |  |
| 

`saasVendor` \*

 | `string` | The name of the identified SaaS vendor (e.g. Atlassian, Slack, Zoom) |  |
| `source` | `string` | The source of this finding |  |

---

### Threatng Service

`threatng_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domain` \*

 | `string` | The domain being monitored |  |
| 

`exposureGrade` \*

 | `string` **|** `null` | The overall ThreatNG exposure grade (e.g. A, B, C, D, F) |  |
| 

`exposureScores` \*

 | `array` **|** `null` | Individual exposure score grades (e.g. "Cyber Risk: C") |  |

---

### Threatng Subdomain Finding

`threatng_subdomain_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`httpStatus` \*

 | `number` **|** `null` | HTTP response status code |  |
| 

`ipv4` \*

 | `string` **|** `null` | IPv4 address of the subdomain |  |
| 

`ipv6` \*

 | `string` **|** `null` | IPv6 address of the subdomain |  |
| 

`isActive` \*

 | `boolean` **|** `null` | Whether the subdomain is actively resolving |  |
| `source` | `string` | The source of this finding |  |
| 

`subdomain` \*

 | `string` | The discovered subdomain |  |
| 

`technologies` \*

 | `array` **|** `null` | Technologies detected on the subdomain |  |

---

---

Source: /integrations/directory/tidal-cyber

# Tidal Cyber

Bring your Tidal Cyber threat-informed defense posture into JupiterOne: the defensive stacks you model in Tidal, the security products and capabilities in each stack, your threat profiles, and the coverage maps that score a stack against a threat profile. Query which products and capabilities cover your prioritized threats alongside the rest of your asset graph.

## Installation

This integration connects to the **Tidal Cyber Enterprise API** of your tenant (`https://<tenant>-hosted-api.tidalcyber.com`) and ingests your defensive stacks, the products and capabilities in them, your threat profiles and your coverage maps. It authenticates with a Tidal API token, sent in the `Authorization: Token <token>` header, and only reads data. The integration is managed by JupiterOne and runs in the JupiterOne cloud, so no collector is needed.

The integration ingests your tenant's own posture data. It does not ingest the MITRE ATT&CK knowledge base (techniques, groups, software, campaigns) that Tidal also serves, because that content is the same for every tenant.

### Prerequisites

-   A **Tidal Cyber Enterprise** tenant.
-   A Tidal admin who can turn on API access for the tenant.
-   A Tidal user account to own the API token. We recommend a dedicated service account, because a token stops working when the user who created it is deactivated.
-   Access to **JupiterOne** with permission to configure integrations.

### Configuration in Tidal Cyber

#### Turn on API access

1.  Sign in to your Tidal tenant as an admin.
2.  Open the user menu in the upper-right corner and select **API Token Management**.
3.  Make sure the **API Access Enabled** toggle is on.

If the **Generate New Token** button is not visible, you are not an admin and API access is turned off for the tenant. Ask a Tidal admin to turn it on.

#### Create the API token

1.  Sign in to Tidal as the user that will own the token.
2.  Open the user menu and select **API Token Management**.
3.  Click **Generate New Token** and give the token a description, such as `JupiterOne`.
4.  Choose **Read Only**. The integration never changes data in Tidal.
5.  Create the token, copy it and store it somewhere safe. Tidal shows the token value only once.

Tidal API tokens are valid for one year. Create a new token and update the instance before the token expires, or ingestion stops. You can see the expiration date in **API Token Management**.

#### Find your tenant name

The tenant name is the first part of the address you use to sign in to Tidal. If you sign in at `https://example.tidalcyber.com`, the tenant name is `example`.

### Configuration in JupiterOne

To install the Tidal Cyber integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Tidal Cyber**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Tidal Cyber account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Authentication** fields below.
    

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **Tenant** | Yes | Your Tidal tenant name, for example `example` for `https://example.tidalcyber.com`. A full Tidal address is also accepted. |
| **API Token** | Yes | The Tidal API token created above. A Read Only token is enough. It is masked in JupiterOne. |

When you save the instance, JupiterOne checks that the tenant name is valid and calls the Tidal API with the token. A wrong tenant, an expired or revoked token, or API access turned off for the tenant fails the check.

Click **Create** once all values are provided to finalize the integration.

#### Data Sources

**All data sources are disabled by default**, so a new instance ingests only the `tidal_account` entity until you enable the ones you want. To enable them, open the instance, turn on the data sources under **Data Sources**, and save. They are ingested on the next run.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Defensive Posture** | Defensive stacks, the security products placed in each stack with their vendor, the product capabilities in each stack and whether they are enabled, threat profiles, and the coverage maps that score a stack against a threat profile. | `tidal_defensive_stack`, `tidal_product`, `tidal_capability`, `tidal_threat_profile`, `tidal_coverage_map` |
| **Users** | The Tidal user that owns the API token. | `tidal_user` |

Relationships are built only when the data source they need is enabled:

| Relationship | Requires |
| --- | --- |
| `tidal_account` **HAS** `tidal_defensive_stack` | **Defensive Posture** |
| `tidal_defensive_stack` **HAS** `tidal_product` | **Defensive Posture** |
| `tidal_product` **HAS** `tidal_capability` | **Defensive Posture** |
| `tidal_coverage_map` **EVALUATES** `tidal_defensive_stack` | **Defensive Posture** |
| `tidal_coverage_map` **USES** `tidal_threat_profile` | **Defensive Posture** |
| `tidal_account` **HAS** `tidal_user` | **Users** |

#### Notes

-   **One entity per product per stack.** A product placed in two defensive stacks becomes two `tidal_product` entities, one under each stack, because each stack has its own capability settings. `productId` holds the Tidal product-registry id, so you can group them in a query.
-   **Every run is a full sync.** Stacks, products, capabilities, threat profiles and coverage maps that Tidal no longer reports are removed from the graph on the next run.
-   **Raw data is not stored.** Entities keep only the mapped properties.

#### Rate limits

The Tidal API allows 2,000 requests per 5 minutes per tenant. A run makes a handful of requests plus one per distinct product in your stacks, so it stays far below that limit. If Tidal returns a rate-limit error, the integration waits and retries.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   Tidal's API documentation is available on request from [support@tidalcyber.com](mailto:support@tidalcyber.com).

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (1)

-   `Read Only API token`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (8)

-   `GET https://<tenant>-hosted-api.tidalcyber.com/api/v1/coverage-maps/coverage-maps/`
-   `GET https://<tenant>-hosted-api.tidalcyber.com/api/v1/coverage-maps/defensive-stack-capabilities/`
-   `GET https://<tenant>-hosted-api.tidalcyber.com/api/v1/coverage-maps/defensive-stack-products/`
-   `GET https://<tenant>-hosted-api.tidalcyber.com/api/v1/coverage-maps/defensive-stacks/`
-   `GET https://<tenant>-hosted-api.tidalcyber.com/api/v1/coverage-maps/threat-profiles/`
-   `GET https://<tenant>-hosted-api.tidalcyber.com/api/v1/mgmt/users/`
-   `GET https://<tenant>-hosted-api.tidalcyber.com/api/v1/product-registry/capabilities/?product=<id>`
-   `GET https://<tenant>-hosted-api.tidalcyber.com/api/v1/product-registry/products/`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (1)

-   [https://docs.jupiterone.io/integrations/directory/tidal-cyber](https://docs.jupiterone.io/integrations/directory/tidal-cyber)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (3)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Fetch Capabilities | `Read Only API token` | `GET https://<tenant>-hosted-api.tidalcyber.com/api/v1/coverage-maps/defensive-stack-capabilities/`, `GET https://<tenant>-hosted-api.tidalcyber.com/api/v1/product-registry/capabilities/?product=<id>` |
| Fetch Coverage Maps | `Read Only API token` | `GET https://<tenant>-hosted-api.tidalcyber.com/api/v1/coverage-maps/coverage-maps/` |
| Fetch Products | `Read Only API token` | `GET https://<tenant>-hosted-api.tidalcyber.com/api/v1/coverage-maps/defensive-stack-products/`, `GET https://<tenant>-hosted-api.tidalcyber.com/api/v1/product-registry/products/` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `tidal_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Capability | `tidal_capability` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Coverage Map | `tidal_coverage_map` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Defensive Stack | `tidal_defensive_stack` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Product | `tidal_product` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Threat Profile | `tidal_threat_profile` | [ThreatIntel](https://docs.jupiterone.io/data-model/schemas/ThreatIntel) |
| User | `tidal_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `tidal_account` | **HAS** | `tidal_user` |
| `tidal_account` | **HAS** | `tidal_defensive_stack` |
| `tidal_coverage_map` | **EVALUATES** | `tidal_defensive_stack` |
| `tidal_coverage_map` | **USES** | `tidal_threat_profile` |
| `tidal_defensive_stack` | **HAS** | `tidal_product` |
| `tidal_product` | **HAS** | `tidal_capability` |

### Tidal Account

`tidal_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`tenant` \*

 | `string` | Tidal tenant name, for example `example` for [https://example.tidalcyber.com](https://example.tidalcyber.com). |  |

---

### Tidal Capability

`tidal_capability` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`capabilityId` \*

 | `string` | Tidal product-registry id of the capability. |  |
| `capabilityType` | `string` **|** `null` | Tidal capability type. |  |
| `isEnabled` | `boolean` **|** `null` | Whether the capability is enabled in the defensive stack. |  |

---

### Tidal Coverage Map

`tidal_coverage_map` inherits from [Assessment](/data-model/schemas/Assessment.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `engine` | `string` **|** `null` | Scoring engine used to compute coverage. |  |
| `platformIds` | `array` **|** `null` | Tidal ids of the platforms the coverage map covers. |  |

---

### Tidal Defensive Stack

`tidal_defensive_stack` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isUsingDefaultWeights` | `boolean` **|** `null` | Whether the stack scores coverage with Tidal default weights. |  |

---

### Tidal Product

`tidal_product` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`productId` \*

 | `string` | Tidal product-registry id of the product. |  |
| `vendor` | `string` **|** `null` | Name of the vendor that makes the product. |  |
| `vendorId` | `string` **|** `null` | Tidal product-registry id of the vendor. |  |

---

### Tidal Threat Profile

`tidal_threat_profile` inherits from [ThreatIntel](/data-model/schemas/ThreatIntel.md)

---

### Tidal User

`tidal_user` inherits from [User](/data-model/schemas/User.md)

---

---

Source: /integrations/directory/torii

# Torii

Visualize Torii users, roles, applications, and contracts in the JupiterOne graph. Map Torii users to employees in your JupiterOne account.

## Installation

> **INFO**
> 
> You will need to create an API key by visiting the Torii [API Access page](https://app.toriihq.com/team/settings/apiAccess). More information can be found [here](https://developers.toriihq.com/reference/introduction-2).

To install the Torii integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Torii. Click **New Instance** to begin configuring the integration.

Creating a Torii instance requires the following:

-   The **Account Name** used to identify the Torii account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your API Key.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Application | `torii_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Contract | `torii_contract` | [Document](https://docs.jupiterone.io/data-model/schemas/Document) |
| Organization | `torii_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Role | `torii_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| User | `torii_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `torii_application` | **HAS** | `torii_user` |
| `torii_application` | **HAS** | `torii_contract` |
| `torii_organization` | **HAS** | `torii_role` |
| `torii_organization` | **HAS** | `torii_user` |
| `torii_organization` | **HAS** | `torii_application` |
| `torii_organization` | **HAS** | `torii_contract` |
| `torii_user` | **ASSIGNED** | `torii_role` |

### Torii User

`torii_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `deletedInIdentitySources` | `boolean` |  |  |
| `external` | `boolean` |  |  |
| `lifecycleStatus` | `string` |  |  |
| `role` | `string` |  |  |
| `roleId` | `integer` |  |  |
| `userId` | `integer` |  |  |

---

---

Source: /integrations/directory/torq

# Torq

Visualize Torq cases, alerts, analysts and runbooks in JupiterOne. Report on case volume, resolution time and triage latency, and monitor your SOC operations through queries and alerts.

## Installation

### Prerequisites

-   A **Torq** workspace, and an **API key** created in it.
-   If you want alert data, a workspace licensed for **Auto Triage (HyperSOC)**. Case data does not require it — see [Auto Triage is licensed separately](#auto-triage-is-licensed-separately).
-   Access to **JupiterOne** with permission to configure integrations.

### Create an API key in Torq

The integration authenticates using **OAuth 2.0 (client credentials)**, exchanging the API key's Client ID and Client Secret for a bearer token. Tokens are valid for one hour and are renewed automatically during a run.

To create the key:

1.  Sign in to Torq.
2.  Go to **Settings → API Keys**.
3.  Create a new API key and copy the **Client ID** and **Client Secret**. The secret is shown only once.

An API key is **scoped to the workspace it is created in**, so a JupiterOne instance collects from exactly one Torq workspace. To cover several workspaces, create one integration instance per workspace.

The integration issues read-only requests.

### Configuration in JupiterOne

To install the Torq integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Torq**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Torq account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Authentication** fields below.
    

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **Region** | Yes | The Torq region hosting your workspace. Choose **EU** only if you sign in at `eu.torq.io`; otherwise leave it as **United States**. |
| **Client ID** | Yes | Client ID of the Torq API key. |
| **Client Secret** | Yes | Client Secret paired with the Client ID. Shown only once when the key is created. |

Click **Create** once all values are provided to finalize the integration.

> **NOTE**
> 
> **Region** selects both the API and authentication hosts — `api.torq.io` and `auth.torq.io` for the United States, `api.eu.torq.io` and `auth.eu.torq.io` for Europe. An API key issued in one region will not authenticate against the other.

#### Data collection fields

These are optional and control how much history each run collects.

| Field | Default | Description |
| --- | --- | --- |
| **Case Lookback Days** | 90 days | How far back to collect cases on each sync, by case creation date. Options are 30, 90, 180 and 365 days, or **All time**. |
| **Alert Lookback Days** | 30 days | How far back to collect Auto Triage alerts on each sync, by acknowledgement time. Options are 7, 30 and 90 days. Only applies when the **Auto Triage Alerts** ingestion source is enabled. |

> **CAUTION**
> 
> **Case Lookback Days** is a rolling window over case _creation_ date. A case created before the window is removed from JupiterOne on the next run, even if it is still open. Choose **All time** if you need the full history retained.

Torq does not serve alerts acknowledged more than 90 days ago, which is why **Alert Lookback Days** stops at 90.

### Data sources

You can narrow what the integration collects from the instance's ingestion source settings.

| Ingestion source | Default | Data collected |
| --- | --- | --- |
| **Cases** | Enabled | Torq cases with their lifecycle timestamps, severity, category and SLA, for resolution-time and case-volume reporting. |
| **Users** | Enabled | User accounts in the Torq workspace. |
| **Roles** | Enabled | Roles available in the workspace and the permission scopes they grant. |
| **User Role Assignments** | Enabled | Which role each Torq user holds. |
| **Runbooks** | Enabled | Case runbooks defined in the workspace. Metadata only — the runbook body is not retrieved. |
| **Case Assignments** | Enabled | Which Torq user each case is assigned to. |
| **Case Runbooks** | Enabled | Which runbook each case follows. |
| **Auto Triage Alerts** | Disabled | Alerts triaged by Torq Auto Triage that resulted in a case, carrying detection, acknowledgement and triage timestamps plus the triage verdict. |
| **Alert Case Links** | Disabled | Which case each Auto Triage alert produced. Requires **Auto Triage Alerts**. |
| **Case Relations** | Disabled | Parent, duplicate and blocking relations between cases. |

Relationships that span two sources are only created when both are enabled. Disabling **Users**, for example, does not stop cases being collected — it removes the assignment edges between them.

#### The three disabled sources

**Auto Triage Alerts** requires a workspace licensed for Auto Triage, and alerts are the highest-volume object in Torq — Auto Triage exists to collapse many alerts into far fewer cases. The collection is bounded in two ways: to alerts that actually produced a case, and to the configured lookback window. That keeps the volume close to case count rather than one to two orders of magnitude above it.

**Alert Case Links** depends on **Auto Triage Alerts** and adds no requests of its own.

**Case Relations** is disabled for cost rather than volume: Torq exposes links only per case, so enabling it issues one additional API request for every case collected.

### Auto Triage is licensed separately

Auto Triage (HyperSOC) is a separately licensed Torq capability. On a workspace without it, the alert endpoints return `403`, while cases, users, roles and runbooks are unaffected.

The integration is built for this. Setup validates the credentials by requesting a token and nothing more, so an unlicensed workspace configures normally. If **Auto Triage Alerts** is enabled on a workspace that lacks the licence, the step records a missing-permission warning and the run continues — the remaining sources are collected as usual.

### What the integration does not collect

The integration is designed to collect the minimum needed for reporting and relationship mapping. It never retrieves:

-   Case descriptions, titles, analyst notes, comments or attachments
-   Resolution write-ups or case review notes
-   Auto Triage narrative output — alert summaries, verdict justifications and suggested actions
-   Runbook bodies

Cases are named by their Torq pretty ID (for example `#4812`) rather than their title, following the same convention as the ServiceNow and Jira integrations. Alert names _are_ collected, because they are the detection rule name reported by the source security tool — for example `Endpoint Detection - ldt` — rather than analyst-authored text.

The case timeline, notes, comments and attachment endpoints are never called at all.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Torq API overview](https://developers.torq.io/apidocs/overview) — hosts, regions and rate limits
-   [Torq API authentication](https://developers.torq.io/apidocs/authentication) — creating an API key and the client credentials flow
-   [Query cases](https://developers.torq.io/apidocs/query-cases) — the case fields this integration reads
-   [List alerts](https://developers.torq.io/apidocs/list-alerts-1) — the Auto Triage alert fields this integration reads

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (6)

-   `GET /v1alpha/cases/runbooks`
-   `GET /v1alpha/cases/{case_id}/links`
-   `GET /v1alpha/roles`
-   `GET /v1alpha/users`
-   `POST /v1/triage/alerts/query`
-   `POST /v1alpha/cases/query`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (6)

-   [https://developers.torq.io/apidocs/list-alerts-1](https://developers.torq.io/apidocs/list-alerts-1)
-   [https://developers.torq.io/apidocs/list-roles-4](https://developers.torq.io/apidocs/list-roles-4)
-   [https://developers.torq.io/apidocs/list-runbooks-1](https://developers.torq.io/apidocs/list-runbooks-1)
-   [https://developers.torq.io/apidocs/list-the-case-links](https://developers.torq.io/apidocs/list-the-case-links)
-   [https://developers.torq.io/apidocs/list-users](https://developers.torq.io/apidocs/list-users)
-   [https://developers.torq.io/apidocs/query-cases](https://developers.torq.io/apidocs/query-cases)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (1)

| Step | Endpoints |
| --- | --- |
| Build Case Links | `GET /v1alpha/cases/{case_id}/links` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `torq_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `torq_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Case | `torq_case` | [Incident](https://docs.jupiterone.io/data-model/schemas/Incident), [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Role | `torq_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Runbook | `torq_runbook` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| User | `torq_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `torq_account` | **HAS** | `torq_user` |
| `torq_alert` | **TRIGGERS** | `torq_case` |
| `torq_case` | **ASSIGNED** | `torq_user` |
| `torq_case` | **USES** | `torq_runbook` |
| `torq_case` | **LINKS** | `torq_case` |
| `torq_user` | **ASSIGNED** | `torq_role` |

### Torq Account

`torq_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiBaseUrl` \*

 | `string` **|** `null` | The Torq Public API base URL this instance collects from, for example [https://api.torq.io/public](https://api.torq.io/public). |  |
| 

`region` \*

 | `string` **|** `null` | The Torq region hosting the workspace: 'us' or 'eu'. Determines both the API and authentication hosts. |  |

---

### Torq Alert

`torq_alert` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`acknowledgedOn` \*

 | `number` **|** `null` | When Auto Triage acknowledged the alert and began work. |  |
| 

`alertType` \*

 | `string` **|** `null` | The detection type reported by the source tool, for example 'Endpoint Detection - ldt'. |  |
| 

`caseClosedByKind` \*

 | `string` **|** `null` | What closed the case this alert produced: 'USER' for an analyst, or 'WORKFLOW' or 'SOCRATES' for automation. Null while the case is open. |  |
| 

`categoryNames` \*

 | `array` **|** `null` | Every category Torq assigned the alert, ordered by dominance. The class-level category property carries only the first — the SDK's entity validator rejects an array there even though the data model documents one. |  |
| 

`changedSeverity` \*

 | `string` **|** `null` | The severity the reviewing analyst substituted, when they changed it. Null when the severity was left as Auto Triage set it. |  |
| 

`changedVerdictValue` \*

 | `string` **|** `null` | The verdict the reviewing analyst substituted, when they changed it. Null when the verdict was confirmed or never reviewed. |  |
| 

`detectedOn` \*

 | `number` **|** `null` | When the source security tool detected the activity, before Torq received it. |  |
| 

`ingestedOn` \*

 | `number` **|** `null` | When the alert arrived in the Torq workspace. |  |
| 

`isAutoClosed` \*

 | `boolean` **|** `null` | Whether the case this alert produced was closed by automation rather than by an analyst. Null while the case is open. |  |
| 

`isVerdictReviewed` \*

 | `boolean` **|** `null` | Whether an analyst reviewed the Auto Triage verdict rather than leaving it unexamined. |  |
| 

`mitreTacticIds` \*

 | `array` **|** `null` | MITRE ATT&CK tactic IDs associated with the alert, for example 'TA0011'. |  |
| 

`mitreTacticNames` \*

 | `array` **|** `null` | Names of the MITRE ATT&CK tactics associated with the alert, positionally aligned with mitreTacticIds. An entry Torq sends without a name repeats its id here. |  |
| 

`mitreTechniqueIds` \*

 | `array` **|** `null` | MITRE ATT&CK technique IDs associated with the alert, for example 'T1566'. |  |
| 

`mitreTechniqueNames` \*

 | `array` **|** `null` | Names of the MITRE ATT&CK techniques associated with the alert, positionally aligned with mitreTechniqueIds. An entry Torq sends without a name repeats its id here. |  |
| 

`organizationId` \*

 | `string` **|** `null` | Identifier of the Torq organization the workspace belongs to. |  |
| 

`prettyId` \*

 | `string` **|** `null` | The alert identifier as shown on the Torq Alerts page. |  |
| 

`sourceIntegrationTypeId` \*

 | `string` **|** `null` | Identifier of the tool the alert came from, for example 'crowdstrike\_streaming' or 'sentinelone\_data\_connector'. |  |
| 

`sourceMitigation` \*

 | `string` **|** `null` | The mitigation the source tool applied or offered for the alert. |  |
| 

`sourceSeverity` \*

 | `string` **|** `null` | The severity the source tool assigned, before Auto Triage reassessed it. |  |
| 

`timeToAcknowledgeSeconds` \*

 | `number` **|** `null` | Elapsed seconds from source detection to Auto Triage acknowledgement. The per-alert input to mean time to acknowledge (MTTA). |  |
| 

`timeToTriageSeconds` \*

 | `number` **|** `null` | Elapsed seconds from acknowledgement to a completed verdict — how long Auto Triage took to reach a decision. |  |
| 

`triagedOn` \*

 | `number` **|** `null` | When Auto Triage finished assigning a verdict. |  |
| 

`verdictConfidence` \*

 | `string` **|** `null` | How confident Auto Triage was in the verdict: 'High', 'Medium', or 'Low'. |  |
| 

`verdictReviewAction` \*

 | `string` **|** `null` | What the reviewing analyst did: 'Confirmed' to agree with Auto Triage, or 'Changed' to override it. The rate of each measures analyst agreement with automated triage. |  |
| 

`verdictTriageSeverity` \*

 | `string` **|** `null` | The severity Auto Triage assigned, as Torq reports it: 'Critical', 'High', 'Medium', 'Low', or 'Info'. The normalized form is on the severity property. |  |
| 

`verdictValue` \*

 | `string` **|** `null` | The Auto Triage verdict: 'True Positive - Malicious', 'True Positive - Benign', or 'False Positive'. |  |
| 

`verifiedByEmail` \*

 | `string` **|** `null` | Email address of the analyst who reviewed the verdict. |  |
| 

`verifiedOn` \*

 | `number` **|** `null` | When the analyst reviewed the verdict. |  |
| 

`workspaceId` \*

 | `string` **|** `null` | Identifier of the Torq workspace the alert belongs to. |  |

---

### Torq Case

`torq_case` inherits from [Incident](/data-model/schemas/Incident.md), [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`accessPolicyType` \*

 | `string` **|** `null` | Who can open the case: 'ACCESS\_POLICY\_PUBLIC' for everyone in the workspace, or 'ACCESS\_POLICY\_COLLABORATORS\_LIST' when it is restricted to named collaborators. |  |
| 

`assigneeEmail` \*

 | `string` **|** `null` | Email address of the analyst the case is assigned to. Retained alongside the assignment relationship because the assignee may be someone who is not an ingested Torq user. |  |
| 

`completedOn` \*

 | `number` **|** `null` | When the case moved to a resolved or closed state. Null while the case is still open. |  |
| 

`isSlaBreached` \*

 | `boolean` **|** `null` | Whether the case took longer than its resolution SLA, measured from the SLA start. Computed for closed cases from the resolution time, and for open cases from the time elapsed so far, so a case that has already run over reports as breached before anyone closes it. Null when the case carries no SLA. |  |
| 

`pendingTaskCount` \*

 | `number` **|** `null` | Number of tasks on the case still awaiting completion. |  |
| 

`prettyId` \*

 | `string` **|** `null` | The case identifier as shown on the Torq Cases page, for example '#28'. |  |
| 

`reporterKind` \*

 | `string` **|** `null` | What opened the case: 'USER', 'WORKFLOW', or 'SOCRATES' (Torq's AI agent). Distinguishes analyst-raised cases from automation-raised ones. |  |
| 

`resolutionReason` \*

 | `string` **|** `null` | The short reason the case was resolved or closed, chosen from the workspace resolution reasons. The free-text resolution details are not ingested. |  |
| 

`reviewConclusion` \*

 | `string` **|** `null` | The outcome of the case review, by default 'Approved' or 'Rejected', though workspaces can customise the set. |  |
| 

`reviewedByEmail` \*

 | `string` **|** `null` | Email address of the analyst who actually recorded the review conclusion. |  |
| 

`reviewerEmail` \*

 | `string` **|** `null` | Email address of the analyst assigned to review the case. |  |
| 

`slaEndedOn` \*

 | `number` **|** `null` | When the resolution SLA timer stopped, which Torq reports as the time the case was resolved or closed. Null while the case is still open. |  |
| 

`slaSeconds` \*

 | `number` **|** `null` | The resolution SLA in seconds: how long after creation the case is expected to be resolved or closed. |  |
| 

`slaStartedOn` \*

 | `number` **|** `null` | When the resolution SLA timer started. Torq reports this as the time the case was created, and it is the baseline the breach calculation measures from. |  |
| 

`timeToResolveSeconds` \*

 | `number` **|** `null` | Elapsed seconds from case creation to resolution or closure. The per-case input to mean time to resolve (MTTR). Null while the case is still open. |  |

---

### Torq Role

`torq_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isCustomRole` \*

 | `boolean` **|** `null` | Whether the role was defined by the workspace rather than being one of the roles Torq ships by default. |  |

---

### Torq Runbook

`torq_runbook` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`runbookId` \*

 | `string` **|** `null` | The Torq identifier of the runbook, as referenced by the cases that follow it. |  |

---

### Torq User

`torq_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isSsoProvisioned` \*

 | `boolean` **|** `null` | Whether the user was provisioned through the SSO identity provider rather than created locally in Torq. |  |
| 

`lastLoginOn` \*

 | `number` **|** `null` | When the user last signed in to Torq, through either the UI or the API. |  |

---

---

Source: /integrations/directory/travisci

# TravisCI

Visualize Travis CI repositories, map Travis CI users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to create an API Token on Travis CI. This can be found under your **Settings > API Authentication** in Travis CI.

### Configuration in JupiterOne

To install the Travis CI integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Travis CI. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Travis CI account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Travis CI **Hostname** and **API Token**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `travisci_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| CodeRepo | `travisci_coderepo` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| User | `travisci_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `travisci_account` | **IS** | `travisci_user` |
| `travisci_user` | **CREATED** | `travisci_coderepo` |
| `travisci_user` | **USES** | `travisci_coderepo` |

---

Source: /integrations/directory/trellix

# Trellix

Visualize Trellix Endpoint protection groups and its corresponding protected devices and findings and monitor changes through alerts and queries.

## Installation

To use this integration, JupiterOne requires Client Credentials to a Trellix account. The process to obrain credentials is described in [Trellix documentation](https://developer.manage.trellix.com/mvision/selfservice/access_manag) under the 'API Access Management' section. There, you will need to request a client ID and Secret. Follow instructions specified and make sure you request a client that has access to at least the following scopes:

-   Devices Read Scope (epo.device.r)
-   Groups Read Scope (epo.grps.r)
-   Threats Read Scope (soc.act.tg)

After requesting the client, you will need to wait for Trellix to approve it. Once approved you will get the Cliend ID and Secret that you can use to integrate with JupiterOne.

### Configuration in JupiterOne

To install the Trellix integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Trellix. Click **New Instance** to begin configuring your integration, providing the following:

-   **API Key**: unique identifier used to authenticate and control access to Trellix API. You should be able to find it [here](https://developer.manage.trellix.com/mvision/selfservice/access_manag)
    
-   **Client ID**: Public identifier for the client created for Jupiter One who must have access to the previously mentioned scopes.
    
-   **Client Secret**: Private key pair of the Client ID, both are necessary to be able to authenticate the user in Trellix.
    
-   **Account Name** used to identify the Trellix account in JupiterOne.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Vulnerability Filters**: here you will be able to customize what severities you want to fetch when retrieving threats.
    
-   **Data Source Settigns**: here you will be able to customize the steps to be ingested. If desired, specific steps can be enabled/disabled from here.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `trellix_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Device | `trellix_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Group | `trellix_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Service | `trellix_endpoint_protection` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Threat | `trellix_threat` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `trellix_account` | **HAS** | `trellix_endpoint_protection` |
| `trellix_account` | **HAS** | `trellix_group` |
| `trellix_account` | **HAS** | `trellix_device` |
| `trellix_device` | **ASSIGNED** | `trellix_group` |
| `trellix_threat` | **EXPLOITS** | `trellix_device` |

### Trellix Account

`trellix_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `description` | `string` |  |  |

---

### Trellix Device

`trellix_device` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentPlatform` | `string` |  |  |
| `agentState` | `number` |  |  |
| `agentVersion` | `string` |  |  |
| `computerName` | `string` |  |  |
| `cpuSpeed` | `number` |  |  |
| `cpuType` | `string` |  |  |
| `createdOn` | `number` |  |  |
| `domainName` | `string` |  |  |
| `excludedTags` | `string` |  |  |
| `hardwareModel` | `string` |  |  |
| `hardwareSerial` | `string` |  |  |
| `hardwareVendor` | `string` |  |  |
| `ipAddress` | `string` |  |  |
| `ipHostName` | `string` |  |  |
| `isPortable` | `string` |  |  |
| `macAddress` | `string` |  |  |
| `managed` | `string` |  |  |
| `managedState` | `number` |  |  |
| `name` | `string` |  |  |
| `nodePath` | `string` |  |  |
| `numOfCpu` | `number` |  |  |
| `parentId` | `number` |  |  |
| `tags` | `array` of `string`s |  |  |
| `tenantId` | `number` |  |  |
| `totalPhysicalMemory` | `number` |  |  |
| `userName` | `string` |  |  |

---

### Trellix Endpoint Protection

`trellix_endpoint_protection` inherits from [Service](/data-model/schemas/Service.md)

---

### Trellix Group

`trellix_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `groupTypeId` | `number` |  |  |
| `l1ParentId` | `number` |  |  |
| `l2ParentId` | `number` |  |  |
| `nodePath` | `string` |  |  |
| `nodeTextPath` | `string` |  |  |
| `nodeTextPath2` | `string` |  |  |
| `notes` | `array` of `string`s |  |  |
| `parentId` | `number` |  |  |

---

---

Source: /integrations/directory/trellix-epo

# Trellix ePO

## Installation

> **INFO**
> 
> You will need your Trellix ePolicy Orchestrator (ePO) instance URL (hostname and port), username, and password to set up this integration. Ensure you have an account with appropriate permissions to access the Trellix ePolicy Orchestrator (ePO) API.

### Configuration in Trellix ePolicy Orchestrator (ePO)

1.  Ensure you have access to your Trellix ePolicy Orchestrator (ePO) instance with administrative permissions.
2.  Note your Trellix ePolicy Orchestrator (ePO) instance URL including the hostname and port (e.g., `https://hostname:8443`).
3.  Create or use an existing user account with API access permissions.
4.  Have your username and password ready for JupiterOne configuration.

### Configuration in JupiterOne

To install the Trellix ePolicy Orchestrator (ePO) integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Trellix ePO. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Trellix ePolicy Orchestrator (ePO) account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Trellix ePolicy Orchestrator (ePO) **Base URL** (hostname and port), for example `https://hostname:8443`.
    
-   Your Trellix ePolicy Orchestrator (ePO) **Username** for API access.
    
-   Your Trellix ePolicy Orchestrator (ePO) **Password** for API access.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `trellix_epo_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| User | `trellix_epo_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `trellix_epo_account` | **HAS** | `trellix_epo_user` |

### Trellix Epo Account

`trellix_epo_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Trellix Epo User

`trellix_epo_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `isAdmin` | `boolean` |  |  |

---

## Release Notes

-   **2025-04-24** — Added Trellix ePO device user ingestion as new entities, relating device users to the hosts they use.

---

Source: /integrations/directory/trend-micro

# Trend Cloud One

Visualize Trend Micro administrators, endpoint agents, and devices, map Trend Micro agents to devices and owners, and monitor changes through queries and alerts.

## Installation

For this integration, you will need an API key from Trend Micro Cloud One.

### Prerequisites

Create an API key in the [Trend Micro Cloud One console](https://cloudone.trendmicro.com/):

1.  Log in to the Cloud One console and navigate to **Administration** > **API Keys**.
2.  Click **New** and give the key a descriptive name (for example, `jupiterone-read`).
3.  Assign the key a role with read access across the Cloud One services you want JupiterOne to ingest (Workload Security, File Storage Security, and Account Management).
4.  Copy the generated API key — it will not be shown again.

For details, see [Trend Micro's API key documentation](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-api-key).

### Configuration in JupiterOne

To install the Trend Micro integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Trend Micro. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Trend Micro account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   **Cloud One Region** — the region where your Cloud One account data is hosted (for example, `us-1`, `gb-1`, or `au-1`). See the [Cloud One regions reference](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-c1-regions) for a full list of valid values.
    
-   Your Trend Micro **API Key** generated for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `https://accounts.cloudone.trendmicro.com/api/apikeys`
-   `https://accounts.cloudone.trendmicro.com/api/roles`
-   `https://accounts.cloudone.trendmicro.com/api/users`
-   `https://filestorage.{region}.cloudone.trendmicro.com/api/events`
-   `https://filestorage.{region}.cloudone.trendmicro.com/api/stacks`
-   `https://workload.{region}.cloudone.trendmicro.com/api/computergroups`
-   `https://workload.{region}.cloudone.trendmicro.com/api/computers`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (10)

-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-file-storage-security-Events](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-file-storage-security-Events)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-file-storage-security-Stack](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-file-storage-security-Stack)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-file-storage-security-api-reference](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-file-storage-security-api-reference)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-api-key](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-api-key)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-api-reference](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-api-reference)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-role](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-role)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-user-account](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-identity-account-management-user-account)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-workload-security-api-reference](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-workload-security-api-reference)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-workload-security-computergroups](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-workload-security-computergroups)
-   [https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-workload-security-computers](https://docs.trendmicro.com/en-us/documentation/article/trend-micro-cloud-one-workload-security-computers)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (3)

| Step | Endpoints |
| --- | --- |
| Build administrator role relationships | \- |
| Build computer group relationships | \- |
| Fetch File Storage Scan Findings | `https://filestorage.{region}.cloudone.trendmicro.com/api/events` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Administrator | `trend_micro_administrator` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Administrator Role | `trend_micro_administrator_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| API Key | `trend_micro_api_key` | [Key](https://docs.jupiterone.io/data-model/schemas/Key) |
| File Storage AWS Stack | `trend_cloud_one_file_storage_aws_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| File Storage Azure Stack | `trend_cloud_one_file_storage_azure_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| File Storage GCP Stack | `trend_cloud_one_file_storage_gcp_stack` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| File Storage Scan Event Finding | `trend_cloud_one_file_storage_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| TrendMicro Host | `trend_cloud_one_workload_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Workload Computer Group | `trend_cloud_one_workload_computer_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Workload Sensor | `trend_cloud_one_workload_sensor` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `trend_cloud_one_file_storage_aws_stack` | **MANAGES** | `trend_cloud_one_file_storage_aws_stack` |
| `trend_cloud_one_file_storage_aws_stack` | **IDENTIFIED** | `trend_cloud_one_file_storage_finding` |
| `trend_cloud_one_file_storage_azure_stack` | **MANAGES** | `trend_cloud_one_file_storage_azure_stack` |
| `trend_cloud_one_file_storage_azure_stack` | **IDENTIFIED** | `trend_cloud_one_file_storage_finding` |
| `trend_cloud_one_file_storage_gcp_stack` | **MANAGES** | `trend_cloud_one_file_storage_gcp_stack` |
| `trend_cloud_one_file_storage_gcp_stack` | **IDENTIFIED** | `trend_cloud_one_file_storage_finding` |
| `trend_cloud_one_workload_computer_group` | **HAS** | `trend_cloud_one_workload_sensor` |
| `trend_cloud_one_workload_sensor` | **PROTECTS** | `trend_cloud_one_workload_host` |
| `trend_micro_administrator` | **ASSIGNED** | `trend_micro_administrator_role` |

### Trend Cloud One File Storage Aws Stack

`trend_cloud_one_file_storage_aws_stack` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `awsAccount` | `string` |  |  |
| `awsManagementRole` | `string` |  |  |
| `awsRegion` | `string` |  |  |
| `awsScannerLambdaAliasArn` | `string` |  |  |
| `awsScannerQueueUrl` | `string` |  |  |
| 
`provider` \*

 | `string` |  | **const**: aws |
| 

`status` \*

 | `string` |  | **Any of**:

-   `ok`

-   `creating`

-   `creation-failed`

 |
| `statusDetail` | `string` |  |  |
| 

`storageName` \*

 | `string` | The name of the protected storage. |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `scanner`

-   `storage`

 |

---

### Trend Cloud One File Storage Azure Stack

`trend_cloud_one_file_storage_azure_stack` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `azureBlobActionTagRoleAssignmentId` | `string` |  |  |
| `azureBlobActionTagRoleDefinitionName` | `string` |  |  |
| `azureBlobListenerRoleAssignmentId` | `string` |  |  |
| `azureBlobListenerRoleDefinitionName` | `string` |  |  |
| `azureBlobSystemTopicSubscriptionId` | `string` |  |  |
| `azureResourceGroupId` | `string` |  |  |
| `azureScannerIdentityPrincipalId` | `string` |  |  |
| `azureScannerQueueNamespace` | `string` |  |  |
| `azureSubscriptionName` | `string` |  |  |
| `azureTenantId` | `string` |  |  |
| 
`provider` \*

 | `string` |  | **const**: azure |
| 

`status` \*

 | `string` |  | **Any of**:

-   `ok`

-   `creating`

-   `creation-failed`

 |
| `statusDetail` | `string` |  |  |
| 

`storageName` \*

 | `string` | The name of the protected storage. |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `scanner`

-   `storage`

 |

---

### Trend Cloud One File Storage Finding

`trend_cloud_one_file_storage_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`detectionType` \*

 | `string` |  |  |
| 

`filename` \*

 | `string` | The hash of the name of the scanned file. |  |
| 

`malwareName` \*

 | `string` |  |  |
| 

`malwareType` \*

 | `string` |  |  |
| 

`numericSeverity` \*

 | `number` | Always 0 as Cloud One does not provide this value. |  |
| 

`open` \*

 | `boolean` | Always true as Cloud One does not provide this value. |  |
| 

`provider` \*

 | `string` |  | **Any of**:

-   `aws`

-   `azure`

-   `gcp`

 |
| 

`providerAccount` \*

 | `string` |  |  |
| 

`severity` \*

 | `string` | Always unknown as Cloud One does not provide this value. |  |
| 

`storageName` \*

 | `string` | The name of the protected storage. |  |

---

### Trend Cloud One File Storage Gcp Stack

`trend_cloud_one_file_storage_gcp_stack` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `gcpDeploymentName` | `string` |  |  |
| `gcpIsLegacyDeployment` | `boolean` |  |  |
| `gcpProjectId` | `string` |  |  |
| `gcpRegion` | `string` |  |  |
| `gcpScannerSecretsName` | `string` |  |  |
| `gcpScannerServiceAccountId` | `string` |  |  |
| `gcpScannerTopic` | `string` |  |  |
| `gcpScanResultTopic` | `string` |  |  |
| 
`provider` \*

 | `string` |  | **const**: gcp |
| 

`status` \*

 | `string` |  | **Any of**:

-   `ok`

-   `creating`

-   `creation-failed`

 |
| `statusDetail` | `string` |  |  |
| 

`storageName` \*

 | `string` | The name of the protected storage. |  |
| 

`type` \*

 | `string` |  | **Any of**:

-   `scanner`

-   `storage`

 |

---

### Trend Cloud One Workload Host

`trend_cloud_one_workload_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentGUID` | `string` |  |  |
| `agentStatus` | `string` |  |  |
| `applianceStatus` | `string` |  |  |
| `awsAccountId` | `string` **|** `null` |  |  |
| `ec2InstanceId` | `string` **|** `null` |  |  |
| `hostGUID` | `string` |  |  |

---

### Trend Cloud One Workload Sensor

`trend_cloud_one_workload_sensor` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `agentGUID` | `string` |  |  |
| `agentStatus` | `string` **|** `null` |  |  |
| `antiMalwareStatus` | `string` |  |  |
| `applianceStatus` | `string` **|** `null` |  |  |
| `applicationControlStatus` | `string` |  |  |
| `awsAccountId` | `string` **|** `null` |  |  |
| `cloudProvider` | `string` |  |  |
| `ec2InstanceId` | `string` **|** `null` |  |  |
| `firewallStatus` | `string` |  |  |
| `groupId` | `string` |  |  |
| `hostGUID` | `string` |  |  |
| `hostname` | `string` |  |  |
| `integrityMonitoringStatus` | `string` |  |  |
| `intrusionPreventionStatus` | `string` |  |  |
| `logInspectionStatus` | `string` |  |  |
| `platform` | `string` |  |  |
| `securityUpdateStatus` | `string` |  |  |
| `webReputationStatus` | `string` |  |  |

---

---

Source: /integrations/directory/trend-vision-one

# Trend Micro Vision One

TrendMicroVisionOne enhances and consolidates detection, investigation and response capabilities across email, endpoints, servers, cloud workloads and networks.

## Installation

### In TrendMicroVisionOne

1.  Create a TrendMicro Vision One Account.
2.  Login to the Tenant using the URL: [https://portal.{country\_Region}.xdr.trendmicro.com](https://portal.%7Bcountry_Region%7D.xdr.trendmicro.com) ![Login](/assets/images/login-459c56b5187820a125a8efce632b48a9.png)
3.  Create a User Role
    -   Go to **Administration** > **User Role** > **Add Role** ![Add Role](/assets/images/addrole-402d9faeef83cf9aa85077d517e1b172.png)
    -   Under the **General Information** section, provide the appropriate **role name** and **role description**. ![Role Name and Description](/assets/images/rolenamedesc-684037d2961ed037fb2393b4256674e2.png)
    -   Under the Permission section, provide the following permissions:
        -   Cloud Account Management (View)
        -   User Accounts (View)
        -   Endpoint Inventory (View)
        -   Workbench (View, Filter, Search)
        -   Report Management (View, Configure, and Download)
    -   Under the Scope section, select necessary scopes. ![Scopes](/assets/images/scopes-43df654a39c7fb1ca4b57274cde2fc70.png)
    -   Click on the Save button.
4.  Generate API Key
    -   Go to **Administration** > **API Keys** > **Add API Key** ![API Key Generation](/assets/images/apikeygeneration-c2506754416c77f27337699c252e0401.png)
    -   Provide the API key name, Select the Role provided in step 3, and the Expiration time as **No Expiration Date**.
    -   Turn on the status and add the description for the API key.
    -   Click on the Add button.

### Configuration in JupiterOne

To install the Trend Micro integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Trend Micro. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

#### Authentication

-   In **Trend Micro Vision One API Key** enter the API key previously generated.
    
-   In **Trend Micro Vision One API Base URL** Enter the Trend Micro Vision One URL (e.g. `https://api.in.xdr.trendmicro.com`).
    

\[Optional\] Disable TLS Verification - Set this to true in advanced settings only if you have an on-prem Trend Micro Vision One server that does not have a valid SSL certificate configured. For most cases this value should be false.

1.  Click **Create Configuration** after you have entered all the values.

#### General Settings

-   The **Account Name** used to identify the Trend Micro account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `trend_micro_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `trend_micro_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Device\_Sensor\_Agent | `trend_micro_sensor` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |
| Device\_Sensor\_Agent | `trend_micro_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Service | `trend_micro_vision_one` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Vulnerability | `trend_micro_vulnerability` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Vulnerability | `trend_micro_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `trend_micro_account` | **HAS** | `trend_micro_sensor` |
| `trend_micro_account` | **HAS** | `trend_micro_vision_one` |
| `trend_micro_sensor` | **PROTECTS** | `trend_micro_host` |
| `trend_micro_sensor` | **HAS** | `trend_micro_alert` |
| `trend_micro_vulnerability` | **EXPLOITS** | `trend_micro_sensor` |

### Trend Micro Host

`trend_micro_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `ipAddresses` | `array` **|** `null` | All IP addresses (IPv4 and IPv6) reported for the endpoint by the Trend Micro Vision One endpointSecurity/endpoints API. |  |
| `objectType` | `string` **|** `null` | Machine category of the endpoint as reported by Trend Micro Vision One endpointSecurity/endpoints API. Expected values: "server", "desktop". |  |
| `policyName` | `string` **|** `null` | Name of the Trend Micro Vision One protection policy assigned to the endpoint agent. |  |

---

### Trend Micro Sensor

`trend_micro_sensor` inherits from [HostAgent](/data-model/schemas/HostAgent.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `objectType` | `string` **|** `null` | Machine category of the endpoint as reported by Trend Micro Vision One endpointSecurity/endpoints API. Expected values: "server", "desktop". |  |
| `policyName` | `string` **|** `null` | Name of the Trend Micro Vision One protection policy assigned to the endpoint agent. |  |

---

### Trend Micro Vulnerability

`trend_micro_vulnerability` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

---

### Trend Micro Vulnerability

`trend_micro_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md)

---

## Release Notes

-   **2025-06-04** — New Trend Micro Vision One integration: ingests host agents, vulnerability findings, and security alerts with host relationships.

---

Source: /integrations/directory/tufin

# Tufin

Visualize Tufin-managed firewalls, security policies, firewall rules, network zones, and policy violations, map violations to the rules that triggered them, and monitor firewall policy changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need credentials for a Tufin Orchestration Suite (TOS) user with access to the SecureTrack and optionally SecureChange APIs. See the [Tufin user management documentation](https://forum.tufin.com/support/kc/latest/Content/Suite/1073.htm) and [user roles documentation](https://forum.tufin.com/support/kc/latest/Content/Suite/10096.htm) for full details.
> 
> ### SecureTrack user setup
> 
> The integration uses SecureTrack to collect firewalls, policies, firewall rules, network zones, and policy violations.
> 
> 1.  Log in to the TOS web UI as an administrator.
>     
> 2.  Navigate to **Settings → Administration → Users**.
>     
> 3.  Create a dedicated user and assign it the **Administrator** role in SecureTrack.
>     
>     > A **User** role is sufficient for devices, policies, rules, and policy violations, but the **Administrator** role is required to access network zones via the API.
>     
> 4.  Assign the user access to all relevant devices.
>     
> 
> ### SecureChange user setup (optional)
> 
> SecureChange is a separate application within TOS and requires independent user configuration. Skip this section if you do not want to ingest SecureChange users or tickets.
> 
> 1.  Navigate to **Settings → Users** in the SecureChange UI (or use LDAP group import).
> 2.  Add the user to SecureChange and assign the appropriate role:
>     -   **Auditor** — read-only access to tickets. Sufficient if you only need ticket ingestion.
>     -   **System Administrator** — required if you also want to ingest SecureChange users.

To install the Tufin integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Tufin. Click **New Instance** to begin configuring your integration.

Creating a Tufin instance requires the following:

-   The **Account Name** used to identify the Tufin account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your TOS server **Hostname** (or IP address), e.g. `tos.example.com`.
    
-   Your TOS **Username** and **Password** to authenticate with the SecureTrack and SecureChange APIs.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `tufin_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Firewall | `tufin_firewall` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| FirewallRule | `tufin_firewall_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| NetworkZone | `tufin_network_zone` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Policy | `tufin_policy` | [Ruleset](https://docs.jupiterone.io/data-model/schemas/Ruleset) |
| PolicyViolation | `tufin_policy_violation` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| SecurityPolicy | `tufin_security_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Ticket | `tufin_ticket` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| User | `tufin_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `tufin_account` | **HAS** | `tufin_firewall` |
| `tufin_account` | **HAS** | `tufin_security_policy` |
| `tufin_account` | **HAS** | `tufin_network_zone` |
| `tufin_account` | **HAS** | `tufin_user` |
| `tufin_firewall` | **HAS** | `tufin_policy` |
| `tufin_firewall_rule` | **HAS** | `tufin_policy_violation` |
| `tufin_policy` | **HAS** | `tufin_firewall_rule` |
| `tufin_user` | **OPENED** | `tufin_ticket` |

### Tufin Account

`tufin_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`hostname` \*

 | `string` | The hostname or IP address of the TOS server. |  |

---

### Tufin Firewall

`tufin_firewall` inherits from [Firewall](/data-model/schemas/Firewall.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`deviceId` \*

 | `string` | The unique identifier of the device in Tufin SecureTrack. |  |
| 

`domainId` \*

 | `number` **|** `null` | The identifier of the SecureTrack domain that owns this device. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the SecureTrack domain that owns this device. |  |
| 

`hasTopology` \*

 | `boolean` **|** `null` | Whether the device participates in the SecureTrack topology map. |  |
| 

`ipAddress` \*

 | `string` **|** `null` | The management IP address of the device. |  |
| 

`isOffline` \*

 | `boolean` **|** `null` | Whether the device is currently offline from Tufin SecureTrack. |  |
| 

`model` \*

 | `string` **|** `null` | The model of the device as reported by SecureTrack. |  |
| 

`parentId` \*

 | `number` **|** `null` | The identifier of the parent device, when this device is virtual or managed. |  |
| 

`vendor` \*

 | `string` **|** `null` | The vendor of the device as reported by SecureTrack. |  |
| 

`virtualType` \*

 | `string` **|** `null` | The virtualization type reported by SecureTrack (e.g. context, vsys). |  |

---

### Tufin Firewall Rule

`tufin_firewall_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `string` **|** `null` | The action enforced by the rule (e.g. accept, drop, reject). |  |
| 

`comment` \*

 | `string` **|** `null` | Free-form comment associated with the rule. |  |
| 

`deviceId` \*

 | `number` | The identifier of the device that owns this rule. |  |
| 

`isImplicit` \*

 | `boolean` **|** `null` | Whether the rule is implicitly added by the device rather than user-defined. |  |
| 

`ruleId` \*

 | `number` | The unique identifier of the rule in SecureTrack. |  |
| 

`ruleNumber` \*

 | `number` **|** `null` | The order of the rule within its policy. |  |
| 

`ruleType` \*

 | `string` **|** `null` | The type/category of the rule as reported by SecureTrack. |  |

---

### Tufin Network Zone

`tufin_network_zone` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainId` \*

 | `number` **|** `null` | The identifier of the SecureTrack domain that owns this zone. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the SecureTrack domain that owns this zone. |  |
| 

`zoneId` \*

 | `number` | The unique identifier of the zone in SecureTrack. |  |

---

### Tufin Policy

`tufin_policy` inherits from [Ruleset](/data-model/schemas/Ruleset.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`deviceId` \*

 | `number` | The identifier of the device that owns this policy. |  |
| 

`policyId` \*

 | `number` | The unique identifier of the policy in SecureTrack. |  |

---

### Tufin Policy Violation

`tufin_policy_violation` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`deviceId` \*

 | `number` | The identifier of the device whose rule triggered the violation. |  |
| 

`policyName` \*

 | `string` **|** `null` | The Unified Security Policy control name (policy\_control\_name) that this rule violates. |  |
| 

`ruleId` \*

 | `number` | The identifier of the rule that triggered the violation. |  |
| 

`ruleNumber` \*

 | `number` **|** `null` | The order of the violating rule within its policy. |  |

---

### Tufin Security Policy

`tufin_security_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`domainId` \*

 | `number` **|** `null` | The identifier of the SecureTrack domain that owns this policy. |  |
| 

`domainName` \*

 | `string` **|** `null` | The name of the SecureTrack domain that owns this policy. |  |
| 

`policyId` \*

 | `number` | The unique identifier of the Unified Security Policy in SecureTrack. |  |

---

### Tufin Ticket

`tufin_ticket` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`currentStep` \*

 | `string` **|** `null` | The current workflow step the ticket is on. |  |
| 

`expiresOn` \*

 | `number` **|** `null` | The ticket expiration date as a Unix timestamp in milliseconds. |  |
| 

`priority` \*

 | `string` **|** `null` | The priority assigned to the ticket. |  |
| 

`requester` \*

 | `string` **|** `null` | The username of the user who opened the ticket. |  |
| 

`slaStatus` \*

 | `string` **|** `null` | The SLA status reported by SecureChange. |  |
| 

`ticketId` \*

 | `number` | The unique identifier of the ticket in SecureChange. |  |
| 

`ticketStatus` \*

 | `string` **|** `null` | The current status of the ticket as reported by SecureChange. |  |
| 

`workflowName` \*

 | `string` **|** `null` | The name of the SecureChange workflow handling the ticket. |  |

---

### Tufin User

`tufin_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authenticationMethod` \*

 | `string` **|** `null` | The authentication method configured for the user (e.g. local, LDAP). |  |
| 

`userId` \*

 | `number` | The unique identifier of the user in SecureChange. |  |
| 

`userType` \*

 | `string` **|** `null` | The party type reported by SecureChange (e.g. user, group, ldap\_user). |  |

---

---

Source: /integrations/directory/upwind

# Upwind

Visualize Upwind cloud security posture including vulnerability findings, threat detections, configuration findings, and inventory assets. Monitor changes through queries and alerts.

## Installation

### Prerequisites in Upwind

Before configuring the integration in JupiterOne, you must generate API credentials in Upwind.

> **INFO**
> 
> You will need the following parameters:
> 
> -   **Client ID** and **Client Secret** — OAuth 2.0 credentials for API authentication
> -   **Organization ID** — Your Upwind organization identifier (e.g., `org_123456789`)
> -   **Region** — The regional API endpoint your Upwind account uses: `us`, `eu`, or `me`

### Step 1: Generate API Credentials in Upwind

1.  Log in to the [Upwind console](https://console.upwind.io).
2.  Navigate to **Settings** > **Credentials**.
3.  Click **Generate Credential**.
4.  Select **API (Call the Upwind API service)**.
5.  Click **Generate New Credentials**.
6.  Copy and securely store the **Client ID** and **Client Secret**. The client secret is shown only once.

> **WARNING**
> 
> Treat your client credentials like a password. Store them securely and never share them in plain text.

### Step 2: Find Your Organization ID

Your Organization ID is available in the Upwind console URL or in your account settings. It follows the format `org_` followed by alphanumeric characters (e.g., `org_123456789`).

### Step 3: Determine Your Region

Upwind operates in three regional environments. Select the region that matches your Upwind deployment:

| Region | API Endpoint |
| --- | --- |
| US (default) | `https://api.upwind.io` |
| EU | `https://api.eu.upwind.io` |
| ME | `https://api.me.upwind.io` |

### Step 4: Configure the Integration in JupiterOne

Navigate to the **Integrations** tab in JupiterOne and select Upwind. Click **New Instance** to begin.

Creating an Upwind instance requires the following:

-   The **Account Name** used to identify this Upwind account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the AccountName toggle is enabled.
    
-   **Description** to help identify the integration instance (optional).
    
-   **Polling Interval** that suits your monitoring needs. You may leave this as `DISABLED` and invoke the integration manually.
    
-   Your Upwind **Client ID** and **Client Secret** from Step 1.
    
-   Your Upwind **Organization ID** from Step 2.
    
-   Your Upwind **Region** (`us`, `eu`, or `me`). Defaults to `us` if not specified.
    

## Data Volume Configuration

The following settings control which findings and detections are ingested. Narrowing these filters reduces ingestion volume and keeps your graph focused on the most relevant security data.

### Vulnerability Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Vulnerability Severity** | Severity levels of vulnerability findings to include. Leave all unselected to ingest all severities. | Critical, High | Critical, High, Medium, Low, Unclassified, Other |
| **Exploitable Only** | When enabled, only ingests vulnerabilities marked as exploitable. | Disabled | — |
| **Fix Available Only** | When enabled, only ingests vulnerabilities that have a fix available. | Disabled | — |

### Configuration Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Configuration Finding Severity** | Severity levels of configuration findings to include. Leave all unselected to ingest all severities. | Critical, High | Critical, High, Medium, Low |
| **Failed Findings Only** | When enabled, only ingests configuration findings with a FAIL status, excluding findings that pass. | Disabled | — |
| **Configuration Findings Ingestion Window** | How far back to look for configuration findings. Reducing this window limits the volume of findings ingested on each run. | 30 days | 7, 15, 30, 60, 90, 180, 365 |

### Threat Detections

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Threat Detection Severity** | Severity levels of threat detections to include. Leave all unselected to ingest all severities. | Critical, High | Critical, High, Medium, Low |
| **Threat Detections Ingestion Window** | How far back to look for threat detections. Reducing this window limits the volume of detections ingested on each run. | 30 days | 7, 15, 30, 60, 90, 180, 365 |

Click **Create** once all values are provided to finish setting up the integration.

### Next steps

Once configured, the integration will run on the polling interval you selected, populating data in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) to learn more about managing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (9)

-   `https://api.upwind.io/v1/organizations/{organizationId}/apisecurity-endpoints`
-   `https://api.upwind.io/v1/organizations/{organizationId}/configuration-findings`
-   `https://api.upwind.io/v1/organizations/{organizationId}/configuration-frameworks`
-   `https://api.upwind.io/v1/organizations/{organizationId}/configuration-rules`
-   `https://api.upwind.io/v1/organizations/{organizationId}/sbom-packages`
-   `https://api.upwind.io/v1/organizations/{organizationId}/threat-detections`
-   `https://api.upwind.io/v1/organizations/{organizationId}/threat-policies`
-   `https://api.upwind.io/v1/organizations/{organizationId}/vulnerability-findings`
-   `https://api.upwind.io/v2/organizations/{organizationId}/inventory/assets/search`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (11)

-   [https://docs.upwind.io/restapi/management/v1](https://docs.upwind.io/restapi/management/v1)
-   [https://docs.upwind.io/restapi/v1/list-api-endpoints](https://docs.upwind.io/restapi/v1/list-api-endpoints)
-   [https://docs.upwind.io/restapi/v1/list-configuration-findings](https://docs.upwind.io/restapi/v1/list-configuration-findings)
-   [https://docs.upwind.io/restapi/v1/list-configuration-frameworks](https://docs.upwind.io/restapi/v1/list-configuration-frameworks)
-   [https://docs.upwind.io/restapi/v1/list-configuration-rules](https://docs.upwind.io/restapi/v1/list-configuration-rules)
-   [https://docs.upwind.io/restapi/v1/list-sbom-packages](https://docs.upwind.io/restapi/v1/list-sbom-packages)
-   [https://docs.upwind.io/restapi/v1/list-threat-detections](https://docs.upwind.io/restapi/v1/list-threat-detections)
-   [https://docs.upwind.io/restapi/v1/list-threat-policies](https://docs.upwind.io/restapi/v1/list-threat-policies)
-   [https://docs.upwind.io/restapi/v1/list-vulnerability-findings](https://docs.upwind.io/restapi/v1/list-vulnerability-findings)
-   [https://docs.upwind.io/restapi/v2/inventory](https://docs.upwind.io/restapi/v2/inventory)
-   [https://docs.upwind.io/settings/credentials](https://docs.upwind.io/settings/credentials)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (6)

| Step | Endpoints |
| --- | --- |
| Fetch API Endpoints | `https://api.upwind.io/v1/organizations/{organizationId}/apisecurity-endpoints` |
| Fetch Configuration Findings | `https://api.upwind.io/v1/organizations/{organizationId}/configuration-findings` |
| Fetch Configuration Rules | `https://api.upwind.io/v1/organizations/{organizationId}/configuration-rules` |
| Fetch Inventory Assets | `https://api.upwind.io/v2/organizations/{organizationId}/inventory/assets/search` |
| Fetch Threat Detections | `https://api.upwind.io/v1/organizations/{organizationId}/threat-detections` |
| Fetch Vulnerability Findings | `https://api.upwind.io/v1/organizations/{organizationId}/vulnerability-findings` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `upwind_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| API Endpoint | `upwind_api_endpoint` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| AWS Auto Scaling Group | `upwind_aws_asg` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| AWS DynamoDB Table | `upwind_aws_dynamodb_table` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| AWS EBS Volume | `upwind_aws_ebs_volume` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore), [Disk](https://docs.jupiterone.io/data-model/schemas/Disk) |
| AWS EC2 Instance | `upwind_aws_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| AWS ECS Cluster | `upwind_aws_ecs_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS ECS Service | `upwind_ecs_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| AWS ECS Task | `upwind_ecs_task` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| AWS EKS Cluster | `upwind_eks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS IAM Group | `upwind_aws_iam_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| AWS IAM Policy | `upwind_aws_iam_policy` | [AccessPolicy](https://docs.jupiterone.io/data-model/schemas/AccessPolicy) |
| AWS IAM Role | `upwind_aws_iam_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| AWS IAM User | `upwind_aws_iam_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| AWS Internet Gateway | `upwind_aws_igw` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Lambda Function | `upwind_aws_lambda` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| AWS NAT Gateway | `upwind_aws_nat_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| AWS Network ACL | `upwind_aws_network_acl` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS RDS Cluster | `upwind_aws_rds_cluster` | [Database](https://docs.jupiterone.io/data-model/schemas/Database), [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| AWS RDS Instance | `upwind_aws_rds_instance` | [Database](https://docs.jupiterone.io/data-model/schemas/Database) |
| AWS Route Table | `upwind_aws_route_table` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| AWS S3 Bucket | `upwind_aws_s3_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| AWS Security Group | `upwind_aws_security_group` | [Firewall](https://docs.jupiterone.io/data-model/schemas/Firewall) |
| AWS Subnet | `upwind_aws_subnet` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| AWS VPC | `upwind_aws_vpc` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Azure AKS Cluster | `upwind_aks_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Azure Function App | `upwind_azure_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| Azure Virtual Machine | `upwind_azure_vm` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Azure VMSS | `upwind_azure_vmss` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| BYOC Host | `upwind_byoc_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Cloud Account | `upwind_cloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Configuration Finding | `upwind_configuration_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Configuration Framework | `upwind_configuration_framework` | [Framework](https://docs.jupiterone.io/data-model/schemas/Framework) |
| Configuration Rule | `upwind_configuration_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Container Image | `upwind_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| GCP Cloud Function | `upwind_gcp_cloud_run_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| GCP Cloud Run | `upwind_gcp_cloud_run_container` | [Workload](https://docs.jupiterone.io/data-model/schemas/Workload) |
| GCP Cloud Run Job | `upwind_gcp_cloud_run_job` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| GCP Compute Instance | `upwind_gcp_instance` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| GCP GKE Cluster | `upwind_gke_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| GCP Instance Group | `upwind_gcp_instance_group` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Host | `upwind_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Host Container | `upwind_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| Inventory Asset | `upwind_inventory_asset` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| Kubernetes Cluster | `upwind_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Kubernetes CronJob | `upwind_k8s_cronjob` | [Task](https://docs.jupiterone.io/data-model/schemas/Task) |
| Kubernetes DaemonSet | `upwind_k8s_daemonset` | [Workload](https://docs.jupiterone.io/data-model/schemas/Workload) |
| Kubernetes Deployment | `upwind_k8s_deployment` | [Deployment](https://docs.jupiterone.io/data-model/schemas/Deployment) |
| Kubernetes Node | `upwind_k8s_node` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Kubernetes ReplicaSet | `upwind_k8s_replicaset` | [Workload](https://docs.jupiterone.io/data-model/schemas/Workload) |
| Kubernetes Standalone Pod | `upwind_k8s_pod` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| Kubernetes StatefulSet | `upwind_k8s_statefulset` | [Workload](https://docs.jupiterone.io/data-model/schemas/Workload) |
| Resource | `upwind_resource` | [Resource](https://docs.jupiterone.io/data-model/schemas/Resource) |
| SBOM Package | `upwind_package` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Service | `upwind_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Threat Detection | `upwind_threat_detection` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Threat Policy | `upwind_threat_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Vulnerability Finding | `upwind_vulnerability` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `upwind_account` | **HAS** | `upwind_service` |
| `upwind_aws_instance` | **HAS** | `upwind_vulnerability` |
| `upwind_azure_vm` | **HAS** | `upwind_vulnerability` |
| `upwind_byoc_host` | **HAS** | `upwind_vulnerability` |
| `upwind_cloud_account` | **HAS** | `upwind_resource` |
| `upwind_cloud_account` | **HAS** | `upwind_aws_instance` |
| `upwind_cloud_account` | **HAS** | `upwind_azure_vm` |
| `upwind_cloud_account` | **HAS** | `upwind_gcp_instance` |
| `upwind_cloud_account` | **HAS** | `upwind_k8s_node` |
| `upwind_cloud_account` | **HAS** | `upwind_host` |
| `upwind_cloud_account` | **HAS** | `upwind_byoc_host` |
| `upwind_configuration_framework` | **HAS** | `upwind_configuration_rule` |
| `upwind_configuration_rule` | **IDENTIFIED** | `upwind_configuration_finding` |
| `upwind_gcp_instance` | **HAS** | `upwind_vulnerability` |
| `upwind_host` | **HAS** | `upwind_vulnerability` |
| `upwind_k8s_node` | **HAS** | `upwind_vulnerability` |
| `upwind_resource` | **HAS** | `upwind_threat_detection` |
| `upwind_resource` | **HAS** | `upwind_configuration_finding` |
| `upwind_resource` | **HAS** | `upwind_api_endpoint` |
| `upwind_resource` | **IS** | `upwind_inventory_asset` |
| `upwind_resource` | **IS** | `upwind_aws_instance` |
| `upwind_resource` | **IS** | `upwind_aws_lambda` |
| `upwind_resource` | **IS** | `upwind_aws_asg` |
| `upwind_resource` | **IS** | `upwind_aws_vpc` |
| `upwind_resource` | **IS** | `upwind_aws_security_group` |
| `upwind_resource` | **IS** | `upwind_aws_network_acl` |
| `upwind_resource` | **IS** | `upwind_aws_subnet` |
| `upwind_resource` | **IS** | `upwind_aws_igw` |
| `upwind_resource` | **IS** | `upwind_aws_nat_gateway` |
| `upwind_resource` | **IS** | `upwind_aws_route_table` |
| `upwind_resource` | **IS** | `upwind_aws_s3_bucket` |
| `upwind_resource` | **IS** | `upwind_aws_ebs_volume` |
| `upwind_resource` | **IS** | `upwind_aws_rds_instance` |
| `upwind_resource` | **IS** | `upwind_aws_rds_cluster` |
| `upwind_resource` | **IS** | `upwind_aws_dynamodb_table` |
| `upwind_resource` | **IS** | `upwind_aws_iam_user` |
| `upwind_resource` | **IS** | `upwind_aws_iam_role` |
| `upwind_resource` | **IS** | `upwind_aws_iam_policy` |
| `upwind_resource` | **IS** | `upwind_aws_iam_group` |
| `upwind_resource` | **IS** | `upwind_aws_ecs_cluster` |
| `upwind_resource` | **IS** | `upwind_ecs_service` |
| `upwind_resource` | **IS** | `upwind_ecs_task` |
| `upwind_resource` | **IS** | `upwind_eks_cluster` |
| `upwind_resource` | **IS** | `upwind_azure_vm` |
| `upwind_resource` | **IS** | `upwind_azure_function` |
| `upwind_resource` | **IS** | `upwind_azure_vmss` |
| `upwind_resource` | **IS** | `upwind_aks_cluster` |
| `upwind_resource` | **IS** | `upwind_gcp_instance` |
| `upwind_resource` | **IS** | `upwind_gcp_instance_group` |
| `upwind_resource` | **IS** | `upwind_gcp_cloud_run_container` |
| `upwind_resource` | **IS** | `upwind_gcp_cloud_run_function` |
| `upwind_resource` | **IS** | `upwind_gcp_cloud_run_job` |
| `upwind_resource` | **IS** | `upwind_gke_cluster` |
| `upwind_resource` | **IS** | `upwind_cluster` |
| `upwind_resource` | **IS** | `upwind_k8s_node` |
| `upwind_resource` | **IS** | `upwind_k8s_deployment` |
| `upwind_resource` | **IS** | `upwind_k8s_statefulset` |
| `upwind_resource` | **IS** | `upwind_k8s_daemonset` |
| `upwind_resource` | **IS** | `upwind_k8s_replicaset` |
| `upwind_resource` | **IS** | `upwind_k8s_cronjob` |
| `upwind_resource` | **IS** | `upwind_k8s_pod` |
| `upwind_resource` | **IS** | `upwind_host` |
| `upwind_resource` | **IS** | `upwind_byoc_host` |
| `upwind_resource` | **IS** | `upwind_container` |
| `upwind_service` | **HAS** | `upwind_cloud_account` |
| `upwind_threat_policy` | **IDENTIFIED** | `upwind_threat_detection` |
| `upwind_vulnerability` | **EXPLOITS** | `upwind_resource` |
| `upwind_vulnerability` | **EXPLOITS** | `upwind_image` |
| `upwind_vulnerability` | **EXPLOITS** | `upwind_package` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `upwind_aws_instance` | **IS** | `aws_instance` | FORWARD |
| `upwind_aws_lambda` | **IS** | `aws_lambda_function` | FORWARD |
| `upwind_azure_vm` | **IS** | `azure_vm` | FORWARD |
| `upwind_gcp_instance` | **IS** | `google_compute_instance` | FORWARD |

### Upwind Account

`upwind_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `organizationId` | `string` |  |  |

---

### Upwind Api Endpoint

`upwind_api_endpoint` inherits from [ApplicationEndpoint](/data-model/schemas/ApplicationEndpoint.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `authenticationState` | `string` |  |  |
| `domains` | `array` of `string`s |  |  |
| `firstSeenOn` | `number` |  |  |
| `internetExposed` | `boolean` |  |  |
| `lastSeenOn` | `number` |  |  |
| `method` | `string` |  |  |
| `resourceId` | `string` |  |  |
| `statusCodes` | `array` of `string`s |  |  |
| `uri` | `string` |  |  |

---

### Upwind Cloud Account

`upwind_cloud_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `accountId` | `string` |  |  |
| `provider` | `string` |  |  |

---

### Upwind Configuration Finding

`upwind_configuration_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `checkId` | `string` |  |  |
| `checkRemediation` | `string` |  |  |
| `checkTitle` | `string` |  |  |
| `firstSeenOn` | `number` |  |  |
| `frameworkId` | `string` |  |  |
| `frameworkTitle` | `string` |  |  |
| `lastSeenOn` | `number` |  |  |
| `resourceId` | `string` |  |  |
| `resourceName` | `string` |  |  |
| `resourceType` | `string` |  |  |
| `title` | `string` |  |  |

---

### Upwind Configuration Framework

`upwind_configuration_framework` inherits from [Framework](/data-model/schemas/Framework.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cloudProvider` | `string` |  |  |
| `frameworkStatus` | `string` |  |  |
| `revision` | `string` |  |  |
| `title` | `string` |  |  |
| `version` | `string` |  |  |

---

### Upwind Configuration Rule

`upwind_configuration_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `createdOn` | `number` |  |  |
| `findingsCount` | `integer` |  |  |
| `framework` | `string` |  |  |
| `updatedOn` | `number` |  |  |

---

### Upwind Image

`upwind_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `digest` | `string` |  |  |
| `osName` | `string` |  |  |
| `osVersion` | `string` |  |  |
| `tag` | `string` |  |  |
| `uri` | `string` |  |  |

---

### Upwind Inventory Asset

`upwind_inventory_asset` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetCategory` | `string` |  |  |
| `assetSubCategory` | `string` |  |  |
| `cloudAccountId` | `string` |  |  |
| `cloudAccountName` | `string` |  |  |
| `cloudProvider` | `string` |  |  |
| `cloudResourceId` | `string` |  |  |
| `clusterId` | `string` |  |  |
| `clusterName` | `string` |  |  |
| `criticalDetectionsCount` | `integer` |  |  |
| `criticalVulnCount` | `integer` |  |  |
| `criticalVulnerabilitiesCount` | `integer` |  |  |
| `externalId` | `string` |  |  |
| `hasActiveInternetEgress` | `boolean` |  |  |
| `hasActiveInternetIngress` | `boolean` |  |  |
| `highDetectionsCount` | `integer` |  |  |
| `highVulnCount` | `integer` |  |  |
| `highVulnerabilitiesCount` | `integer` |  |  |
| `lowVulnCount` | `integer` |  |  |
| `mediumVulnCount` | `integer` |  |  |
| `namespace` | `string` |  |  |
| `region` | `string` |  |  |
| `resourceLabel` | `string` |  |  |
| `resourceType` | `string` |  |  |
| `status` | `string` |  |  |
| `totalVulnCount` | `integer` |  |  |

---

### Upwind Package

`upwind_package` inherits from [CodeModule](/data-model/schemas/CodeModule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cloudAccountId` | `string` |  |  |
| `cloudProvider` | `string` |  |  |
| `criticalVulnCount` | `integer` |  |  |
| `framework` | `string` |  |  |
| `highVulnCount` | `integer` |  |  |
| `inUse` | `boolean` |  |  |
| `licenses` | `array` of `string`s |  |  |
| `lowVulnCount` | `integer` |  |  |
| `mediumVulnCount` | `integer` |  |  |
| `packageManager` | `string` |  |  |
| `packageType` | `string` |  |  |
| `totalVulnCount` | `integer` |  |  |
| `version` | `string` |  |  |

---

### Upwind Resource

`upwind_resource` inherits from [Resource](/data-model/schemas/Resource.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cloudAccountId` | `string` |  |  |
| `cloudAccountName` | `string` |  |  |
| `cloudProvider` | `string` |  |  |
| `clusterId` | `string` |  |  |
| `clusterName` | `string` |  |  |
| `externalId` | `string` |  |  |
| `internetExposed` | `boolean` |  |  |
| `namespace` | `string` |  |  |
| `region` | `string` |  |  |
| `resourceType` | `string` |  |  |

---

### Upwind Service

`upwind_service` inherits from [Service](/data-model/schemas/Service.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `array` of `string`s |  |  |
| 

`function` \*

 | `array` of `string`s |  |  |

---

### Upwind Threat Detection

`upwind_threat_detection` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `firstSeenOn` | `number` |  |  |
| `lastSeenOn` | `number` |  |  |
| `mitreTacticId` | `string` |  |  |
| `mitreTacticName` | `string` |  |  |
| `mitreTechniqueId` | `string` |  |  |
| `mitreTechniqueName` | `string` |  |  |
| `occurrenceCount` | `integer` |  |  |
| `resourceId` | `string` |  |  |
| `resourceName` | `string` |  |  |
| `resourceType` | `string` |  |  |
| `threatCategory` | `string` |  |  |

---

### Upwind Threat Policy

`upwind_threat_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `enabled` | `boolean` |  |  |
| `managedBy` | `string` |  |  |
| `openIssues` | `integer` |  |  |
| `policyCategory` | `string` |  |  |
| `scope` | `string` |  |  |
| `severity` | `string` |  |  |

---

### Upwind Vulnerability

`upwind_vulnerability` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cvssScore` | `number` |  |  |
| `cvssV2Score` | `string` |  |  |
| `cvssV2Severity` | `string` |  |  |
| `cvssV4Score` | `string` |  |  |
| `cvssV4Severity` | `string` |  |  |
| `epssScore` | `string` |  |  |
| `epssSeverity` | `string` |  |  |
| `exploitable` | `boolean` |  |  |
| `firstSeenOn` | `number` |  |  |
| `fixedInVersion` | `string` |  |  |
| `imageDigest` | `string` |  |  |
| `imageName` | `string` |  |  |
| `lastScanOn` | `number` |  |  |
| `packageName` | `string` |  |  |
| `packageType` | `string` |  |  |
| `packageVersion` | `string` |  |  |
| `resourceId` | `string` |  |  |
| `resourceName` | `string` |  |  |
| `resourceType` | `string` |  |  |
| `source` | `string` |  |  |

---

## Release Notes

-   **2026-01-22** — New Upwind integration: ingests cloud resources (AWS, Azure, and GCP), vulnerabilities, configuration findings, configuration frameworks, and API endpoints with cross-cloud relationship mapping.

---

Source: /integrations/directory/varonis

# Varonis

Bring Varonis SaaS threat detection into JupiterOne. Ingest your Varonis threat models and the alerts they raise, see which users and hosts each alert involves, and query, prioritize and alert on Varonis findings next to the rest of your assets.

## Installation

This integration connects to the **Varonis SaaS API** on your tenant (`https://<your tenant>.varonis.io`) and ingests your Varonis threat models and the alerts they raised. It authenticates with a Varonis API key, which it exchanges for a short-lived access token, and it only reads data. The integration is managed by JupiterOne and runs in the JupiterOne cloud, so no collector is needed.

This version supports **Varonis SaaS**. Self-hosted Varonis Data Security Platform (DatAdvantage) is not supported yet.

### Prerequisites

-   A **Varonis SaaS** tenant, and an administrator who can create API keys.
-   Access to **JupiterOne** with permission to configure integrations.

### Configuration in Varonis

#### Create an API key

1.  Sign in to your Varonis SaaS tenant.
2.  Open **Configuration** > **API Keys** and create a new API key.
3.  Assign the key the **Threat Detection Integrator** role.
4.  Copy the key and store it somewhere safe.

#### Find your tenant hostname

The hostname is the address you use to sign in to Varonis SaaS, without `https://` or a path, for example `acme.varonis.io`.

### Configuration in JupiterOne

To install the Varonis integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Varonis**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Varonis account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The fields below.
    

#### Authentication fields

| Field | Required | Description |
| --- | --- | --- |
| **Varonis Hostname** | Yes | Your Varonis SaaS tenant hostname, for example `acme.varonis.io`. An `https://` prefix is accepted; a path, port or IP address is not. |
| **API Key** | Yes | The Varonis API key created above. It is masked in JupiterOne. |

#### Alert settings

| Field | Default | Description |
| --- | --- | --- |
| **Alert Lookback** | 30 days | How many days of alerts to ingest, by alert time: 30, 60 or 90 days. |
| **Minimum Alert Severity** | Medium and above | The lowest alert severity to ingest: High, Medium and above, Low and above, or All (including Informational). |

When you save the instance, JupiterOne exchanges the API key for an access token and reads your threat models. A wrong hostname or an API key that is invalid, expired or missing the **Threat Detection Integrator** role fails the check.

Click **Create** once all values are provided to finalize the integration.

#### Data Sources

**The data source is disabled by default**, so a new instance ingests only the `varonis_account` entity until you enable it. To enable it, open the instance, turn on **Threat Models and Alerts** under **Data Sources**, and save. It is ingested on the next run.

| Data Source | Description | Entities Created |
| --- | --- | --- |
| **Threat Models and Alerts** | Varonis threat models, and the alerts they raised in the lookback window at or above the minimum severity, with their severity, status, category, close reason, event count, asset path, MITRE tactic and whether sensitive data is involved. | `varonis_threat_model`, `varonis_alert` |

| Relationship | Requires |
| --- | --- |
| `varonis_account` **HAS** `varonis_threat_model` | **Threat Models and Alerts** |
| `varonis_threat_model` **GENERATED** `varonis_alert` | **Threat Models and Alerts** |
| `User` **HAS** `varonis_alert` (mapped) | **Threat Models and Alerts**, and a `User` entity whose `username` matches |
| `Host` **HAS** `varonis_alert` (mapped) | **Threat Models and Alerts**, and a `Host` entity whose `hostname` matches |

#### Required permissions

The API key needs the **Threat Detection Integrator** role. The integration only reads threat models and alerts; it never changes alert status or adds notes.

#### Notes

-   **Users and hosts are matched by name.** An alert is related to the `User` entities whose `username` equals the SAM account name Varonis reports (without a `DOMAIN\` prefix), and to the `Host` entities whose `hostname` equals the device hostname Varonis reports. Both the reported spelling and its lowercase form are matched, for up to 10 users and 10 hosts per alert. Directory integrations that store a different form, such as an email address, as `username` are not matched. Device names that are IP addresses are not matched.
-   **The alert window rolls forward.** Each run ingests the alerts from the last 30, 60 or 90 days. Alerts that fall out of the window, or below the minimum severity, are removed from the graph on the next run. Lowering the lookback or raising the minimum severity removes the alerts outside the new setting.
-   **Alerted events are not ingested.** The integration reads alerts, not the individual events behind them.
-   **Raw data is not stored for alerts.** Every alert field the integration reads is mapped to a property, so `varonis_alert` raw data holds only a redaction note.
-   **Alert searches run asynchronously.** Varonis runs each alert search on the tenant and the integration waits for it to finish, up to about three minutes, before it reads the results.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Additional resources

-   [Varonis SaaS source setup (Sumo Logic): creating an API key with the Threat Detection Integrator role](https://www.sumologic.com/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/varonis-source)
-   [Varonis SaaS integration reference (Cortex XSOAR)](https://xsoar.pan.dev/docs/reference/integrations/varonis-saa-s)

### Roles

RBAC roles that must be assigned to the integration principal.

Show Roles (1)

-   `Threat Detection Integrator`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (4)

-   `https://{hostname}/api/authentication/api_keys/token`
-   `https://{hostname}/api/entitymodel/enum/5821`
-   `https://{hostname}/app/dataquery/api/search/v2/search`
-   `https://{hostname}/app/dataquery/api/search/{location}`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (3)

-   [https://docs.jupiterone.io/integrations/directory/varonis](https://docs.jupiterone.io/integrations/directory/varonis)
-   [https://www.sumologic.com/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/varonis-source](https://www.sumologic.com/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/varonis-source)
-   [https://xsoar.pan.dev/docs/reference/integrations/varonis-saa-s](https://xsoar.pan.dev/docs/reference/integrations/varonis-saa-s)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (1)

| Step | Roles | Endpoints |
| --- | --- | --- |
| Fetch Alerts | `Threat Detection Integrator` | `https://{hostname}/api/authentication/api_keys/token`, `https://{hostname}/app/dataquery/api/search/v2/search`, `https://{hostname}/app/dataquery/api/search/{location}` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `varonis_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Alert | `varonis_alert` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Threat Model | `varonis_threat_model` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `varonis_account` | **HAS** | `varonis_threat_model` |
| `varonis_threat_model` | **GENERATED** | `varonis_alert` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `varonis_alert` | **HAS** | `User` | REVERSE |
| `varonis_alert` | **HAS** | `Host` | REVERSE |

### Varonis Account

`varonis_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`hostname` \*

 | `string` | Fully qualified hostname of the Varonis SaaS tenant. |  |

---

### Varonis Alert

`varonis_alert` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`alertId` \*

 | `string` | Varonis alert id (Alert.ID, a GUID). |  |
| `assetPath` | `string` **|** `null` | Path of the asset (file, folder, mailbox, site) the alert is about, as reported by Varonis. |  |
| `closeReason` | `string` **|** `null` | Reason the alert was closed (Alert.CloseReason.Name), e.g. "Benign activity". |  |
| `deviceHostnames` | `array` **|** `null` | Hostnames of the devices involved in the alert; used to relate the alert to Host entities. |  |
| `eventsCount` | `number` **|** `null` | Number of events attached to the alert. |  |
| `filerNames` | `array` **|** `null` | Names of the file servers or domains where the alerted activity happened. |  |
| `ingestedOn` | `number` **|** `null` | When Varonis ingested the alert (Alert.IngestTime). |  |
| `initialEventOn` | `number` **|** `null` | Time of the first event that contributed to the alert (Alert.Initial.Event.TimeUTC). |  |
| `isFlaggedData` | `boolean` **|** `null` | Whether the alert involves data flagged in Varonis. |  |
| `isMaliciousExternalIp` | `boolean` **|** `null` | Whether a device on the alert connected from an external IP Varonis considers malicious. |  |
| `isSensitiveData` | `boolean` **|** `null` | Whether the alert involves data Varonis classified as sensitive. |  |
| `mitreTactic` | `string` **|** `null` | MITRE ATT&CK tactic of the threat model, when reported. |  |
| `platforms` | `array` **|** `null` | Platforms of those file servers or domains, e.g. Windows, SharePoint Online, Exchange Online. |  |
| `userName` | `string` **|** `null` | Name of the user (or users, comma-separated) involved in the alert, as reported by Varonis. |  |
| `userSamAccountNames` | `array` **|** `null` | SAM account names of the users involved in the alert; used to relate the alert to User entities by username. |  |
| `vendorSeverity` | `string` **|** `null` | Severity as reported by Varonis: High, Medium, Low or Informational. |  |

---

### Varonis Threat Model

`varonis_threat_model` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `ruleSource` | `string` **|** `null` | Origin of the threat model as reported by Varonis, e.g. "Predefined", when present. |  |
| `vendorSeverity` | `string` **|** `null` | Threat model severity exactly as reported by Varonis, e.g. "3 - Error", when present. |  |

---

---

Source: /integrations/directory/veracode

# Veracode

Visualize Veracode application scan results and findings, map findings to a code repo or project, and monitor changes and CWEs through queries and alerts.

## Installation

This integration requires a configured API ID and Secret Key from Veracode. This can be acquired

> **INFO**
> 
> Depending on your Veracode account configuration, you may need to create an API Service account to generate your credentials. See [Veracode's documentation](https://docs.veracode.com/r/t_create_api_creds) for more information.

### Configuration in JupiterOne

To install the Veracode integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Veracode. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Veracode account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Veracode **API ID** and **Secret Key**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `veracode_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Assessment | `veracode_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Finding | `veracode_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Project | `veracode_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `veracode_account` | **HAS** | `veracode_project` |
| `veracode_assessment` | **IDENTIFIED** | `veracode_finding` |
| `veracode_project` | **HAS** | `veracode_assessment` |
| `veracode_project` | **HAS** | `veracode_finding` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `veracode_finding` | **EXPLOITS** | `cwe` | FORWARD |

---

Source: /integrations/directory/vmware-cloud-director

# VMware Cloud Director

Visualize VMware Cloud Director organizations, VDCs, VDC groups, edge gateways, networks, firewall rules, virtual machines, users, and roles, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> The integration authenticates against the VMware Cloud Director CloudAPI as a **tenant-scoped** user. System (provider/sysadmin) login is not currently supported, so the configured user only sees the organization it logs in to.

### Configuration in VMware Cloud Director

You will need a VMware Cloud Director user with read access to the resources you want to ingest (organizations, users, roles, VDCs, VDC groups, edge gateways, networks, firewall rules, and virtual machines).

Collect the following information for use when configuring the integration in JupiterOne:

-   The **API host** of your VMware Cloud Director instance, e.g. `vcd.example.com`.
-   The **username** of the tenant user the integration will sign in as. The value must not contain `@` or `:` characters — VMware Cloud Director uses both as delimiters in the basic-auth credential it accepts at `POST /cloudapi/1.0.0/sessions`.
-   The **password** for that user.
-   The **organization name** the user belongs to. As with the username, the value must not contain `@` or `:` characters.

The integration uses these credentials to obtain a bearer JWT from `POST /cloudapi/1.0.0/sessions` (returned via the `X-VMWARE-VCLOUD-ACCESS-TOKEN` response header) and re-mints the token automatically on `401` responses, so long collection runs survive the token's lifetime.

### Configuration in JupiterOne

To install the VMware Cloud Director integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select VMware Cloud Director. Click **New Instance** to begin configuring your integration.

Creating a VMware Cloud Director instance requires the following:

-   The **Account Name** used to identify the VMware Cloud Director account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **API Host**, **Username**, **Password**, and **Organization Name** collected in the previous section.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `vmware_cloud_director_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| EdgeGateway | `vmware_cloud_director_edge_gateway` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| FirewallRule | `vmware_cloud_director_firewall_rule` | [Rule](https://docs.jupiterone.io/data-model/schemas/Rule) |
| Network | `vmware_cloud_director_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Organization | `vmware_cloud_director_org` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Role | `vmware_cloud_director_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Service | `vmware_cloud_director_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| User | `vmware_cloud_director_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Vdc | `vmware_cloud_director_vdc` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| VdcGroup | `vmware_cloud_director_vdc_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| VirtualMachine | `vmware_cloud_director_virtual_machine` | [Workload](https://docs.jupiterone.io/data-model/schemas/Workload) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `vmware_cloud_director_account` | **HAS** | `vmware_cloud_director_service` |
| `vmware_cloud_director_account` | **HAS** | `vmware_cloud_director_org` |
| `vmware_cloud_director_account` | **HAS** | `vmware_cloud_director_role` |
| `vmware_cloud_director_edge_gateway` | **CONNECTS** | `vmware_cloud_director_network` |
| `vmware_cloud_director_edge_gateway` | **HAS** | `vmware_cloud_director_firewall_rule` |
| `vmware_cloud_director_org` | **HAS** | `vmware_cloud_director_user` |
| `vmware_cloud_director_org` | **HAS** | `vmware_cloud_director_vdc` |
| `vmware_cloud_director_org` | **HAS** | `vmware_cloud_director_vdc_group` |
| `vmware_cloud_director_user` | **ASSIGNED** | `vmware_cloud_director_role` |
| `vmware_cloud_director_vdc` | **HAS** | `vmware_cloud_director_edge_gateway` |
| `vmware_cloud_director_vdc` | **CONTAINS** | `vmware_cloud_director_network` |
| `vmware_cloud_director_vdc` | **CONTAINS** | `vmware_cloud_director_virtual_machine` |
| `vmware_cloud_director_vdc_group` | **CONTAINS** | `vmware_cloud_director_vdc` |
| `vmware_cloud_director_vdc_group` | **HAS** | `vmware_cloud_director_edge_gateway` |

### Vmware Cloud Director Account

`vmware_cloud_director_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`apiHost` \*

 | `string` | The hostname of the VMware Cloud Director API endpoint. |  |

---

### Vmware Cloud Director Edge Gateway

`vmware_cloud_director_edge_gateway` inherits from [Gateway](/data-model/schemas/Gateway.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`backingId` \*

 | `string` **|** `null` | The identifier of the underlying NSX backing object for the gateway. |  |
| 

`deploymentMode` \*

 | `string` **|** `null` | The deployment topology of the edge gateway (e.g. STANDARD, ACTIVE\_STANDBY). |  |
| 

`gatewayType` \*

 | `string` **|** `null` | The backing gateway type reported by VCD (e.g. NSXT\_BACKED, NSXV\_BACKED). |  |
| 

`isDistributedRoutingEnabled` \*

 | `boolean` **|** `null` | Whether distributed routing is enabled on the edge gateway. |  |
| 

`isUniversalVdcGroupEdge` \*

 | `boolean` **|** `null` | Whether the edge gateway belongs to a universal VDC group. |  |
| 

`orgVdcNetworkCount` \*

 | `number` **|** `null` | The number of org VDC networks attached to the edge gateway. |  |

---

### Vmware Cloud Director Firewall Rule

`vmware_cloud_director_firewall_rule` inherits from [Rule](/data-model/schemas/Rule.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `string` **|** `null` | The action taken when the rule matches (ALLOW, DROP, REJECT). Sourced from `actionValue` with a fallback to the deprecated `action` field on older VCD versions. |  |
| 

`direction` \*

 | `string` **|** `null` | The traffic direction the rule applies to (IN, OUT, IN\_OUT). |  |
| 

`ipProtocol` \*

 | `string` **|** `null` | The IP protocol family the rule applies to (IPV4, IPV6, IPV4\_IPV6). |  |
| 

`isLoggingEnabled` \*

 | `boolean` **|** `null` | Whether matches against the rule are logged. |  |
| 

`ruleCategory` \*

 | `string` | Whether the rule is system-managed, a tenant default, or user-defined (SYSTEM, DEFAULT, USER). |  |

---

### Vmware Cloud Director Network

`vmware_cloud_director_network` inherits from [Network](/data-model/schemas/Network.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`connectionType` \*

 | `string` **|** `null` | How the network connects to its upstream router (INTERNAL, DISTRIBUTED, NON\_DISTRIBUTED). |  |
| 

`dnsServer1` \*

 | `string` **|** `null` | The primary DNS server distributed to clients on the network. |  |
| 

`dnsServer2` \*

 | `string` **|** `null` | The secondary DNS server distributed to clients on the network. |  |
| 

`gateway` \*

 | `string` **|** `null` | The IP address of the primary subnet gateway. |  |
| 

`isRouteAdvertised` \*

 | `boolean` **|** `null` | Whether routes for the network are advertised to upstream gateways. |  |
| 

`isShared` \*

 | `boolean` **|** `null` | Whether the network is shared with other VDCs. |  |
| 

`networkType` \*

 | `string` **|** `null` | The type of org VDC network (NAT\_ROUTED, ISOLATED, DIRECT, CROSS\_VDC, OPAQUE). |  |
| 

`prefixLength` \*

 | `number` **|** `null` | The CIDR prefix length of the primary subnet. |  |
| 

`totalIpCount` \*

 | `number` **|** `null` | The total number of IP addresses available in the network. |  |
| 

`usedIpCount` \*

 | `number` **|** `null` | The number of IP addresses currently allocated from the network. |  |

---

### Vmware Cloud Director Org

`vmware_cloud_director_org` inherits from [Organization](/data-model/schemas/Organization.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`catalogCount` \*

 | `number` **|** `null` | The number of catalogs in the organization. |  |
| 

`isManageOrgsAllowed` \*

 | `boolean` **|** `null` | Whether this organization can manage other organizations. |  |
| 

`isPublishAllowed` \*

 | `boolean` **|** `null` | Whether this organization can publish catalogs. |  |
| 

`orgVdcCount` \*

 | `number` **|** `null` | The number of VDCs that belong to the organization. |  |
| 

`runningVMCount` \*

 | `number` **|** `null` | The number of currently running VMs in the organization. |  |
| 

`userCount` \*

 | `number` **|** `null` | The number of users in the organization. |  |
| 

`vappCount` \*

 | `number` **|** `null` | The number of vApps in the organization. |  |

---

### Vmware Cloud Director Role

`vmware_cloud_director_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`bundleKey` \*

 | `string` **|** `null` | The localization bundle key used by the VCD UI to display the role name. |  |

---

### Vmware Cloud Director Service

`vmware_cloud_director_service` inherits from [Service](/data-model/schemas/Service.md)

---

### Vmware Cloud Director User

`vmware_cloud_director_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`deployedVmQuota` \*

 | `number` **|** `null` | The maximum number of VMs the user is allowed to keep deployed concurrently. |  |
| 

`isGroupRole` \*

 | `boolean` **|** `null` | Whether the user inherits its role assignments from a group rather than directly. |  |
| 

`isLocked` \*

 | `boolean` **|** `null` | Whether the user account is locked out, typically after failed sign-in attempts. |  |
| 

`isStranded` \*

 | `boolean` **|** `null` | Whether the user is in a stranded state (no longer linked to its identity provider). |  |
| 

`providerType` \*

 | `string` **|** `null` | The identity provider type for the user (e.g. INTEGRATED, SAML, LDAP). |  |
| 

`storedVmQuota` \*

 | `number` **|** `null` | The maximum number of VMs the user is allowed to keep stored. |  |

---

### Vmware Cloud Director Vdc

`vmware_cloud_director_vdc` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`allocationType` \*

 | `string` **|** `null` | The allocation model for the VDC (AllocationVApp, AllocationPool, ReservationPool, Flex). |  |
| 

`isNetworkingTenancyEnabled` \*

 | `boolean` **|** `null` | Whether NSX-T multi-tenant networking is enabled for the VDC. |  |

---

### Vmware Cloud Director Vdc Group

`vmware_cloud_director_vdc_group` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`groupType` \*

 | `string` **|** `null` | The scope of the VDC group (LOCAL or UNIVERSAL). |  |
| 

`isDfwEnabled` \*

 | `boolean` **|** `null` | Whether the NSX-T Distributed Firewall is enabled on the group. |  |
| 

`isUniversalNetworkingEnabled` \*

 | `boolean` **|** `null` | Whether universal (cross-site) networking is enabled on the group. |  |
| 

`networkProviderType` \*

 | `string` **|** `null` | The network provider type backing the group (NSX\_T, NSXV). |  |
| 

`participatingVdcCount` \*

 | `number` **|** `null` | The number of organization VDCs that participate in the group. |  |

---

### Vmware Cloud Director Virtual Machine

`vmware_cloud_director_virtual_machine` inherits from [Workload](/data-model/schemas/Workload.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`moref` \*

 | `string` **|** `null` | The vCenter managed object reference (moref) for the underlying VM. |  |

---

## Release Notes

-   **2026-05-07** — Added initial VMware Cloud Director integration, ingesting organizations, roles, users, vApps, virtual machines, and networks.

---

Source: /integrations/directory/vsphere

# vSphere

Visualize vSphere data and monitor changes through queries and alerts.

## Installation

This integration supports VMware vSphere versions 6.5–8.0. Some data types are only available on newer versions:

-   **VM Guest Identity**: vSphere 6.7.0 and newer
-   **Namespace ingestion**: vSphere 7.0.0 and newer
-   **Distributed Switch ingestion**: vSphere 7.0.0 and newer

### Prerequisites

1.  Access to a VMware vCenter instance with a service account that has the **Read-Only** role assigned at the root of the vCenter inventory (propagated to all children). The integration reads all inventory data using this account.
    
2.  Your vCenter credentials:
    
    -   The vCenter domain (hostname), for example `vcenter.sddc-X-YY-ZZ-F.vmwarevmc.com`
    -   The service account login and password

### Configuration in JupiterOne

To install the VMware vSphere integration in JupiterOne, navigate to **Integrations**, select **VMware vSphere**, and click **New Instance**.

Creating an instance requires the following:

-   **Account Name** — a display name for this vSphere account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
-   **Description** — optional label for this integration instance.
-   **Polling Interval** — how often JupiterOne collects data from vSphere. Set to `DISABLED` to run manually.
-   **vSphere Domain** — the hostname of your vCenter server (for example, `vcenter.sddc-X-YY-ZZ-F.vmwarevmc.com` for a VMware Cloud-hosted vCenter).
-   **vCenter Login** — the login or email address of the service account.
-   **vCenter Password** — the password for the service account.

Click **Create** once all required values are provided.

### Optional configuration

| Field | Description | Default |
| --- | --- | --- |
| **Uses NSX** | When enabled, the integration queries distributed switch compatibility using VMware NSX (NSXT\_CONTAINER\_PLUGIN) as the network provider instead of standard vSphere networking. Enable this if your environment uses VMware NSX for Kubernetes workload networking. | Disabled |
| **Disable TLS Verification** | When enabled, TLS certificate verification is skipped for connections to the vCenter host. Use this only for vCenter hosts that cannot present a valid certificate (for example, those using self-signed certificates). | Disabled |

> **CAUTION**
> 
> Disabling TLS verification reduces transport security. Use a valid TLS certificate on your vCenter host whenever possible.

### Next steps

Once configured, the integration will run on the polling interval you selected and populate vSphere inventory data in JupiterOne. See the [Instance management guide](/integrations/instance-management.md) to learn how to edit or disable an integration instance.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `vsphere_client` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Cluster | `vsphere_cluster` | [Cluster](https://docs.jupiterone.io/data-model/schemas/Cluster) |
| Data Center | `vsphere_data_center` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Datastore | `vsphere_datastore` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Distributed Switch | `vsphere_distributed_switch` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Host | `vsphere_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Namespace | `vsphere_namespace` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Network | `vsphere_network` | [Network](https://docs.jupiterone.io/data-model/schemas/Network) |
| Virtual Machine | `vsphere_vm` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `vsphere_client` | **MANAGES** | `vsphere_data_center` |
| `vsphere_cluster` | **USES** | `vsphere_distributed_switch` |
| `vsphere_vm` | **USES** | `vsphere_network` |

## Release Notes

-   **2026-07-17** — vSphere virtual machines are now classified as hosts and participate in unified device correlation, using hostname, IP addresses, MAC addresses, and BIOS UUID for matching.

---

Source: /integrations/directory/watchtowr

# watchTowr

The watchTowr integration adds visibility about continuous Automated Red Teaming and Attack Surface Management. This integration enables JupiterOne users to better manage assets, assess risks, and respond to incidents more effectively by leveraging watchTowr's findings.

## Installation

To use this integration, JupiterOne requires a watchTowr API Token. The process to obtain credentials is following:

1.  Login into watchTowr using your login credentials
2.  Click the 'Integrations' menu option
3.  Under 'Client API' section click on 'Client API'
4.  Click on 'Regenerate New API Token', you will see the generated token under 'API Authentication' section.

> **NOTE**
> 
> In the `API Whitelist Management` section, please turn off whitelisting or contact JupiterOne support to get our list of outbound IPs used for integrations.

### Configuration in JupiterOne

To install the watchTowr integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select watchTowr. Click **New Instance** to begin configuring your integration, providing the following:

-   **API Token**: unique identifier used to authenticate and control access to watchTowr API. You should be able to find it [here](https://jigsaw.core.watchtowr.com/integrations/api-settings). If you don't have one yet see above section to generate one.
    
-   **Account Name** used to identify the watchTowr account in JupiterOne.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Vulnerability Filters**: here you will be able to customize what severities you want to fetch when retrieving findings.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `watchtowr_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Cloud Storage | `watchtowr_cloud_storage` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Container | `watchtowr_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| Domain | `watchtowr_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| Finding | `watchtowr_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding), [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability) |
| IP Address | `watchtowr_ip_address` | [IpAddress](https://docs.jupiterone.io/data-model/schemas/IpAddress) |
| Mobile Applications | `watchtowr_mobile_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Package Manager | `watchtowr_package_manager` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Saas Platform | `watchtowr_saas_platform` | [Vendor](https://docs.jupiterone.io/data-model/schemas/Vendor) |
| Service | `watchtowr_service` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Source code repositories | `watchtowr_source_code_repository` | [Repository](https://docs.jupiterone.io/data-model/schemas/Repository) |
| Subdomain | `watchtowr_subdomain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `watchtowr_account` | **HAS** | `watchtowr_service` |
| `watchtowr_cloud_storage` | **HAS** | `watchtowr_finding` |
| `watchtowr_container` | **HAS** | `watchtowr_finding` |
| `watchtowr_domain` | **HAS** | `watchtowr_finding` |
| `watchtowr_ip_address` | **HAS** | `watchtowr_finding` |
| `watchtowr_mobile_application` | **HAS** | `watchtowr_finding` |
| `watchtowr_package_manager` | **HAS** | `watchtowr_finding` |
| `watchtowr_saas_platform` | **HAS** | `watchtowr_finding` |
| `watchtowr_service` | **IDENTIFIED** | `watchtowr_finding` |
| `watchtowr_service` | **SCANS** | `watchtowr_cloud_storage` |
| `watchtowr_service` | **SCANS** | `watchtowr_container` |
| `watchtowr_service` | **SCANS** | `watchtowr_source_code_repository` |
| `watchtowr_service` | **SCANS** | `watchtowr_mobile_application` |
| `watchtowr_service` | **SCANS** | `watchtowr_domain` |
| `watchtowr_service` | **SCANS** | `watchtowr_subdomain` |
| `watchtowr_service` | **SCANS** | `watchtowr_ip_address` |
| `watchtowr_service` | **SCANS** | `watchtowr_package_manager` |
| `watchtowr_service` | **SCANS** | `watchtowr_saas_platform` |
| `watchtowr_source_code_repository` | **HAS** | `watchtowr_finding` |
| `watchtowr_subdomain` | **HAS** | `watchtowr_finding` |

### Watchtowr Finding

`watchtowr_finding` inherits from [Finding](/data-model/schemas/Finding.md), [Vulnerability](/data-model/schemas/Vulnerability.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`affectedType` \*

 | `string` **|** `null` |  |  |
| 

`cve` \*

 | `string` **|** `null` |  |  |
| 

`cvssMetrics` \*

 | `string` **|** `null` |  |  |
| 

`cvssScore` \*

 | `number` **|** `null` |  |  |
| 

`epssScore` \*

 | `number` **|** `null` |  |  |
| 

`evidence` \*

 | `string` **|** `null` |  |  |
| `recommendation` | `string` |  | **deprecated**: true |
| `recommendationAction` | `string` |  |  |
| 

`retestEvidence` \*

 | `string` **|** `null` |  |  |
| 

`tags` \*

 | `array` **|** `null` |  |  |

---

## Release Notes

-   **2025-10-27** — Added recommended action property to Watchtowr finding entities, standardizing remediation guidance to the shared ontology field.
-   **2025-06-05** — Promoted Watchtowr finding entities to carry both the Finding and Vulnerability entity classes, enabling vulnerability-based queries.

---

Source: /integrations/directory/wazuh

# Wazuh

Visualize Wazuh endpoint agents and devices, map Wazuh agents to devices and employees, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> Before configuring this integration in JupiterOne, you need to create API credentials in Wazuh:
> 
> **Required in Wazuh:**
> 
> -   Access to your Wazuh Manager API URL
> -   A dedicated service account username and password for API access
> -   The service account should have read-only permissions (not administrator credentials)
> 
> **Authentication:** This integration uses HTTP Basic authentication to obtain a JWT token from the Wazuh API, which is then used for subsequent API requests.
> 
> **Recommended Setup:**
> 
> 1.  Create a dedicated user in Wazuh (e.g., `jupiterone-readonly`)
> 2.  Assign read-only permissions to this user via **Security > Users > Create User** in the Wazuh Dashboard
> 3.  Do not use administrator credentials for the integration
> 
> **Manager URL Format:**
> 
> -   Self-hosted: `https://your-wazuh-server:55000`
> -   Wazuh Cloud: `https://${wazuhCloudEnvId}.cloud.wazuh.com/api/wazuh`

> **NOTE**
> 
> If you are using Wazuh Cloud, contact [JupiterOne Support](https://info.jupiterone.com/contact-us) to obtain a list of IPs for Wazuh to whitelist. After you get the IP list, contact Wazuh Support to make changes to your Wazuh Cloud account to expose the API.
> 
> After you have done this, the JupiterOne integration can connect to your Wazuh Cloud instance. Be sure to structure your **MANAGER\_URL** in the JupiterOne integration configuration to be in the following format: `https://${wauzhCloudEnvId}.cloud.wazuh.com/api/wazuh`

### Configuration in JupiterOne

To install the Wazuh integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Wazuh. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Wazuh account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Wazuh **Manager URL**, the **Username** to authenticate with the Manager URL, and the**Password** associated with the username.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `wazuh_manager` | [Service](https://docs.jupiterone.io/data-model/schemas/Service), [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Agent | `wazuh_agent` | [HostAgent](https://docs.jupiterone.io/data-model/schemas/HostAgent) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `wazuh_manager` | **HAS** | `wazuh_agent` |

## Release Notes

-   **2019-03-05** — New Wazuh integration: ingests the Wazuh manager service and connected host agents, providing visibility into Wazuh-monitored endpoints and their connection status.

---

Source: /integrations/directory/whitehat

# WhiteHat

Visualize WhiteHat Security scans, vulnerabilities, and findings, map them to code repositories, projects, or applications, and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> For this integration, you will need to create an API Token key within your Whitehat account. See [their documentation](https://apidocs.whitehatsec.com/whs/docs/authentication) for more information.

### Configuration in JupiterOne

To install the Whitehat integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Whitehat. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Whitehat account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Whitehat **API Key** generated for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `whitehat_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Appliance | `whitehat_appliance` | [Gateway](https://docs.jupiterone.io/data-model/schemas/Gateway) |
| Application and Mobile Application | `whitehat_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Assessment | `whitehat_assessment` | [Assessment](https://docs.jupiterone.io/data-model/schemas/Assessment) |
| Asset | `whitehat_asset` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Codebase | `whitehat_codebase` | [CodeRepo](https://docs.jupiterone.io/data-model/schemas/CodeRepo) |
| Component | `whitehat_component` | [CodeModule](https://docs.jupiterone.io/data-model/schemas/CodeModule) |
| Endpoint | `web_app_endpoint` | [ApplicationEndpoint](https://docs.jupiterone.io/data-model/schemas/ApplicationEndpoint) |
| Finding | `whitehat_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Group | `whitehat_group` | [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Role | `whitehat_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Scan Type | `whitehat_scan` | [Service](https://docs.jupiterone.io/data-model/schemas/Service) |
| Site | `web_app_domain` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| User | `whitehat_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `web_app_domain` | **HAS** | `whitehat_assessment` |
| `web_app_domain` | **HAS** | `whitehat_finding` |
| `web_app_domain` | **HAS** | `web_app_endpoint` |
| `whitehat_account` | **HAS** | `whitehat_user` |
| `whitehat_account` | **HAS** | `whitehat_asset` |
| `whitehat_account` | **HAS** | `whitehat_scan` |
| `whitehat_account` | **HAS** | `whitehat_group` |
| `whitehat_account` | **HAS** | `whitehat_appliance` |
| `whitehat_application` | **HAS** | `whitehat_assessment` |
| `whitehat_application` | **HAS** | `whitehat_codebase` |
| `whitehat_application` | **HAS** | `whitehat_finding` |
| `whitehat_application` | **HAS** | `whitehat_component` |
| `whitehat_assessment` | **IDENTIFIED** | `whitehat_finding` |
| `whitehat_asset` | **HAS** | `web_app_domain` |
| `whitehat_asset` | **HAS** | `whitehat_application` |
| `whitehat_group` | **HAS** | `whitehat_user` |
| `whitehat_scan` | **PERFORMED** | `whitehat_assessment` |
| `whitehat_user` | **ASSIGNED** | `whitehat_role` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `whitehat_component` | **HAS** | `cve` | FORWARD |
| `whitehat_finding` | **EXPLOITS** | `cwe` | FORWARD |

---

Source: /integrations/directory/whois

# Whois

Visualize Whois domains and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> This integration does not require any vendor setup or API credentials. It performs public WHOIS lookups for the domains you specify.
> 
> **Required Configuration:**
> 
> -   A comma-separated list of domain names to monitor (e.g., `google.com,facebook.com,notion.so`)
> 
> **How it Works:** The integration queries public WHOIS servers to retrieve domain registration information including registrar details, registration dates, and expiration dates.
> 
> **No Authentication Required:** WHOIS is a public protocol and does not require API keys or credentials to access domain registration information.

When configuring the Whois integration, the instance creation input for **Domains** expects a comma separated lists of domains.

For example:

```text
google.com,facebook.com,notion.so
```

### Configuration in JupiterOne

To install the Whois integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Whois. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Whois account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Domains** as a comma-separated list that JupiterOne will look up.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Domain | `internet_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |

---

Source: /integrations/directory/wiz

# Wiz

Visualize Wiz Vulnerability Findings and monitor changes through queries and alerts.

## Installation

> **INFO**
> 
> You will need the following parameters:
> 
> -   Active service account
>     
>     -   A Wiz service account serves as a machine-to-machine interface to authenticate with the Wiz API. Permissions must be explicitly assigned to a service account by a Wiz user, typically requiring a user with elevated privileges such as a Global Admin. See [their documentation](https://docs.wiz.io/wiz-docs/docs/service-accounts-settings#add-a-service-account) for more information.
>     -   Required API scopes:
>         -   `read:users`
>         -   `read:projects`
>         -   `read:resources`
>         -   `read:host_configuration`
>         -   `read:reports`
>         -   `create:reports`
>         -   `read:vulnerabilities`
>     -   Additional API scopes, needed only if you enable the matching ingestion source (these sources are disabled by default):
>         -   `read:cloud_configuration` for Cloud Configuration Findings
>         -   `read:issues` for Risk Issues
>         -   `read:controls` for Graph Controls
>         -   `read:automation_rules` and `read:integrations` for Automation Rules
> -   **OAuth Client ID** and **OAuth Client Secret** obtained from the service account
>     
> -   **Access Token API URL** — Example: `https://auth.app.wiz.io/oauth/token`
>     
> -   **GraphQL API URL** — Example: `https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>/graphql`
>     
>     -   `<TENANT_DATA_CENTER>` is your Wiz regional data center (e.g., `us1`, `us2`, `eu1`, or `eu2`)
>     -   `<ENVIRONMENT>` is one of `app.wiz.io`, `app.wiz.us`, or `gov.wiz.io`

To install the Wiz integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Wiz. Click **New Instance** to begin configuring your integration.

Creating a Wiz instance requires the following:

-   The **Account Name** used to identify the Wiz account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Wiz **Access Token API URL**.
    
-   Your Wiz **GraphQL API URL**.
    
-   Your Wiz **OAuth Client ID** and **OAuth Client Secret**.
    

Click **Create** once all values are provided to finalize the integration.

## Data Volume Configuration

These optional settings control how much data is ingested on each run. Narrowing severity and status filters reduces ingestion volume and run time.

### Ingestion Windows

Each finding type has an independent ingestion window. Only findings updated (or first seen, if **Filter by First Seen** is enabled) within the selected number of days are ingested.

| Field | Description | Default |
| --- | --- | --- |
| **Ingestion Window (days)** — VM Host Vulnerabilities | How many days back to ingest VM host vulnerability findings. | 90 |
| **Ingestion Window (days)** — Host Configuration Findings | How many days back to ingest host configuration findings. | 90 |
| **Ingestion Window (days)** — Bucket Vulnerabilities | How many days back to ingest bucket vulnerability findings. | 90 |
| **Ingestion Window (days)** — Container Vulnerabilities | How many days back to ingest container vulnerability findings. | 90 |
| **Ingestion Window (days)** — Container Image Vulnerabilities | How many days back to ingest container image vulnerability findings. | 90 |
| **Ingestion Window (days)** — Serverless Vulnerabilities | How many days back to ingest serverless vulnerability findings. | 90 |
| **Ingestion Window (days)** — VM Image Vulnerabilities | How many days back to ingest VM image vulnerability findings. | 90 |

Available options for all ingestion window fields: **90**, **180**, **275**, **365** (days).

### Data Filtering Options

#### VM Host Vulnerability Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Vendor severity levels to include. | Critical | Critical, High, Medium, Low, None |
| **Status** | Status values to include. | Open, Resolved | Open, Resolved, Rejected |

#### Host Configuration Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Severity levels to include. | Critical | Critical, High, Medium, Low, Informational |
| **Status** | Status values to include. | Open | Open, Resolved, Rejected |

#### Bucket Vulnerability Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Vendor severity levels to include. | Critical, High | Critical, High, Medium, Low, None |
| **Status** | Status values to include. | Open, Resolved | Open, Resolved, Rejected |

#### Container Vulnerability Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Vendor severity levels to include. | Critical, High | Critical, High, Medium, Low, None |
| **Status** | Status values to include. | Open, Resolved | Open, Resolved, Rejected |

#### Container Image Vulnerability Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Vendor severity levels to include. | Critical, High | Critical, High, Medium, Low, None |
| **Status** | Status values to include. | Open, Resolved | Open, Resolved, Rejected |

#### Serverless Vulnerability Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Vendor severity levels to include. | Critical, High | Critical, High, Medium, Low, None |
| **Status** | Status values to include. | Open, Resolved | Open, Resolved, Rejected |

#### VM Image Vulnerability Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Vendor severity levels to include. | Critical, High | Critical, High, Medium, Low, None |
| **Status** | Status values to include. | Open, Resolved | Open, Resolved, Rejected |

#### Cloud Configuration Findings

| Field | Description | Default | Options |
| --- | --- | --- | --- |
| **Severity** | Severity levels to include. | Critical, High | Critical, High, Medium, Low, None |
| **Status** | Status values to include. | Open | Open, Resolved, Rejected |
| **Result** | Result values to include. | Fail | Fail, Pass, Error, Not Assessed |

### Advanced Configuration

| Field | Description | Default |
| --- | --- | --- |
| **Filter by First Seen** | When enabled, the ingestion window date filter uses the finding's First Seen date instead of Updated At. Applies to all vulnerability types. | Disabled |
| **Use Severity instead of Vendor Severity** | When enabled, filters vulnerability findings by Severity instead of Vendor Severity. Applies to all vulnerability types. | Disabled |
| **Ingest findings of missing and deleted assets** | When enabled, vulnerability findings are retained even when their source asset was not ingested (for example, when the asset belongs to a Wiz project not configured for ingestion, or was deleted). A minimal host record is reconstructed from the finding so the finding is not dropped. Recently-deleted assets still within Wiz's retention window are also ingested with their deleted status. | Disabled |
| **Project IDs to ingest** | An optional list of Wiz project IDs to ingest. When set, only assets and findings belonging to these projects are collected. Provide IDs separated by commas. | All projects |
| **Map assets to ServiceNow CMDB** | When enabled, mapped relationships are emitted from Wiz assets (hosts, containers, serverless functions) to ServiceNow CMDB records, matched by the asset's app ID tag and subscription external ID. Enable only for tenants whose Wiz app ID tag holds a ServiceNow `sys_id`. | Disabled |
| **App ID tag key** | The asset tag key whose value is the ServiceNow application/service `sys_id`. Case-sensitive — must match the tag key exactly as it appears in Wiz. Used only when **Map assets to ServiceNow CMDB** is enabled. | `appid` |
| **Support group tag key** | Asset tag key whose value identifies the responsible support group or team. When set, the tag value is promoted onto the `supportGroup` property of Wiz asset entities so it is queryable without knowing the raw tag key. Case-sensitive. | Not set |
| **Support owner tag key** | Asset tag key whose value is the operational or support owner (typically an email address). Promoted onto the `supportOwner` property of Wiz asset entities. Case-sensitive. | Not set |
| **Business owner tag key** | Asset tag key whose value is the business owner (typically an email address). Promoted onto the `businessOwner` property of Wiz asset entities. Case-sensitive. | Not set |

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### OAuth Scopes

OAuth scopes that must be granted to the application or service principal.

Show OAuth Scopes (12)

-   `create:reports`
-   `read:automation_rules`
-   `read:cloud_configuration`
-   `read:controls`
-   `read:host_configuration`
-   `read:integrations`
-   `read:issues`
-   `read:projects`
-   `read:reports`
-   `read:resources`
-   `read:users`
-   `read:vulnerabilities`

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (15)

| Step | OAuth Scopes |
| --- | --- |
| Fetch AI Resources | `read:resources` |
| Fetch Bucket Vulnerability Findings | `read:reports`, `create:reports`, `read:vulnerabilities` |
| Fetch Buckets | `read:resources` |
| Fetch Cloud Configuration Findings | `read:cloud_configuration`, `read:reports`, `create:reports` |
| Fetch Container Image Vulnerability Findings | `read:reports`, `create:reports`, `read:vulnerabilities` |
| Fetch Container Images | `read:resources` |
| Fetch Container Vulnerability Findings | `read:reports`, `create:reports`, `read:vulnerabilities` |
| Fetch Containers | `read:resources` |
| Fetch Host Configuration Findings | `read:host_configuration` |
| Fetch Hosts | `read:resources` |
| Fetch Serverless Functions | `read:resources` |
| Fetch Serverless Vulnerability Findings | `read:reports`, `create:reports`, `read:vulnerabilities` |
| Fetch VM Image Vulnerability Findings | `read:reports`, `create:reports`, `read:vulnerabilities` |
| Fetch VM Images | `read:resources` |
| Fetch Vulnerability Findings | `read:reports`, `create:reports`, `read:vulnerabilities` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `wiz_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| AI Resource | `wiz_ai_resource` | [Application](https://docs.jupiterone.io/data-model/schemas/Application), [NHI](https://docs.jupiterone.io/data-model/schemas/NHI) |
| Automation Rule | `wiz_automation_rule` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Bucket | `wiz_bucket` | [DataStore](https://docs.jupiterone.io/data-model/schemas/DataStore) |
| Cloud Configuration Finding | `wiz_cloud_configuration_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Container | `wiz_container` | [Container](https://docs.jupiterone.io/data-model/schemas/Container) |
| Container Image | `wiz_container_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Control | `wiz_control` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Host | `wiz_host` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Host Configuration Finding | `wiz_host_configuration_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Issue | `wiz_issue` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Project | `wiz_project` | [Project](https://docs.jupiterone.io/data-model/schemas/Project) |
| Serverless Function | `wiz_serverless_function` | [Function](https://docs.jupiterone.io/data-model/schemas/Function) |
| User | `wiz_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| VM Image | `wiz_vm_image` | [Image](https://docs.jupiterone.io/data-model/schemas/Image) |
| Vulnerability Finding | `wiz_vulnerability_finding` | [Vulnerability](https://docs.jupiterone.io/data-model/schemas/Vulnerability), [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `wiz_account` | **MANAGES** | `wiz_project` |
| `wiz_account` | **MANAGES** | `wiz_user` |
| `wiz_control` | **IDENTIFIED** | `wiz_issue` |
| `wiz_host` | **HAS** | `wiz_vulnerability_finding` |
| `wiz_host_configuration_finding` | **EXPLOITS** | `wiz_host` |
| `wiz_issue` | **EXPLOITS** | `wiz_host` |
| `wiz_issue` | **EXPLOITS** | `wiz_bucket` |
| `wiz_issue` | **EXPLOITS** | `wiz_container` |
| `wiz_issue` | **EXPLOITS** | `wiz_container_image` |
| `wiz_issue` | **EXPLOITS** | `wiz_serverless_function` |
| `wiz_issue` | **EXPLOITS** | `wiz_vm_image` |
| `wiz_issue` | **EXPLOITS** | `wiz_ai_resource` |
| `wiz_project` | **HAS** | `wiz_host` |
| `wiz_project` | **HAS** | `wiz_cloud_configuration_finding` |
| `wiz_project` | **HAS** | `wiz_bucket` |
| `wiz_project` | **HAS** | `wiz_container` |
| `wiz_project` | **HAS** | `wiz_container_image` |
| `wiz_project` | **HAS** | `wiz_serverless_function` |
| `wiz_project` | **HAS** | `wiz_vm_image` |
| `wiz_project` | **HAS** | `wiz_ai_resource` |
| `wiz_vulnerability_finding` | **EXPLOITS** | `wiz_bucket` |
| `wiz_vulnerability_finding` | **EXPLOITS** | `wiz_container` |
| `wiz_vulnerability_finding` | **EXPLOITS** | `wiz_container_image` |
| `wiz_vulnerability_finding` | **EXPLOITS** | `wiz_serverless_function` |
| `wiz_vulnerability_finding` | **EXPLOITS** | `wiz_vm_image` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `wiz_container` | **CONNECTS** | `service_now_cmdb_object` | FORWARD |
| `wiz_host` | **CONNECTS** | `service_now_cmdb_object` | FORWARD |
| `wiz_serverless_function` | **CONNECTS** | `service_now_cmdb_object` | FORWARD |

### Wiz Account

`wiz_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Wiz Ai Resource

`wiz_ai_resource` inherits from [Application](/data-model/schemas/Application.md), [NHI](/data-model/schemas/NHI.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`aiCategory` \*

 | `string` **|** `null` | Coarse category derived from the Wiz `type` enum — `agent` for `AI_AGENT`, `mcp_server` for `MCP_SERVER`. `null` if Wiz returns an unrecognised AI type. |  |
| 

`aiDetectionMethod` \*

 | `string` **|** `null` | How this identity was detected as AI. Always `cloud_inventory` for Wiz-ingested entities — Wiz discovers these via cloud provider / SaaS APIs. |  |
| 

`aiPlatformName` \*

 | `string` **|** `null` | Human-readable AI platform / technology name. Sourced from Wiz `technology.name` (e.g. "Anthropic (claude.ai) Agent", "Salesforce Agentforce Employee Agent", "Microsoft Copilot Studio Agent"). |  |
| 

`cloudAccountExternalId` \*

 | `string` **|** `null` | Provider-side identifier for the owning account / organisation (e.g. an AWS account id, an Anthropic organisation id). Sourced from Wiz `cloudAccount.externalId`. |  |
| 

`cloudAccountId` \*

 | `string` **|** `null` | Wiz internal id for the owning cloud account / organisation. Sourced from Wiz `cloudAccount.id`. |  |
| 

`cloudAccountName` \*

 | `string` **|** `null` | Human-readable name of the owning cloud account / organisation. Sourced from Wiz `cloudAccount.name`. |  |
| 

`cloudPlatform` \*

 | `string` **|** `null` | Cloud platform the AI identity lives on (e.g. `Anthropic`, `Salesforce`, `MicrosoftPowerPlatform`, `AWS`, `GCP`, `Azure`). Sourced from Wiz `cloudPlatform`. |  |
| 

`externalId` \*

 | `string` **|** `null` | Wiz-side external identifier. For SaaS-style agents this typically encodes the upstream provider + organisation + agent IDs (e.g. `anthropic##agent##claude_proj_…`). |  |
| 

`firstSeenOn` \*

 | `number` **|** `null` | Epoch ms when Wiz first observed the identity. Parsed from Wiz `firstSeen`. |  |
| 

`hasAccessToSensitiveData` \*

 | `boolean` **|** `null` | Whether Wiz flagged this identity as having access to sensitive data. Sourced from Wiz `hasAccessToSensitiveData`. |  |
| 

`hasAdminPrivileges` \*

 | `boolean` **|** `null` | Whether Wiz flagged this identity as holding admin-tier privileges. Sourced from Wiz `hasAdminPrivileges`. |  |
| 

`hasHighPrivileges` \*

 | `boolean` **|** `null` | Whether Wiz flagged this identity as holding high-tier privileges. Sourced from Wiz `hasHighPrivileges`. |  |
| 

`hasSensitiveData` \*

 | `boolean` **|** `null` | Whether Wiz flagged this identity as touching sensitive data. Sourced from Wiz `hasSensitiveData`. |  |
| 

`isAccessibleFromInternet` \*

 | `boolean` **|** `null` | Whether Wiz flagged this identity as reachable from the internet (not necessarily wide open). Sourced from Wiz `isAccessibleFromInternet`. |  |
| 

`isOpenToAllInternet` \*

 | `boolean` **|** `null` | Whether Wiz flagged this identity as openly reachable from the public internet. Sourced from Wiz `isOpenToAllInternet`. |  |
| 

`lastSeenOn` \*

 | `number` **|** `null` | Epoch ms when Wiz last observed the identity. Parsed from Wiz `lastSeen`. |  |
| 

`providerUniqueId` \*

 | `string` **|** `null` | Provider-side unique identifier for the resource. May be null when Wiz lacks one (some SaaS-style agents). |  |
| 

`region` \*

 | `string` **|** `null` | Cloud region the identity is hosted in, when applicable. Sourced from Wiz `region`. |  |
| 

`wizNativeType` \*

 | `string` **|** `null` | Provider-native sub-type per Wiz (e.g. `anthropic#agent`, `agentforce#employeeagent`, `Microsoft/CopilotStudio.Agent`, `hostedAiAgent`). Sourced from Wiz `nativeType`. |  |
| 

`wizTechnologyId` \*

 | `string` **|** `null` | Wiz-internal technology catalog id (`technology.id`) — stable identifier for the upstream technology behind this agent / server. |  |
| 

`wizType` \*

 | `string` **|** `null` | Verbatim Wiz `type` value (e.g. `AI_AGENT`, `MCP_SERVER`). Kept untransformed so a J1QL consumer can filter on Wiz’s native discriminator without re-deriving from `aiCategory`. |  |

---

### Wiz Automation Rule

`wiz_automation_rule` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`actionIntegrationIds` \*

 | `array` **|** `null` | Ids of the integrations the rule’s actions target. Source: `AutomationRule.actions[].integration.id`. |  |
| 

`actionIntegrationNames` \*

 | `array` **|** `null` | Names of the integrations the rule’s actions target (for example a Jira or Slack integration). Source: `AutomationRule.actions[].integration.name`. |  |
| 

`actionTypes` \*

 | `array` **|** `null` | The action template types the rule performs. Source: `AutomationRule.actions[].actionTemplateType`. |  |
| 

`filters` \*

 | `string` **|** `null` | The scrubbed trigger-filter keys of the rule, as a comma-separated list of top-level keys. Secret-bearing values from the raw `AutomationRule.filters` JSON are never ingested. Computed from `AutomationRule.filters`. |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` | Whether the automation rule is enabled. Source: `AutomationRule.enabled`. |  |
| 

`isLastExecutionFailed` \*

 | `boolean` **|** `null` | Whether the rule’s last execution returned an error. The error text itself is not ingested because it can echo the action target. Computed from `AutomationRule.lastExecutionError`. |  |
| 

`triggerSource` \*

 | `string` **|** `null` | The event source that triggers the rule. Source: `AutomationRule.triggerSource`. |  |
| 

`triggerType` \*

 | `array` **|** `null` | The event types that trigger the rule. Source: `AutomationRule.triggerType`. |  |

---

### Wiz Bucket

`wiz_bucket` inherits from [DataStore](/data-model/schemas/DataStore.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cloudPlatform` | `string` |  |  |
| `cloudProviderId` | `string` |  |  |
| `cloudProviderUrl` | `string` |  |  |
| `isDeleted` | `boolean` | Whether the asset was deleted from the cloud provider. Set to true when ingested via the deleted-asset pass (ingestDeletedAssets config option). |  |
| 
`lastSeenOn` \*

 | `number` **|** `null` |  |  |
| `providerUniqueId` | `string` |  |  |
| `subscriptionExternalId` | `string` |  |  |
| `subscriptionId` | `string` |  |  |

---

### Wiz Cloud Configuration Finding

`wiz_cloud_configuration_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`analyzedOn` \*

 | `null` **|** `number` |  |  |
| 

`evidenceCloudConfigurationLink` \*

 | `null` **|** `string` |  |  |
| 

`evidenceConfigurationPath` \*

 | `null` **|** `string` |  |  |
| 

`evidenceCurrentValue` \*

 | `null` **|** `string` |  |  |
| 

`evidenceExpectedValue` \*

 | `null` **|** `string` |  |  |
| 

`firstSeenOn` \*

 | `null` **|** `number` |  |  |
| 

`isDeleted` \*

 | `null` **|** `boolean` |  |  |
| 

`resolutionReason` \*

 | `null` **|** `string` |  |  |
| 

`resourceCloudPlatform` \*

 | `null` **|** `string` |  |  |
| 

`resourceHasAccessToSensitiveData` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceHasAdminPrivileges` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceHasHighPrivileges` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceHasSensitiveData` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceId` \*

 | `null` **|** `string` |  |  |
| 

`resourceIsAccessibleFromInternet` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceIsAccessibleFromOtherSubscriptions` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceIsAccessibleFromVPN` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceIsOpenToAllInternet` \*

 | `null` **|** `boolean` |  |  |
| 

`resourceName` \*

 | `null` **|** `string` |  |  |
| 

`resourceNativeType` \*

 | `null` **|** `string` |  |  |
| 

`resourceProviderId` \*

 | `null` **|** `string` |  |  |
| 

`resourceRegion` \*

 | `null` **|** `string` |  |  |
| 

`resourceStatus` \*

 | `null` **|** `string` |  |  |
| 

`resourceType` \*

 | `null` **|** `string` |  |  |
| 

`result` \*

 | `null` **|** `string` |  |  |
| 

`ruleDescription` \*

 | `null` **|** `string` |  |  |
| 

`ruleHasAutoRemediation` \*

 | `null` **|** `boolean` |  |  |
| 

`ruleId` \*

 | `null` **|** `string` |  |  |
| 

`ruleIsBuiltin` \*

 | `null` **|** `boolean` |  |  |
| 

`ruleIsEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`ruleName` \*

 | `null` **|** `string` |  |  |
| 

`ruleRemediationInstructions` \*

 | `null` **|** `string` |  |  |
| 

`ruleRisks` \*

 | `null` **|** `array` |  |  |
| 

`ruleServiceType` \*

 | `null` **|** `string` |  |  |
| 

`ruleSeverity` \*

 | `null` **|** `string` |  |  |
| 

`ruleShortId` \*

 | `null` **|** `string` |  |  |
| 

`ruleTargetNativeTypes` \*

 | `null` **|** `array` |  |  |
| 

`securitySubCategoryIds` \*

 | `null` **|** `array` |  |  |
| 

`securitySubCategoryNames` \*

 | `null` **|** `array` |  |  |
| 

`source` \*

 | `null` **|** `string` |  |  |
| 

`statusChangedOn` \*

 | `null` **|** `number` |  |  |
| 

`subscriptionCloudProvider` \*

 | `null` **|** `string` |  |  |
| 

`subscriptionExternalId` \*

 | `null` **|** `string` |  |  |
| 

`subscriptionId` \*

 | `null` **|** `string` |  |  |
| 

`subscriptionName` \*

 | `null` **|** `string` |  |  |
| 

`targetExternalId` \*

 | `null` **|** `string` |  |  |
| 

`targetObjectProviderUniqueId` \*

 | `null` **|** `string` |  |  |

---

### Wiz Container

`wiz_container` inherits from [Container](/data-model/schemas/Container.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `businessOwner` | `string` | Business owner of the asset (typically an email), promoted from the asset tag named by the businessOwnerTagKey config option. |  |
| `cloudPlatform` | `string` |  |  |
| `cloudProviderId` | `string` |  |  |
| `cloudProviderUrl` | `string` |  |  |
| `isDeleted` | `boolean` | Whether the asset was deleted from the cloud provider. Set to true when ingested via the deleted-asset pass (ingestDeletedAssets config option). |  |
| 
`lastSeenOn` \*

 | `number` **|** `null` |  |  |
| `providerUniqueId` | `string` |  |  |
| `subscriptionExternalId` | `string` |  |  |
| `subscriptionId` | `string` |  |  |
| `supportGroup` | `string` | Support group / team responsible for the asset, promoted from the asset tag named by the supportGroupTagKey config option. |  |
| `supportOwner` | `string` | Operational / support owner of the asset (typically an email), promoted from the asset tag named by the supportOwnerTagKey config option. |  |

---

### Wiz Container Image

`wiz_container_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cloudPlatform` | `string` |  |  |
| `cloudProviderId` | `string` |  |  |
| `cloudProviderUrl` | `string` |  |  |
| `isDeleted` | `boolean` | Whether the asset was deleted from the cloud provider. Set to true when ingested via the deleted-asset pass (ingestDeletedAssets config option). |  |
| 
`lastSeenOn` \*

 | `number` **|** `null` |  |  |
| `providerUniqueId` | `string` |  |  |
| `subscriptionExternalId` | `string` |  |  |
| `subscriptionId` | `string` |  |  |

---

### Wiz Control

`wiz_control` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`controlType` \*

 | `string` **|** `null` | The control type. Source: `Control.type` (SECURITY\_GRAPH | CLOUD\_CONFIGURATION). |  |
| 

`isAutoRemediationAvailable` \*

 | `boolean` **|** `null` | Whether the control has auto-remediation. Source: `Control.hasAutoRemediation`. |  |
| 

`isBuiltin` \*

 | `boolean` **|** `null` | Whether the control is built-in (vs custom). Source: `Control.builtin`. |  |
| 

`isEnabled` \*

 | `boolean` **|** `null` | Whether the control is enabled. Source: `Control.enabled`. |  |
| 

`isEnabledForHBI` \*

 | `boolean` **|** `null` | Whether the control is enabled for high business impact projects. Source: `Control.enabledForHBI`. |  |
| 

`isEnabledForLBI` \*

 | `boolean` **|** `null` | Whether the control is enabled for low business impact projects. Source: `Control.enabledForLBI`. |  |
| 

`isEnabledForMBI` \*

 | `boolean` **|** `null` | Whether the control is enabled for medium business impact projects. Source: `Control.enabledForMBI`. |  |
| 

`isEnabledForUnattributed` \*

 | `boolean` **|** `null` | Whether the control is enabled for projects not attributed to a business impact level. Source: `Control.enabledForUnattributed`. |  |
| 

`issueCount` \*

 | `number` **|** `null` | Number of issues the control has raised, as reported by Wiz at ingestion time. Source: `Control.issueAnalytics.issueCount`. |  |
| 

`securityScoreImpact` \*

 | `number` **|** `null` | The score impact of the control on the total security score. Source: `Control.securityScoreImpact`. |  |
| 

`severity` \*

 | `string` **|** `null` | Severity of issues this control raises. Source: `Control.severity`. |  |

---

### Wiz Host

`wiz_host` inherits from [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `businessOwner` | `string` | Business owner of the asset (typically an email), promoted from the asset tag named by the businessOwnerTagKey config option. |  |
| `cloudPlatform` | `string` |  |  |
| `cloudProviderId` | `string` |  |  |
| `cloudProviderUrl` | `string` |  |  |
| `isDeleted` | `boolean` | Whether the asset was deleted from the cloud provider. Set to true when ingested via the deleted-asset pass (ingestDeletedAssets config option). |  |
| `isSynthesizedFromFinding` | `boolean` | True when this host was reconstructed from a vulnerability finding row (ingestDeletedAssets) because its asset was not ingested by the hosts step - e.g. it lives in an un-ingested Wiz project or was deleted. Such hosts are sparse carriers, not full host records. |  |
| `osKernel` | `string` |  |  |
| `providerUniqueId` | `string` |  |  |
| `subscriptionExternalId` | `string` |  |  |
| `subscriptionId` | `string` |  |  |
| `supportGroup` | `string` | Support group / team responsible for the asset, promoted from the asset tag named by the supportGroupTagKey config option. |  |
| `supportOwner` | `string` | Operational / support owner of the asset (typically an email), promoted from the asset tag named by the supportOwnerTagKey config option. |  |

---

### Wiz Host Configuration Finding

`wiz_host_configuration_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`analyzedOn` \*

 | `null` **|** `number` |  |  |
| 

`assessmentError` \*

 | `null` **|** `string` |  |  |
| 

`assessmentErrorMessage` \*

 | `null` **|** `string` |  |  |
| 

`detectedBy` \*

 | `null` **|** `array` |  |  |
| 

`firstSeenOn` \*

 | `null` **|** `number` |  |  |
| 

`hasGraphObject` \*

 | `null` **|** `boolean` |  |  |
| 

`matcherResultDynamicScanner` \*

 | `null` **|** `string` |  |  |
| 

`matcherResultWorkloadScanner` \*

 | `null` **|** `string` |  |  |
| 

`nucleiDescription` \*

 | `null` **|** `string` |  |  |
| 

`ovalDescription` \*

 | `null` **|** `string` |  |  |
| 

`resolutionReason` \*

 | `null` **|** `string` |  |  |
| 

`resourceCloudPlatform` \*

 | `null` **|** `string` |  |  |
| 

`resourceName` \*

 | `null` **|** `string` |  |  |
| 

`resourceNativeType` \*

 | `null` **|** `string` |  |  |
| 

`resourceProviderUniqueId` \*

 | `null` **|** `string` |  |  |
| 

`resourceRegion` \*

 | `null` **|** `string` |  |  |
| 

`resourceStatus` \*

 | `null` **|** `string` |  |  |
| 

`resourceType` \*

 | `null` **|** `string` |  |  |
| 

`result` \*

 | `null` **|** `string` |  |  |
| 

`ruleDescription` \*

 | `null` **|** `string` |  |  |
| 

`ruleExcludedTechnologies` \*

 | `null` **|** `array` |  |  |
| 

`ruleExternalId` \*

 | `null` **|** `string` |  |  |
| 

`ruleIsBuiltin` \*

 | `null` **|** `boolean` |  |  |
| 

`ruleIsEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`ruleIsMissingPrerequisite` \*

 | `null` **|** `boolean` |  |  |
| 

`ruleName` \*

 | `null` **|** `string` |  |  |
| 

`ruleRemediationInstructions` \*

 | `null` **|** `string` |  |  |
| 

`ruleShortName` \*

 | `null` **|** `string` |  |  |
| 

`ruleTargetOperatingSystems` \*

 | `null` **|** `array` |  |  |
| 

`ruleTargetPlatforms` \*

 | `null` **|** `array` |  |  |
| 

`ruleTargetTechnologies` \*

 | `null` **|** `array` |  |  |
| 

`securityFrameworkSubCategoryIds` \*

 | `null` **|** `array` |  |  |
| 

`securityRisks` \*

 | `null` **|** `array` |  |  |
| 

`securityThreats` \*

 | `null` **|** `array` |  |  |
| 

`targetObjectCloudPlatform` \*

 | `null` **|** `string` |  |  |
| 

`targetObjectName` \*

 | `null` **|** `string` |  |  |
| 

`targetObjectNativeType` \*

 | `null` **|** `string` |  |  |
| 

`targetObjectProviderUniqueId` \*

 | `null` **|** `string` |  |  |
| 

`targetObjectRegion` \*

 | `null` **|** `string` |  |  |
| 

`targetObjectStatus` \*

 | `null` **|** `string` |  |  |
| 

`updatedOn` \*

 | `null` **|** `number` |  |  |

---

### Wiz Issue

`wiz_issue` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`cloudPlatform` \*

 | `string` **|** `null` | Cloud platform of the affected resource. Source: `Issue.entitySnapshot.cloudPlatform`. |  |
| 

`dueOn` \*

 | `number` **|** `null` | When the issue is due, in ms since epoch. Source: `Issue.dueAt`. |  |
| 

`entityId` \*

 | `string` **|** `null` | Id of the affected resource. Source: `Issue.entitySnapshot.id`. |  |
| 

`entityName` \*

 | `string` **|** `null` | Name of the affected resource. Source: `Issue.entitySnapshot.name`. |  |
| 

`entityNativeType` \*

 | `string` **|** `null` | Native (provider) type of the affected resource. Source: `Issue.entitySnapshot.nativeType`. |  |
| 

`entityType` \*

 | `string` **|** `null` | Wiz graph entity type of the affected resource. Source: `Issue.entitySnapshot.type`. |  |
| 

`id` \*

 | `string` | The Wiz issue id. Source: `Issue.id`. |  |
| 

`isFromCustomRule` \*

 | `boolean` **|** `null` | Whether at least one source rule that generated the issue is a custom (not built-in) Control, Cloud Configuration Rule or Cloud Event Rule. Computed from `Issue.sourceRules[].builtin`. |  |
| 

`issueType` \*

 | `string` **|** `null` | The Wiz issue type. Source: `Issue.type` (CLOUD\_CONFIGURATION | THREAT\_DETECTION | TOXIC\_COMBINATION). |  |
| 

`region` \*

 | `string` **|** `null` | Region of the affected resource. Source: `Issue.entitySnapshot.region`. |  |
| 

`resolutionReason` \*

 | `string` **|** `null` | Reason the issue was resolved. Source: `Issue.resolutionReason`. |  |
| 

`resolvedOn` \*

 | `number` **|** `null` | When the issue was resolved, in ms since epoch. Source: `Issue.resolvedAt`. |  |
| 

`serviceTicketIds` \*

 | `array` **|** `null` | External ids of ticketing-service tickets linked to this issue (e.g. Jira), kept as FK provenance for audit evidence. Source: `Issue.serviceTickets[].externalId`. |  |
| 

`serviceTicketUrls` \*

 | `array` **|** `null` | URLs of ticketing-service tickets linked to this issue. Source: `Issue.serviceTickets[].url`. |  |
| 

`sourceRuleIds` \*

 | `array` **|** `null` | Ids of the source rules (Controls / Cloud Configuration Rules) that generated the issue. Source: `Issue.sourceRules[].id`. |  |
| 

`sourceRuleNames` \*

 | `array` **|** `null` | Names of the source rules that generated the issue. Source: `Issue.sourceRules[].name`. |  |
| 

`statusChangedOn` \*

 | `number` **|** `null` | When the issue status last changed, in ms since epoch. Source: `Issue.statusChangedAt`. |  |
| 

`subscriptionExternalId` \*

 | `string` **|** `null` | Subscription/account external id of the affected resource. Source: `Issue.entitySnapshot.subscriptionExternalId`. |  |
| 

`subscriptionName` \*

 | `string` **|** `null` | Subscription/account name of the affected resource. Source: `Issue.entitySnapshot.subscriptionName`. |  |

---

### Wiz Project

`wiz_project` inherits from [Project](/data-model/schemas/Project.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`archived` \*

 | `boolean` |  |  |
| `businessUnit` | `string` |  |  |
| 

`isFolder` \*

 | `boolean` |  |  |
| 

`slug` \*

 | `string` |  |  |

---

### Wiz Serverless Function

`wiz_serverless_function` inherits from [Function](/data-model/schemas/Function.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `businessOwner` | `string` | Business owner of the asset (typically an email), promoted from the asset tag named by the businessOwnerTagKey config option. |  |
| `cloudPlatform` | `string` |  |  |
| `cloudProviderId` | `string` |  |  |
| `cloudProviderUrl` | `string` |  |  |
| `isDeleted` | `boolean` | Whether the asset was deleted from the cloud provider. Set to true when ingested via the deleted-asset pass (ingestDeletedAssets config option). |  |
| 
`lastSeenOn` \*

 | `number` **|** `null` |  |  |
| `providerUniqueId` | `string` |  |  |
| `subscriptionExternalId` | `string` |  |  |
| `subscriptionId` | `string` |  |  |
| `supportGroup` | `string` | Support group / team responsible for the asset, promoted from the asset tag named by the supportGroupTagKey config option. |  |
| `supportOwner` | `string` | Operational / support owner of the asset (typically an email), promoted from the asset tag named by the supportOwnerTagKey config option. |  |

---

### Wiz User

`wiz_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authenticationSource` \*

 | `string` |  | **Any of**:

-   `LEGACY`

-   `MODERN`

 |
| 

`isSuspended` \*

 | `boolean` |  |  |
| `lastLoginOn` | `number` |  |  |

---

### Wiz Vm Image

`wiz_vm_image` inherits from [Image](/data-model/schemas/Image.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cloudPlatform` | `string` |  |  |
| `cloudProviderId` | `string` |  |  |
| `cloudProviderUrl` | `string` |  |  |
| `isDeleted` | `boolean` | Whether the asset was deleted from the cloud provider. Set to true when ingested via the deleted-asset pass (ingestDeletedAssets config option). |  |
| 
`lastSeenOn` \*

 | `number` **|** `null` |  |  |
| `providerUniqueId` | `string` |  |  |
| `subscriptionExternalId` | `string` |  |  |
| `subscriptionId` | `string` |  |  |

---

### Wiz Vulnerability Finding

`wiz_vulnerability_finding` inherits from [Vulnerability](/data-model/schemas/Vulnerability.md), [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`assetHasWideInternetExposure` \*

 | `boolean` **|** `null` | Whether the underlying asset has wide internet exposure per Wiz's network analysis. Source: Wiz optional custom column `Asset has wide internet exposure`. |  |
| `assetType` | `string` |  |  |
| 

`cnaScore` \*

 | `number` **|** `null` | CNA-assigned CVSS score. Source: Wiz optional custom column `CNAScore`. |  |
| 

`cveDescription` \*

 | `string` **|** `null` | CVE description. Source: Wiz column `CVEDescription`. |  |
| 

`cvssSeverity` \*

 | `string` **|** `null` | CVSS severity. Source: Wiz column `CVSSSeverity`. |  |
| 

`detailedName` \*

 | `string` **|** `null` |  |  |
| 

`detectionMethod` \*

 | `string` **|** `null` |  |  |
| `firstDetectedOn` | `number` |  |  |
| 

`fixedVersion` \*

 | `string` **|** `null` |  |  |
| 

`hasCisaKevExploit` \*

 | `boolean` **|** `null` | Whether the vulnerability appears in CISA KEV. Source: Wiz column `HasCisaKevExploit`. |  |
| 

`hasExploit` \*

 | `boolean` **|** `null` | Whether a public exploit exists. Source: Wiz column `HasExploit`. |  |
| 

`impactScore` \*

 | `number` **|** `null` | CVSS impact subscore. Source: Wiz column `ImpactScore`. |  |
| `lastDetectedOn` | `number` |  |  |
| 

`nvdSeverity` \*

 | `string` **|** `null` | NVD-assigned severity. Source: Wiz column `NvdSeverity`. |  |
| 

`remediation` \*

 | `string` **|** `null` |  |  |
| 

`remediationActions` \*

 | `string` **|** `null` |  |  |
| `resolvedOn` | `number` |  |  |
| 

`vendorSeverity` \*

 | `string` **|** `null` | Upstream vendor (CVE) severity. Source: Wiz column `VendorSeverity`. |  |
| 

`version` \*

 | `string` **|** `null` |  |  |
| 

`wizSeverity` \*

 | `string` **|** `null` | Wiz-calculated severity for the finding (distinct from upstream vendor severity). Source: Wiz column `Severity`. |  |

---

## Release Notes

-   **2026-10-05** — Added ingestion of Wiz Risk Issues including toxic combinations, threat detections, and cloud configuration issues as Finding entities, and Wiz Graph Controls as policy entities.
-   **2026-07-13** — Wiz hosts, containers, and serverless resources can now be linked to their corresponding ServiceNow CMDB records via mapped relationships.
-   **2026-05-14** — Wiz vulnerability findings now include Wiz-calculated severity, NVD severity, CNA score, and internet exposure status.
-   **2026-04-30** — Added cloud configuration findings ingestion, linking findings to their associated Wiz projects.
-   **2026-03-31** — Added OS kernel version property to Wiz host entities.
-   **2026-03-05** — Added serverless function and VM image entities to Wiz ingestion, with vulnerability findings and project relationships for each asset type.
-   **2026-03-05** — Added Wiz bucket, container, and container image entities as new ingested types with asset relationships.
-   **2026-01-23** — Improved rendering of Wiz vulnerability remediation steps and descriptions by converting markdown links to readable text.
-   **2025-12-02** — Added creation and last-updated timestamps to Wiz vulnerability findings.
-   **2025-10-23** — Normalized severity values on Wiz vulnerability findings to lowercase for consistent querying.
-   **2025-09-12** — Added project ID filter configuration option to limit Wiz vulnerability finding ingestion to specific projects.

---

Source: /integrations/directory/workday

# Workday 2.0

Visualize Workday workers and accounts, map employees to their organizational data, and monitor changes through queries and alerts.

## Installation

To use this integration, you must have a Workday tenant and an **Integration System User (ISU)** account with the appropriate security group permissions. The integration authenticates via **OAuth 2.0**: you register a Workday API Client backed by the ISU and provide JupiterOne with the client ID, client secret, and a refresh token.

> **NOTE**
> 
> All tasks below require a Workday administrator. If you do not have administrator access, ask your Workday admin to complete the provider-side steps for you.

### Configuration in Workday

#### Step 1 — Create an Integration System User (ISU)

1.  In Workday, use the search bar to find and open the **Create Integration System User** task.
2.  Enter a descriptive **Username** (for example, `ISU_JupiterOne`) and a secure **Password**.
3.  Leave **Session Timeout Minutes** at `0` — this prevents the session from expiring during API calls.
4.  Click **OK** to create the account.

To prevent the ISU password from expiring and disrupting the integration:

5.  Search for and open the **Maintain Password Rules** task.
6.  Add the ISU account to the **System Users exempt from password expiration** list.

#### Step 2 — Create an Integration System Security Group (ISSG)

1.  Search for and open the **Create Security Group** task.
2.  Set **Type of Tenanted Security Group** to **Integration System Security Group (Unconstrained)**.
3.  Enter a descriptive **Name** (for example, `ISSG_JupiterOne`).
4.  Click **OK**.
5.  On the next screen, add the ISU created in Step 1 as a member of the group.

#### Step 3 — Grant Domain Security Policies

1.  Search for and open the **Maintain Permissions for Security Group** task.
    
2.  Select the ISSG created in Step 2.
    
3.  Under **Domain Security Policy Permissions**, grant **GET** access to the following domains:
    
    | Domain Security Policy | Purpose |
    | --- | --- |
    | Worker Data: Workers | Fetch active worker records |
    | Worker Data: Active and Terminated Workers | Required if ingesting terminated workers |
    | Worker Data: Current Staffing Information | Employment status and job assignments |
    
4.  Click **OK** to save.
    

#### Step 4 — Activate Security Policy Changes

1.  Search for and open the **Activate Pending Security Policy Changes** task.
2.  Enter a comment describing the change (for example, `Create ISU and ISSG for JupiterOne integration`).
3.  Check the **Confirm** checkbox and click **OK**. The domain policy changes take effect immediately.

#### Step 5 — Register an API Client for OAuth 2.0

The Workday REST API requires OAuth 2.0, so register an API Client backed by the ISU:

1.  Search for and open the **Register API Client for Integrations** task.
2.  Enter a **Client Name** (for example, `JupiterOne`).
3.  Enable **Non-Expiring Refresh Tokens**.
4.  Set the **Scope (Functional Areas)** to include the areas that cover worker and person data (for example, **Staffing** and **Contact Information**). The access token inherits the ISU's permissions, so the scope must allow reading workers, legal names, and work emails.
5.  Click **OK**. Workday displays the **Client ID** and **Client Secret** — copy both now, as the secret is shown only once.

#### Step 6 — Generate a Refresh Token

1.  Search for and open the **View API Clients** task, then select the API Client created in Step 5.
2.  From the related actions menu, select **Manage Refresh Token for Integration**.
3.  Select the ISU created in Step 1, generate a new refresh token, and copy it.

#### Finding Your Tenant URL

The Workday REST API base URL follows this pattern:

```text
https://<workday-host>/ccx/api/<tenant-name>
```

To locate your host and tenant name:

1.  Log in to Workday as an administrator.
2.  Search for and open the **Tenant Setup** task.
3.  Navigate to the **Implementation** tab.
4.  Your **Workday Host** (for example, `wd2-impl-services1.workday.com`) and **Tenant Name** are displayed on this page.

**Example:** `https://wd2-impl-services1.workday.com/ccx/api/acme_corp`

### Configuration in JupiterOne

To install the Workday integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select **Workday**. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Workday account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Workday **Tenant URL** — the REST API base URL constructed in the previous section (for example, `https://wd2-impl-services1.workday.com/ccx/api/acme_corp`).
    
-   The **Client ID**, **Client Secret**, and **Refresh Token** from the API Client you registered in Steps 5–6.
    
-   **Include Terminated Workers** _(optional)_ — when enabled, the integration also ingests workers whose employment has ended. Requires the **Worker Data: Active and Terminated Workers** domain security policy to be granted.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `workday_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Worker | `workday_worker` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `workday_account` | **HAS** | `workday_worker` |

### Workday Account

`workday_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`tenant` \*

 | `string` | Workday tenant name parsed from the tenant URL |  |
| 

`tenantUrl` \*

 | `string` | Workday tenant base URL |  |

---

### Workday Worker

`workday_worker` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`employeeType` \*

 | `string` **|** `null` | Worker type descriptor (Employee or Contingent Worker) |  |
| 

`hiredOn` \*

 | `number` **|** `null` | Timestamp (ms) of the most recent hire date |  |
| 

`jobTitle` \*

 | `string` **|** `null` | Business title from primary job position |  |
| 

`location` \*

 | `string` **|** `null` | Primary work location name |  |
| 

`supervisoryOrganizationId` \*

 | `string` **|** `null` | ID of the primary supervisory organization |  |
| 

`supervisoryOrganizationName` \*

 | `string` **|** `null` | Name of the primary supervisory organization |  |

---

---

Source: /integrations/directory/workspace-one-uem

# Workspace ONE UEM

Visualize Omnissa Workspace ONE UEM (formerly VMware AirWatch) admins, users, organization groups, profiles, and devices, map Workspace ONE UEM users to employees, and monitor changes through queries and alerts.

## Installation

Omnissa Workspace ONE UEM was formerly known as VMware AirWatch. Instances configured before the rename keep working without changes.

To install this integration, you will need to configure settings both within Workspace ONE UEM and on JupiterOne. Before enabling in JupiterOne, ensure that you have completed the setup within your Workspace ONE UEM console.

### Configuration in Workspace ONE UEM

Log into the Workspace ONE UEM console and create an Administrator user account for the integration to authenticate with the REST API:

1.  Select **Accounts** > **Administrators** > **Admins** (**List View** in console versions 2402 and earlier).
    
2.  Select **Add** > **Add Admin**. On the **Basic** tab, set **User Type** to **Basic** and fill in the required details. The integration authenticates with this username and password.
    
    > **NOTE**
    > 
    > We _recommend_ setting values that represent JupiterOne as a `system` user account. Ensure that you set **Title** on the **Details** tab to `system` so that JupiterOne understands this is a user for automation (so it does not attempt to map to a Person entity).
    
3.  **Assign the necessary read-only permissions** to the administrator account. The REST API key does not carry permissions of its own; requests use the permissions of this administrator's role. The integration requires read access to:
    
    -   **Devices** (`/mdm/devices/search`, `/mdm/devices/security`)
    -   **Administrators** (`/system/admins/search`)
    -   **Organization Groups** (`/system/groups/search`, `/system/groups/{id}/children`)
    -   **Profiles** (`/mdm/profiles/search`, `/mdm/profiles/{uuid}/devices`)
    
    Roles are managed under **Accounts** > **Administrators** > **Roles**.
    
4.  Navigate to **Groups & Settings** > **All Settings** > **System** > **Advanced** > **API** > **REST API** ([Omnissa documentation](https://docs.omnissa.com/SystemSettings-VSaaS/RestAPIforWorkspaceONEUEM)):
    
    -   On the **General** tab, select **Enable API Access**.
    -   Select **Add**, enter a **Service** name (for example `JupiterOne`), set **Account Type** to **Admin**, and copy the generated **API Key**.
    -   On the **Authentication** tab, make sure **Basic** is enabled.
    -   On the **Usage** tab, check the **Daily Quota** (50,000 calls per day by default). See **Skip Device Security Details** below for large tenants.

### Configuration in JupiterOne

To install the Workspace ONE UEM integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Workspace ONE UEM. Click **New Instance** to begin configuring the integration.

Creating a Workspace ONE UEM instance requires the following:

-   The **Account Name** used to identify the Workspace ONE UEM account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The **Hostname** (for example `cn1234.awmdm.com`), **Admin Username**, and **Admin Password** of your Workspace ONE UEM environment.
    
-   **Rest API Key** (or Tenant Code) used to authenticate with Workspace ONE UEM.
    
-   Optionally, **Skip Device Security Details**. By default the integration makes one Workspace ONE API call per device to collect passcode and encryption properties. On large tenants this is most of the integration's API usage, which counts against the Workspace ONE daily API quota (50,000 calls per day by default). Enabling this option skips that call, and those device properties are no longer ingested.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (7)

-   `https://<workspaceOneHost>/API/mdm/devices/search`
-   `https://<workspaceOneHost>/API/mdm/devices/security`
-   `https://<workspaceOneHost>/API/mdm/profiles/search`
-   `https://<workspaceOneHost>/API/mdm/profiles/{profileUuid}/devices`
-   `https://<workspaceOneHost>/API/system/admins/search`
-   `https://<workspaceOneHost>/API/system/groups/search`
-   `https://<workspaceOneHost>/API/system/groups/{id}/children`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (5)

-   [https://developer.omnissa.com/workspace-one-uem-apis/versions/2607/mdm-api-v1/](https://developer.omnissa.com/workspace-one-uem-apis/versions/2607/mdm-api-v1/)
-   [https://developer.omnissa.com/workspace-one-uem-apis/versions/2607/mdm-api-v2/](https://developer.omnissa.com/workspace-one-uem-apis/versions/2607/mdm-api-v2/)
-   [https://developer.omnissa.com/workspace-one-uem-apis/versions/2607/mdm-api-v3/](https://developer.omnissa.com/workspace-one-uem-apis/versions/2607/mdm-api-v3/)
-   [https://developer.omnissa.com/workspace-one-uem-apis/versions/2607/system-api-v1/](https://developer.omnissa.com/workspace-one-uem-apis/versions/2607/system-api-v1/)
-   [https://developer.omnissa.com/workspace-one-uem-apis/versions/2607/system-api-v2/](https://developer.omnissa.com/workspace-one-uem-apis/versions/2607/system-api-v2/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (2)

| Step | Endpoints |
| --- | --- |
| Build device and profile relationships | `https://<workspaceOneHost>/API/mdm/profiles/{profileUuid}/devices` |
| Fetch Admins | `https://<workspaceOneHost>/API/system/admins/search` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `workspace_one_uem_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Admin | `workspace_one_uem_admin` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Device | `workspace_one_uem_device` | [Host](https://docs.jupiterone.io/data-model/schemas/Host), [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Device User | `workspace_one_uem_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Organization Group | `workspace_one_uem_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group), [UserGroup](https://docs.jupiterone.io/data-model/schemas/UserGroup) |
| Profile | `workspace_one_uem_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `workspace_one_uem_account` | **HAS** | `workspace_one_uem_group` |
| `workspace_one_uem_account` | **MANAGES** | `workspace_one_uem_device` |
| `workspace_one_uem_device` | **INSTALLED** | `workspace_one_uem_profile` |
| `workspace_one_uem_group` | **HAS** | `workspace_one_uem_group` |
| `workspace_one_uem_group` | **HAS** | `workspace_one_uem_admin` |
| `workspace_one_uem_user` | **OWNS** | `workspace_one_uem_device` |

### Workspace One Uem Account

`workspace_one_uem_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Workspace One Uem Admin

`workspace_one_uem_admin` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `initialLandingPage` | `string` | Console page shown to the admin after login |  |
| `lastLoginTimeStamp` | `number` | Last console login time |  |
| `locale` | `string` | Admin console locale |  |
| `locationGroup` | `string` | Name of the admin organization group |  |
| `locationGroupId` | `string` | Id of the admin organization group |  |
| `messageTemplateId` | `string` | Id of the admin notification message template |  |
| `messageTemplateUuid` | `string` | UUID of the admin notification message template |  |
| `organizationGroupUuid` | `string` | UUID of the organization group the admin belongs to |  |
| `timeZone` | `string` | Admin time zone |  |
| `uuid` | `string` | Workspace ONE admin UUID |  |

---

### Workspace One Uem Device

`workspace_one_uem_device` inherits from [Host](/data-model/schemas/Host.md), [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `assetNumber` | `string` | Device asset number |  |
| `authenticatedRootVolumeEnabled` | `boolean` | Whether the macOS authenticated root volume is enabled |  |
| `blockLevelEncryption` | `boolean` | Whether block-level encryption is enabled |  |
| `bootstrapTokenAllowedForAuthentication` | `string` | Whether the macOS bootstrap token is allowed for authentication |  |
| `bootstrapTokenEscrowStatus` | `boolean` | Whether the macOS bootstrap token is escrowed |  |
| `bootstrapTokenRequiredForKernelExtensionApproval` | `boolean` | Whether the macOS bootstrap token is required for kernel extension approval |  |
| `bootstrapTokenRequiredForSoftwareUpdate` | `boolean` | Whether the macOS bootstrap token is required for software updates |  |
| `dataProtectionEnabled` | `boolean` | Whether data protection is enabled on the device |  |
| `dellDdpeEncryptionStatus` | `boolean` | Dell Data Protection | Encryption status |  |
| `deviceFriendlyName` | `string` | Device friendly name in Workspace ONE |  |
| `driveEncryptionLevel` | `string` | Disk encryption level reported by Workspace ONE |  |
| `email` | `string` | Lower-cased email of the device user |  |
| `encryptionStatus` | `string` | Disk encryption status reported by Workspace ONE |  |
| `enrolledViaDep` | `boolean` | Whether the device enrolled via Apple Automated Device Enrollment (DEP) |  |
| `fileLevelEncryption` | `boolean` | Whether file-level encryption is enabled |  |
| `hasInstitutionalRecoveryKey` | `boolean` | Whether an institutional disk recovery key is set |  |
| `hasPersonalRecoveryKey` | `boolean` | Whether a personal disk recovery key is escrowed (the key itself is never ingested) |  |
| `imei` | `string` | Device IMEI |  |
| `isActivationLockManageable` | `boolean` | Whether Activation Lock can be managed by MDM |  |
| `isCompromised` | `boolean` | Whether the device is reported as compromised |  |
| `isEncrypted` | `boolean` | Whether the device disk is encrypted |  |
| `isPasscodeCompliant` | `boolean` | Whether the device passcode complies with policy |  |
| `isPasscodePresent` | `boolean` | Whether a device passcode is set |  |
| `isRecoveryLockEnabled` | `boolean` | Whether macOS Recovery Lock is enabled |  |
| `isSupervised` | `boolean` | Whether the Apple device is supervised |  |
| `locationGroupIdName` | `string` | Name of the organization group referenced by LocationGroupId |  |
| `locationGroupName` | `string` | Name of the organization group the device belongs to |  |
| `macAddress` | `string` | Primary MAC address, colon-separated and lower-cased |  |
| `operatingSystem` | `string` | Operating system version reported by Workspace ONE |  |
| `ownerId` | `string` | Workspace ONE owner id of the device |  |
| `passcodeLockGracePeriod` | `number` | Passcode lock grace period reported by the device |  |
| `passcodeLockGracePeriodEnforced` | `number` | Passcode lock grace period enforced by policy |  |
| `percentComplete` | `number` | Disk encryption progress percentage |  |
| `platform` | `string` | Lower-cased Workspace ONE platform, e.g. apple, winrt, android |  |
| `serialNumber` | `string` | Device serial number |  |
| `systemIntegrityProtectionEnabled` | `boolean` | Whether macOS System Integrity Protection is enabled |  |
| `userApprovedEnrollment` | `boolean` | Whether the MDM enrollment was approved by the user |  |
| `userEmailAddress` | `string` | Email address of the enrolled user as reported by Workspace ONE |  |
| `username` | `string` | Enrollment username of the device user |  |
| `uuid` | `string` | Workspace ONE device UUID |  |
| `wifiSsid` | `string` | SSID of the Wi-Fi network the device last reported |  |

---

### Workspace One Uem Group

`workspace_one_uem_group` inherits from [Group](/data-model/schemas/Group.md), [UserGroup](/data-model/schemas/UserGroup.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `admins` | `number` | Number of console admin users in the organization group |  |
| `country` | `string` | Organization group country |  |
| `devices` | `number` | Number of enrolled/unenrolled devices present in the organization group |  |
| `groupId` | `string` | Organization group identifier (activation code) |  |
| `locale` | `string` | Organization group locale |  |
| `locationGroupType` | `string` | Type of organization group  
  
**Examples**: Global, Customer, Partner |  |
| `users` | `number` | Number of enrollment users in the organization group |  |
| `uuid` | `string` | Organization group UUID |  |

---

### Workspace One Uem Profile

`workspace_one_uem_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `managedBy` | `string` | Organization group that manages the profile |  |
| `payloads` | `array` of `string`s | Names of the payloads configured in the profile |  |
| `platform` | `string` | Platform the profile applies to |  |

---

### Workspace One Uem User

`workspace_one_uem_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `uuid` | `string` | Workspace ONE enrollment user UUID |  |

---

## Release Notes

-   **2026-10-09** — Published the Workspace ONE UEM integration, providing ingestion of managed devices, organization groups, administrators, and device profiles with their relationships.
-   **2026-04-08** — Improved OS name accuracy for AirWatch device entities, deriving human-readable OS names from the device platform and model fields.
-   **2025-04-22** — Updated AirWatch admin user entities to align with the latest data model, adding email domain and short login ID properties.
-   **2025-04-17** — Added location group name and ID to AirWatch device entities.
-   **2025-04-17** — Added email address to AirWatch device user entities.

---

Source: /integrations/directory/workwize

# Workwize

Visualize Workwize assets and employees, map assets to device owners, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to [generate an API Token in Workwize](https://docs.goworkwize.com/) before initiating the integration in JupiterOne. Once the API Token has been retrieved, proceed to JupiterOne to continue.

### Configuration in Workwize

1.  Log in to your Workwize account.
2.  Navigate to **Settings > API**.
3.  Click **Generate API Token** or **Create New Token**.
4.  Copy and securely save the generated API Token for use in JupiterOne.

> **INFO**
> 
> API tokens should be treated securely and not shared. Ensure the user generating the token has sufficient permissions to access asset and employee data.

### Configuration in JupiterOne

To complete the Workwize integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Workwize. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Workwize account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The Workwize **API Token** generated for use with JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Asset | `workwize_asset` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| Employee | `workwize_employee` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Organization | `workwize_organization` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `workwize_employee` | **OWNS** | `workwize_asset` |
| `workwize_organization` | **HAS** | `workwize_employee` |

### Workwize Asset

`workwize_asset` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`category` \*

 | `string` |  |  |
| 

`condition` \*

 | `string` |  |  |
| 

`invoiceCurrency` \*

 | `string` **|** `null` |  |  |
| 

`invoicePrice` \*

 | `number` **|** `null` |  |  |
| 

`warehouseStatus` \*

 | `string` |  |  |

---

### Workwize Employee

`workwize_employee` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`departmentId` \*

 | `number` **|** `null` |  |  |
| 

`departmentName` \*

 | `string` **|** `null` |  |  |
| 

`foreignId` \*

 | `string` **|** `null` |  |  |
| 

`isDeactivated` \*

 | `boolean` |  |  |
| 

`jobTitle` \*

 | `string` **|** `null` |  |  |
| 

`registrationStatus` \*

 | `string` |  |  |
| 

`team` \*

 | `string` |  |  |
| 

`userId` \*

 | `number` |  |  |

---

### Workwize Organization

`workwize_organization` inherits from [Account](/data-model/schemas/Account.md)

---

---

Source: /integrations/directory/wpengine

# WP Engine

Visualize WordPress accounts, domains, installs, sites, and users, map WordPress users to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will need to acquire API Credentials from WP Engine. This can be done by accessing your [WP Engine profile page under **API Access**](https://my.wpengine.com/api_access).

> **INFO**
> 
> If you have not already done so, you may need to enable Account API Access within Wordpress to generate your API credentials. See [their documentation](https://wpengine.com/support/enabling-wp-engine-api/) for more information.

### Configuration in JupiterOne

To install the WP Engine integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select WP Engine. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the WP Engine account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your WP Engine **API Credentials**.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `wp_engine_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Domain | `wp_engine_domain` | [Domain](https://docs.jupiterone.io/data-model/schemas/Domain) |
| Install | `wp_engine_install` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Site | `wp_engine_site` | [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| User | `wp_engine_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `wp_engine_account` | **HAS** | `wp_engine_site` |
| `wp_engine_account` | **HAS** | `wp_engine_install` |
| `wp_engine_install` | **HAS** | `wp_engine_domain` |
| `wp_engine_site` | **HAS** | `wp_engine_install` |
| `wp_engine_user` | **MANAGES** | `wp_engine_account` |

---

Source: /integrations/directory/xmcyber

# XM Cyber

Visualize XM Cyber entities within JupiterOne to proactively identify vulnerabilities and assess your security posture.

## Installation

To install this integration, you will need to configure settings both within \[integration name\] and on JupiterOne. Before enabling in JupiterOne, ensure that you complete the setup within your \[integration name\]'s account.

### Configuration on XM Cyber

-   Request an API Key with permissions to fetch entities `GET https://cyberrange.clients.xmcyber.com/api/systemReport/entities`

### Finalize in JupiterOne

To install the XM Cyber integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select XM Cyber. Click **New Instance** to begin configuring the integration.

Creating an integration instance requires the following:

-   The **Account Name** used to identify the XM Cyber account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Enter the XM Cyber API key generated for use by JupiterOne.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `xmcyber_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Entity | `xmcyber_entity` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `xmcyber_account` | **HAS** | `xmcyber_entity` |

---

Source: /integrations/directory/zendesk

# Zendesk

Visualize Zendesk accounts, groups, organizations, tickets, and users, and monitor changes through queries and alerts.

## Installation

JupiterOne's Zendesk integration requires an OAuth App to be created within your Zendesk and authenticating JupiterOne with Zendesk after you have created the OAuth application.

Though it is not required, a Zendesk Pro account provides more data resources to JupiterOne than a regular Zendesk account.

### Configuration in Zendesk

You will need to create the OAuth application to successfully integrate Zendesk with JupiterOne:

1.  Create an OAuth app in Zendesk by going to your Zendesk Admin Center and navigating to **Apps and integrations > APIs > Zendesk APIs**.
    -   This can be accessed here: `https://{your-zendesk-subdomain}.zendesk.com/admin/apps-integrations/apis/apis/oauth_clients.`) though, be sure to input your Zendesk subdomain.
2.  Click on the **Add OAuth Client** button.
3.  Provide information for the OAuth app, and enter '[http://localhost:5000/redirect](http://localhost:5000/redirect)' as the redirect URL for OAuth.

> **INFO**
> 
> See [Zendesk's documentation](https://support.zendesk.com/hc/en-us/articles/4408845965210-Using-OAuth-authentication-with-your-application) for additional assistance configuring an Oauth application.

### Configuration in JupiterOne

To install the Addigy integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Addigy. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Addigy account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   Your Zendesk **Subdomain**
    
    -   e.g.,`https://{this-is-your-zendesk-subdomain}.zendesk.com`

Click **Create** once all values are provided. You will be redirected to authenticate JupiterOne with Zendesk via OAuth flow. Once you complete the authentication process, your integration will be ready for use.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `zendesk_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Group | `zendesk_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Organization | `zendesk_organization` | [Organization](https://docs.jupiterone.io/data-model/schemas/Organization) |
| Ticket | `zendesk_ticket` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| User | `zendesk_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `zendesk_account` | **HAS** | `zendesk_organization` |
| `zendesk_group` | **HAS** | `zendesk_user` |
| `zendesk_group` | **HAS** | `zendesk_ticket` |
| `zendesk_organization` | **HAS** | `zendesk_group` |
| `zendesk_user` | **OPENED** | `zendesk_ticket` |
| `zendesk_user` | **ASSIGNED** | `zendesk_ticket` |

### Zendesk User

`zendesk_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `chatOnly` | `boolean` |  |  |
| `createdAt` | `string` |  |  |
| `defaultGroupId` | `integer` |  |  |
| `ianaTimeZone` | `string` |  |  |
| `locale` | `string` |  |  |
| `localeId` | `integer` |  |  |
| `moderator` | `boolean` |  |  |
| `organizationId` | `integer` |  |  |
| `phone` | `string` |  |  |
| `photoUrl` | `string` |  |  |
| `restrictedAgent` | `boolean` |  |  |
| `role` | `string` |  |  |
| `shared` | `boolean` |  |  |
| `suspended` | `boolean` |  |  |
| `timeZone` | `string` |  |  |
| `updatedAt` | `string` |  |  |
| `url` | `string` |  |  |
| `verified` | `boolean` |  |  |

---

---

Source: /integrations/directory/zentral

# Zentral

Visualize Zentral managed devices, users, device apps, profiles, and certificates, and monitor changes through queries and alerts.

## Installation

JupiterOne requires a Zentral API token and the base URL of your Zentral instance. The service account that owns the token must be granted the `Inventory::Action::"viewMachineSnapshot"` PBAC action, which authorizes the full-inventory export used to collect all device, user, profile, certificate, and application data.

### Configuration in Zentral

#### Create a role

1.  Log in to your Zentral console.
2.  Go to **Platform settings** > **Roles**.
3.  Click **Add role**, enter a name such as `JupiterOne Inventory Reader`, and save.
4.  Note the numeric **ID** displayed in the role list or URL — you will need it when writing the policy.

#### Create a Cedar policy

1.  In **Platform settings**, go to **Policies**.
    
2.  Click **Add policy**, give it a descriptive name, and enable the **Active** toggle.
    
3.  Enter the following Cedar source, replacing `<role-pk>` with the numeric ID from the previous step:
    
    ```text
    permit (
      principal in Role::"<role-pk>",
      action in [Inventory::Action::"viewMachineSnapshot"],
      resource
    );
    ```
    
4.  Save the policy.
    

#### Create a service account and generate a token

1.  Go to **Platform settings** > **Service accounts**.
2.  Click **Add service account**, enter a name such as `jupiterone`, and assign it the **JupiterOne Inventory Reader** role.
3.  Save the service account, then open its detail page and click **Add token**.
4.  Copy the generated API token and store it securely — you will not be able to retrieve it again.
5.  Copy your Zentral **base URL** (the root URL of your instance, for example `https://example.zentral.com`).

### Configuration in JupiterOne

To install the Zentral integration in JupiterOne, navigate to the **Integrations** tab, select **Zentral**, and click **New Instance**.

Creating an instance requires the following:

-   **Account Name** — A label to identify this account in JupiterOne. Ingested entities store this value in `tag.AccountName`.
    
-   **Description** — Optional. Helps distinguish multiple integration instances.
    
-   **Polling Interval** — How often JupiterOne collects data from Zentral. Set to `DISABLED` to run manually.
    
-   **Base URL** — The root URL of your Zentral instance, for example `https://example.zentral.com`.
    
-   **API Token** — The API token generated in the steps above.
    

Click **Create** to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Permissions

IAM permissions that must be granted to the integration principal for data ingestion.

Show Permissions (1)

-   `Inventory::Action::"viewMachineSnapshot"`

### Endpoints

API endpoints that the integration makes requests to.

Show Endpoints (2)

-   `GET {baseUrl}/api/task_result/{task_id}/`
-   `POST {baseUrl}/api/inventory/full_export/`

### Documentation Links

Links to provider documentation relevant to setup and configuration.

Show Documentation Links (2)

-   [https://docs.zentral.io/en/latest/apps/inventory/#apiinventoryfull\_export](https://docs.zentral.io/en/latest/apps/inventory/#apiinventoryfull_export)
-   [https://docs.zentral.io/en/latest/configuration/pbac/](https://docs.zentral.io/en/latest/configuration/pbac/)

### Per-Step Breakdown

Detailed authorization requirements for each ingestion step.

Show all steps (1)

| Step | Permissions | Endpoints |
| --- | --- | --- |
| Build machine installed MacOS app relationship | `Inventory::Action::"viewMachineSnapshot"` | `POST {baseUrl}/api/inventory/full_export/` |

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Certificate | `zentral_certificate` | [Certificate](https://docs.jupiterone.io/data-model/schemas/Certificate) |
| Machine | `zentral_machine` | [Device](https://docs.jupiterone.io/data-model/schemas/Device) |
| MacOS App | `zentral_macos_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Principal User | `zentral_principal_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| Profile | `zentral_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| Zentral Cloud Account | `zentral_cloud_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `zentral_machine` | **INSTALLED** | `zentral_profile` |
| `zentral_machine` | **USES** | `zentral_certificate` |
| `zentral_machine` | **INSTALLED** | `zentral_macos_app` |
| `zentral_principal_user` | **OWNS** | `zentral_machine` |

### Zentral Certificate

`zentral_certificate` inherits from [Certificate](/data-model/schemas/Certificate.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `validOn` | `number` |  |  |

---

### Zentral Cloud Account

`zentral_cloud_account` inherits from [Account](/data-model/schemas/Account.md)

---

### Zentral Machine

`zentral_machine` inherits from [Device](/data-model/schemas/Device.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `cpuBrand` | `string` |  |  |
| `cpuLogicalCores` | `number` |  |  |
| `cpuPhysicalCores` | `number` |  |  |
| `cpuSubtype` | `string` |  |  |
| `cpuType` | `string` |  |  |
| `physicalMemory` | `string` |  |  |
| `physicalMemoryInBytes` | `number` |  |  |

---

### Zentral Macos App

`zentral_macos_app` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `bundleDisplayName` | `string` |  |  |
| 
`bundleId` \*

 | `string` |  |  |
| 

`bundleVersion` \*

 | `string` |  |  |
| 

`name` \*

 | `string` |  |  |

---

### Zentral Principal User

`zentral_principal_user` inherits from [User](/data-model/schemas/User.md)

---

### Zentral Profile

`zentral_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `hasRemovalPasscode` | `boolean` |  |  |
| 
`identifier` \*

 | `string` |  |  |
| `installedOn` | `number` |  |  |
| `isEncrypted` | `boolean` |  |  |
| 

`isVerified` \*

 | `boolean` |  |  |
| 

`removalDisallowed` \*

 | `boolean` |  |  |
| 

`uuid` \*

 | `string` |  |  |

---

## Release Notes

-   **2025-07-08** — Improved macOS application version accuracy in Zentral by using the full bundle version string when available.

---

Source: /integrations/directory/zoom

# Zoom

Visualize Zoom users, settings, roles, and groups, map them to employees, and monitor changes through queries and alerts.

## Installation

For this integration, you will first need to create an app within Zoom, and provide the API credentials associated with that app to JupiterOne.

### Configuration in Zoom

1.  In the Zoom App Marketplace, go to the Develop dropdown menu in the top-right corner and select [Build App](https://marketplace.zoom.us/develop/create).
2.  In the Choose Your App window, click **Create** under the Server-to-Server OAuth type. If you do not see this OAuth type, contact your Zoom administrator to be given permission for the Server-to-Server OAuth type.
3.  Enter an app name and app type to begin creation. Your app configuration page opens for the new app.
4.  Take note of your `Account ID`, `Client ID`, and `Client secret` for use later in JupiterOne.
5.  Enter the required information for the app credentials, information, feature, scopes sections and so on. Zoom prompts you if any required fields are omitted.
6.  In the **Scopes** section, add the following:

| Scope | Used to |
| --- | --- |
| `user:read:user:admin` | Read the user the app authenticates as, to build the account entity |
| `user:read:list_users:admin` | List the users in the account |
| `user:read:settings:admin` | Read each user's meeting and recording security settings |
| `group:read:list_groups:admin` | List the groups in the account |
| `group:read:list_members:admin` | List the members of each group |
| `role:read:list_roles:admin` | List the roles in the account |
| `role:read:list_members:admin` | List the members assigned to each role |

> **NOTE**
> 
> Zoom has replaced its classic scopes with the granular scopes above, and new apps no longer offer the classic ones. If your app still shows only classic scopes, add `user:read:admin`, `group:read:admin` and `role:read:admin` instead.

> **NOTE**
> 
> Zoom only lists the scopes your own Zoom role allows. If a scope above is missing from the list, ask a Zoom admin to give your role view access to Users, Groups and Roles under **User Management > Roles**, then return to the app and add it. A step whose scope is not granted on the Zoom app fails with Zoom error 4711.

7.  On the final screen, after you have provided all the required information, click`Activate your app` to complete the app creation.

After completing this configuration within Zoom, you are ready to go to JupiterOne to finalize the integration.

### Configuration in JupiterOne

To install the Zoom integration in JupiterOne, navigate to the **Integrations** tab in JupiterOne and select Zoom. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Zoom account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   The Zoom **Account ID**, **Client ID**, **Client Secret**, and **Scopes**. Select the same scopes you granted to the Zoom app; JupiterOne skips any step whose scope is not selected here, but selecting a scope does not grant it on the Zoom side.
    

Click **Create** once all values are provided to finalize the integration.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `zoom_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Group | `zoom_group` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| Role | `zoom_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| User | `zoom_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `zoom_account` | **HAS** | `zoom_user` |
| `zoom_account` | **HAS** | `zoom_group` |
| `zoom_account` | **HAS** | `zoom_role` |
| `zoom_group` | **HAS** | `zoom_user` |
| `zoom_user` | **ASSIGNED** | `zoom_role` |

### Zoom User

`zoom_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `audioConferencingTollFreeAndFeeBasedTollCallAllowWebinarAttendeesDial` | `boolean` |  |  |
| `audioConferencingTollFreeAndFeeBasedTollCallEnable` | `boolean` |  |  |
| `createdAt` | `string` |  |  |
| `dept` | `string` |  |  |
| `emailNotificationAlternativeHostReminder` | `boolean` |  |  |
| `emailNotificationCancelMeetingReminder` | `boolean` |  |  |
| `emailNotificationCloudRecordingAvailableReminder` | `boolean` |  |  |
| `emailNotificationJbhReminder` | `boolean` |  |  |
| `emailNotificationScheduleForReminder` | `boolean` |  |  |
| `featureCnMeeting` | `boolean` |  |  |
| `featureConcurrentMeeting` | `string` |  |  |
| `featureInMeeting` | `boolean` |  |  |
| `featureLargeMeeting` | `boolean` |  |  |
| `featureLargeMeetingCapacity` | `integer` |  |  |
| `featureMeetingCapacity` | `integer` |  |  |
| `featureWebinar` | `boolean` |  |  |
| `featureWebinarCapacity` | `integer` |  |  |
| `featureZoomEvents` | `boolean` |  |  |
| `featureZoomEventsCapacity` | `integer` |  |  |
| `featureZoomPhone` | `boolean` |  |  |
| `groupIds` | `array` of `string`s |  |  |
| `hostKey` | `string` |  |  |
| `inMeetingAllowLiveStreaming` | `boolean` |  |  |
| `inMeetingAllowParticipantsChatWith` | `integer` |  |  |
| `inMeetingAllowParticipantsToRename` | `boolean` |  |  |
| `inMeetingAllowUsersSaveChats` | `integer` |  |  |
| `inMeetingAnnotation` | `boolean` |  |  |
| `inMeetingAttendeeOnHold` | `boolean` |  |  |
| `inMeetingAutoSavingChat` | `boolean` |  |  |
| `inMeetingBreakoutRoom` | `boolean` |  |  |
| `inMeetingBreakoutRoomSchedule` | `boolean` |  |  |
| `inMeetingChat` | `boolean` |  |  |
| `inMeetingClosedCaption` | `boolean` |  |  |
| `inMeetingCoHost` | `boolean` |  |  |
| `inMeetingCustomDataCenterRegions` | `boolean` |  |  |
| `inMeetingCustomLiveStreamingService` | `boolean` |  |  |
| `inMeetingCustomServiceInstructions` | `string` |  |  |
| `inMeetingDataCenterRegions` | `array` of `string`s |  |  |
| `inMeetingE2eEncryption` | `boolean` |  |  |
| `inMeetingEntryExitChime` | `string` |  |  |
| `inMeetingFarEndCameraControl` | `boolean` |  |  |
| `inMeetingFeedbacl` | `boolean` |  |  |
| `inMeetingFileTransfer` | `boolean` |  |  |
| `inMeetingGroupHd` | `boolean` |  |  |
| `inMeetingJoinFromDesktop` | `boolean` |  |  |
| `inMeetingJoinFromMobile` | `boolean` |  |  |
| `inMeetingLiveStreamingFacebook` | `boolean` |  |  |
| `inMeetingLiveStreamingYoutube` | `boolean` |  |  |
| `inMeetingMeetingReactions` | `boolean` |  |  |
| `inMeetingNonVerbalFeedback` | `boolean` |  |  |
| `inMeetingPolling` | `boolean` |  |  |
| `inMeetingPrivateChat` | `boolean` |  |  |
| `inMeetingRecordPlayVoice` | `boolean` |  |  |
| `inMeetingRemoteControl` | `boolean` |  |  |
| `inMeetingRemoteSupport` | `boolean` |  |  |
| `inMeetingRequestPermissionToUnmute` | `boolean` |  |  |
| `inMeetingRequestPermissionToUnmuteParticipants` | `boolean` |  |  |
| `inMeetingScreenSharing` | `boolean` |  |  |
| `inMeetingShareDualCamera` | `boolean` |  |  |
| `inMeetingShowAJoinFromYourBrowserLink` | `boolean` |  |  |
| `inMeetingShowMeetingControlToolbar` | `boolean` |  |  |
| `inMeetingVirtualBackground` | `boolean` |  |  |
| `inMeetingVirtualBackgroundSettingsAllowUploadCustom` | `boolean` |  |  |
| `inMeetingVirtualBackgroundSettingsAllowVideos` | `boolean` |  |  |
| `inMeetingVirtualBackgroundSettingsEnable` | `boolean` |  |  |
| `inMeetingWaitingRoom` | `boolean` |  |  |
| `inMeetingWebinarChatAllowAttendeesChatWith` | `integer` |  |  |
| `inMeetingWebinarChatAllowAutoSaveLocalChatFile` | `boolean` |  |  |
| `inMeetingWebinarChatAllowPanelistsChatWith` | `integer` |  |  |
| `inMeetingWebinarChatAllowPanelistsSendDirectMessage` | `boolean` |  |  |
| `inMeetingWebinarChatAllowUsersSaveChats` | `integer` |  |  |
| `inMeetingWebinarChatDefaultAttendeesChatWith` | `integer` |  |  |
| `inMeetingWebinarChatEnable` | `boolean` |  |  |
| `inMeetingWebinarLiveStreamingCustomServiceInstructions` | `string` |  |  |
| `inMeetingWebinarLiveStreamingEnable` | `boolean` |  |  |
| `inMeetingWebinarLiveStreamingLiveStreamingReminder` | `boolean` |  |  |
| `inMeetingWebinarLiveStreamingLiveStreamingService` | `array` of `string`s |  |  |
| `inMeetingWhoCanShareScreen` | `string` |  |  |
| `inMeetingWhoCanShareScreenWhenSomeoneIsSharing` | `string` |  |  |
| `inMeetingWorkplaceByFacebook` | `boolean` |  |  |
| `language` | `string` |  |  |
| `lastClientVersion` | `string` |  |  |
| `lastLoginTime` | `string` |  |  |
| `meetingAuthentication` | `boolean` |  |  |
| `meetingSecurityApprovedOrDeniedCountriesOrRegionsEnable` | `boolean` |  |  |
| `meetingSecurityAutoSecurity` | `boolean` |  |  |
| `meetingSecurityBlockUserDomain` | `boolean` |  |  |
| `meetingSecurityBlockUserDomainList` | `array` of `string`s |  |  |
| `meetingSecurityEmbedPasswordInJoinLink` | `boolean` |  |  |
| `meetingSecurityEncryptionType` | `string` |  |  |
| `meetingSecurityEndToEndEncryptedMeetings` | `boolean` |  |  |
| `meetingSecurityMeetingPassword` | `boolean` |  |  |
| `meetingSecurityMeetingPasswordRequirementConsecutiveCharactersLength` | `integer` |  |  |
| `meetingSecurityMeetingPasswordRequirementHaveLetter` | `boolean` |  |  |
| `meetingSecurityMeetingPasswordRequirementHaveNumber` | `boolean` |  |  |
| `meetingSecurityMeetingPasswordRequirementHaveSpecialCharacter` | `boolean` |  |  |
| `meetingSecurityMeetingPasswordRequirementHaveUpperAndLowerCharacters` | `boolean` |  |  |
| `meetingSecurityMeetingPasswordRequirementLength` | `integer` |  |  |
| `meetingSecurityMeetingPasswordRequirementOnlyAllowNumeric` | `boolean` |  |  |
| `meetingSecurityMeetingPasswordRequirementWeakEnhanceDetection` | `boolean` |  |  |
| `meetingSecurityPasswordForPmi` | `string` |  |  |
| `meetingSecurityPhonePassword` | `boolean` |  |  |
| `meetingSecurityPmiPassword` | `boolean` |  |  |
| `meetingSecurityRequirePasswordForScheduledMeeting` | `boolean` |  |  |
| `meetingSecurityRequirePasswordForScheduledWebinar` | `boolean` |  |  |
| `meetingSecurityWaitingRoom` | `boolean` |  |  |
| `meetingSecurityWaitingRoomSettingsParticipantsToPlaceInWaitingRoom` | `integer` |  |  |
| `meetingSecurityWaitingRoomSettingsUsersWhoCanAdmitParticipantsFromWaitingRoom` | `integer` |  |  |
| `meetingSecurityWaitingRoomSettingsWhitelistedDomainsForWaitingRoom` | `string` |  |  |
| `meetingSecurityWebinarPassword` | `boolean` |  |  |
| `phoneNumber` | `string` |  |  |
| `picUrl` | `string` |  |  |
| `pmi` | `integer` |  |  |
| `profileRecordingStorageLocationAllowedValues` | `array` of `string`s |  |  |
| `profileRecordingStorageLocationValue` | `string` |  |  |
| `recordingAskHostToConfirmDisclaimer` | `boolean` |  |  |
| `recordingAskParticipantsToConsentDisclaimer` | `boolean` |  |  |
| `recordingAuthentication` | `boolean` |  |  |
| `recordingAutoDeleteCmr` | `boolean` |  |  |
| `recordingAutoDeleteCmrData` | `integer` |  |  |
| `recordingAutoRecording` | `string` |  |  |
| `recordingCloudRecording` | `boolean` |  |  |
| `recordingHostDeleteCloudRecording` | `boolean` |  |  |
| `recordingHostPauseStopRecording` | `boolean` |  |  |
| `recordingIpAddressAccessControlEnable` | `boolean` |  |  |
| `recordingIpAddressAccessControlIpAddressesOrRanges` | `string` |  |  |
| `recordingLocalRecording` | `boolean` |  |  |
| `recordingRecordAudioFile` | `boolean` |  |  |
| `recordingRecordGalleryView` | `boolean` |  |  |
| `recordingRecordingAudioTranscript` | `boolean` |  |  |
| `recordingRecordingDisclaimer` | `boolean` |  |  |
| `recordingRecordingPasswordRequirementHaveLetter` | `boolean` |  |  |
| `recordingRecordingPasswordRequirementHaveNumber` | `boolean` |  |  |
| `recordingRecordingPasswordRequirementHaveSpecialCharacter` | `boolean` |  |  |
| `recordingRecordingPasswordRequirementLength` | `integer` |  |  |
| `recordingRecordingPasswordRequirementOnlyAllowNumeric` | `boolean` |  |  |
| `recordingRecordSpeakerView` | `boolean` |  |  |
| `recordingRequirePasswordForSharedCloudRecordings` | `boolean` |  |  |
| `recordingSaveChatText` | `boolean` |  |  |
| `recordingShowTimestamp` | `boolean` |  |  |
| `roleId` | `string` |  |  |
| `scheduleMeetingAudioType` | `string` |  |  |
| `scheduleMeetingDefaultPasswordForScheduledMeetings` | `string` |  |  |
| `scheduleMeetingEmbedPasswordInJoinLink` | `boolean` |  |  |
| `scheduleMeetingForcePmiJbhPassword` | `boolean` |  |  |
| `scheduleMeetingHostVideo` | `boolean` |  |  |
| `scheduleMeetingJoinBeforeHost` | `boolean` |  |  |
| `scheduleMeetingMeetingPasswordRequirementConsecutiveCharactersLength` | `integer` |  |  |
| `scheduleMeetingMeetingPasswordRequirementHaveLetter` | `boolean` |  |  |
| `scheduleMeetingMeetingPasswordRequirementHaveNumber` | `boolean` |  |  |
| `scheduleMeetingMeetingPasswordRequirementHaveSpecialCharacter` | `boolean` |  |  |
| `scheduleMeetingMeetingPasswordRequirementHaveUpperAndLowerCharacters` | `boolean` |  |  |
| `scheduleMeetingMeetingPasswordRequirementLength` | `integer` |  |  |
| `scheduleMeetingMeetingPasswordRequirementOnlyAllowNumeric` | `boolean` |  |  |
| `scheduleMeetingMeetingPasswordRequirementWeakEnhanceDetection` | `boolean` |  |  |
| `scheduleMeetingMuteUponEntry` | `boolean` |  |  |
| `scheduleMeetingParticipantsVideo` | `boolean` |  |  |
| `scheduleMeetingPersonalMeeting` | `boolean` |  |  |
| `scheduleMeetingPmiPassword` | `string` |  |  |
| `scheduleMeetingPstnPasswordProtected` | `boolean` |  |  |
| `scheduleMeetingRequirePasswordForInstantMeetings` | `boolean` |  |  |
| `scheduleMeetingRequirePasswordForPmiMeetings` | `string` |  |  |
| `scheduleMeetingRequirePasswordForScheduledmeetings` | `boolean` |  |  |
| `scheduleMeetingRequirePasswordForSchedulingNewMeetings` | `boolean` |  |  |
| `scheduleMeetingUsePmiForInstantMeetings` | `boolean` |  |  |
| `scheduleMeetingUsePmiForScheduledMeetings` | `boolean` |  |  |
| `telephonyAudioConferenceInfo` | `string` |  |  |
| `telephonyShowInternationalNumbersLink` | `boolean` |  |  |
| `telephonyTelephonyRegionsAllowedValues` | `array` of `string`s |  |  |
| `telephonyTelephonyRegionsSelectionValue` | `string` |  |  |
| `telephonyThirdPartyAudio` | `boolean` |  |  |
| `timezone` | `string` |  |  |
| `tspCallOut` | `boolean` |  |  |
| `tspCallOutCountries` | `array` of `string`s |  |  |
| `tspShowInternationalNumbersLink` | `boolean` |  |  |
| `type` | `integer` |  |  |
| `verified` | `integer` |  |  |

---

---

Source: /integrations/directory/zscaler

# Zscaler

Visualize Zscaler Internet Access (ZIA) resources including accounts, users, roles, sites, applications, policies, and destinations. Monitor security policy configurations, track user access roles, and understand your Zscaler deployment through queries and alerts.

## Installation

The Zscaler integration supports both Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) data. You can authenticate against a ZIA tenant (optionally adding ZPA as an add-on), or against a standalone ZPA tenant. For each path, ZIdentity + OneAPI (OAuth2) is the recommended modern approach, while legacy credentials remain available for backward compatibility.

### Configuring the Integration in JupiterOne

To install the Zscaler integration in JupiterOne, navigate to the **Integrations** tab and select Zscaler. Click **New Instance** to begin configuring your integration.

Creating an instance requires the following:

-   The **Account Name** used to identify the Zscaler account in JupiterOne. Ingested entities will have this value stored in `tag.AccountName` when the `AccountName` toggle is enabled.
    
-   **Description** to assist in identifying the integration instance, if desired.
    
-   **Polling Interval** that you feel is sufficient for your monitoring needs. You may leave this as `DISABLED` and manually execute the integration.
    
-   An **authentication method** (see below).
    

Click **Create** once all values are provided to finalize the integration.

### Authentication Methods

Select the authentication method that matches your tenant:

-   **ZIdentity + OneAPI (OAuth2)** — Recommended. ZIA tenant authenticated with an OAuth2 client, with optional ZPA add-on.
-   **Legacy Authentication (API Key + Session)** — ZIA tenant authenticated with an API key, username, and password, with optional ZPA add-on.
-   **ZPA only - ZIdentity + OneAPI (OAuth2)** — Standalone ZPA tenant authenticated with an OAuth2 client.
-   **ZPA only - ZPA API Key** — Standalone ZPA tenant authenticated with a ZPA API key.

#### ZIdentity + OneAPI (OAuth2) — Recommended

This method uses OAuth2 Client Credentials via ZIdentity. It requires:

-   **Client ID**: The OAuth2 Client ID from your ZIdentity API client.
-   **Client Secret**: The OAuth2 Client Secret from your ZIdentity API client.
-   **Vanity Domain**: Your Zscaler tenant vanity domain (e.g., `mycompany` for `mycompany.zslogin.net`).
-   **Zscaler Cloud** (optional): The Zscaler cloud environment (e.g., `zscaler`, `zscalerone`, `zscalertwo`). Leave blank for the default cloud.

To create OAuth2 credentials:

1.  Log in to the ZIdentity Admin Portal.
2.  Create an API client with the **Client Credentials** grant type.
3.  Note the **Client ID** and **Client Secret**.
4.  Note your **Vanity Domain** — this is the subdomain portion of your `zslogin.net` URL.

To also ingest ZPA data with this method, add your **ZPA Customer ID** (optional). The same OAuth2 client above is reused for ZPA, so it must have ZPA API access.

> **NOTE**
> 
> The **ZPA Policies and Profiles** ingestion source is disabled by default. To ingest ZPA policy rules and profiles, enable it in the instance ingestion settings. Without it, setting the ZPA fields collects no ZPA entities.

#### Legacy Authentication (API Key + Session)

This method uses an API key, username, and password to create a session-based connection to the Zscaler ZIA API. It requires:

-   **API Key**: The API key used to authenticate with Zscaler.
-   **Username**: The API user email address.
-   **Password**: The API user password.
-   **Cloud Name**: Your Zscaler cloud instance (e.g., `zscaler`, `zscalerone`, `zscalertwo`, `zscalerthree`, `zscloud`, `zscalerbeta`).

To create legacy API credentials:

1.  Log in to your Zscaler Admin Portal.
2.  Navigate to **Administration > API Key Management**.
3.  Generate or retrieve your API key.
4.  Note the cloud name from your Zscaler URL (the subdomain before `.net`).

To also ingest ZPA data with this method, provide the following add-on fields:

-   **ZPA Customer ID** (optional): The ZPA tenant customer ID. ZPA is ingested only when this is set.
-   **ZPA API Client ID** (optional): The ZPA API client ID, created in the ZPA Admin Portal under **Public API > API Keys**. Required when a ZPA Customer ID is set.
-   **ZPA API Client Secret** (optional): The ZPA API client secret paired with the client ID above.
-   **ZPA Cloud** (optional): The ZPA cloud environment (e.g., `private.zscaler.com`, `zpatwo.net`, `zpabeta.net`, `zpagov.net`, `zpagov.us`). Defaults to `private.zscaler.com`.

> **NOTE**
> 
> The **ZPA Policies and Profiles** ingestion source is disabled by default. To ingest ZPA policy rules and profiles, enable it in the instance ingestion settings. Without it, setting the ZPA add-on fields collects no ZPA entities.

> **INFO**
> 
> See the [Zscaler API documentation](https://help.zscaler.com/zia/getting-started-zia-api) for more information on generating API keys.

#### ZPA only - ZIdentity + OneAPI (OAuth2)

Use this method for a standalone ZPA tenant authenticated with an OAuth2 client. It requires:

-   **ZPA Customer ID**: The ZPA tenant customer ID.
-   **Client ID**: The OAuth2 Client ID. The client must have ZPA API access.
-   **Client Secret**: The OAuth2 Client Secret.
-   **Vanity Domain**: Your Zscaler tenant vanity domain (e.g., `mycompany` for `mycompany.zslogin.net`).
-   **Zscaler Cloud** (optional): The Zscaler cloud environment (e.g., `zscaler`, `zscalerone`, `zscalertwo`). Leave blank for the default cloud.

> **NOTE**
> 
> The **ZPA Policies and Profiles** ingestion source is disabled by default. To ingest ZPA policy rules and profiles, enable it in the instance ingestion settings. Without it, this ZPA-only instance collects no ZPA entities.

#### ZPA only - ZPA API Key

Use this method for a standalone ZPA tenant authenticated with a ZPA API key. It requires:

-   **ZPA Customer ID**: The ZPA tenant customer ID, found in the ZPA Admin Portal under **Public API > API Keys**.
-   **ZPA API Client ID**: The ZPA API client ID.
-   **ZPA API Client Secret**: The ZPA API client secret.
-   **ZPA Cloud** (optional): The ZPA cloud environment (e.g., `private.zscaler.com`, `zpatwo.net`, `zpabeta.net`, `zpagov.net`, `zpagov.us`). Defaults to `private.zscaler.com`.

> **NOTE**
> 
> The **ZPA Policies and Profiles** ingestion source is disabled by default. To ingest ZPA policy rules and profiles, enable it in the instance ingestion settings. Without it, this ZPA-only instance collects no ZPA entities.

### Advanced Configuration

The following field is optional and applies to any authentication method that ingests ZPA data.

| Field | Description | Default |
| --- | --- | --- |
| **ZPA Microtenant ID** | Scopes ZPA list endpoints to a specific microtenant. Leave blank to ingest from the default tenant only. | Blank |

## AppTotal Configuration (Optional)

To ingest third-party SaaS app inventory and SSPM posture findings from Zscaler AppTotal, provide the following additional credentials when creating your integration instance. These fields are optional — leaving them blank disables AppTotal data collection without affecting the core integration.

| Field | Description |
| --- | --- |
| **AppTotal API Key** | API key for the Zscaler AppTotal service. When provided, the integration ingests the SaaS app inventory and posture findings linked to the specified App View. |
| **AppTotal App View ID** | UUID of the AppTotal App View whose apps should be ingested. Required when an AppTotal API Key is provided. |

> **NOTE**
> 
> The **AppTotal Apps** and **AppTotal Posture Findings** ingestion sources are disabled by default. To ingest AppTotal data, enable them in the instance ingestion settings. Without them, providing the AppTotal fields collects no AppTotal entities.

To obtain these credentials:

1.  Log in to the [AppTotal portal](https://apptotal.zscaler.com).
2.  Navigate to **Settings** to generate or copy your API key.
3.  Go to **App Views**, select the view you want to ingest, and copy its UUID.

### Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our [Instance management guide](/integrations/instance-management.md) to learn more about working with and editing integration instances.

### Entities

The following entities are created:

| Resources | Entity `_type` | Entity `_class` |
| --- | --- | --- |
| Account | `zscaler_account` | [Account](https://docs.jupiterone.io/data-model/schemas/Account) |
| Application | `zscaler_application` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| Application Category | `zscaler_application_category` | [Group](https://docs.jupiterone.io/data-model/schemas/Group) |
| AppTotal App | `zscaler_apptotal_app` | [Application](https://docs.jupiterone.io/data-model/schemas/Application) |
| AppTotal Posture Finding | `zscaler_apptotal_posture_finding` | [Finding](https://docs.jupiterone.io/data-model/schemas/Finding) |
| Destination | `zscaler_destination` | [Record](https://docs.jupiterone.io/data-model/schemas/Record) |
| Device | `zscaler_device` | [Device](https://docs.jupiterone.io/data-model/schemas/Device), [Host](https://docs.jupiterone.io/data-model/schemas/Host) |
| Policy | `zscaler_policy` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |
| Policy Control | `zscaler_policy_control` | [Control](https://docs.jupiterone.io/data-model/schemas/Control) |
| Role | `zscaler_role` | [AccessRole](https://docs.jupiterone.io/data-model/schemas/AccessRole) |
| Site | `zscaler_site` | [Site](https://docs.jupiterone.io/data-model/schemas/Site) |
| User | `zscaler_user` | [User](https://docs.jupiterone.io/data-model/schemas/User) |
| ZpaInspectionProfile | `zscaler_zpa_inspection_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ZpaIsolationProfile | `zscaler_zpa_isolation_profile` | [Configuration](https://docs.jupiterone.io/data-model/schemas/Configuration) |
| ZpaPolicyRule | `zscaler_zpa_policy_rule` | [ControlPolicy](https://docs.jupiterone.io/data-model/schemas/ControlPolicy) |

### Relationships

The following relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `zscaler_account` | **HAS** | `zscaler_role` |
| `zscaler_account` | **HAS** | `zscaler_site` |
| `zscaler_account` | **HAS** | `zscaler_application_category` |
| `zscaler_account` | **HAS** | `zscaler_application` |
| `zscaler_account` | **HAS** | `zscaler_destination` |
| `zscaler_account` | **HAS** | `zscaler_policy` |
| `zscaler_account` | **HAS** | `zscaler_user` |
| `zscaler_account` | **HAS** | `zscaler_device` |
| `zscaler_account` | **HAS** | `zscaler_apptotal_app` |
| `zscaler_account` | **HAS** | `zscaler_apptotal_posture_finding` |
| `zscaler_account` | **HAS** | `zscaler_zpa_inspection_profile` |
| `zscaler_account` | **HAS** | `zscaler_zpa_isolation_profile` |
| `zscaler_account` | **HAS** | `zscaler_zpa_policy_rule` |
| `zscaler_policy` | **HAS** | `zscaler_policy_control` |
| `zscaler_user` | **ASSIGNED** | `zscaler_role` |
| `zscaler_zpa_policy_rule` | **USES** | `zscaler_zpa_inspection_profile` |
| `zscaler_zpa_policy_rule` | **USES** | `zscaler_zpa_isolation_profile` |

### Mapped Relationships

The following mapped relationships are created:

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
| --- | --- | --- | --- |
| `zscaler_device` | **HAS** | `User` | REVERSE |

### Zscaler Account

`zscaler_account` inherits from [Account](/data-model/schemas/Account.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| `companyId` | `number` |  |  |
| `webLink` | `string` |  |  |
| `zpaCustomerId` | `string` | Zscaler Private Access (ZPA) customer ID. Set on the account entity of ZPA-only instances, which have no ZIA organization. |  |

---

### Zscaler Application

`zscaler_application` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`appTags` \*

 | `null` **|** `array` | Tags associated with the application (named `appTags` to avoid the reserved `tag.*` property map). |  |
| 

`category` \*

 | `null` **|** `string` | Application category from the Shadow IT report (e.g. Collaboration). |  |
| 

`isSanctioned` \*

 | `null` **|** `boolean` | True when the application status is sanctioned. |  |
| 

`potentialIntegrations` \*

 | `null` **|** `number` | Number of potential 3rd-party integrations the application has with corporate SaaS platforms (populated by Zscaler 3rd-Party App Governance). |  |
| 

`riskIndex` \*

 | `null` **|** `number` | Zscaler-computed risk index, 1 (lowest risk) to 5 (highest risk). |  |
| 

`sanctionedState` \*

 | `null` **|** `string` | Whether the application is sanctioned or unsanctioned. |  |

---

### Zscaler Application Category

`zscaler_application_category` inherits from [Group](/data-model/schemas/Group.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`categoryType` \*

 | `null` **|** `string` |  |  |
| 

`configuredName` \*

 | `null` **|** `string` |  |  |
| 

`customCategory` \*

 | `null` **|** `boolean` |  |  |
| 

`superCategory` \*

 | `null` **|** `string` |  |  |

---

### Zscaler Apptotal App

`zscaler_apptotal_app` inherits from [Application](/data-model/schemas/Application.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`appTags` \*

 | `null` **|** `array` | Tags supplied by AppTotal (e.g. OAuth, 3rd Party). Named `appTags` to avoid collision with the inherited `tags` map. |  |
| 

`appViewId` \*

 | `string` | UUID of the AppTotal App View that this app was retrieved from. |  |
| 

`categories` \*

 | `array` of `string`s | AppTotal categories (e.g. Games, Productivity). |  |
| 

`category` \*

 | `null` **|** `string` | First category from `categories[]`, for J1QL convenience scalar. |  |
| 

`clientId` \*

 | `null` **|** `string` | Primary OAuth client identifier (the preferred `_key` source). |  |
| 

`clientType` \*

 | `null` **|** `string` | OAuth client type (e.g. Web Client). |  |
| 

`compliance` \*

 | `null` **|** `array` | Compliance attestations claimed by the vendor (e.g. GDPR, CCPA). |  |
| 

`consentScreenshotUrl` \*

 | `null` **|** `string` | URL of the captured OAuth consent screen. |  |
| 

`dataRetention` \*

 | `null` **|** `string` | Free-text retention policy from the vendor. |  |
| 

`developerEmail` \*

 | `null` **|** `string` | Vendor contact email for remediation. |  |
| 

`externalIds` \*

 | `array` of `string`s | All OAuth/UUID identifiers from `externalIds[].id`, parallel-indexed with `externalIdTypes`. |  |
| 

`externalIdTypes` \*

 | `null` **|** `array` | Per-identifier type values from `externalIds[].type` (e.g. clientId). Parallel-indexed with `externalIds`. |  |
| 

`extractedApiCalls` \*

 | `null` **|** `array` | API calls observed in app source (Premium Only). |  |
| 

`extractedUrls` \*

 | `null` **|** `array` | URLs extracted from app source (Premium Only). |  |
| 

`instanceClassifications` \*

 | `null` **|** `array` | Per-tenant classification from `instances[].classification` (Sanctioned/Unsanctioned/Unclassified/Reviewing). |  |
| 

`instanceStatuses` \*

 | `null` **|** `array` | Per-tenant install status from `instances[].status` (Enabled/Disabled/Deleted/Not Installed). |  |
| 

`isCanonicVerified` \*

 | `null` **|** `boolean` | True if AppTotal's verification flag is set. |  |
| 

`isPlatformVerified` \*

 | `null` **|** `boolean` | True if the publisher is verified by the SaaS platform (critical TPR signal). |  |
| 

`marketplaceDownloads` \*

 | `null` **|** `number` | Vendor trust signal: marketplace download count. |  |
| 

`marketplaceReviews` \*

 | `null` **|** `number` | Vendor trust signal: marketplace review count. |  |
| 

`marketplaceStars` \*

 | `null` **|** `number` | Vendor trust signal: marketplace star rating. |  |
| 

`permissionAccessTypes` \*

 | `null` **|** `array` | Per-scope access category from `permissions[].accessType`. |  |
| 

`permissionLevel` \*

 | `number` | Numeric score quantifying OAuth scope breadth. Critical risk metric. |  |
| 

`permissionLevels` \*

 | `null` **|** `array` | Per-scope risk band from `permissions[].level` (LOW/MEDIUM/HIGH). |  |
| 

`permissions` \*

 | `null` **|** `array` | OAuth scopes flattened from `permissions[].scope`. Critical TPR signal. |  |
| 

`permissionServices` \*

 | `null` **|** `array` | Per-scope service from `permissions[].service`. |  |
| 

`platform` \*

 | `string` | The SaaS platform the app integrates with (e.g. google\_workspace, microsoft\_365). |  |
| 

`privacyPolicyUrl` \*

 | `null` **|** `string` | Vendor privacy policy URL. |  |
| 

`redirectUrls` \*

 | `null` **|** `array` | OAuth redirect URIs registered for this app (forensic / token-theft IOC). |  |
| 

`riskCategories` \*

 | `null` **|** `array` | AppTotal per-app risk categories from `risks[].category` (Premium Only). |  |
| 

`riskLevel` \*

 | `string` | Categorical risk band (LOW/MEDIUM/HIGH). Renamed from the API field `risk` to avoid collision with the inherited Application.risk numeric 1-10. |  |
| 

`riskScore` \*

 | `null` **|** `number` | AppTotal numeric risk score (raw, typically 0-10). |  |
| 

`riskSeverities` \*

 | `null` **|** `array` | Per-risk severity from `risks[].severity` (LOW/MEDIUM/HIGH) (Premium Only). |  |
| 

`termsOfServiceUrl` \*

 | `null` **|** `string` | Vendor terms-of-service URL. |  |
| 

`totalEnabledUsers` \*

 | `null` **|** `number` | Number of internal users currently authorized to use the app (blast radius proxy). |  |
| 

`vendor` \*

 | `null` **|** `string` | The publisher / vendor name (from publisher.name). |  |
| 

`vendorDescription` \*

 | `null` **|** `string` | Publisher self-description (from publisher.description). |  |
| 

`vendorLogoUrl` \*

 | `null` **|** `string` | Publisher logo URL (from publisher.logoUrl). |  |
| 

`vendorUrl` \*

 | `null` **|** `string` | Publisher web site URL (from publisher.siteUrl). |  |
| 

`vulnerabilityCveIds` \*

 | `null` **|** `array` | CVEs found in third-party libraries from `vulnerabilities[].cveId` (Premium Only). |  |
| 

`websiteUrls` \*

 | `null` **|** `array` | App-controlled URLs (informational). |  |

---

### Zscaler Apptotal Posture Finding

`zscaler_apptotal_posture_finding` inherits from [Finding](/data-model/schemas/Finding.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`appViewId` \*

 | `null` **|** `string` | AppTotal App View UUID carried through from configuration so J1QL can correlate findings to apps. |  |
| 

`categoryIds` \*

 | `null` **|** `array` | Stable category UUIDs. |  |
| 

`categoryNames` \*

 | `null` **|** `array` | Human-readable categories (e.g. authentication, encryption). |  |
| 

`complexity` \*

 | `null` **|** `string` | Remediation effort estimate (LOW/MEDIUM/HIGH). |  |
| 

`complianceCategories` \*

 | `null` **|** `array` | Per-framework category labels from `compliance[].controlCategory`. |  |
| 

`complianceControlNumbers` \*

 | `null` **|** `array` | Framework-specific control numbers from `compliance[].controlNumber` (e.g. CIS-1.2.3). Auto-correlated by the JupiterOne compliance layer when the strings match. |  |
| 

`complianceFrameworks` \*

 | `null` **|** `array` | Compliance framework names from `compliance[].name` (e.g. CIS, SOC2). |  |
| 

`complianceIds` \*

 | `null` **|** `array` | Compliance framework UUIDs from `compliance[].id`. |  |
| 

`controlId` \*

 | `string` | Stable rule identifier (UUID) for this posture control. |  |
| 

`controlName` \*

 | `string` | Human-readable name of the posture control. |  |
| 

`failedAssetsCount` \*

 | `null` **|** `number` | Count of assets currently failing this control (blast-radius proxy). |  |
| 

`mitreTacticId` \*

 | `null` **|** `string` | MITRE ATT&CK tactic ID (from `mitreTactic.id`). |  |
| 

`mitreTacticName` \*

 | `null` **|** `string` | MITRE ATT&CK tactic name (e.g. Initial Access). |  |
| 

`mitreTacticUrl` \*

 | `null` **|** `string` | Direct link to the MITRE tactic. |  |
| 

`mitreTechniqueIds` \*

 | `null` **|** `array` | MITRE technique IDs flattened from `mitreTechniques[].id` (e.g. T1078). |  |
| 

`mitreTechniqueNames` \*

 | `null` **|** `array` | MITRE technique names from `mitreTechniques[].name`. |  |
| 

`mitreTechniqueUrls` \*

 | `null` **|** `array` | Direct links from `mitreTechniques[].url`. |  |
| 

`platformId` \*

 | `null` **|** `string` | UUID of the SaaS platform this control evaluates (e.g. google\_workspace). |  |
| 

`policyStatus` \*

 | `null` **|** `string` | Policy compliance state (PARTIAL / COMPLIANT / NON\_COMPLIANT). Drives the inherited `open` flag. |  |
| 

`remediationThreat` \*

 | `null` **|** `string` | Risk-of-not-fixing description from AppTotal. Populates the inherited `recommendation`. |  |
| 

`tenantId` \*

 | `null` **|** `string` | Multi-tenant identifier (UUID) of the evaluated tenant. |  |
| 

`tenantName` \*

 | `null` **|** `string` | Customer-facing tenant label. |  |
| 

`violationDescription` \*

 | `null` **|** `string` | Raw violation description from AppTotal. Populates the inherited `description`. |  |

---

### Zscaler Destination

`zscaler_destination` inherits from [Record](/data-model/schemas/Record.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`addresses` \*

 | `null` **|** `array` |  |  |
| 

`countries` \*

 | `null` **|** `array` |  |  |
| 

`destinationType` \*

 | `null` **|** `string` |  |  |
| 

`ipAddresses` \*

 | `null` **|** `array` |  |  |
| 

`urls` \*

 | `null` **|** `array` |  |  |

---

### Zscaler Device

`zscaler_device` inherits from [Device](/data-model/schemas/Device.md), [Host](/data-model/schemas/Host.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`agentArchitecture` \*

 | `string` **|** `null` | CPU architecture the ZCC agent was built for (e.g. x64). |  |
| 

`companyName` \*

 | `string` **|** `null` | Name of the Zscaler tenant the device is enrolled with. |  |
| 

`configDownloadedOn` \*

 | `number` **|** `null` | Time the device last downloaded its ZCC configuration, in milliseconds since epoch. |  |
| 

`deregisteredOn` \*

 | `number` **|** `null` | Time the device deregistered from ZCC, in milliseconds since epoch. |  |
| 

`enrolledUser` \*

 | `string` **|** `null` | Email/username of the user who enrolled this device with ZCC. |  |
| 

`hardwareFingerprint` \*

 | `string` **|** `null` | Zscaler-computed fingerprint of the device hardware, used to detect re-imaging. |  |
| 

`keepAliveOn` \*

 | `number` **|** `null` | Time of the last ZCC keep-alive received from the device, in milliseconds since epoch. |  |
| 

`policyName` \*

 | `string` **|** `null` | Name of the ZCC app profile / policy applied to the device. |  |
| 

`registeredOn` \*

 | `number` **|** `null` | Time the device registered with ZCC, in milliseconds since epoch. |  |
| 

`registrationState` \*

 | `string` **|** `null` | ZCC registration state reported for the device (e.g. Registered, Remove pending). |  |
| 

`tunnelVersion` \*

 | `string` **|** `null` | ZCC tunnel protocol version in use. |  |
| 

`udid` \*

 | `string` | Unique device identifier assigned by Zscaler. |  |
| 

`upmVersion` \*

 | `string` **|** `null` | Installed Unified Policy Manager (UPM) component version. |  |
| 

`zccVersion` \*

 | `string` **|** `null` | Installed Zscaler Client Connector (ZCC) agent version. |  |

---

### Zscaler Policy

`zscaler_policy` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `null` **|** `string` |  |  |
| 

`lastModifiedBy` \*

 | `null` **|** `string` |  |  |
| 

`lastModifiedOn` \*

 | `null` **|** `number` |  |  |
| 

`order` \*

 | `null` **|** `number` |  |  |
| 

`policyType` \*

 | `null` **|** `string` |  |  |
| 

`protocols` \*

 | `null` **|** `array` |  |  |
| 

`rank` \*

 | `null` **|** `number` |  |  |
| 

`state` \*

 | `null` **|** `string` |  |  |

---

### Zscaler Policy Control

`zscaler_policy_control` inherits from [Control](/data-model/schemas/Control.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `null` **|** `string` |  |  |
| 

`controlType` \*

 | `null` **|** `string` |  |  |
| 

`enabled` \*

 | `null` **|** `boolean` |  |  |
| 

`enforcement` \*

 | `null` **|** `string` |  |  |
| 

`policyId` \*

 | `null` **|** `number` |  |  |

---

### Zscaler Role

`zscaler_role` inherits from [AccessRole](/data-model/schemas/AccessRole.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`functionalScope` \*

 | `null` **|** `array` |  |  |
| 

`permissions` \*

 | `null` **|** `array` |  |  |
| 

`policyAccess` \*

 | `null` **|** `string` |  |  |
| 

`rank` \*

 | `null` **|** `number` |  |  |
| 

`roleType` \*

 | `null` **|** `string` |  |  |

---

### Zscaler Site

`zscaler_site` inherits from [Site](/data-model/schemas/Site.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`authRequired` \*

 | `null` **|** `boolean` |  |  |
| 

`city` \*

 | `null` **|** `string` |  |  |
| 

`country` \*

 | `null` **|** `string` |  |  |
| 

`ipAddresses` \*

 | `null` **|** `array` |  |  |
| 

`language` \*

 | `null` **|** `string` |  |  |
| 

`ports` \*

 | `null` **|** `array` |  |  |
| 

`profile` \*

 | `null` **|** `string` |  |  |
| 

`sslScanEnabled` \*

 | `null` **|** `boolean` |  |  |
| 

`state` \*

 | `null` **|** `string` |  |  |
| 

`surrogateIP` \*

 | `null` **|** `string` |  |  |

---

### Zscaler User

`zscaler_user` inherits from [User](/data-model/schemas/User.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`adminScopeType` \*

 | `null` **|** `string` |  |  |
| 

`disabled` \*

 | `null` **|** `boolean` |  |  |
| 

`firstName` \*

 | `null` **|** `string` |  |  |
| 

`isPasswordLoginAllowed` \*

 | `null` **|** `boolean` |  |  |
| 

`lastLoginTime` \*

 | `null` **|** `number` |  |  |
| 

`lastName` \*

 | `null` **|** `string` |  |  |
| 

`loginName` \*

 | `null` **|** `string` |  |  |
| 

`passwordExpiryTime` \*

 | `null` **|** `number` |  |  |
| 

`twoFactorAuthEnabled` \*

 | `null` **|** `boolean` |  |  |

---

### Zscaler Zpa Inspection Profile

`zscaler_zpa_inspection_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`customControlIds` \*

 | `array` **|** `null` | IDs of the custom WAF controls attached to this profile (flattened from customControls\[\].id). |  |
| 

`globalControlActions` \*

 | `array` **|** `null` | Default PASS/BLOCK behavior for global controls. |  |
| 

`incarnationNumber` \*

 | `string` **|** `null` | Deployment/version marker for the profile. |  |
| 

`modifiedBy` \*

 | `string` **|** `null` | Identifier of who last modified the profile. |  |
| 

`modifiedOn` \*

 | `number` **|** `null` | Time the profile was last modified, in milliseconds since epoch. |  |
| 

`paranoiaLevel` \*

 | `string` **|** `null` | OWASP CRS paranoia level (1-4) governing WAF inspection aggressiveness. |  |
| 

`predefinedControlCount` \*

 | `number` **|** `null` | Number of predefined WAF controls attached to this profile. |  |
| 

`predefinedControlsVersion` \*

 | `string` **|** `null` | OWASP CRS ruleset version deployed (e.g. OWASP\_CRS/3.3.0). |  |
| 

`ruleDeploymentState` \*

 | `string` **|** `null` | Whether the profile controls are actually deployed. |  |
| 

`rulesetName` \*

 | `string` **|** `null` | Name of the ruleset in force. |  |
| 

`rulesetVersion` \*

 | `string` **|** `null` | Version of the ruleset deployed. |  |

---

### Zscaler Zpa Isolation Profile

`zscaler_zpa_isolation_profile` inherits from [Configuration](/data-model/schemas/Configuration.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`isDefault` \*

 | `boolean` **|** `null` | Whether this is the tenant default isolation profile. |  |
| 

`isolationProfileId` \*

 | `string` **|** `null` | Identifier of the underlying Cloud Browser Isolation profile (distinct from the ZPA object id that policy rules reference). |  |
| 

`isolationUrl` \*

 | `string` **|** `null` | CBI endpoint URL the isolated browser session is sent to. |  |
| 

`modifiedBy` \*

 | `string` **|** `null` | Identifier of who last modified the profile. |  |
| 

`modifiedOn` \*

 | `number` **|** `null` | Time the profile was last modified, in milliseconds since epoch. |  |

---

### Zscaler Zpa Policy Rule

`zscaler_zpa_policy_rule` inherits from [ControlPolicy](/data-model/schemas/ControlPolicy.md)

| Property | Type | Description | Specifications |
| --- | --- | --- | --- |
| 
`action` \*

 | `string` **|** `null` | What the rule does: ALLOW / DENY / BYPASS / ISOLATE / INSPECT (the core security control). |  |
| 

`idpId` \*

 | `string` **|** `null` | Identity provider ID scoping the rule. |  |
| 

`isDefaultRule` \*

 | `boolean` **|** `null` | Whether this is the catch-all default rule (its action defines fail-open/closed posture). |  |
| 

`isDisabled` \*

 | `boolean` **|** `null` | Whether the rule is disabled (a disabled deny rule is a silent enforcement gap). |  |
| 

`isZscalerManaged` \*

 | `boolean` **|** `null` | Whether the rule is Zscaler-managed rather than customer-defined. |  |
| 

`modifiedBy` \*

 | `string` **|** `null` | Identifier of who last modified the rule. |  |
| 

`modifiedOn` \*

 | `number` **|** `null` | Time the rule was last modified, in milliseconds since epoch. |  |
| 

`operator` \*

 | `string` **|** `null` | AND/OR operator joining the rule conditions. |  |
| 

`policySetId` \*

 | `string` **|** `null` | ID of the policy set this rule belongs to (join key to the set). |  |
| 

`policyType` \*

 | `string` **|** `null` | ACCESS\_POLICY / ISOLATION\_POLICY / INSPECTION\_POLICY / TIMEOUT\_POLICY / CLIENT\_FORWARDING\_POLICY / CREDENTIAL\_POLICY / CAPABILITIES\_POLICY / CLIENTLESS\_SESSION\_PROTECTION\_POLICY / REDIRECTION\_POLICY. |  |
| 

`priority` \*

 | `number` **|** `null` | Rule priority. |  |
| 

`reauthIdleTimeout` \*

 | `number` **|** `null` | Idle reauthentication interval, in seconds. |  |
| 

`reauthTimeout` \*

 | `number` **|** `null` | Session reauthentication interval, in seconds. |  |
| 

`ruleOrder` \*

 | `number` **|** `null` | Evaluation order; a permissive rule high in the order can shadow deny rules. |  |

---

## Release Notes

-   **2026-09-14** — Added ingestion of Zscaler Client Connector enrolled devices as queryable host entities.
-   **2026-06-15** — Added support for sourcing Zscaler application data from the Shadow IT report export, providing a more complete view of discovered and sanctioned applications.
-   **2026-04-15** — Added ZIdentity + OneAPI (OAuth2) as a second authentication method alongside legacy session-based auth.
-   **2026-01-12** — Added support for ingesting Zscaler Internet Access data including applications, application categories, destinations, policies, roles, sites, and users.

---

Source: /integrations/instance-management

# Instance management

Once configured, integration instances can be accessed from the **Integrations** tab in JupiterOne. From the Integrations tab, select the integration for which you would like to view an instance(s).

Within that integration's page, a table containing all existing instances of that integration are displayed. The table contains the following information for each instance:

-   The **Instance name**: name assigned to the instance.
-   The **\# of Entities**: the total number of entities, or assets, that are ingested by JupiterOne via the instance.
-   **Most recent job status**: the status of the integrations recent job status.
-   **Most recent job date**: displays the date for which the instance has most recently completed running.
-   The **Schedule**: shows the instance's polling interval frequency.

#### Calculate the number of instance entities

Within the **\# of Entities** column, you can quickly calculate the number of data entities that are tied to a particular instance by selecting **Calculate**.

To view those entities via J1QL query, select the "link out" icon to be redirected to a J1QL query and results page outlining your integration instance's entities (comprised of `entity._type`, and `count(entity)`).

### View instance summary and jobs

By clicking on an instance's name from within the table, you can view a more detailed set of instance-specific information.

#### Instance summary

The instance summary provides additional details of the instance itself and the data associated to it. In the Summary, you can find:

-   The instance **Id**: which is used to associate the instance with the data it ingests into JupiterOne
-   The instance **Account name**, **Description**, and **Polling interval** as defined during creation.
-   Specific **Scopes** if applicable to the integration.
-   Any **Tags** associated to the instance.

#### Instance jobs

Integration instance jobs are run according to the instance's determined polling interval. For example, if an instance has a weekly polling interval, the job will trigger on a weekly basis for which ever day and time have been configured (e.g., every Monday at 12:00AM).

To review instance jobs, navigate to the integration instance for which you would like to examine (**Integrations > Integration > Integration instance**), and select **Instance Jobs**.

You will find a table outlining all known jobs for that instance. The table displays the following information:

-   **Job ID**: The unique identifier for the job instance.
-   **Job Status**: Indicates the status of the job and highlights if there were any issues.
-   **Start Date** and **End Date**: The date and time the job began and completed
-   **Execution time**: The amount of time the job took to complete.

#### Instance job logs

Additionally, you can view a log of each instance job by clicking the instance **Job ID** from the Instance Jobs table.

> **INFO**
> 
> If there were any issues with the job, the log can provide additional context for where the issue may have occurred while the job was trying to run.

#### Instance job statues

The `status` and `errorsOccurred` properties indicate the result of the job.

##### job.status

| Status | Definition |
| --- | --- |
| IN\_PROGRESS | The job is currently ingesting and processing the data retrieved from the source. |
| CONFIGURATION\_FAILURE | The job was unable to begin ingestion due to invalid configuration or credentials. **Please update your integration configuration and/or credentials to resolve this issue.** |
| COMPLETED | The job completed ingestion and processing without any known errors. |
| COMPLETED\_WITH\_WARNINGS | The job completed ingestion and processing with missing data due to ingestion limits or missing provider permissions. |
| COMPLETED\_WITH\_ERRORS | The job completed ingestion and processing with unexpected errors. The successfully collected data will be available in JupiterOne. |
| FAILED | The job failed to ingest and/or process the data. No changes were made to the data within JupiterOne. |

#### job.errorsOccurred

During the execution of a job, if an error level job event is logged, the `errorsOccurred` boolean is set to true. A job with status `FAILED` or `COMPLETED_WITH_ERRORS` will always have `errorsOccurred` set to true.

### Run an integration instance

In addition to instances running regularly on a determined polling interval, you have the ability to manually initiate an integration instance for ad-hoc results.

> **NOTE**
> 
> This is a great way to test your integration configuration to ensure it is operating as it should immediately after creation.

You can run an integration instance at any time by navigating to that particular instance (**Integrations > Integration > Integration instance**), and selecting **Run integration**.

This will initiate an instance job to run, and you will be able to review the instance job and logs once the job has completed.

### Edit an instance

You can change your [instance settings](/integrations/settings.md), while viewing an integration instance by clicking **Edit**. Doing so allows you to adjust any of the information used during the creation of the integration.

### Remove an instance

To remove an integration instance, simply navigate to that particular instance from within the Integrations tab: **Integrations > Integration name > Integration instance to be deleted**.

Select the **Instance Name** of the instance you wish to delete, and click **Delete**.

> **WARNING**
> 
> This will delete all existing data within JupiterOne that is tied to the integration instance.

---

Source: /integrations/jupiterone-mcp-server

# JupiterOne AI Integration (MCP Server)

The JupiterOne Model Context Protocol (MCP) Server enables AI assistants like Claude (on claude.ai and Claude Desktop), Claude Code, Cursor, and Amazon Kiro to interact directly with your JupiterOne account using natural language.

## Prerequisites

-   Active JupiterOne account with API access
-   JupiterOne API key and account ID
-   Node.js version 20 or higher (for local server only)
-   AI assistant with MCP support (Claude on claude.ai, Claude Desktop, Claude Code, Cursor IDE, ChatGPT, GitHub Copilot, Continue.dev, Cline, Devin Desktop (formerly Windsurf), Amazon Kiro, etc.)

## Installation Methods

### Install from the Claude connector directory (easiest)

JupiterOne is published in the Claude connector directory. If you use Claude, this is the fastest path — there is no JSON to edit and no URL to construct.

1.  Open **[claude.ai/directory/jupiterone](https://claude.ai/directory/jupiterone)**.
2.  Click **Connect** and choose your JupiterOne region.
3.  Sign in to JupiterOne, then approve the consent screen — it lists what the connector will be allowed to do before anything is granted.

The directory connector uses JupiterOne's hosted remote server, so it requires no local installation and stays on the current release automatically.

> **TIP**
> 
> The directory connector is not tied to one account. If your sign-in can reach more than one, ask Claude to _"list my JupiterOne accounts"_ — every tool acts on one account per call, and `list-accounts` returns each account you can use along with its `accountId`.

### Have an AI set this up for you

If you'd rather not edit JSON by hand, copy the prompt below and paste it into your AI assistant. It will ask for the credentials it needs and walk you through the install.

Preview the prompt

> Help me install the JupiterOne MCP server in this client. The setup docs are at [https://docs.jupiterone.io/integrations/jupiterone-mcp-server](https://docs.jupiterone.io/integrations/jupiterone-mcp-server).
> 
> 1.  Ask whether I want the remote (OAuth, recommended) or local (API key) deployment.
> 2.  If local, ask me for my JupiterOne API key and account ID. My account ID can be found at [https://docs.jupiterone.io/features/admin/admin-settings#account-management](https://docs.jupiterone.io/features/admin/admin-settings#account-management) — this is the account ID, not the vanity domain.
> 3.  Show me the JSON to add to your MCP config file. If a config already exists, preserve existing servers and merge mine in.
> 4.  Tell me how to restart and verify the server is connected.

### Manual setup

The JupiterOne MCP Server can be configured in two ways:

#### Option 1: Remote HTTP Server (Recommended)

Use JupiterOne's hosted MCP server without local installation:

-   **URL Format**: `https://your-account-id-here.mcp.<REGION>.jupiterone.io/mcp`
-   **Example**: `https://j1dev.mcp.us.jupiterone.io/mcp`
-   **Authentication**: OAuth-based authentication with JupiterOne login

Replace `<REGION>` with `us` or `eu` based on your JupiterOne instance. The examples in this guide use `us`.

> **INFO**
> 
> The remote HTTP server option:
> 
> -   Requires no local installation
> -   Handles authentication through JupiterOne's OAuth flow
> -   Automatically stays up-to-date with the latest features
> -   Works across different machines without setup

#### Option 2: Local Server (stdio)

Install and run the MCP server locally using npx:

```bash
npx @jupiterone/jupiterone-mcp
```

Or install globally for repeated use:

```bash
npm install -g @jupiterone/jupiterone-mcp
```

## Configuration

### Get Your Credentials

#### For Remote Server (Option 1)

-   **Account ID**: Found in [Account Management](/features/admin/admin-settings.md#account-management)
-   **Region**: Your JupiterOne instance region (e.g., `us`, `eu`)

#### For Local Server (Option 2)

1.  **API Key**: Navigate to **Settings** → **User API Tokens** in JupiterOne and create a new API key
2.  **Account ID**: Found in [Account Management](/features/admin/admin-settings.md#account-management) or by running: `find jupiterone_account as x return x.accountId`

> **INFO**
> 
> -   **Local Server**: Uses API key authentication and runs within the context of the user, respecting RBAC configuration
> -   **Remote Server**: Uses OAuth authentication through JupiterOne login, automatically applying your user permissions
> -   **Remote Server with an API token**: For unattended agents and scheduled workflows that cannot complete a sign-in. See [API tokens for agentic workflows](/integrations/mcp-service-accounts.md).

### AI Platform Setup

**Configuration file location:**

-   **macOS**: `~/Library/Application Support/Claude/claude_desktop_config.json`
-   **Windows**: `%APPDATA%\Claude\claude_desktop_config.json`

##### Local server

Edit the configuration file above and add:

**Local Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      }
    }
  }
}
```

Restart Claude Desktop.

##### Remote server

In the Claude Desktop App:

1.  Navigate to **Settings** → **Connectors**.
2.  Click **Add custom connector** at the bottom of the section.
3.  Set the title to `JupiterOne` and the URL to `https://your-account-id-here.mcp.us.jupiterone.io/mcp`.
4.  Click **Add** and complete the OAuth sign-in.

Claude Code supports MCP via CLI command or config file.

##### Option A — CLI (recommended)

For the local server:

```bash
claude mcp add jupiterone -- npx -y @jupiterone/jupiterone-mcp \
  --env JUPITERONE_API_KEY=your-api-key-here \
  --env JUPITERONE_ACCOUNT_ID=your-account-id-here
```

For the remote server:

```bash
claude mcp add --transport http jupiterone https://your-account-id-here.mcp.us.jupiterone.io/mcp
```

##### Option B — Config file

Edit `~/.claude.json` (user-level) or create `.mcp.json` in your project root (project-level, can be checked into source control):

**Local Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      }
    }
  }
}
```

**Remote Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "url": "https://your-account-id-here.mcp.us.jupiterone.io/mcp"
    }
  }
}
```

Replace `us` with `eu` if your JupiterOne instance is in the EU region.

Run `/mcp` inside Claude Code to verify the server is connected.

1.  Open Cursor Settings (⌘+, on Mac, Ctrl+, on Windows).
2.  Navigate to **Features** → **Model Context Protocol**.
3.  Add configuration based on your chosen method:

**Local Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      }
    }
  }
}
```

**Remote Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "url": "https://your-account-id-here.mcp.us.jupiterone.io/mcp"
    }
  }
}
```

Replace `us` with `eu` if your JupiterOne instance is in the EU region.

4.  Restart Cursor.

> **INFO**
> 
> If you've previously connected to JupiterOne or need to switch accounts:
> 
> 1.  In Cursor Settings, navigate to **Features** → **Model Context Protocol**.
> 2.  Expand the **Tools enabled** section for the JupiterOne MCP server.
> 3.  Click the **Logout** button at the top.
> 4.  Restart Cursor to reauthenticate with your JupiterOne account.

> **INFO**
> 
> GitHub Copilot MCP support is generally available in Visual Studio Code, JetBrains, Eclipse, and Xcode. The **MCP servers in Copilot** policy is disabled by default and must be enabled by an organization or enterprise administrator before Copilot can connect to JupiterOne.

1.  Create `.vscode/mcp.json` in your project root.
2.  Add configuration based on your chosen method.

**Local Server Configuration:**

```json
{
  "servers": {
    "jupiterone": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      }
    }
  }
}
```

**Remote Server Configuration:**

```json
{
  "servers": {
    "jupiterone": {
      "type": "http",
      "url": "https://your-account-id-here.mcp.us.jupiterone.io/mcp"
    }
  }
}
```

3.  Click **Start** in the gutter of `.vscode/mcp.json` to launch the server.
4.  Open Copilot Chat, select **Agent** mode, and click the tools icon to confirm JupiterOne tools are listed.

For details, see the [GitHub Copilot MCP documentation](https://docs.github.com/en/copilot/customizing-copilot/extending-copilot-chat-with-mcp).

1.  Open Continue.dev settings.
2.  Navigate to MCP configuration.
3.  Add configuration based on your chosen method:

**Local Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      }
    }
  }
}
```

**Remote Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "url": "https://your-account-id-here.mcp.us.jupiterone.io/mcp"
    }
  }
}
```

Replace `us` with `eu` if your JupiterOne instance is in the EU region.

1.  Install the Cline extension from the VS Code marketplace.
2.  Open VS Code settings (⌘+, on Mac, Ctrl+, on Windows).
3.  Search for "Cline MCP".
4.  Add configuration based on your chosen method:

**Local Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      }
    }
  }
}
```

**Remote Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "url": "https://your-account-id-here.mcp.us.jupiterone.io/mcp"
    }
  }
}
```

Replace `us` with `eu` if your JupiterOne instance is in the EU region.

> **INFO**
> 
> Windsurf was rebranded as Devin Desktop by Cognition in June 2026. Existing installs received the change as an over-the-air update, and the configuration file path still uses the original `windsurf` directory name.

1.  Open **Devin Settings** → **Cascade** → **MCP Servers**, or click the **MCPs** icon in the top-right menu of the Cascade panel.
2.  Open the raw configuration file, `~/.codeium/windsurf/mcp_config.json`.
3.  Add configuration based on your chosen method:

**Local Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      }
    }
  }
}
```

**Remote Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "url": "https://your-account-id-here.mcp.us.jupiterone.io/mcp"
    }
  }
}
```

Replace `us` with `eu` if your JupiterOne instance is in the EU region.

4.  Restart Devin Desktop.

1.  Locate or create your Kiro MCP configuration file:
    
    -   **Workspace (project-specific)**: `.kiro/settings/mcp.json` in your project root
    -   **User (global)**: `~/.kiro/settings/mcp.json`
    
    Workspace settings override user settings when both define the same server.
    
2.  Add configuration based on your chosen method.
    

**Local Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}
```

**Remote Server Configuration:**

```json
{
  "mcpServers": {
    "jupiterone": {
      "url": "https://your-account-id-here.mcp.us.jupiterone.io/mcp",
      "disabled": false,
      "autoApprove": []
    }
  }
}
```

3.  Save the file. Kiro applies `autoApprove` and `disabledTools` changes immediately, but you must restart Kiro to register a newly added server.
    
4.  Verify the connection by opening Kiro's Output panel and selecting **Kiro - MCP Logs**.
    

> **INFO**
> 
> Kiro supports stdio and HTTP transports natively but does not currently support SSE.

### Verify Installation

Once configured, test the connection by asking your AI assistant:

> "List my JupiterOne integrations"

A successful response confirms the MCP server is connected and authenticated. If you receive an error or no response, see [Troubleshooting](#troubleshooting).

## What You Can Do

The MCP server provides 38 tools spanning query execution, threat intelligence, compliance status and attestations, alert monitoring, rules management, dashboard management, integration monitoring, and account discovery. Ask your AI assistant questions in natural language — it selects the right tool and, when a query is needed, writes the [J1QL](/j1ql.md) for you.

### Prompt Templates by Use Case

Copy any prompt below and paste it into your AI assistant. Where a prompt produces a J1QL query, the query is shown so you can learn the syntax or adapt it.

| Prompt | J1QL the AI generates |
| --- | --- |
| "How many cloud instances do I have, broken down by provider?" | `Find Host with _integrationType != undefined as h return h._integrationType as Provider, count(h) as Total` |
| "List all data stores that are not encrypted" | `Find DataStore with encrypted != true` |
| "Show me all resources without a data classification tag" | `Find (Host|DataStore) with classification = undefined` |
| "Which S3 buckets are publicly accessible?" | `Find aws_s3_bucket with classification = 'Public' OR bucketPolicy.public = true` |
| "Find all hosts that have not been scanned in the last 30 days" | `Find Host that !has Assessment with _createdOn > date.now-30days` |

| Prompt | J1QL the AI generates |
| --- | --- |
| "Who has admin access across all providers?" | `Find AccessRole with admin = true as role that assigned User as user return user.displayName, role.displayName, role._integrationType` |
| "Find users with MFA disabled" | `Find User with mfaEnabled != true` |
| "Which service accounts have not been rotated in 90 days?" | `Find AccessKey with createdOn < date.now-90days as key return key.displayName, key._integrationType, key.createdOn` |
| "List new hires from the last 12 months" | `Find employee with _createdOn > date.now-12months` |
| "Find all users who can assume a role in a production account" | `Find User that assigned AccessRole that assigned Account with tag.Production = true` |

| Prompt | J1QL the AI generates |
| --- | --- |
| "Show me all critical vulnerabilities from the last 7 days" | `Find Finding with severity = 'critical' and _createdOn > date.now-7days as f return f.displayName, f.severity, f.numericSeverity` |
| "Which applications have open vulnerabilities?" | `Find Application as app that has Vulnerability as vuln return app.displayName, vuln.displayName, vuln.severity` |
| "Are there any hosts with both public exposure and critical vulnerabilities?" | `Find Host with publicIpAddress != undefined that has Finding with severity = 'critical'` |
| "Find vulnerabilities that have been open for more than 30 days" | `Find Vulnerability with _createdOn < date.now-30days and open = true` |
| "Count open findings by severity" | `Find Finding with open = true as f return f.severity as Severity, count(f) as total` |

| Prompt | J1QL the AI generates |
| --- | --- |
| "What's the threat brief for CVE-2021-44228?" | Uses `get-threat` tool directly |
| "What CVEs are trending right now?" | Uses `get-threat-trending` tool directly |
| "Am I exposed to Log4Shell?" | Uses `check-threat-exposure` tool directly |
| "Check my exposure to everything trending this week" | Uses `get-threat-trending` then `check-threat-exposure` with the returned CVE IDs |
| "Which of my devices carry CVE-2021-44228?" | `check-threat-exposure` returns a `unifiedVulnerabilityId`, then `Find * with _id = '<unifiedVulnerabilityId>' that relates to Finding as f that relates to (Host|Device|Domain) as a return a.displayName, a._type, f._type, f._beginOn order by f._beginOn desc limit 50` |

| Prompt | J1QL the AI generates |
| --- | --- |
| "How is our SOC 2 posture, section by section?" | Uses `get-compliance-summary` to find the framework, then calls it again with that `frameworkId` |
| "Which controls are failing for the Platform team's org unit?" | Uses `list-controls` tool with the `status` filter set to `FAIL` and `orgUnit` set to the org unit's name |
| "Why is control 3.14 failing, and which assets are affected?" | Uses `get-control` with `identifier`, then `get-rule-evaluation-query-results` with the failing test's `rawDataKey` |
| "Attest control 3.14 with our Log Management Policy, expiring 2027-06-30" | Uses `get-control` to resolve the control, then `create-attestation` |
| "Renew the attestations expiring this month for another year" | Uses `get-compliance-summary` to find expiring attestations, then `update-attestation` with a later `expiresOn` |

| Prompt | J1QL the AI generates |
| --- | --- |
| "Get all active alerts" | Uses `get-active-alerts` tool directly |
| "List all my alert rules" | Uses `list-rules` tool directly |
| "Create a rule that fires when a new critical vulnerability is found" | Uses `create-inline-question-rule` tool with a Finding query |
| "Show my dashboards" | Uses `get-dashboards` tool directly |
| "Create a dashboard tracking my biggest security risks" | Uses `create-dashboard` + `create-dashboard-widget` tools |

| Prompt | J1QL the AI generates |
| --- | --- |
| "List my JupiterOne integrations" | Uses `get-integration-instances` tool directly |
| "Which integrations failed their last run?" | Uses `get-integration-jobs` tool with `status` filter |
| "Show me the event log for the latest AWS integration job" | Uses `get-integration-jobs` then `get-integration-events` tools |
| "What integration types are available?" | Uses `get-integration-definitions` tool directly |
| "Is my CrowdStrike integration healthy?" | Uses `get-integration-instances` then `get-integration-jobs` tools |

For the full J1QL language reference, including traversals, aggregations, and filtering, see the [J1QL documentation](/j1ql.md).

### Available Tools

The MCP server exposes the following tools. Your AI assistant selects the right tool automatically based on your question.

Query Execution

| Tool | Description |
| --- | --- |
| `execute-j1ql-query` | Execute any [J1QL query](/j1ql.md). Supports variables, cursor-based pagination, deleted entity inclusion, scope filters, and query flags. |
| `get-query-results` | Retrieve results of a long-running query. Use when `execute-j1ql-query` returns `status: "IN_PROGRESS"` with a `resultsUrl`. |

Threat Intelligence

These tools require the **Vulnerability Management** entitlement on your account plus vulnerability read permission. Without them the tools return an access-denied message naming the entitlement.

| Tool | Description |
| --- | --- |
| `get-threat` | Threat brief for a single CVE — severity, exploitation status, KEV listing, remediation window, and the affected vendor and product. Returns a compact decision-first summary by default; `detail: true` returns the full brief including CPE footprint, threat-actor techniques, and detection tooling. |
| `get-threat-trending` | The ranked list of currently trending CVEs — newly exploited in the wild, weaponized, added to a KEV catalog, or a public proof-of-concept appeared. Cached with roughly a 30-minute TTL. |
| `check-threat-exposure` | Whether your own graph is exposed to given CVEs, 1–25 per call. Returns the scanner-confirmed device count, a handle for drilling into the affected assets, and whether any matched device is internet-facing. |

**Reading an exposure result.** A count of `0` means no scanner reported the CVE — render it as "none found", not "not affected", and note that a CVE that does not exist and a real CVE with no findings both return `0`. A status of `unavailable` is a retry state, not a zero count. An `assetExposure` of `null` means unknown, not "not internet-facing". A count is only as fresh as the scanner behind it, so drill into the affected assets before acting on one.

Compliance (CCM)

These tools require the **Continuous Control Monitoring** entitlement on your account plus control read permission. Creating, editing, or revoking an attestation also needs edit permission on the control, and listing attestations across the whole account needs CCM read-admin. Without them the tools return an access-denied message that leads with the reason JupiterOne gave, such as the missing entitlement.

| Tool | Description |
| --- | --- |
| `get-compliance-summary` | Scorecard of every CCM framework — control and requirement counts, passing and failing controls, attested controls (every control with a valid attestation, passing or failing), and a health percentage. Pass a `frameworkId` or a `frameworkName` to score that framework alone and add per-section stats, its failing controls, and the failing requirements with their failing controls. Also lists active attestations expiring within `attestationsExpiringWithinDays` (default 30), and the expired attestations nobody revoked, which fail their controls now. |
| `list-controls` | The controls status view with its filters: `search`, `status`, `states`, `effectiveness`, `hasValidAttestation`, `owner`, `catalogs`, `mitreTechniques`, `frameworkId`, `source`, and `orgUnit` (an org unit's display name, or its id as `<namespace>:<uuid>`). Returns compact rows — status, state, effectiveness, attested, owner, test counts, and framework names — with sorting and cursor paging (`limit` default 50, max 250). |
| `get-control` | One control by `controlId`, `identifier`, or `controlName`: its frameworks and requirements, its control tests with each test's latest evaluation, its attestations, a `statusExplanation` that says why it passes or fails, and `blockers`, every cause that fails it. An identifier or name that matches several controls returns the one live control when there is exactly one, and otherwise up to 25 candidates, each with its frameworks, instead of a guess. A test's `rawDataKey` feeds `get-rule-evaluation-query-results` to list the affected assets. |
| `create-attestation` | Record an attestation on a live control, with a `subject`, an `expiresOn` in the future (`YYYY-MM-DD` for the end of that day in UTC, a date-time with a time zone, or epoch milliseconds), and an optional markdown `description`, `owner` email, and `documentLink`. Refuses controls that are not live. If an active attestation with the same subject already exists, returns it instead of creating a duplicate. Reports a `statusImpact`: whether the control now passes on the attestation, already passed on a test, or stays failing because a failing test or an expired attestation blocks it. |
| `update-attestation` | Edit an attestation's subject, description, expiry, owner, or document link. Extending `expiresOn` renews an attestation, before or after it lapses. Reports the same `statusImpact` as `create-attestation`. |
| `revoke-attestation` | Revoke an attestation. Permanent: the control reverts to whatever its tests and any remaining valid attestations say, and the result reports that `statusImpact`. Repeating a revoke is harmless. To extend an attestation instead, use `update-attestation`. |

**Reading a compliance result.** Every framework and control in a result carries a `url` to its page in the JupiterOne app, and your assistant gives that link when it names one. A status of `unavailable` on an attestation list means it could not be read, because of your permissions or, in `get-control`, the time budget — not that there are none. A summary's `warnings` are sentences to pass on with the answer, each naming what the response could not confirm. A `null` count on a scorecard means it was not read, never zero. When CCM has not yet re-scored a control, `get-control` sets `storedStatusStale` and gives the `expectedStatus`. A pass flagged `passingWithoutData` rests on tests whose queries saw no data: CCM counts it as passing, but it is not evidence the control is met. A health percentage covers evaluated requirements only, so compare passing plus failing requirements with the total before calling a framework healthy. CCM's reads trail a write by a few seconds, occasionally up to a minute, so a control may not show a new attestation straight after `create-attestation` succeeds. Re-read after a pause instead of creating it again. An attestation write that went through is never reported as an error. An `interrupted` error means the write may have landed, so check before repeating it.

Alert Monitoring

| Tool | Description |
| --- | --- |
| `get-active-alerts` | List currently active alerts, with optional limit (1–1000). |

Rules Management

| Tool | Description |
| --- | --- |
| `list-rules` | List all rules in the account, with optional limit. |
| `get-rule-details` | Get full details of a specific rule by ID. |
| `create-inline-question-rule` | Create a new inline question-based rule with queries, operations, and actions. Refuses names that start `CONTROL-TEST:`, which CCM reserves for its control tests. |
| `update-inline-question-rule` | Update an existing inline question rule. Refuses rules that CCM runs for its control tests. |
| `delete-rule` | Delete an alert rule. Irreversible, and it does not dismiss alerts the rule already raised. Refuses rules that CCM runs for its control tests. |
| `evaluate-rule` | Trigger on-demand evaluation of a specific rule. |
| `list-rule-evaluations` | Get historical evaluation data for a rule, with optional time range filtering and an optional `limit` on the number of runs. |
| `get-rule-evaluation-details` | Get detailed evaluation results including query output, condition results, and action results. |
| `get-raw-data-download-url` | Get a download URL for raw evaluation data. |
| `get-rule-evaluation-query-results` | Get the actual query results from a rule evaluation, with an optional `limit` of up to 250 rows. A cut result carries `truncated: true` and `total`. For a CCM control test's evidence, use the `rawDataKey` that `get-control` returns. |

Dashboard Management

| Tool | Description |
| --- | --- |
| `get-dashboards` | List all dashboards in your account. |
| `create-dashboard` | Create a new dashboard. |
| `get-dashboard-details` | Get full dashboard information including widgets and layouts. |
| `update-dashboard` | Update an existing dashboard's layout. |
| `create-dashboard-widget` | Add a widget to a dashboard. |
| `update-dashboard-widget` | Update an existing widget's query, title, or chart type. |
| `delete-dashboard` | Delete an entire dashboard and all its widgets. |
| `delete-dashboard-widget` | Delete a single widget from a dashboard. |

Integration Management

| Tool | Description |
| --- | --- |
| `get-integration-definitions` | List available integration types, optionally including configuration fields. |
| `get-integration-instances` | List configured integration instances, optionally filtered by definition. |
| `get-integration-jobs` | List integration jobs filtered by status, instance, or definition. |
| `get-integration-job` | Get details for a specific integration job. |
| `get-integration-events` | Get events for a specific integration job, with pagination. |

Account Management

| Tool | Description |
| --- | --- |
| `test-connection` | Test connectivity and return account information and permissions. |
| `list-accounts` | List JupiterOne accounts the authenticated user can access, each with its `accountId`, display name, and `mcpUrl` — the connector URL that pins that account. Use it to find the right account when a connector points at one you cannot reach. |
| `list-entity-types` | Discover all entity classes and types available in your account. |

## Known Limitations

> **WARNING**
> 
> -   **Deletes cover rules and dashboards only**: `delete-rule`, `delete-dashboard`, and `delete-dashboard-widget` are the only delete operations, and `revoke-attestation` is the only other irreversible one. Integrations, entities, and other resources cannot be deleted through the MCP server. Write and delete tools are annotated (`readOnlyHint`/`destructiveHint`) so MCP clients can prompt for approval before running them.
> -   **Deleting a rule does not dismiss its alerts**: alerts the rule already raised stay active after the rule is gone, and the rule's configuration cannot be recovered. To stop a rule firing while keeping its configuration and evaluation history, ask for its polling interval to be set to `DISABLED` instead of deleting it.
> -   **Control-test rules belong to CCM**: CCM runs each control test as an internal rule named `CONTROL-TEST:<test name>`. `list-rules` never lists these rules, and `get-rule-details` reports one as internal, to be read through `get-control` on its control. `create-inline-question-rule` and `update-inline-question-rule` refuse a name with that prefix. `update-inline-question-rule` and `delete-rule` also refuse any rule that a control test references, including a change to its polling interval, because editing or deleting one breaks the control test. Change the test on its control instead.

> **WARNING**
> 
> The MCP server consumes your JupiterOne API rate limit quota. Each operation counts against your [API rate limits](/api/rate-limiting.md). Monitor your usage to avoid hitting limits during critical operations.

## Troubleshooting

### URL uses your vanity domain instead of your account ID

The remote server URL must use your **account ID**, not your vanity domain (the custom subdomain like `acme.app.us.jupiterone.io`). If you see authentication or "account not found" errors with the remote server, double-check the URL.

Find your account ID in [Account Management](/features/admin/admin-settings.md#account-management) — it is listed separately from the Vanity URL.

### Server does not appear in your client

1.  Confirm your JSON config is valid (a single trailing comma will cause silent failure).
2.  Restart your AI client. Most clients only load MCP config on startup.
3.  Check the client's MCP log:
    -   **Claude Desktop**: `~/Library/Logs/Claude/mcp*.log` (macOS) or `%APPDATA%\Claude\logs\mcp*.log` (Windows)
    -   **Cursor**: Output panel → "Cursor MCP"
    -   **VS Code (Copilot/Cline)**: Output panel → relevant extension
    -   **Kiro**: Output panel → "Kiro - MCP Logs"
    -   **Claude Code**: run `/mcp` inside the session

### `npx` or `command not found` errors

The local server requires Node.js 20+ on your `PATH`. Run `node --version` in the same shell your client uses. On macOS, GUI apps may not inherit your shell's `PATH`; use an absolute path to `npx` (find it with `which npx`) in the config.

### OAuth flow fails for the remote server

Sign out of your JupiterOne account in your browser, then retry the OAuth handshake.

### A query comes back as `status: "IN_PROGRESS"`

This is not an error. Heavy graph traversals can outlive a single tool call, so the query keeps running on the server and the response carries a `resultsUrl` handle. Your assistant should call `get-query-results` with that handle to collect the results — it does not need to run the query again.

-   Queries that succeed almost always finish within about **4 minutes**.
-   Past roughly **13 minutes** a query will not complete. Narrow it — indexed `WITH` filters, a smaller `LIMIT`, fewer traversals — and run it again.
-   The handle expires about **an hour** after the query started. Re-running an identical query within about 5 minutes re-attaches to the same execution instead of starting over.

If your assistant keeps re-issuing `execute-j1ql-query` instead of using the handle, it restarts the query from scratch each time. Tell it to call `get-query-results` with the `resultsUrl` it was given.

### A valid query is rejected as a syntax error (local server)

The local server checks J1QL against a copy of the platform's query grammar that is bundled when the package is published, so syntax mistakes come back instantly instead of costing a round-trip. A significantly out-of-date install can therefore reject syntax that a newer query service would accept.

Update the package first: `npx` picks up the newest version on each run, and a global install updates with `npm install -g @jupiterone/jupiterone-mcp`. If you need to bypass the local check in the meantime, set `JUPITERONE_SKIP_QUERY_VALIDATION` to `1` in your MCP client config — the backend still validates every query.

```json
{
  "mcpServers": {
    "jupiterone": {
      "command": "npx",
      "args": ["-y", "@jupiterone/jupiterone-mcp"],
      "env": {
        "JUPITERONE_API_KEY": "your-api-key-here",
        "JUPITERONE_ACCOUNT_ID": "your-account-id-here",
        "JUPITERONE_SKIP_QUERY_VALIDATION": "1"
      }
    }
  }
}
```

This applies to the local server only. The remote server always runs the current release, so its grammar cannot fall behind.

### Hitting API rate limits

Each MCP query consumes JupiterOne API quota. See [API rate limiting](/api/rate-limiting.md) for limits and recommendations.

## FAQ

### Data Residency & Processing

The JupiterOne MCP Server is available in two deployment modes. The **local server** runs on your machine and uses your API key to fetch data on demand from JupiterOne's cloud — data never passes through any centralized JupiterOne MCP host. The **remote HTTP server** is hosted by JupiterOne in the same region as your account and authenticates via OAuth; data residency follows the same regional principles as standard JupiterOne API access. In both modes, retrieved data is forwarded to your AI assistant's LLM provider (e.g., Anthropic, OpenAI) per your client's configuration.

### LLM Compatibility & Data Handling

The MCP Server integrates with any AI assistant that supports the Model Context Protocol (MCP), including Claude on claude.ai, Claude Desktop, Claude Code, Cursor IDE, ChatGPT, GitHub Copilot, Continue.dev, Cline, Devin Desktop (formerly Windsurf), and Amazon Kiro. Once the server is running and configured, your assistant can use natural language to request security data, which is fetched from JupiterOne and passed to the LLM for interpretation. This means data such as asset inventories, vulnerability reports, or alert summaries can be included in AI prompts, depending on what you query. It's important to treat this as a form of third-party data sharing—ensure your selected assistant has appropriate enterprise security practices in place.

### Connecting from your own code (Python and other languages)

The remote server speaks standard MCP over HTTP, so any MCP client library connects to it — including the official Python and TypeScript SDKs. There is no separate JupiterOne Python client; you use whichever MCP library your language already provides. Point it at `https://<accountId>.mcp.<region>.jupiterone.io/mcp` and send the header `Authorization: Bearer <token>`. See [API tokens for agentic workflows](/integrations/mcp-service-accounts.md) for creating the token and building the URL. Node.js is required only to run the local server — it is not needed to connect from your own code. Note that the [Python client](/api/python-client.md) is the JupiterOne REST API SDK, not an MCP client; it does not connect to the MCP Server.

### Privacy, Logging & Data Sharing

Your API key (local server) or OAuth session (remote server) governs all access, and data is only transmitted in response to your assistant's specific queries. JupiterOne does not store the results of your queries, your query parameters, or action payloads.

For operational monitoring, the remote server records sanitized, non-sensitive usage telemetry — such as which tool ran and whether it succeeded — with query content redacted. The local server keeps this telemetry on your own machine and sends nothing to JupiterOne.

Separately, your AI assistant may log conversations or prompts on its own platform, just as it would during typical usage. To manage exposure, review your LLM provider's data retention and privacy terms, and consider using enterprise or self-hosted models for sensitive environments.

For JupiterOne's formal data-handling commitments — including data collection, retention, storage, and third-party processors — see the [Privacy Policy](https://www.jupiterone.com/privacy-policy), [Data Processing Addendum](https://www.jupiterone.com/legal-and-security/data-processing-addendum), and [Subprocessors](https://www.jupiterone.com/legal-and-security/subprocessors) in the [Legal & Security Hub](https://www.jupiterone.com/legal-and-security-hub). For privacy questions, contact [privacy@jupiterone.com](mailto:privacy@jupiterone.com).

### Access Control & Security Enforcement

Data access through the MCP Server is governed entirely by the credentials you provide. The local server inherits all access controls from the user role attached to the API key; the remote server inherits them from the OAuth-authenticated user, or from the API token when you [connect with one](/integrations/mcp-service-accounts.md). AI assistants can only retrieve what your account has permission to access. You can further restrict access by scoping the API key, adjusting user roles, or disabling individual MCP tools. You retain full control over when the server runs and what it can access — turning off the server or removing its configuration from your assistant completely disables AI access.

### Rate Limits & Quotas

Every request made through the MCP Server counts against your JupiterOne API rate limit. This includes queries for asset data, alerts, dashboards, or integrations. Frequent use through an AI assistant could impact your rate quota if not monitored. We recommend reviewing your API usage regularly—especially when enabling assistants for broad or high-frequency queries—to avoid service slowdowns.

### Deployment, Support & Customer Control

The JupiterOne MCP Server can be deployed either locally on your machine or accessed through JupiterOne's hosted remote server. The local server runs entirely in your environment with no persistent connections; the remote server connects securely through OAuth authentication and is hosted in the same region as your account. You can disable either at any time by stopping the local process or removing your AI assistant's MCP configuration. For assistance or onboarding, reach out to your CSM or email [support@jupiterone.com](mailto:support@jupiterone.com).

## Release notes

-   [What's new in MCP 2.5](/integrations/mcp-2-5.md) — six Continuous Control Monitoring (CCM) tools for compliance status and attestations, a guard on the rules CCM runs for its control tests, and access-denied messages that lead with the reason
-   [What's new in MCP 2.0](/integrations/mcp-2-0.md) — the 2026-07-28 protocol revision, a cacheable tool list, accurate query result schemas, and the Node.js 20 requirement for the local server
-   [What's new in MCP 1.0](/integrations/mcp-1-0.md) — the first generally available release: 24 tools, hardened OAuth on the remote server, structured output, and the 1.x point releases that took it to 28 tools

## Support

For technical support or questions, email [support@jupiterone.com](mailto:support@jupiterone.com). Existing customers can also reach their Customer Success Manager or use their standard JupiterOne support channels.

---

Source: /integrations/mcp-1-0

# MCP 1.0 Release Notes

**Release date: June 2026**

MCP 1.0 is the first generally available release of the JupiterOne MCP Server. It turns JupiterOne into something your AI assistant can operate directly: ask a question in plain language and the assistant picks the right tool, writes the [J1QL](/j1ql.md) when a query is needed, and works with your graph, alerts, rules, dashboards, and integrations on your behalf.

The 0.x previews proved the idea. 1.0 is the release that makes it safe to hand to a security team — every tool declares what it does and what it returns, failures explain themselves instead of surfacing raw API errors, and the hosted remote server runs a fully hardened OAuth 2.1 flow with a consent screen you see before anything is granted.

## What is new in MCP 1.0

| Feature | What it means for you |
| --- | --- |
| **24 tools across six domains** | Query execution, alert monitoring, rules management, dashboard management, integration monitoring, and account discovery — all reachable in natural language |
| **Hardened OAuth for the remote server** | Per-client registration, enforced PKCE, exact-match redirect validation, and a JupiterOne-branded consent screen that tells you what a connector is asking for before you approve it |
| **Multi-account access** | `list-accounts` shows every JupiterOne account your sign-in can reach, with the connector URL for each one |
| **Structured output** | Every tool publishes a schema for what it returns, so assistants read results reliably instead of re-parsing prose |
| **Tool annotations** | Read, write, and destructive tools are labelled, so your MCP client can ask for approval before anything changes |
| **Honest failure messages** | Permission and authentication problems come back as "access denied, here is what to do" rather than an opaque error, with credentials and internal detail stripped out |
| **Working deep links** | Results link back to the right place in the JupiterOne app, so you can open a rule, query, or dashboard the assistant just referenced |
| **Listed in the Claude connector directory** | One-click install from [claude.ai/directory/jupiterone](https://claude.ai/directory/jupiterone), plus the protocol-level self-description — name, icon, readable tool titles — that the listing required |

## 24 tools across six domains

MCP 1.0 ships 24 tools. Your assistant chooses among them automatically — you ask a question, it decides whether that means running a query, listing rules, or checking an integration job.

| Domain | Tools |
| --- | --- |
| Query execution | `execute-j1ql-query` |
| Alert monitoring | `get-active-alerts` |
| Rules management | `list-rules`, `get-rule-details`, `create-inline-question-rule`, `update-inline-question-rule`, `evaluate-rule`, `list-rule-evaluations`, `get-rule-evaluation-details`, `get-rule-evaluation-query-results`, `get-raw-data-download-url` |
| Dashboard management | `get-dashboards`, `get-dashboard-details`, `create-dashboard`, `create-dashboard-widget`, `update-dashboard` |
| Integration monitoring | `get-integration-definitions`, `get-integration-instances`, `get-integration-jobs`, `get-integration-job`, `get-integration-events` |
| Account | `test-connection`, `list-accounts`, `list-entity-types` |

Query results support cursor-based pagination, and integration listings now return a reliable stop signal, so an assistant paging through a large result set knows when it has reached the end instead of looping.

> **NOTE**
> 
> The 1.x line grew this to 28 tools. See [The 1.x point releases](#the-1x-point-releases) below.

## Hardened OAuth for the remote server

The hosted remote server — the option most customers use, connected from claude.ai, Claude Desktop, Cursor, and other MCP clients — received a full authorization rework for 1.0.

-   **Per-client registration.** Each connector that registers gets its own client identity with its own persisted redirect URIs, rather than sharing one. Registrations expire after 90 days; an active connector re-registers transparently, so you never notice.
-   **Exact-match redirect validation.** A connector can only be sent back to a redirect URI it registered, matched exactly. Prefix and wildcard matches are rejected.
-   **PKCE enforced.** Proof Key for Code Exchange is required at both the authorization and token steps, so an intercepted authorization code is useless on its own.
-   **Authorization code flow only.** `/authorize` accepts nothing else.
-   **A consent screen you actually read.** Before you are handed to sign-in, a JupiterOne-branded interstitial names the connector requesting access, summarises the permissions it will receive, and links to the relevant policies. Nothing is granted until you approve it there.
-   **Sanitized errors.** OAuth failures return standards-compliant error codes without leaking secrets or internal detail, and secrets are never written to logs.

Your existing permissions still govern everything: the remote server acts as the signed-in user, and the local server acts as the owner of the API key you configure. MCP grants no access your account does not already have.

### Session expiry your client can act on

When a token expires, the remote server now returns a standards-compliant `401` with a `WWW-Authenticate` challenge that distinguishes **expired** (your client should refresh silently) from **invalid** (you need to re-authorize), and points at the protected-resource metadata document so the client knows where to go. In practice this means an expiring session refreshes in the background instead of leaving a connector that appears connected but answers nothing.

Requests are also bounded. A connector that disconnects mid-call, or a call that exceeds the server's deadline, is cleanly aborted rather than left hanging — so a stuck request returns an error your assistant can act on instead of stalling the conversation.

## Listed in the Claude connector directory

JupiterOne is published in the Claude connector directory at **[claude.ai/directory/jupiterone](https://claude.ai/directory/jupiterone)**. For Claude users this is the shortest path in: click **Connect**, choose your region, sign in — no JSON to edit and no URL to construct. The directory connector runs on the hosted remote server, so it stays on the current release automatically.

Getting listed was a real part of 1.0. Directory review checks how a server describes _itself_ over the protocol, not just that its tools work, so the release added:

-   **Server identity.** The server advertises the title `JupiterOne`, its website, and the JupiterOne mark as an icon. The icon travels over the protocol as a data URI rather than a hosted asset, so it resolves identically for the remote and local servers with nothing to fetch.
-   **Readable tool titles.** Every tool carries a human-readable title alongside its machine name, so clients can show _Execute J1QL Query_ rather than `execute-j1ql-query`.
-   **Fully typed parameters.** Every tool parameter declares a schema type — a directory requirement, and a correctness win for any assistant reasoning about what to pass.
-   **Behaviour annotations on every tool.** `readOnlyHint` and `destructiveHint` are required for listing, which is what lets a client tell a read from a write _before_ running it.

## Multi-account access

If your sign-in can reach more than one JupiterOne account, `list-accounts` returns all of them — resolved from your verified token, not guessed — along with the connector URL for each. When a tool call is rejected because it targeted an account you are not a member of, the error names the accounts you _can_ reach and gives you their URLs, so you can repoint the connector instead of retrying a sign-in that will never help.

## Structured output and tool annotations

Every tool declares an output schema and returns structured content alongside its human-readable text. Assistants read the structured form directly rather than re-parsing prose, which makes chained work — query, then build a widget from the result — far more reliable.

Tools are also annotated with their behaviour. Read-only tools are marked read-only; tools that create, change, or delete are marked accordingly. MCP clients use these hints to decide when to pause and ask you for approval, so a dashboard is never modified without your say-so.

## Honest failures

Two changes make failures useful rather than alarming:

-   **Access denied means access denied.** Upstream 401 and 403 responses are reframed as an access-denied result explaining which permission is missing and what to do about it. Previously these surfaced as raw errors that assistants tended to answer by looping on re-authentication. (1.1.0 extended this to the authorization failures JupiterOne's API delivers inside a 200 response, which had been slipping through as apparent success.)
-   **Errors are sanitized.** Error text never carries credentials, tokens, or internal request detail.

Recovery guidance stays inside the assistant's reach: narrow the query, aggregate, paginate, or re-check permissions. You are never told to go do it in the UI instead.

## Privacy and telemetry

The remote server records sanitized operational telemetry — which tool ran, whether it succeeded, how long it took — with query content redacted. Query results, query parameters, and action payloads are never stored. **The local server sends nothing to JupiterOne**; its telemetry stays on your own machine.

For the full data-handling position, see the [FAQ on the MCP Server overview page](/integrations/jupiterone-mcp-server.md#faq).

## The 1.x point releases

Six point releases followed 1.0 through July 2026, adding four tools and closing the gaps that showed up in real use.

| Version | Released | Highlights |
| --- | --- | --- |
| **1.0.1** | July 2026 | Dashboard tool hardening, tolerant query output schema with an explicit `hasMore` signal, corrected layout and pagination guidance |
| **1.1.0** | July 2026 | Dashboard CRUD completed — `update-dashboard-widget`, `delete-dashboard`, `delete-dashboard-widget` — plus automatic dashboard layout and access-denied framing for authorization failures returned as HTTP 200 |
| **1.1.1** | July 2026 | Rewritten J1QL error messages for the mistakes assistants actually make |
| **1.2.0** | July 2026 | Instant J1QL syntax validation using the platform's own parser |
| **1.3.0** | July 2026 | Resumable long-running queries via `get-query-results` |
| **1.4.0** | July 2026 | `test-connection` reports who you are and what you can do |

### Dashboard CRUD (1.1.0)

1.0 could create dashboards and widgets but not fully manage them. 1.1.0 closed the loop with `update-dashboard-widget`, `delete-dashboard`, and `delete-dashboard-widget`, taking the tool count to 27. `update-dashboard` also gained automatic layout: ask for a dashboard and the widgets are placed sensibly instead of stacking on top of each other.

Delete operations are annotated as destructive, so your client prompts before running them.

### Instant J1QL validation (1.2.0)

The MCP Server now bundles the same query-language parser the JupiterOne query service runs, and validates every query locally before sending it. A syntax error comes back immediately with the specific problem and a suggested fix — no round-trip, no waiting on a query that was never going to run. Because it is the platform's own grammar, what the server accepts locally matches what the backend accepts.

`LIMIT` is pre-checked against its real 1–250 range, with the corrected approach (page with the cursor, or use `count()` for totals) supplied in the error.

> **NOTE**
> 
> The bundled grammar is frozen when the package is published, so a much older local install could in principle reject syntax a newer query service accepts. Setting `JUPITERONE_SKIP_QUERY_VALIDATION=1` in your MCP client config bypasses the local check entirely; the backend still validates every query. Upgrading the package is the better fix.

Query timeout guidance was rewritten in the same release to preserve what you were actually asking for — suggesting indexed filters and tighter traversals rather than telling the assistant to ask a smaller question.

### Resumable long-running queries (1.3.0)

Heavy graph traversals can outlive a single tool call. Instead of failing, `execute-j1ql-query` now returns `status: "IN_PROGRESS"` with a `resultsUrl` handle, and the new `get-query-results` tool picks the query back up.

-   The query keeps running server-side, and its results stay retrievable for about an hour.
-   Each `get-query-results` call waits up to 40 seconds, and reports elapsed time so the assistant can judge whether to keep waiting.
-   Most queries that succeed finish within about four minutes; past roughly 13 minutes a query will not complete, and the guidance says so plainly rather than leaving the assistant to poll forever.

Your assistant does not have to sit and wait — it can do other work between checks. This brought the tool count to 28.

### Connection and permission visibility (1.4.0)

`test-connection` now answers three questions instead of one:

-   **Am I connected?** As before.
-   **Who am I?** The email your token resolves to — decisive when it is not clear which sign-in a connector is using.
-   **What am I allowed to do?** A per-area create/read/update/delete summary covering dashboards, rules, and integrations, plus a `hasBroadAccess` flag for full account admins.

Assistants use this to check before acting: if you lack dashboard-create permission, you get told that, instead of watching a create attempt fail. When a connection is pinned to one account and that account is inaccessible, the guidance names the binding and lists the accounts you _can_ reach — so you fix the connector rather than re-authenticating in a loop.

## Getting started

**If you already use the MCP Server:**

-   **Remote server** — nothing to do. The hosted server always runs the current release.
-   **Local server** — `npx @jupiterone/jupiterone-mcp` picks up the latest version on each run. If you installed globally, run `npm install -g @jupiterone/jupiterone-mcp` to update.

**If you are new to the MCP Server:**

1.  **Using Claude?** Install straight from [claude.ai/directory/jupiterone](https://claude.ai/directory/jupiterone). For any other assistant, follow the setup on the [MCP Server overview page](/integrations/jupiterone-mcp-server.md) — the remote server is recommended and requires no local install.
2.  Ask your assistant _"test my JupiterOne connection"_ to confirm it is connected and see what your sign-in can do.
3.  Try _"List my JupiterOne integrations"_ or one of the [prompt templates](/integrations/jupiterone-mcp-server.md#prompt-templates-by-use-case) to see the tools in action.

For the full setup guide, tool reference, and FAQ, see [JupiterOne AI Integration (MCP Server)](/integrations/jupiterone-mcp-server.md). For what came next, see [What's new in MCP 2.0](/integrations/mcp-2-0.md).

---

Source: /integrations/mcp-2-0

# MCP 2.0 Release Notes

**Release date: July 2026**

MCP 2.0 brings the JupiterOne MCP Server onto the **2026-07-28 revision of the Model Context Protocol** — and onto version 2 of the official MCP TypeScript SDK — without breaking a single existing client.

This is a compatibility and correctness release, not a feature release. The tool surface was unchanged from 1.4.0: the same 28 tools, the same names, the same parameters. (2.1.0 later added a 29th — see [The 2.x point releases](#the-2x-point-releases).) What changes is how well the server describes itself to the client on the other side, and which clients can talk to it at all. Newer clients get the current protocol with cache hints and honest result schemas. Older clients get exactly the wire they got before.

> **INFO**
> 
> **Remote server users: no.** The hosted server always runs the current release, and both protocol eras are served from the same URL.
> 
> **Local server users: check your Node version.** MCP 2.0 requires **Node.js 20 or later**, up from 18. This is the only breaking change in the release. See [Upgrading the local server](#upgrading-the-local-server).

## What is new in MCP 2.0

| Feature | What it means for you |
| --- | --- |
| **2026-07-28 protocol support** | The server speaks the current MCP revision to clients that ask for it, so newer assistants get the newer capabilities |
| **Both protocol eras, one endpoint** | Older clients are served exactly as before on the same URL — nothing to reconfigure, nothing to migrate |
| **Cacheable tool list** | Clients can cache the tool list for an hour instead of re-fetching it on every connection, cutting startup overhead |
| **Accurate query result schema** | `execute-j1ql-query` and `get-query-results` now advertise their real two-shape contract — completed results _or_ an in-progress handle — instead of a lowest-common-denominator approximation |
| **RFC 9207 authorization responses** | The remote server returns its issuer identifier on authorization responses, so clients can verify which server answered — a defence against mix-up attacks |
| **Client identity in diagnostics** | Support can see which client and version made a call, which makes client-specific problems far faster to diagnose |
| **Node.js 20 floor** _(breaking, local only)_ | The local server now requires Node 20 or later |
| **Open output schemas** _(2.0.2)_ | Strict-validating MCP clients no longer reject responses from `get-rule-details`, `get-dashboard-details`, and 22 other tools |

## Both protocol eras from one endpoint

MCP is a versioned protocol, and the 2026-07-28 revision changed how a connection is opened. Rather than force every client to move at once — or run a second endpoint — the server decides per connection:

-   A client opening with the **2026-07-28** handshake gets the modern protocol, including the cache hints and schema improvements below.
-   A client opening with the **legacy** handshake gets byte-for-byte the wire it got from MCP 1.x.

This holds for both deployment modes: the hosted remote server and the local stdio server. There is no configuration, no separate URL, and no migration step. If your assistant worked against MCP 1.x, it works against 2.0 unchanged.

This is not a theoretical concern. Claude — including the [connector directory listing](https://claude.ai/directory/jupiterone) — and ChatGPT both still open connections on the 2025-era handshake. Serving both eras is what let us adopt the new protocol revision without waiting on those clients or breaking the directory connector that most customers install through.

## Cacheable tool list

The server now tells 2026-era clients that its tool list is cacheable for an hour, so a client does not need to re-enumerate 28 tools on every connection. The hint is marked private to the connection, because the list genuinely differs between a multi-tenant connection and one pinned to a single account — a shared cache would serve the wrong list.

Legacy clients are unaffected: the hint is only emitted on 2026-era responses.

## An accurate schema for query results

Since [MCP 1.3.0](/integrations/mcp-1-0.md#resumable-long-running-queries-130), `execute-j1ql-query` can return one of two genuinely different things: a completed result envelope, or an in-progress handle with a `resultsUrl` to resume from. The older protocol could only describe a single object shape, so the server advertised every field as optional — technically permissive, but it told clients almost nothing.

2.0 advertises the real contract: a union of the two shapes, with the in-progress handle strictly typed so `status` and `resultsUrl` are required and a malformed handle cannot pass as a result set. Assistants get an accurate picture of what to expect, and can branch on it properly rather than guessing.

Clients that only understand a single object shape at the root keep working — the schema still presents as an object there.

## RFC 9207 authorization responses

The remote server now includes its issuer identifier (`iss`) on authorization responses, per [RFC 9207](https://www.rfc-editor.org/rfc/rfc9207.html). This lets a client confirm that the response it received came from the authorization server it actually started the flow with, closing off a class of mix-up attack in which a malicious server tries to have a code redeemed at the wrong place.

This is transparent — no connector reconfiguration, no change to how you sign in. It layers on top of the per-client registration, PKCE enforcement, and exact-match redirect validation delivered in [MCP 1.0](/integrations/mcp-1-0.md#hardened-oauth-for-the-remote-server).

## Client identity in diagnostics

Operational telemetry now records the client name, client version, user agent, and protocol version that made each call, alongside the tool name and outcome already captured. Query content stays redacted, and results, parameters, and action payloads are still never stored.

The practical benefit is support turnaround. Client-specific problems — a particular IDE mishandling a response, one client version failing where another succeeds — used to be invisible; they are now identifiable from the first report.

## Upgrading the local server

**MCP 2.0 requires Node.js 20 or later.** This comes from the MCP SDK v2 requirement and is the release's only breaking change. It applies **only to the local (stdio) server** — remote server users are unaffected, since the runtime is ours.

Check your version in the same shell your AI client uses:

```bash
node --version
```

If it reports v18 or lower, install Node 20 or later, then restart your AI client. Note that on macOS, GUI applications do not always inherit your shell's `PATH` — if your client still fails after upgrading, point it at an absolute path to `npx` (find it with `which npx`).

If you run the local server with `npx @jupiterone/jupiterone-mcp`, you pick up the latest version automatically on each run. For a global install, update it with:

```bash
npm install -g @jupiterone/jupiterone-mcp
```

## The 2.x point releases

| Version | Released | Highlights |
| --- | --- | --- |
| **2.0.1** | August 2026 | Updated the bundled J1QL parser, so local syntax validation matches the current query service grammar |
| **2.0.2** | August 2026 | Opened tool output schemas so strict-validating clients accept real responses |
| **2.1.0** | August 2026 | Added `delete-rule`, taking the tool count to 29 |
| **2.2.0** | August 2026 | Dashboard reliability: widget queries are checked against the chart render contract before they are saved |
| **2.3.0** | September 2026 | Added the three threat intelligence tools, taking the tool count to 32 |

### Opened output schemas (2.0.2)

Most tools return more data than their published schema documents — `get-rule-details` documents 8 fields and returns 28; `get-dashboard-details` documents 5 and returns 19. The published schemas nevertheless declared themselves _closed_, meaning no additional fields allowed. The two statements contradicted each other.

Clients that ignore the advertised schema never noticed. Clients that **validate** structured output against it — including Amazon Kiro and anything built on the official MCP client SDK — rejected the response outright with an "additional properties" error, making those tools unusable on those clients.

2.0.2 opens the schemas across all 24 affected tools, so the documented fields remain the contract while the full payload passes validation. Nothing about the data returned changed; only the schema that describes it. A regression test now asserts that no tool advertises a closed shape anywhere in its output schema.

This was never a 2.0 regression — the schemas had been closed since structured output shipped in [MCP 1.0](/integrations/mcp-1-0.md#structured-output-and-tool-annotations). If a strict-validating client rejected JupiterOne tool responses for you before August 2026, 2.0.2 fixes it.

### Rule deletion (2.1.0)

`delete-rule` closes the last gap in rule management. Until 2.1.0 an assistant could create and update rules but never remove one, so a rule created with a name or tag that collided with an existing one left no way to clean up — by far the most common failure in rule creation.

The tool is annotated as destructive, so your MCP client prompts before it runs. Two things to know:

-   **It is irreversible.** The rule's configuration cannot be recovered.
-   **It does not dismiss alerts the rule already raised.** Those stay active. If you want a rule to stop firing but keep its configuration and evaluation history, ask for its polling interval to be set to `DISABLED` instead — that is a reversible change, and deletion is not.

## Getting started

**Remote server:** nothing to do. Your connector already runs 2.0 — including the connector installed from [claude.ai/directory/jupiterone](https://claude.ai/directory/jupiterone).

**Local server:** confirm Node 20 or later, then restart your AI client. `npx` picks up the new version automatically.

**Verify the upgrade.** Ask your assistant:

> "Test my JupiterOne connection"

`test-connection` reports the package version alongside your identity and permissions, so you can confirm which release you are on.

For the full setup guide, tool reference, and FAQ, see [JupiterOne AI Integration (MCP Server)](/integrations/jupiterone-mcp-server.md). For the 1.x line, see [What's new in MCP 1.0](/integrations/mcp-1-0.md).

---

Source: /integrations/mcp-2-5

# MCP 2.5 Release Notes

**Release date: October 2026**

MCP 2.5 brings [Continuous Control Monitoring (CCM)](/features/ccm/continuous-control-monitoring.md) to the JupiterOne MCP Server. Six new tools take the server from 32 tools to 38. Your assistant can now read compliance status the way CCM reports it, by framework, requirement, and control, and explain why a control passes or fails. It can also record, renew, and revoke [attestations](/features/ccm/continuous-control-monitoring.md#control-attestations) on live controls.

Before 2.5 the MCP server had no compliance tools. An assistant could only approximate CCM status with J1QL queries over the `ccm_*` entities, and it had no way to record an attestation.

> **INFO**
> 
> **Remote server users: no.** The hosted server runs 2.5, so the compliance tools appear in your connector's tool list. A client that caches the tool list picks them up when it next refreshes it.
> 
> **Local server users: nothing beyond your usual update.** `npx @jupiterone/jupiterone-mcp` picks up 2.5 on its next run. A global install updates with `npm install -g @jupiterone/jupiterone-mcp`.
> 
> The compliance tools need the Continuous Control Monitoring entitlement on your account. See [Access and permissions](#access-and-permissions).

## What is new in MCP 2.5

| Feature | What it means for you |
| --- | --- |
| **Compliance summary** (`get-compliance-summary`) | A scorecard of every CCM framework, with a drill-down into one framework, by id or name, for its sections and failing requirements, plus the attestations that expire soon and the expired ones failing controls now |
| **Controls list** (`list-controls`) | The controls status view with its filters, including org units by id or display name, in compact rows with cursor paging |
| **Control details** (`get-control`) | One control with its frameworks, requirements, control tests, latest test results, and attestations, plus the reason it passes or fails |
| **Attestations** (`create-attestation`, `update-attestation`, `revoke-attestation`) | Record, renew, and revoke attestations on live controls. Each create and update reports what it does to the control's status, including when a failing test or an expired attestation keeps the control failing. A repeated create returns the existing attestation instead of a duplicate |
| **Links to the JupiterOne app** | Every framework and control in a compliance result carries a `url` to its page in the JupiterOne app, and your assistant gives that link when it names one |
| **Control-test rule guard** | The rule create, update, and delete tools refuse the rules CCM runs for its control tests, so an assistant cannot break a control test by editing its rule |
| **Clearer access-denied messages** | An access-denied error now leads with the reason JupiterOne gave, such as a missing entitlement, before the recovery guidance |

## Compliance status through the MCP

The three read tools go from broad to narrow: the scorecard, the controls behind it, then one control in detail.

### The compliance summary

`get-compliance-summary` returns every framework in the account with its control counts (total, passing, and failing), its requirement counts, and a health percentage. The `attested` count is every control with a valid attestation, passing or failing. It is not a subset of `passing`, because an attestation never masks a failing test. The health percentage is passing requirements divided by passing plus failing requirements. It is `null` when the framework has neither. It covers evaluated requirements only, so a framework can read 100% with 10 of its 130 requirements evaluated. Compare passing plus failing requirements with the total before calling a framework healthy.

The counts are read in time-boxed batches, so an account with many frameworks still gets a summary. `statsIncomplete` lists the frameworks whose counts did not return in time or could not be read. Their scorecards carry `null` counts and a `null` health percentage, which means not read, never zero. A drilled framework whose counts were not read reports `sections: null`, not an empty list. A call for one of them by `frameworkId` reads it.

Pass a `frameworkId`, or a `frameworkName` instead, to drill into one framework. The summary then reads and scores that framework only, adds the pass and fail counts for each section, and lists the failing requirements, critical ones first, each with the controls that fail it. A requirement counts as failing only when one of its live controls fails. Controls in Draft or Review keep whatever status they last had, so the summary ignores them, as CCM's own rollup does.

A `frameworkName` is matched as an exact id, then as an exact name ignoring case, then as the single framework whose name contains it. Framework names repeat, so several matches return `ambiguous` with up to 25 candidates, each with its id, name, `source`, `sourceId`, `owner`, import status, and `url`, plus a `candidateCount`. Same-named frameworks often differ only in their source, source id, or owner. An unknown framework, by id or by name, returns `framework_not_found`. Both results also list every framework in `frameworks`, with the same fields and no counts, so your assistant can choose from the full list. A drilled call reports how it matched in `frameworkResolution`. A `partial` match came from part of the name, so your assistant confirms the framework with you when it matters.

A drilled summary reads its failing controls, their requirements, and its no-data count from the JupiterOne graph, which CCM refreshes after each evaluation, and reports `drillSource: "graph"`. When the graph cannot answer, it reads them from CCM itself and reports `drillSource: "api"`. The scorecard counts, the health percentage, and the section counts are CCM's own either way. When the graph's failing controls and the scorecard's failing count differ, `warnings` says so.

A drilled summary adds two things:

-   **`failingControls`** lists every failing live control the summary read, with its id, identifier, name, and `url`. On a large framework the requirement lookups can stop short, which `requirementLookupsSkipped` above 0 or `failingControlsTruncated` reports. `failingRequirements` can then be incomplete, but `failingControls` still lists every failing control read. Your assistant answers from it, and reads a control with `get-control` for its requirements. `requirementLookupsSkippedBy` counts the skips by reason: `timeBudget`, `cap`, and `readFailed`. `cap` covers controls past the first 50, and a control whose requirements ran past their own page limit, whose requirements read so far are kept. Calling again can recover time-budget skips, never cap skips.
-   **`controls.passingWithoutData`** counts the live controls that pass on tests that saw no data. CCM counts them as passing, and so does the health percentage, so a high health figure can rest partly on tests that checked nothing. It is `null` when they could not be counted, and `passingWithoutDataSkipped` then says why: `time_budget` or `read_failed`. A control with no tests is not counted, because it passes on an attestation, not on tests that saw nothing. `passingWithoutDataTruncated` is `true` when not every passing control was read. That happens past 500 controls, or past 1,000 test rows when the graph answers, because the graph returns one row per test. Your assistant lists those controls with `list-controls`, using that `frameworkId`, `effectiveness: "NO_DATAPOINTS"`, `status: ["PASS"]`, and `states: ["LIVE"]`.

The summary also returns two attestation lists:

-   **`expiringAttestations`** holds the active attestations that expire within `attestationsExpiringWithinDays`, which defaults to 30, soonest first.
-   **`expiredAttestations`** holds the attestations past their expiry that nobody revoked, most recently expired first. An expired attestation fails its control until it is renewed with `update-attestation` or revoked, whatever the tests say and even beside a valid attestation. These are the attestations failing controls right now. Each entry shows how many days ago it expired. The list holds at most 50, and `expiredAttestationsTruncated` is `true` when there were more. `attestationsExpiringWithinDays` does not limit it.

One read names the controls in both lists and confirms which framework they belong to. It starts as soon as the request does, so names and scope are usually resolved. It covers at most 100 controls, the expired attestations' controls first.

-   **Scope.** `expiringAttestationsScope` says what both lists cover. It reads `framework` when a drilled summary lists only that framework's controls. It reads `account` without a framework, when that read failed, or when more than 100 controls would need checking, and both lists are then account-wide.
-   **Missing names.** `controlNamesUnavailable` is `true` when the read failed, ran out of time, or more than 100 controls were listed. Some control names are then `null`, but each `controlId` is still exact.
-   **Unconfirmed controls.** `controlNamesUnresolved` counts listed attestations whose control the read did not find. On a drill they stay listed even though their framework could not be confirmed, because a control created moments ago can be missing from the read. Your assistant confirms one with `get-control` before reporting it as part of the framework.

Reading these lists across the account needs CCM read-admin. Without it each list reads `unavailable` and the rest of the summary still returns. `unavailable` means a list could not be read, not that nothing is expiring or expired.

A summary can also carry `warnings`, sentences your assistant passes on to you with the answer. Each says what the response could not confirm, such as attestation lists that stayed account-wide on a drill. There are no warnings when there is nothing to say.

### Finding controls

`list-controls` is the controls status view as a tool. It filters by free-text `search`, `status` (pass or fail), lifecycle `states`, `effectiveness` (no tests or no datapoints), `hasValidAttestation`, `owner`, `catalogs`, `mitreTechniques`, `frameworkId`, `source`, and `orgUnit`. Each row carries the control's status, state, effectiveness, whether it is attested, its owner, its test counts, and the names of its frameworks. Results page with a cursor, 50 rows by default and up to 250. A cursor works only with the exact filters of the call that returned it. One the API refuses returns an error whose text starts `cursor_rejected:` and keeps the API's reason. The recovery is to call again with those filters and that cursor, or without a cursor for the first page. Sorting by `LAST_EVALUATED_ON` descending lists never-evaluated controls first; adding `status: ["PASS", "FAIL"]` leaves them out. When you name something that is not an account or a framework, your assistant treats it as a possible control and searches for it with `list-controls` before saying it does not exist.

For a count rather than rows, such as how many live controls fail, your assistant runs a J1QL count with `execute-j1ql-query` instead of paging through every row:

```j1ql
FIND ccm_control WITH state = 'LIVE' AND status = 'FAIL' AS c RETURN count(c) AS value
```

`orgUnit` selects the controls whose tests touch an asset in the org unit. Each row's `status` stays the control's overall status, not a status within the unit. The filter takes an org unit's display name or its id:

-   **A display name** is looked up across the account's org unit namespaces. A name that matches more than one org unit returns `ambiguous` with the candidates to choose from instead of a guess. A name that matches none returns `org_unit_not_found`, with `units` offering up to 10 org units from each namespace searched to choose from.
-   **An id**, written as `<namespace>:<uuid>`, is used as given and reported as `ouResolution: "id_unverified"`. An empty result with that value may mean the id is mistyped rather than that the org unit has no controls.

### Why a control passes or fails

`get-control` looks up one control by its `controlId`, its `identifier`, or its `controlName`. An identifier or name search considers every control that is not deleted, in any state. A search is `found` only when it read every candidate. That means a single match, or several matches of which exactly one is live. In the second case the live one is returned, because CCM evaluates only live controls, and `otherCandidates` lists up to 25 of the rest. Several matches without exactly one live control return `ambiguous` with up to 25 candidates and a `candidateCount` of all matches, instead of a guess. A search cut short also returns `ambiguous`, with `searchComplete: false`, even when it found a single match, because a second match may lie past the cut. Each candidate names its frameworks, which is usually how to tell them apart. A control that is not found comes back with a `note` that says to search with `list-controls`. The result carries the control's frameworks and requirements, its control tests with each test's latest evaluation, its attestations, and a `statusExplanation`. The tool checks the explanations in this order and reports the first that applies:

| `statusExplanation` | Meaning |
| --- | --- |
| `not_live` | The control is in Draft, Review, or Retired, so CCM does not evaluate it |
| `failing_test` | At least one control test fails. An attestation never masks a failing test |
| `failing_expired_attestation` | A non-revoked attestation has expired, which fails the control even when its tests pass |
| `undetermined` | The stored status is a fail, but nothing the caller can read either fails or passes the control, or the control's attestations were `unavailable` |
| `passing_by_tests` | At least one control test passes and none fails, including a test whose query saw no data. `passingWithoutData: true` flags that case, which is a pass on no data rather than evidence the control is met |
| `passing_by_attestation` | No test has a status, and a valid attestation makes the control pass, which CCM shows as **Attested** |
| `no_tests` | The control has no control tests and no valid attestation, so it is not evaluated |
| `no_datapoints` | The control has tests, but none has a status yet, so it is not evaluated |

CCM scores a test by its status whenever the test has run, whether or not its query saw any data. A test whose query saw nothing still passes and counts. An attestation passes a control only when no test has a status, because a passing test already passes it. These follow the CCM 1.4 rules in [How attestations affect control status](/features/ccm/continuous-control-monitoring.md#how-attestations-affect-control-status).

`statusExplanation` names the first cause. A found control also carries `blockers`, which lists every cause that fails the control: each failing test and each expired attestation nobody revoked. It is empty when nothing fails the control. A control fixed for one cause keeps failing until every blocker is cleared. When the attestations are `unavailable`, `blockers` covers the tests only.

`statusExplanation` reads the current facts, while `control.status` is what CCM stored. CCM re-scores an attested control within 24 hours of an expiry and on its next test run, so the two can disagree for a while. When they do, `storedStatusStale` is `true` and `expectedStatus` gives the status the facts call for, `PASS` or `FAIL`. Your assistant reports that status and says CCM has not re-scored the control yet.

`get-control` answers within a fixed time budget. The control and its tests always come back, and for a lookup by `controlId` its attestations are read at the same time. Whatever else is not back in time is skipped rather than failing the call:

-   **Requirements** come back empty, with `requirementsSkipped` set to `time_budget` or `read_failed` and `requirementsComplete: false`.
-   **Frameworks** come back empty, with `frameworksSkipped`. The control's own `frameworkIds` still name them.
-   **Attestations** read as `unavailable`, which in `get-control` means they could not be read with the caller's permissions or within the time budget.

Explaining why a control fails needs only the control, its tests, and its attestations.

Each test's latest evaluation carries a `rawDataKey`. Passing it to `get-rule-evaluation-query-results` returns the assets that test scored, which is how your assistant answers "which assets make this control fail?". That tool takes an optional `limit` of up to 250 rows, because each row is a full entity. When rows are cut, the result carries `truncated: true` and the `total` before the cut. To see what the test's query matches right now instead, your assistant can run the test's own query with `execute-j1ql-query`. The tool looks up the latest evaluation for at most 10 rule-backed tests, failing tests first, and the lookups are time-boxed. A test that was not looked up is marked `skipped` rather than failing the call.

### Links to the JupiterOne app

Every framework and control in a compliance result carries a `url` to its page in the JupiterOne app. That covers the scorecards, the drilled framework, its failing controls, the expiring and expired attestations (each links its control), the `list-controls` rows, `get-control`'s control, its frameworks, and its candidates, and the control on every attestation write. When your assistant names a framework or control, it gives that link. The `url` is empty when no link can be built.

## Attestations through the MCP

An [attestation](/features/ccm/ccm-1-4.md) justifies a control with evidence that lives outside its automated tests, for a bounded time. The three attestation tools are write tools, annotated so your MCP client can ask for approval before it runs them.

### Recording an attestation

`create-attestation` takes the control's `controlId`, a `subject`, and an `expiresOn` date. `description` (markdown), `owner` (an email address), and `documentLink` (an http or https URL) are optional. A `documentLink` that is not http or https is refused with a message that says so. Your assistant resolves the `controlId` with `get-control` first.

-   **Live controls only.** Attestations apply to live controls, so the tool refuses a control in Draft, Review, or Retired. It reports the control's current state and writes nothing. See [Control Lifecycle](/features/ccm/continuous-control-monitoring.md#control-lifecycle).
-   **The subject must not be blank.** A subject of only whitespace is refused.
-   **The expiry must be in the future.** `expiresOn` accepts a date as `YYYY-MM-DD`, read as the end of that day, 23:59:59.999 UTC, which is how the JupiterOne app stores it. Today's date is therefore accepted until the end of today. The same applies on `update-attestation`. `expiresOn` also accepts a date-time with `Z` or a `±hh:mm` offset, or epoch milliseconds. A date-time without a time zone is rejected. So is a number below 1e12, such as epoch seconds or a compact date like `20270630`, rather than being read as a date in 1970.
-   **A repeated create returns the existing attestation.** Before creating, the tool checks the control's active attestations. If one has the same subject, ignoring case and surrounding spaces, the tool returns that attestation as `already_exists` instead of creating a second one. The check sees only what CCM can already read, so a second call made before the first write shows can still create a duplicate. If the check cannot read the control's attestations, the call fails rather than risk one. When several active attestations already share the subject, `matches` lists them all, newest first. The returned `attestation` is the one whose subject matches exactly, or the most recently created when none or several do. They are separate attestations, so check `matches` before renewing one. An `already_exists` result also carries `requestedExpiresOnIso`, the expiry you asked for. When the existing attestation's expiry differs, `requestedExpiresOnApplied` is `false` and the note says the requested expiry was not applied. Your assistant reports the existing expiry and changes it with `update-attestation`.

An unknown control and a control that is not live are both reported as errors, and nothing is written. Every compliance-tool refusal's text starts with its outcome, such as `not_live:`, `not_found:`, or `invalid_input:`. That is the same value `structuredContent.outcome` carries, for clients that show only the text. `update-attestation` and `revoke-attestation` handle an unknown attestation id differently. They return `not_found` as a normal result, with a `note` on how to recover: read the current ids from `get-control`, and attest again with `create-attestation` when the attestation was revoked.

### What an attestation does to the control

An attestation passes a control only when no control test has a status, and it never masks a failing test. So `created`, `already_exists`, and `updated` results each carry a `statusImpact` and a `blockers` list:

| `statusImpact` | Meaning |
| --- | --- |
| `blocked` | Something keeps the control failing whatever is attested. A blocker is a failing test, or an expired attestation nobody revoked. On an update it can also be a control that is not live. Your assistant must not tell you the control is covered |
| `passes_by_attestation` | No test has a status and nothing blocks it, so the control passes on its attestations once CCM re-scores it |
| `already_passing` | A passing test already passes the control. The attestation is recorded but does not change the status |
| `unknown` | On `update-attestation` only: the control could not be read back in time, or that read failed. The update itself went through and does not need repeating. The result's `control` then carries only its id and `url`, and there are no blockers |

The result's `note` names each blocker. A failing test is fixed on the control, and an expired attestation is renewed with `update-attestation` or revoked.

### Expiry and renewal

When an attestation's expiry passes, the control fails, even over passing tests, until the attestation is renewed or revoked. CCM re-checks attested controls within 24 hours of an expiry. `update-attestation` renews an attestation by moving `expiresOn` later, before or after it lapses. An expired attestation given a future `expiresOn` is active again. It also edits the subject, description, owner, and document link, and it needs at least one field. Your assistant finds the `attestationId` in the attestations that `get-control` returns, or in the expiring and expired lists from `get-compliance-summary`.

Subjects should stay distinct on a control, because `create-attestation` finds attestations by subject. CCM allows two active attestations with the same subject. When an update leaves another active attestation on the control with the same subject, the result carries `subjectCollision` naming it, and the fix is to rename one of them.

### Revoking an attestation

`revoke-attestation` is permanent. The attestation stops counting, and the control reverts to whatever its tests and any remaining valid attestations say. A revoked attestation cannot be edited or restored, though CCM's audit trail keeps its history. `get-control` usually drops it, but may still list it, often an older revocation, with `state: "REVOKED"`. A revoked attestation never affects the status. Repeating a revoke is harmless: the second call returns `not_found` and changes nothing. To keep an attestation and extend it, use `update-attestation` instead.

A `revoked` result carries the control, with its `url`, and a `statusImpact` read after the revoke, with `blockers`:

| `statusImpact` | Meaning |
| --- | --- |
| `no_longer_passing` | Nothing else passes the control, so it is not evaluated once CCM re-scores it |
| `still_passing` | A passing test or another valid attestation keeps the control passing |
| `still_failing` | A failing test or another expired attestation keeps the control failing. `blockers` lists them |
| `now_passing` | The revoked attestation had expired, so revoking it cleared a failure, and something else passes the control |
| `no_longer_failing` | The revoked attestation had expired, and nothing else passes the control, so it is not evaluated |
| `unknown` | The control could not be read back in time, or that read failed. The revoke went through and does not need repeating |

### Reads catch up after a write

CCM's reads trail its writes by a few seconds, occasionally up to a minute. Straight after `create-attestation` succeeds, `get-control` may not list the new attestation and the scorecard may not count it yet. After an update or a revoke, `get-control` can still show the old values for a while, or the attestation as active. The write's own response is the confirmation. Re-read after a pause rather than repeating the write.

### When a write is interrupted

A write that went through is never reported as an error. One error, `interrupted`, means the request reached the server's time limit while the write was being made, so it may have landed. Its text starts `interrupted:`, and the recovery depends on the tool:

-   **`create-attestation`**: do not call it again at once. Read the control with `get-control` first. Its attestations list the subject once CCM can read it, which can take up to a minute, so wait a minute if it is not there yet before deciding whether another create is needed. Inside that minute the duplicate check cannot see the first attestation either, so an immediate retry can create a duplicate.
-   **`update-attestation`**: read the attestation with `get-control` before repeating the update.
-   **`revoke-attestation`**: call again. `not_found` means the first call revoked it.

## Rules that CCM runs for control tests

CCM runs each control test as a rule in the account's rule engine, named `CONTROL-TEST:<test name>`. CCM creates and reconciles these rules itself, so editing or deleting one directly breaks its control test. They are internal rules, so `list-rules` never lists them. Asked for one by id, `get-rule-details` reports it as an internal rule that is read through `get-control` on its control.

From 2.5 the rule write tools refuse them:

-   **By name.** `create-inline-question-rule` and `update-inline-question-rule` refuse a rule name that starts `CONTROL-TEST:`.
-   **By reference.** Before acting, `update-inline-question-rule` and `delete-rule` check the graph for a control test that references the rule id, and refuse when one exists. This covers any change, including the rule's polling interval.
-   **When the check cannot finish.** `delete-rule` refuses and deletes nothing, and a retry is safe. An update goes ahead and reports `ownershipCheck: "skipped"`.

To change what a control test checks, change the test on its control, not its rule.

## Clearer access-denied messages

When JupiterOne denies a call for a specific reason, the error now leads with that reason. A call from an account without CCM, for example, returns a message that begins:

```text
Not authorized (HTTP 403): Feature access not allowed to CCM.
```

A recovery sentence follows, then the tool's own hint. For a missing permission or entitlement, the recovery sentence says that re-authenticating will not help and that an account admin can grant access. Before 2.5 the server discarded the reason and returned only general guidance about permissions and account membership. A denial that gives no specific reason keeps that general guidance. The change applies to every tool, not only the compliance tools.

## Other changes

`list-rule-evaluations` now returns at most `limit` runs and stops reading pages once it has them. Before 2.5 it read every page and returned every run whatever the `limit`. Without a `limit` it still reads every page.

## Access and permissions

The compliance tools are available on every connection, and JupiterOne checks access on each call.

-   **All six tools** need the Continuous Control Monitoring entitlement on the account and control read permission.
-   **`create-attestation`, `update-attestation`, and `revoke-attestation`** also need edit permission on the control.
-   **The expiring and expired attestation lists in `get-compliance-summary`** need CCM read-admin, because they read attestations across the whole account. Without it each list reads `unavailable` and the rest of the summary still returns.

## Getting started

**Remote server:** nothing to do. Your connector already runs 2.5.

**Local server:** restart your AI client. `npx` picks up the new version automatically.

**Verify the upgrade.** Ask your assistant:

> "Test my JupiterOne connection"

`test-connection` reports the package version alongside your identity and permissions. Then try:

> "Give me a compliance summary of our frameworks"

More compliance prompts are in the **Compliance (CCM)** tab of the [prompt templates](/integrations/jupiterone-mcp-server.md#prompt-templates-by-use-case), and every tool is listed under [Available Tools](/integrations/jupiterone-mcp-server.md#available-tools). For CCM itself, see [Continuous Control Monitoring](/features/ccm/continuous-control-monitoring.md) and [What's new in CCM 1.4](/features/ccm/ccm-1-4.md). For the 2.x line, see [What's new in MCP 2.0](/integrations/mcp-2-0.md).

---

Source: /integrations/mcp-service-accounts

# Use the MCP server with API tokens for agentic workflows

Scheduled jobs, agents in chat tools, and other unattended workflows cannot complete a browser sign-in, and an OAuth session eventually needs a person to sign in again. For these workflows, connect to the JupiterOne remote MCP server with a JupiterOne API token. The agent sends the token on every request, so the connection keeps working without anyone present until the token expires or you revoke it.

Use OAuth when a person works with the assistant interactively. Use an API token when the assistant runs on its own.

## Prerequisites

-   Your JupiterOne account ID, found in [Account Management](/features/admin/admin-settings.md#account-management)
-   Your JupiterOne region (`us` or `eu`)
-   An AI client that can send a custom HTTP header to a remote MCP server
-   For an account-level API token, the account administrator role

## Choose a token type

The remote MCP server accepts both kinds of JupiterOne API token. Choose the one that matches how the workflow should be identified.

| Detail | Account-level API token | User API token |
| --- | --- | --- |
| Acts as | The token itself—it has no user | The user who created it |
| Permissions | Set on the token when you create it | The user's roles and groups |
| Created in | **Settings** > **Account API tokens** (administrators) | **Settings** > **User API Tokens** |
| Lifetime | 1 to 365 days, set at creation | Capped by the account's maximum token age, when one is set |
| Best for | A service account for one workflow | A workflow that must act as a specific person |

Account-level API tokens are usually the better fit for agentic workflows: each workflow gets its own token with only the permissions it needs, and nothing depends on a person's account.

## Create an account-level API token

1.  Navigate to **Settings** > **Account API tokens**.
2.  Click **New token**.
3.  Enter a **Name** that identifies the workflow, for example `Nightly exposure report agent`.
4.  Enter **Days before expiration**. Choose the shortest lifetime the workflow can tolerate, and plan to rotate the token before it expires.
5.  Under **Permissions**, select only what the workflow needs. A reporting or triage agent typically needs read access only.
6.  Optionally, use **Resource permissions** to limit the token to specific resources.
7.  Save the token and copy its value. Store it in your secret manager; you need it to configure the agent.

To let the agent see the token's own permissions when it tests the connection, include the read level of **Full Admin Access** (`fullReadAccess`). Without it, the connection still works, but the agent cannot list the token's permissions.

To use a user API token instead, create it in **Settings** > **User API Tokens** while signed in as the user the workflow should act as.

## Build the server URL

The URL must name your account by its account ID. Use either form:

```text
https://<accountId>.mcp.<region>.jupiterone.io/mcp
https://mcp.<region>.jupiterone.io/mcp?accountId=<accountId>
```

Replace `<region>` with `us` or `eu`, and `<accountId>` with your account ID exactly as it appears in Account Management. Most account IDs are UUIDs; some older accounts have a readable ID instead. Do not use your vanity domain. The URL without an account, `https://mcp.<region>.jupiterone.io/mcp`, does not accept API tokens.

## Configure your agent

Every request must carry the token in the `Authorization` header with the `Bearer` scheme:

```text
Authorization: Bearer <your-api-token>
```

Include the word `Bearer` and a space before the token. A token sent in another header, without `Bearer`, or in the URL is not accepted.

### Claude Code

Add the server with the header:

```bash
claude mcp add --transport http jupiterone \
  "https://<accountId>.mcp.us.jupiterone.io/mcp" \
  --header "Authorization: Bearer $JUPITERONE_API_TOKEN"
```

To read the token from a secret store each time Claude Code connects, use `headersHelper` in `.mcp.json` instead of a fixed header. The helper command must print a JSON object of headers:

```json
{
  "mcpServers": {
    "jupiterone": {
      "type": "http",
      "url": "https://<accountId>.mcp.us.jupiterone.io/mcp",
      "headersHelper": "echo '{\"Authorization\": \"Bearer '\"$(get-jupiterone-token)\"'\"}'"
    }
  }
}
```

Replace `get-jupiterone-token` with the command that reads the token from your secret store. Claude Code runs the helper again when the server rejects a request, so a rotated token is picked up without a restart.

### Claude and Claude in Slack

When you add the JupiterOne connector, enter the server URL, then add a custom header:

-   **Name:** `Authorization`
-   **Value:** `Bearer <your-api-token>`

If the connector restricts network access, allow the MCP server host. An API token connection only calls the `/mcp` path.

### Microsoft Copilot Studio

1.  On the agent's **Tools** page, select **Add a tool** > **New tool** > **Model Context Protocol**.
2.  Enter a name, a description, and the server URL.
3.  Select **API key** as the authentication type, **Header** as the type, and enter `Authorization` as the header name.
4.  When you create the connection, enter the key as `Bearer <your-api-token>`.

Copilot Studio does not list tools whose inputs use reference types, so `create-inline-question-rule` and `update-inline-question-rule` are not available there.

### Other clients

Most MCP clients that connect to remote servers accept a headers setting next to the URL. Use the same URL and `Authorization` header shown above. This also applies to agents you write yourself with an MCP client library (Python, TypeScript, and others): pass the same URL and `Authorization` header to the library's streamable-HTTP transport.

## Verify the connection

Ask the agent to run `test-connection`. A working connection reports `connected: true`, the account, and how the credential was identified:

-   `credential.type: "account_token"`—an account-level token, with its `name`, `expiresAt`, and the permissions set on it in `permissions.granted`
-   `credential.type: "user"`—a user API token, with the user's email and a summary of their permissions
-   `credential.type: "userless_token"`—an API token with no user whose permissions the agent cannot see. `credential.note` explains why, most often that the token lacks `fullReadAccess`.

To find its own entry, an account-level token with `fullReadAccess` reads the account's token list each time it runs `test-connection`. Each read records a `list tokens` event in the audit log under that token, so a service account that tests its connection regularly shows repeated `list tokens` events.

## Run workflows safely

-   **Give each workflow its own token.** Name the token after the workflow so you can revoke one without affecting others.
-   **Grant the minimum permissions.** Agents that read untrusted data, such as alert text or asset metadata from external sources, can be steered by that data. A read-only token limits what a misled agent can change.
-   **Set an expiry and rotate.** Track expiry dates and replace tokens before they lapse. Revoking a token in JupiterOne takes effect on the MCP server within about six minutes.
-   **Keep the token secret.** Store it in a secret manager and inject it at run time. Never put it in a URL, a prompt, or source control.
-   **Create Account dashboards.** An account-level token has no user, so it cannot own a personal (User) dashboard. Ask the agent to create Account dashboards instead.
-   **Plan for long queries.** Each MCP request has a time limit of about 55 seconds. A long-running J1QL query returns a handle instead of results, and the agent retrieves the results with `get-query-results`.
-   **Watch your rate limits.** Every MCP request counts against your [API rate limits](/api/rate-limiting.md).

> **WARNING**
> 
> Accounts that restrict access with an IP allowlist cannot use the remote MCP server. Do not add the MCP server's addresses to your allowlist to make it work: every request through the MCP server comes from those addresses, so anyone holding a valid token for your account could reach it through the MCP server from anywhere.

## Troubleshooting

| Response | Cause | Fix |
| --- | --- | --- |
| `400` "API tokens need the account ID in the URL" | The URL has no account | Use one of the URL forms in [Build the server URL](#build-the-server-url) |
| `400` "not a JupiterOne API token" | The header value is not a token, for example `Bearer` appears twice or the value has spaces | Send `Authorization: Bearer <your-api-token>` with the token exactly as issued |
| `401` "Authorization header must use the Bearer scheme" | The token was sent without `Bearer` | Add `Bearer` before the token |
| `401` "API token rejected" | The token is invalid, revoked, or expired, or the URL names a different account than the token's | Check the token, and check that the account ID in the URL is the token's account |
| `401` "API token belongs to a different account" | The token is valid for another account | Use the URL for the token's account |
| `403` | JupiterOne refused the request for the account, for example because of an IP allowlist | See the IP allowlist warning above |
| `503` "retry shortly" | The token could not be checked | Retry the request |

A rejected token stays rejected for about 15 seconds. Wait before you retry with the same token.

## Related topics

-   [JupiterOne AI Integration (MCP Server)](/integrations/jupiterone-mcp-server.md)
-   [API authentication](/api/authentication.md)
-   [API rate limits](/api/rate-limiting.md)

---

Source: /integrations/outbound-directory/jira

# Jira

# Setup Guide

## Overview

The application facilitates seamless integration with JupiterOne and Jira, enhancing the ability to manage and respond to cybersecurity alerts. This integration empowers users to automatically generate Jira tickets from JupiterOne alerts and create alerts within the system, ensuring that critical vulnerabilities are promptly addressed. The application fetches data from JupiterOne, maps fields to Jira issues, and allows for customization of these mappings. With automated alert creation, ticket generation, and updates, the application streamlines workflows and improves the efficiency of incident response processes. The user-friendly setup and real-time synchronization between JupiterOne and Jira ensure that cybersecurity efforts are both comprehensive and up-to-date, ultimately strengthening your organization’s security posture.

## Prerequisites

Ensure the JupiterOne account must have the following permissions:

-   **Full Admin Privileges**
-   **API Key Management (Read and Write)**
-   **Alerts (Read and Write)**

Ensure the Jira account must have the following permission:

-   **Admin Privileges**

## Configuration in JupiterOne

### Generating JupiterOne API Token

1.  **Log in** to the JupiterOne portal using your Administrator privileges.
2.  Go to **Settings > API Tokens**
3.  Click on **New Token**
4.  Provide the following details
    -   **Token Name** Assign a name to the token.
    -   **Days before Expiration** Set the token's expiry date.
5.  Copy the **API Token** and save it securely as it can only be viewed once.

### Get JupiterOne Account ID

1.  **Log in** to the JupiterOne portal using your Administrator privileges.
2.  Go to **Settings > Account Management**
3.  Copy the **Account ID**

## Configuration in Jira

Before beginning the configuration, ensure that you have a JIRA project created

1.  Go to your project and click on the **Project Settings**. Navigate to Issues, open any issue type, click on **Go to Custom fields** at bottom right, and click on the **Create Custom Field** button
    
    ![Create Custom Field](/assets/images/jira_custom_field-7d42735b6891b7fd0410f1ba26123cd7.png)
    
2.  Select required field type
    
    -   To map specific field types, create custom fields in Jira as follows:
        -   **Number Field:** For mapping number-type fields.
        -   **Labels:** For mapping array-type fields.
        -   **Datetime Picker:** For mapping datetime-type fields.
    
    ![Jira Custom Fields](/assets/images/jira_custom_field_types-8d78bb8946fbcd7563a40b103dbfd9fd.png)
    
3.  Enter the field name, description and click on the **Create** button.
    
    ![Create](/assets/images/jira_create_field-086b987e1902769efbbb49545d62f036.png)
    
4.  Go to your project and click on the **Project Settings**
    
    ![Project Settings](/assets/images/jira_project_settings-cfba784fc23ca8627b5a321608d22277.png)
    
5.  Go to Issue Types, select an issue, and search for the required custom fields
    
    ![Select](/assets/images/jira_custom_fields_addition-836f321072491fb5b9ba57f3c3135f97.png)
    
6.  The custom fields will be visible under the Description fields tab. Once you have added all the custom fields, click on the **Save changes** button.
    
    ![Save Changes](/assets/images/jira_custom_fields_save-d4a20b668b636fabb873a29eebe752ab.png)
    

## Using the Application

The integration enables you to use the following functionalities within the JIRA dashboard

-   You can create JupiterOne alerts.
-   You can map JIRA fields with JupiterOne fields to create Issues for vulnerabilities.

### Creating Alerts

1.  Go to your project > Project Settings > Apps and select the **JupiterOne-Jira Integration Application**
    
    ![Application](/assets/images/jira_app_navigation-8f2d36f58df39445526a31892a5348b7.png)
    
2.  Go to the JupiterOne Configuration tab.
    
3.  The application will prompt you to enter the following details
    
    -   **JupiterOne account ID**
    -   **JupiterOne API Key**
    -   **JupiterOne instance region**
    -   **Name of the Alert**
    -   **Alert query**
    -   **Evaluation Interval**
4.  After entering the details, click on the **test connection** button. This will authenticate your credentials and create the alert. After successful authentication and alert creation, **Status** will be shown
    
    ![Status](/assets/images/jira_jupiterone_alert_creation-7505ceee57ef79e155190b8576ffa3c7.png)
    

### Mapping JIRA fields with JupiterOne fields

1.  Go to the **JIRA ticketing configuration** tab
    
2.  Select Issue type
    
3.  Select the JIRA field and JupiterOne field that you want to map and click on the **Add Mapping** button
    
    -   **Summary** and **Description** JIRA fields are required to be mapped.
    -   **Boolean** or **DateTime** fields coming from JupiterOne cannot be selected as Primary Key
    
    ![Add Mapping](/assets/images/jira_jupiterone_field_mapping-52632c626ab6c41ed2d3647c63a951f0.png)
    
4.  Your mappings will be shown under the **JupiterOne to Jira Fields Mapping** table. You can remove a mapping by clicking on the **Remove** button under **Actions**.
    
5.  Click on the **lock icon** next to the mapping you want to select as the **primary key**.
    
    ![Primary Key](/assets/images/jira_jupiterone_primary_key-b1036b85c9d103ab685e8932716aed36.png)
    
6.  After adding the mappings, click on the **Save Mappings** button to save the mappings. Upon successful completion, a status box indicating “Mappings saved successfully” will be shown
    
    ![Save Mapping](/assets/images/jira_jupiterone_save_mappings-c90c15ff50fa43e77ad14caf1589dcab.png)
    

### Updating Alerts

1.  Go to the JupiterOne Configuration tab.
    
2.  The application will prompt you with the configured page where JupiterOne account ID, JupiterOne API Key, the JupiterOne instance region fields and Test connection button will be disabled.
    
3.  Modify Alert Name, alert query, and the evaluation interval of the alert as per requirement.
    
4.  After entering the data, click on the **Update Alert** button. This will authenticate your credentials and update the alert. After successful authentication and alert creation, Status will be shown
    
    ![Update Alert](/assets/images/jira_jupiterone_alert_updation-15028c9aee1f57f4019ee27fee784a6f.png)
    

##### Note:

After Alert Updation, the fields of JupiterOne Fields dropdown will also be updated according to the change in query and mappings can be done accordingly

### Deleting Alerts

1.  Go to the JupiterOne Configuration tab.
    
2.  The application will prompt you with the configured page where JupiterOne account ID, JupiterOne API Key, the JupiterOne instance region fields and Test connection button will be disabled.
    
3.  Click on the **Delete Alert** button. This will authenticate your credentials and update the alert. After successful authentication and alert creation, Status will be shown
    
    ![Delete Alert](/assets/images/jira_jupiterone_alert_deletion-bf39b961b94b192f250bbe8cbee2c705.png)
    

## Limitations

### Duplicate issues

In Jira duplication of issues arises when the primary key value of the data is empty or the string acting as primary key has some special characters.

-   The supported special characters are @, #, $, %, &, and -

### Numeric data

When few math operations are used on return properties of custom query Numeric data may come as undefined.

-   Supported Math Operations for custom query are +, -, \*. Math Operations can be used as mentioned in the below example.
    
    > FIND jupiterone\_compliance\_gap with totalNumberOfAffectedEntities > 1 as i return i.displayName, i.description, i.ref, **i.totalNumberOfAffectedEntities+5**, i.framework
    
-   For other Math operations alias should be used as mentioned in the below example
    
    > FIND jupiterone\_compliance\_gap with totalNumberOfAffectedEntities > 1 as i return i.displayName, i.description, i.ref, **i.totalNumberOfAffectedEntities/5 as gapAffected**, i.framework
    

## Troubleshooting

This section aims to guide users about the possible problems they might encounter while using the app. Please follow the instructions if you come across any of the following scenarios

### Alert creation failure

2.  The alert name should be unique.
3.  Make sure your account has the required permissions to create alerts.

### JIRA field names not visible

If the JIRA field names are not appearing in the "Choose a JIRA Ticket Field" dropdown, please refresh the page.

## Debugging

If you encounter issues while using the app, you can use your browser's developer console to help diagnose problems. Follow these steps:

-   Open the Browser Console:
-   Press F12 or Ctrl+Shift+I (Windows/Linux) or Cmd+Option+I (Mac) to open the developer tools.
-   Navigate to the "Console" tab to view logs, errors, and warnings.

## Conclusion

In conclusion, this document has provided a detailed guide to using the JupiterOne and Jira integration app. By integrating these platforms, users can enhance their workflow efficiency and vulnerability management capabilities. The app facilitates the automatic creation of alerts and seamless synchronization of vulnerability data, ensuring that critical issues are tracked and resolved in Jira. Additionally, users can leverage this integration to gain real-time insights and maintain a comprehensive view of their security posture within the Jira environment.

# Privacy Policy

**Updated: January 2025**

JupiterOne ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, products, or services.

## Information We Collect

When you interact with our services, we may collect various types of personal data, including but not limited to:

### Account Information

We may collect JupiterOne Account identifiable information, such as your Account ID, Region, and API key of the account. We may keep a record of your communications with us and other information you share during the course of the communications.

### Usage Data

We may collect information about how you interact with JupiterOne's website, products, or services.

## Purpose of Processing

We may use your information for the following purposes:

-   **Personalize User Experience**: To personalize user experience and provide requested services.
-   **Service Provision**: To provide and maintain our services, process transactions, and fulfill your requests.
-   **Analytics**: To analyze user behavior, improve our offerings, and enhance the user experience. To enhance existing user profiles, verify and update information, and enrich the understanding of user preferences and behaviors.
-   **Security**: To protect against unauthorized access, detect and prevent fraudulent activities.

We process your Account data based on one or more of the following legal grounds:

-   **Consent**: When you provide explicit consent for specific processing activities, such as opting out of our marketing communications.
-   **Contractual Necessity**: When processing is necessary for the performance of a contract with you.
-   **Legal Obligations**: When processing is required to comply with legal obligations.
-   **Legitimate Interests**: When processing is based on our legitimate interests and does not override your rights and freedoms.
-   **Other Purposes**: We will process your personal information for other purposes about which we notify you in advance, or for which we receive your consent. In general, we collect and process personal information about you as necessary to provide the products you use, operate our sites and business, meet our contractual and legal obligations, protect the security of our systems and our customers, or fulfill other legitimate interests as described in this Privacy Policy and in our notices to you.

## Information Sharing

We do not sell, trade, or rent your personal information to third parties. However, we may share your information with trusted third parties who assist us in operating our website, conducting our business, or servicing you.

## Cookies and Similar Technologies

We may use cookies and similar technologies to collect information and enhance your experience.

## Security

We implement reasonable security measures to protect your information from unauthorized access, disclosure, alteration, or destruction.

## Changes to This Privacy Policy

We may modify or update this Privacy Policy from time to time to reflect changes in our business and practices. Please review this page periodically. Any changes to this Privacy Policy will be indicated by updating the 'Last Updated' date above. For significant modifications, we will provide additional notice or obtain consent as required by applicable law.

## Contact Us

If you have questions about this Privacy Policy, please contact us at [privacy@jupiterone.com](mailto:privacy@jupiterone.com).

# Terms and Conditions

**Effective Date: 13/01/2025**

These Customer Terms of Service (“Terms”) govern the use of the JupiterOne Jira Integration application ("App") provided by JupiterOne ("we", "our", or "us") on the Atlassian Marketplace for integration with Jira. By installing, accessing, or using the App, you agree to be bound by these Terms. If you do not agree to these Terms, you may not use the App.

## 1\. License Grant

### 1.1 License

We grant you a non-exclusive, non-transferable, revocable license to install and use the App solely for internal business purposes within your organization, subject to the terms of this agreement.

### 1.2 Usage Restrictions

You shall not:

-   Sublicense, lease, distribute, transfer, or assign the App.
-   Reverse-engineer, decompile, or disassemble the App.
-   Use the App in any manner that violates applicable laws or regulations.

## 2\. Pricing and Payments

### 2.1 Pricing

The pricing for the App is as stated on the Atlassian Marketplace listing. Pricing may vary depending on the number of users or features selected.

### 2.2 Payment

Payments for the App are processed via the Atlassian Marketplace, and you agree to pay the applicable subscription fees in accordance with Atlassian’s payment terms.

### 2.3 Subscription Term and Renewal

Subscriptions may be charged on a monthly or annual basis, as selected at the time of purchase. Subscriptions automatically renew unless canceled prior to the renewal date.

### 2.4 Refund Policy

Unless required by law, we do not offer refunds for subscription fees, except in cases where the App is found to be non-functional or fails to meet the agreed-upon specifications.

## 3\. Trial Period

### 3.1 Trial Period

If a trial period is offered, you may use the App free of charge for the trial duration specified in the Marketplace listing. After the trial period ends, you will be charged according to the pricing plan selected unless you cancel the subscription before the trial expires.

## 4\. Support and Maintenance

### 4.1 Support

We provide support for the App as specified in the Atlassian Marketplace listing. Support requests can be made by sending an email to [support@jupiterone.com](mailto:support@jupiterone.com), and we will respond to such requests within a reasonable timeframe.

### 4.2 Updates

We may provide updates, bug fixes, or new versions of the App. You are responsible for keeping the App up to date, and updates will be made available to you as part of your subscription.

## 5\. Data Privacy and Security

### 5.1 Data Collection

The App may collect certain data, including but not limited to usage statistics, error logs, and other information necessary for support and improvement purposes. We will handle all customer data in accordance with our Privacy Policy.

### 5.2 Data Security

We implement reasonable security measures to protect your data. However, we do not guarantee that your data will be completely secure.

### 5.3 Data Usage

We will not sell or rent your personal data to third parties. We may use aggregated, non-personally identifiable data to improve the App and provide better services.

## 6\. Intellectual Property

### 6.1 Ownership

We retain all rights, titles, and interest in and to the App, including all intellectual property rights. You do not acquire any ownership rights in the App, other than the limited rights expressly granted in these Terms.

### 6.2 User Content

You retain ownership of any content you input into the App but grant us a license to use such content to provide the services described in these Terms.

## 7\. Termination

### 7.1 Termination by You

You may terminate your subscription at any time by canceling through the Atlassian Marketplace. Your access to the App will continue until the end of your current billing cycle.

### 7.2 Termination by Us

We may terminate or suspend your access to the App at any time if you breach these Terms, fail to make payment, or otherwise engage in conduct that we deem inappropriate.

### 7.3 Effect of Termination

Upon termination of this agreement, you must cease using the App and remove it from your Jira instance. Any fees paid up to the date of termination are non-refundable.

## 8\. Limitation of Liability

### 8.1 No Warranty

The App is provided "as-is" without warranty of any kind, either express or implied, including but not limited to implied warranties of merchantability or fitness for a particular purpose.

### 8.2 Limitation of Liability

To the maximum extent permitted by law, we are not liable for any indirect, incidental, special, consequential, or punitive damages, or loss of profits, data, or goodwill, arising from or related to your use of the App.

## 9\. Governing Law and Dispute Resolution

### 9.1 Governing Law

These Terms shall be governed by and construed in accordance with the laws of \[Your Jurisdiction\].

### 9.2 Dispute Resolution

Any disputes arising out of or in connection with these Terms shall be resolved through \[arbitration/mediation\] in \[Location\], in accordance with the rules of \[Arbitration Organization\].

## 10\. Changes to These Terms

### 10.1 Amendments

We may update these Terms from time to time by posting a new version on the Atlassian Marketplace. You will be notified of significant changes through the App or via email.

### 10.2 Effective Date

Any updates to these Terms will become effective on the date they are posted.

## 11\. Miscellaneous

### 11.1 Entire Agreement

These Terms constitute the entire agreement between you and us with respect to the App and supersede all prior agreements, whether written or oral.

### 11.2 Severability

If any provision of these Terms is found to be unenforceable, the remaining provisions shall remain in full effect.

# Security and Compliance Policy

**Updated: January 2025**

## Overview

This document outlines the security and compliance policies for the JupiterOne-Jira Integration Application, ensuring that all customer data and system operations are protected and meet standard compliance requirements.

## Security Governance

We maintain a robust security governance framework that includes regular risk assessments, monitoring, and continuous improvement efforts to mitigate threats to the JupiterOne-Jira Integration Application.

## Access Control

-   **User Authentication**: Access to the Jira JupiterOne Application is done via the JIRA Authentication.
-   **Role-Based Access Control (RBAC)**: All users with Jira admin access to the project are granted access to the application based on their roles.
-   **Session Management**: By default, session timeout is the same as Jira session timeout

## Data Protection

-   **Data Encryption**: All sensitive data is encrypted using in-built methods of [JIRA Storage](https://developer.atlassian.com/platform/forge/runtime-reference/storage-api-secret/)
-   **Data Minimization**: We adhere to the data minimization principle, collecting only the necessary information required for Jira integration and compliance monitoring.
-   **Backup and Recovery**: Customers are responsible for backing up state data on the JupiterOne-Jira Integration Application Platform. The Application provides a reflection of Customer Data from Jupiterone and should not serve as the system of record for any novel Customer Data.

## Continuous Improvement

We are committed to continuous improvement and the adaptation of new security measures in line with evolving industry best practices. Periodic security reviews and internal audits are conducted to ensure compliance with current standards.

## Data Subject Rights

**Data Access**: Customers can request a copy of all data stored within the Jira JupiterOne Application at any time. Since the app is hosted in JIRA Server itself, this data can be obtained with the collaboration of JIRA Support

## Training and Awareness

We conduct regular security and compliance training for all employees and contractors involved in the development, deployment, and maintenance of the Jira JupiterOne Application. Security best practices and compliance obligations are embedded into the onboarding and ongoing training programs.

## Review and Updates

This policy is reviewed annually or whenever there are significant changes in regulations, technology, or organizational structure. Updates to the policy will be communicated to all users.

## Contact Us

If you have questions about this Policy, please contact us at [support@jupiterone.com](mailto:support@jupiterone.com).

---

Source: /integrations/outbound-directory/jira/privacy-policy

# Privacy Policy

**Updated: January 2025**

JupiterOne ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, products, or services.

## Information We Collect

When you interact with our services, we may collect various types of personal data, including but not limited to:

### Account Information

We may collect JupiterOne Account identifiable information, such as your Account ID, Region, and API key of the account. We may keep a record of your communications with us and other information you share during the course of the communications.

### Usage Data

We may collect information about how you interact with JupiterOne's website, products, or services.

## Purpose of Processing

We may use your information for the following purposes:

-   **Personalize User Experience**: To personalize user experience and provide requested services.
-   **Service Provision**: To provide and maintain our services, process transactions, and fulfill your requests.
-   **Analytics**: To analyze user behavior, improve our offerings, and enhance the user experience. To enhance existing user profiles, verify and update information, and enrich the understanding of user preferences and behaviors.
-   **Security**: To protect against unauthorized access, detect and prevent fraudulent activities.

We process your Account data based on one or more of the following legal grounds:

-   **Consent**: When you provide explicit consent for specific processing activities, such as opting out of our marketing communications.
-   **Contractual Necessity**: When processing is necessary for the performance of a contract with you.
-   **Legal Obligations**: When processing is required to comply with legal obligations.
-   **Legitimate Interests**: When processing is based on our legitimate interests and does not override your rights and freedoms.
-   **Other Purposes**: We will process your personal information for other purposes about which we notify you in advance, or for which we receive your consent. In general, we collect and process personal information about you as necessary to provide the products you use, operate our sites and business, meet our contractual and legal obligations, protect the security of our systems and our customers, or fulfill other legitimate interests as described in this Privacy Policy and in our notices to you.

## Information Sharing

We do not sell, trade, or rent your personal information to third parties. However, we may share your information with trusted third parties who assist us in operating our website, conducting our business, or servicing you.

## Cookies and Similar Technologies

We may use cookies and similar technologies to collect information and enhance your experience.

## Security

We implement reasonable security measures to protect your information from unauthorized access, disclosure, alteration, or destruction.

## Changes to This Privacy Policy

We may modify or update this Privacy Policy from time to time to reflect changes in our business and practices. Please review this page periodically. Any changes to this Privacy Policy will be indicated by updating the 'Last Updated' date above. For significant modifications, we will provide additional notice or obtain consent as required by applicable law.

## Contact Us

If you have questions about this Privacy Policy, please contact us at [privacy@jupiterone.com](mailto:privacy@jupiterone.com).

---

Source: /integrations/outbound-directory/jira/security-policy

# Security and Compliance Policy

**Updated: January 2025**

## Overview

This document outlines the security and compliance policies for the JupiterOne-Jira Integration Application, ensuring that all customer data and system operations are protected and meet standard compliance requirements.

## Security Governance

We maintain a robust security governance framework that includes regular risk assessments, monitoring, and continuous improvement efforts to mitigate threats to the JupiterOne-Jira Integration Application.

## Access Control

-   **User Authentication**: Access to the Jira JupiterOne Application is done via the JIRA Authentication.
-   **Role-Based Access Control (RBAC)**: All users with Jira admin access to the project are granted access to the application based on their roles.
-   **Session Management**: By default, session timeout is the same as Jira session timeout

## Data Protection

-   **Data Encryption**: All sensitive data is encrypted using in-built methods of [JIRA Storage](https://developer.atlassian.com/platform/forge/runtime-reference/storage-api-secret/)
-   **Data Minimization**: We adhere to the data minimization principle, collecting only the necessary information required for Jira integration and compliance monitoring.
-   **Backup and Recovery**: Customers are responsible for backing up state data on the JupiterOne-Jira Integration Application Platform. The Application provides a reflection of Customer Data from Jupiterone and should not serve as the system of record for any novel Customer Data.

## Continuous Improvement

We are committed to continuous improvement and the adaptation of new security measures in line with evolving industry best practices. Periodic security reviews and internal audits are conducted to ensure compliance with current standards.

## Data Subject Rights

**Data Access**: Customers can request a copy of all data stored within the Jira JupiterOne Application at any time. Since the app is hosted in JIRA Server itself, this data can be obtained with the collaboration of JIRA Support

## Training and Awareness

We conduct regular security and compliance training for all employees and contractors involved in the development, deployment, and maintenance of the Jira JupiterOne Application. Security best practices and compliance obligations are embedded into the onboarding and ongoing training programs.

## Review and Updates

This policy is reviewed annually or whenever there are significant changes in regulations, technology, or organizational structure. Updates to the policy will be communicated to all users.

## Contact Us

If you have questions about this Policy, please contact us at [support@jupiterone.com](mailto:support@jupiterone.com).

---

Source: /integrations/outbound-directory/jira/setup

# Setup Guide

## Overview

The application facilitates seamless integration with JupiterOne and Jira, enhancing the ability to manage and respond to cybersecurity alerts. This integration empowers users to automatically generate Jira tickets from JupiterOne alerts and create alerts within the system, ensuring that critical vulnerabilities are promptly addressed. The application fetches data from JupiterOne, maps fields to Jira issues, and allows for customization of these mappings. With automated alert creation, ticket generation, and updates, the application streamlines workflows and improves the efficiency of incident response processes. The user-friendly setup and real-time synchronization between JupiterOne and Jira ensure that cybersecurity efforts are both comprehensive and up-to-date, ultimately strengthening your organization’s security posture.

## Prerequisites

Ensure the JupiterOne account must have the following permissions:

-   **Full Admin Privileges**
-   **API Key Management (Read and Write)**
-   **Alerts (Read and Write)**

Ensure the Jira account must have the following permission:

-   **Admin Privileges**

## Configuration in JupiterOne

### Generating JupiterOne API Token

1.  **Log in** to the JupiterOne portal using your Administrator privileges.
2.  Go to **Settings > API Tokens**
3.  Click on **New Token**
4.  Provide the following details
    -   **Token Name** Assign a name to the token.
    -   **Days before Expiration** Set the token's expiry date.
5.  Copy the **API Token** and save it securely as it can only be viewed once.

### Get JupiterOne Account ID

1.  **Log in** to the JupiterOne portal using your Administrator privileges.
2.  Go to **Settings > Account Management**
3.  Copy the **Account ID**

## Configuration in Jira

Before beginning the configuration, ensure that you have a JIRA project created

1.  Go to your project and click on the **Project Settings**. Navigate to Issues, open any issue type, click on **Go to Custom fields** at bottom right, and click on the **Create Custom Field** button
    
    ![Create Custom Field](/assets/images/jira_custom_field-7d42735b6891b7fd0410f1ba26123cd7.png)
    
2.  Select required field type
    
    -   To map specific field types, create custom fields in Jira as follows:
        -   **Number Field:** For mapping number-type fields.
        -   **Labels:** For mapping array-type fields.
        -   **Datetime Picker:** For mapping datetime-type fields.
    
    ![Jira Custom Fields](/assets/images/jira_custom_field_types-8d78bb8946fbcd7563a40b103dbfd9fd.png)
    
3.  Enter the field name, description and click on the **Create** button.
    
    ![Create](/assets/images/jira_create_field-086b987e1902769efbbb49545d62f036.png)
    
4.  Go to your project and click on the **Project Settings**
    
    ![Project Settings](/assets/images/jira_project_settings-cfba784fc23ca8627b5a321608d22277.png)
    
5.  Go to Issue Types, select an issue, and search for the required custom fields
    
    ![Select](/assets/images/jira_custom_fields_addition-836f321072491fb5b9ba57f3c3135f97.png)
    
6.  The custom fields will be visible under the Description fields tab. Once you have added all the custom fields, click on the **Save changes** button.
    
    ![Save Changes](/assets/images/jira_custom_fields_save-d4a20b668b636fabb873a29eebe752ab.png)
    

## Using the Application

The integration enables you to use the following functionalities within the JIRA dashboard

-   You can create JupiterOne alerts.
-   You can map JIRA fields with JupiterOne fields to create Issues for vulnerabilities.

### Creating Alerts

1.  Go to your project > Project Settings > Apps and select the **JupiterOne-Jira Integration Application**
    
    ![Application](/assets/images/jira_app_navigation-8f2d36f58df39445526a31892a5348b7.png)
    
2.  Go to the JupiterOne Configuration tab.
    
3.  The application will prompt you to enter the following details
    
    -   **JupiterOne account ID**
    -   **JupiterOne API Key**
    -   **JupiterOne instance region**
    -   **Name of the Alert**
    -   **Alert query**
    -   **Evaluation Interval**
4.  After entering the details, click on the **test connection** button. This will authenticate your credentials and create the alert. After successful authentication and alert creation, **Status** will be shown
    
    ![Status](/assets/images/jira_jupiterone_alert_creation-7505ceee57ef79e155190b8576ffa3c7.png)
    

### Mapping JIRA fields with JupiterOne fields

1.  Go to the **JIRA ticketing configuration** tab
    
2.  Select Issue type
    
3.  Select the JIRA field and JupiterOne field that you want to map and click on the **Add Mapping** button
    
    -   **Summary** and **Description** JIRA fields are required to be mapped.
    -   **Boolean** or **DateTime** fields coming from JupiterOne cannot be selected as Primary Key
    
    ![Add Mapping](/assets/images/jira_jupiterone_field_mapping-52632c626ab6c41ed2d3647c63a951f0.png)
    
4.  Your mappings will be shown under the **JupiterOne to Jira Fields Mapping** table. You can remove a mapping by clicking on the **Remove** button under **Actions**.
    
5.  Click on the **lock icon** next to the mapping you want to select as the **primary key**.
    
    ![Primary Key](/assets/images/jira_jupiterone_primary_key-b1036b85c9d103ab685e8932716aed36.png)
    
6.  After adding the mappings, click on the **Save Mappings** button to save the mappings. Upon successful completion, a status box indicating “Mappings saved successfully” will be shown
    
    ![Save Mapping](/assets/images/jira_jupiterone_save_mappings-c90c15ff50fa43e77ad14caf1589dcab.png)
    

### Updating Alerts

1.  Go to the JupiterOne Configuration tab.
    
2.  The application will prompt you with the configured page where JupiterOne account ID, JupiterOne API Key, the JupiterOne instance region fields and Test connection button will be disabled.
    
3.  Modify Alert Name, alert query, and the evaluation interval of the alert as per requirement.
    
4.  After entering the data, click on the **Update Alert** button. This will authenticate your credentials and update the alert. After successful authentication and alert creation, Status will be shown
    
    ![Update Alert](/assets/images/jira_jupiterone_alert_updation-15028c9aee1f57f4019ee27fee784a6f.png)
    

##### Note:

After Alert Updation, the fields of JupiterOne Fields dropdown will also be updated according to the change in query and mappings can be done accordingly

### Deleting Alerts

1.  Go to the JupiterOne Configuration tab.
    
2.  The application will prompt you with the configured page where JupiterOne account ID, JupiterOne API Key, the JupiterOne instance region fields and Test connection button will be disabled.
    
3.  Click on the **Delete Alert** button. This will authenticate your credentials and update the alert. After successful authentication and alert creation, Status will be shown
    
    ![Delete Alert](/assets/images/jira_jupiterone_alert_deletion-bf39b961b94b192f250bbe8cbee2c705.png)
    

## Limitations

### Duplicate issues

In Jira duplication of issues arises when the primary key value of the data is empty or the string acting as primary key has some special characters.

-   The supported special characters are @, #, $, %, &, and -

### Numeric data

When few math operations are used on return properties of custom query Numeric data may come as undefined.

-   Supported Math Operations for custom query are +, -, \*. Math Operations can be used as mentioned in the below example.
    
    > FIND jupiterone\_compliance\_gap with totalNumberOfAffectedEntities > 1 as i return i.displayName, i.description, i.ref, **i.totalNumberOfAffectedEntities+5**, i.framework
    
-   For other Math operations alias should be used as mentioned in the below example
    
    > FIND jupiterone\_compliance\_gap with totalNumberOfAffectedEntities > 1 as i return i.displayName, i.description, i.ref, **i.totalNumberOfAffectedEntities/5 as gapAffected**, i.framework
    

## Troubleshooting

This section aims to guide users about the possible problems they might encounter while using the app. Please follow the instructions if you come across any of the following scenarios

### Alert creation failure

2.  The alert name should be unique.
3.  Make sure your account has the required permissions to create alerts.

### JIRA field names not visible

If the JIRA field names are not appearing in the "Choose a JIRA Ticket Field" dropdown, please refresh the page.

## Debugging

If you encounter issues while using the app, you can use your browser's developer console to help diagnose problems. Follow these steps:

-   Open the Browser Console:
-   Press F12 or Ctrl+Shift+I (Windows/Linux) or Cmd+Option+I (Mac) to open the developer tools.
-   Navigate to the "Console" tab to view logs, errors, and warnings.

## Conclusion

In conclusion, this document has provided a detailed guide to using the JupiterOne and Jira integration app. By integrating these platforms, users can enhance their workflow efficiency and vulnerability management capabilities. The app facilitates the automatic creation of alerts and seamless synchronization of vulnerability data, ensuring that critical issues are tracked and resolved in Jira. Additionally, users can leverage this integration to gain real-time insights and maintain a comprehensive view of their security posture within the Jira environment.

---

Source: /integrations/outbound-directory/jira/terms-and-conditions

# Terms and Conditions

**Effective Date: 13/01/2025**

These Customer Terms of Service (“Terms”) govern the use of the JupiterOne Jira Integration application ("App") provided by JupiterOne ("we", "our", or "us") on the Atlassian Marketplace for integration with Jira. By installing, accessing, or using the App, you agree to be bound by these Terms. If you do not agree to these Terms, you may not use the App.

## 1\. License Grant

### 1.1 License

We grant you a non-exclusive, non-transferable, revocable license to install and use the App solely for internal business purposes within your organization, subject to the terms of this agreement.

### 1.2 Usage Restrictions

You shall not:

-   Sublicense, lease, distribute, transfer, or assign the App.
-   Reverse-engineer, decompile, or disassemble the App.
-   Use the App in any manner that violates applicable laws or regulations.

## 2\. Pricing and Payments

### 2.1 Pricing

The pricing for the App is as stated on the Atlassian Marketplace listing. Pricing may vary depending on the number of users or features selected.

### 2.2 Payment

Payments for the App are processed via the Atlassian Marketplace, and you agree to pay the applicable subscription fees in accordance with Atlassian’s payment terms.

### 2.3 Subscription Term and Renewal

Subscriptions may be charged on a monthly or annual basis, as selected at the time of purchase. Subscriptions automatically renew unless canceled prior to the renewal date.

### 2.4 Refund Policy

Unless required by law, we do not offer refunds for subscription fees, except in cases where the App is found to be non-functional or fails to meet the agreed-upon specifications.

## 3\. Trial Period

### 3.1 Trial Period

If a trial period is offered, you may use the App free of charge for the trial duration specified in the Marketplace listing. After the trial period ends, you will be charged according to the pricing plan selected unless you cancel the subscription before the trial expires.

## 4\. Support and Maintenance

### 4.1 Support

We provide support for the App as specified in the Atlassian Marketplace listing. Support requests can be made by sending an email to [support@jupiterone.com](mailto:support@jupiterone.com), and we will respond to such requests within a reasonable timeframe.

### 4.2 Updates

We may provide updates, bug fixes, or new versions of the App. You are responsible for keeping the App up to date, and updates will be made available to you as part of your subscription.

## 5\. Data Privacy and Security

### 5.1 Data Collection

The App may collect certain data, including but not limited to usage statistics, error logs, and other information necessary for support and improvement purposes. We will handle all customer data in accordance with our Privacy Policy.

### 5.2 Data Security

We implement reasonable security measures to protect your data. However, we do not guarantee that your data will be completely secure.

### 5.3 Data Usage

We will not sell or rent your personal data to third parties. We may use aggregated, non-personally identifiable data to improve the App and provide better services.

## 6\. Intellectual Property

### 6.1 Ownership

We retain all rights, titles, and interest in and to the App, including all intellectual property rights. You do not acquire any ownership rights in the App, other than the limited rights expressly granted in these Terms.

### 6.2 User Content

You retain ownership of any content you input into the App but grant us a license to use such content to provide the services described in these Terms.

## 7\. Termination

### 7.1 Termination by You

You may terminate your subscription at any time by canceling through the Atlassian Marketplace. Your access to the App will continue until the end of your current billing cycle.

### 7.2 Termination by Us

We may terminate or suspend your access to the App at any time if you breach these Terms, fail to make payment, or otherwise engage in conduct that we deem inappropriate.

### 7.3 Effect of Termination

Upon termination of this agreement, you must cease using the App and remove it from your Jira instance. Any fees paid up to the date of termination are non-refundable.

## 8\. Limitation of Liability

### 8.1 No Warranty

The App is provided "as-is" without warranty of any kind, either express or implied, including but not limited to implied warranties of merchantability or fitness for a particular purpose.

### 8.2 Limitation of Liability

To the maximum extent permitted by law, we are not liable for any indirect, incidental, special, consequential, or punitive damages, or loss of profits, data, or goodwill, arising from or related to your use of the App.

## 9\. Governing Law and Dispute Resolution

### 9.1 Governing Law

These Terms shall be governed by and construed in accordance with the laws of \[Your Jurisdiction\].

### 9.2 Dispute Resolution

Any disputes arising out of or in connection with these Terms shall be resolved through \[arbitration/mediation\] in \[Location\], in accordance with the rules of \[Arbitration Organization\].

## 10\. Changes to These Terms

### 10.1 Amendments

We may update these Terms from time to time by posting a new version on the Atlassian Marketplace. You will be notified of significant changes through the App or via email.

### 10.2 Effective Date

Any updates to these Terms will become effective on the date they are posted.

## 11\. Miscellaneous

### 11.1 Entire Agreement

These Terms constitute the entire agreement between you and us with respect to the App and supersede all prior agreements, whether written or oral.

### 11.2 Severability

If any provision of these Terms is found to be unenforceable, the remaining provisions shall remain in full effect.

---

Source: /integrations/outbound-directory/n8n-community-node

# n8n Community Node

## Overview

JupiterOne provides an n8n node for collecting JupiterOne data as part of your n8n workflows. Currently two nodes are supported; Query and Webhook.

Use the JupiterOne n8n nodes for building automation workflows based of data or events in JupiterOne!

## Installation

### Self Hosted n8n

If you are running your own n8n instance it is possible to install the JupiterOne node using the following steps:

1.  Navigate in n8n to Settings > Community Nodes
2.  Enter the node name `n8n-nodes-jupiterone`
3.  Click `install` and the node should be installed

### n8n Cloud

> **INFO**
> 
> The JupiterOne n8n node is currently pending acceptance into the n8n Community Node ecosystem. It is only possible to install the JupiterOne node in self managed n8n instances today.

## Using the Nodes

### Credentials

To use the n8n query node it is necessary to configure credentials to access the JupiterOne API.

To configure credentials in n8n:

1.  Go to Create Credentials and choose `JupiterOne API`
2.  Provide an account ID
3.  Provide an API Key
4.  If necessary modify the API endpoint to use; the default endpoint is for the US region.
5.  Click Save

The credentials are automatically validated against JupiterOne, and if valid will be successfully saved.

For details on creating JupiterOne API access keys see the documentation [here](/api/authentication.md#creating-api-keys-within-the-dashboard).

### Query Node

To use the JupiterOne query node you first add the node to your workflow. You then configure the following parameters:

-   Select or create the credentials needed for your account
-   Enter the JupiterOne query you wish to run
-   Select a LIMIT on the number of results returned (max: 10,000)

You can preview the results returned using the "Execute Step" button

![n8n Configuration Page](/assets/images/n8n-node-config-08b79890dbda7fede04d36881afe57bc.png)

#### LIMIT Parameter

The n8n node supports returning between 1-10,000 results. This limit is managed outside of the J1QL query itself and you should not include `LIMIT` parameters in the query directly. The `LIMIT` has a maximum value of `10,000` in n8n workflows to prevent brining too many results into your workflow.

### Webhook Node

The webhook node can be used to trigger n8n workflows based on the webhook output from a JupiterOne rule. To ensure that your n8n workflow is only triggered from authorised sources it is strongly recommended to provide an additional header in your JupiterOne rule.

To use the webhook node from a JupiterOne rule:

1.  Add the JupiterOne Webhook node to your workflow
2.  Set a webhook header token for authentication (recommended)

In JupiterOne configure the webhook action for your alert and ensure that, if required in n8n, the webhook authentication header is also set.

---

Source: /integrations/settings

# Integration Settings

Integrations configured from the JupiterOne Integration application have various configuration settings that are described in this document. Some of these configuration settings have a direct impact on the integration execution lifecycle and other settings have a direct impact on the graph objects that are ingested into the JupiterOne graph.

## Account Name

The "Account Name" configuration field is a required field that is used as a "display name" for the integration instance. The Account Name value is not unique to an account, but it is recommended to keep the Account Name value unique for organization.

Sample values:

-   Production
-   the-production-account

## Description

The "Description" field is an optional field that exists only to supply JupiterOne users with additional details about the specific integration instance.

Sample values:

-   "AWS Production account in us-east-1"

## Polling Intervals

Integration polling intervals represent the frequency that the JupiterOne managed integration platform executes each integration. For example, if an integration is configured on a `ONE_DAY` polling interval, the integration will run once every 24 hours. Additionally, each customer integration is scheduled to run at roughly the same respective time every day. If your integration's first scheduled execution happens at 12:00pm, your next scheduled integration execution should also happen roughly at 12:00pm.

**Supported polling intervals**:

| Polling Interval | Description |
| --- | --- |
| `DISABLED` | This integration will never be scheduled by the managed JupiterOne integration platform. However, the integration may be manually executed via the UI or API. |
| `ONE_WEEK` | Executed once per week |
| `ONE_DAY` | Executed once per day |
| `TWELVE_HOURS` | Executed once every twelve hours |
| `EIGHT_HOURS` | Executed once every eight hours |
| `FOUR_HOURS` | Executed once every four hours |
| `ONE_HOUR` | Executed once every hour |

## Data Sources

An instance can be configured to enable or disable specific data sources within an integration. This is useful for integrations that have multiple data sources, but you only want to enable a subset of them. For example, the AWS integration has a data source for `CloudTrail` and `CloudWatch`. If you only want to ingest data from `CloudTrail`, you can disable the `CloudWatch` data source.

For more information, check out [Data Sources](/integrations/data-sources.md).

The Data Sources settings is available for many integrations. It can be found in the "Advanced Options" section when creating or editing an integration instance. ![Data Sources Example](/assets/images/data-sources-1-14c4b498c5fe4a3ab4b3204654cb56f5.png)

Adjusting data sources is easily done by moving the items left or right in the list. ![Data Sources Example](/assets/images/data-sources-2-12a5b0536855d1aa4e300905506bfda6.png)

## Tags

Tags can be configured along with integrations. Each tag key and value will be automatically propagated onto entities that are produced by the integration where the respective entity tag property names are prefixed with `tag.` (e.g. `tag.AccountName`). The JupiterOne Integration application has a few recommended tags that can be automatically enabled/disabled via toggle. Additionally, JupiterOne users may create custom tags of their own.

Recommended default tags for JupiterOne Integrations:

| Tag Name | Tag Description | Data Type | Value |
| --- | --- | --- | --- |
| `AccountName` | The vendor account that this integration is associated with. The value is automatically inherited from the integration "Account Name" field. | `string` | `{{Integration Account Name}}` |
| `Production` | Whether the integration's vendor account represents a _production_ account or not. | `boolean` | `true` |

### Custom Tags

Custom tags can be defined when creating or editing an integration instance. For custom tags a static key and value can be used on a per-integration instance basis, for example to tag which business unit owns a particular account or service. Load the custom tags option by opening the `Advanced Options` section when editing an integration instance (see image below).

> **INFO**
> 
> If you don't see the "Custom Tags" option please check that you are editing/creating the integration instance and not just viewing it

![Highlight Custom Tags Config](/assets/images/integration-custom-tags-70418b5a1c7bce6a0ddf173b0cd899b4.png)

---

Source: /j1ql

# J1QL Overview

The JupiterOne Query Language (J1QL) is a powerful natural query language designed for querying and analyzing data in the JupiterOne platform. It provides a flexible and intuitive way to retrieve information from the graph database and perform complex data operations.

With J1QL, you can search for specific assets, filter results based on various criteria, traverse relationships, perform mathematical calculations, and more. It offers a comprehensive set of features and functions to facilitate data exploration, analysis, and reporting within the JupiterOne ecosystem.

## Getting started with J1QL

J1QL is inspired by SQL and Cypher and aspires to be as close to natural language as possible. The execution of a J1QL query seamlessly queries a full-text search, asset-relationship graph, and any other future data stores, as needed.

Depending on your familiarity with querying languages and J1QL specifically, here are some useful places to learn the basics of J1QL, dive into querying with J1QL, or explore example queries and common questions.

> **INFO**
> 
> JupiterOne AI supports natural language querying — ask questions in plain English and get J1QL queries generated automatically. [Learn more →](/features/jupiterone-ai/ai-capabilities.md#natural-language-search)

[

![](/icons/illustrations/orbit.svg)![](/icons/illustrations/orbit.svg)

Learn J1QL

Dive into the basics of J1QL and gain functional and conceptual knowledge of how to effectively query your data in JupiterOne.





](/j1ql/basic-keywords.md)[

![](/icons/illustrations/puzzle.svg)![](/icons/illustrations/puzzle.svg)

Get Started

Jump into querying in your JupiterOne workspace and gain practical experience executing queries and exploring their results.





](/j1ql/basic-keywords.md)[

![](/icons/illustrations/tree.svg)![](/icons/illustrations/tree.svg)

Basic Queries

Explore basic J1QL example queries by use case.





](/j1ql/basic-queries.md)[

![](/icons/illustrations/shuttle.svg)![](/icons/illustrations/shuttle.svg)

Question Library

View the comprehensive J1QL query library featuring a wide range of queries relating to integrations and use cases.





](http://ask.us.jupiterone.io/)

---

Source: /j1ql/aggregate-functions

# Aggregate functions

J1QL offers powerful aggregate functions that allow you to perform calculations on groups of entities and derive meaningful insights from your data. These functions include SUM, AVG, MIN, MAX, and COUNT, which can be applied to numerical or date properties. By using these aggregate functions in your queries, you can efficiently summarize data, calculate totals or averages, identify minimum and maximum values, and determine the count of entities that meet specific criteria.

Supported aggregating functions (not case sensitive) in J1QL are:

-   `COUNT(selector)`
-   `COUNT(selector.field)`
-   `MIN(selector.field)`
-   `MAX(selector.field)`
-   `AVG(selector.field)`
-   `SUM(selector.field)`

Below are a few example queries implementing an aggregate function:

```j1ql
FIND bitbucket_team AS team
  THAT RELATES TO bitbucket_user AS user
RETURN team.name, COUNT(user)
```

```j1ql
FIND bitbucket_team AS team
  THAT RELATES TO bitbucket_user AS user
RETURN COUNT(user), AVG(user.age)
```

### Aggregation application

There are three different ways for aggregations to be applied:

-   On the customer's subgraph (determined by the traversal that is run).
-   On a portion of the customer's subgraph relative to a set of entities (groupings).
-   On data for a single entity.

The way aggregations happen is determined by what is requested via the query language's `RETURN` clause.

### Aggregations relative to a subgraph

If all selectors are aggregations, then all aggregations will be scoped to the entire traversal that the user has requested and not tied to individual entities.

Example: RETURN COUNT(acct), COUNT(user)

```md
FIND Account AS acct
  THAT HAS User AS user
RETURN COUNT(acct), COUNT(user)
```

### Aggregations relative to a grouping by entity attribute

If selectors are provided that do not use an aggregation function, they will be used as a _grouping key_. This key will be used to apply the aggregations relative to the data chosen.

Example: RETURN acct.\_type, COUNT(user)

```md
FIND Account AS acct
  THAT HAS User AS user
RETURN acct._type, COUNT(user)
```

### Aggregations relative to a grouping by multiple attributes

If multiple attributes of a selector are included the return function, the last one before the aggregation will be used as the _grouping key_.

Example: return acct.\_type, acct.displayName, COUNT(user)

```md
FIND Account AS acct
  THAT HAS User AS user
RETURN acct._type, acct.displayName, COUNT(user)
```

## Additional examples

`COUNT` always returns the number of distinct entities or attributes requested. We'll illustrate an example below with the following data:

| id | class | name | lead |
| --- | --- | --- | --- |
| 1 | bitbucket\_team | team1 | alice |
| 2 | bitbucket\_team | team2 | bob |
| 3 | bitbucket\_team | team3 | alice |

Example query

```md
FIND bitbucket_team AS team
RETURN COUNT(team.lead)
```

Our results would look like this:

Response

```json
{
  "type": "table",
  "data": [
    { "COUNT(team.lead)": 2 }
  ]
}
```

#### Single grouping key

For example, with the following query,

```md
FIND bitbucket_team AS team
  THAT RELATES TO bitbucket_user AS user
RETURN team.name, COUNT(user)
```

the result will be:

Response

```json
{
  "type": "table",
  "data": [
    { "team.name": "team1", "COUNT(user)": 25 },
    { "team.name": "team2", "COUNT(user)": 5 }
  ]
}
```

In this case, the `team.name` acts as the key that groups aggregations together. So `COUNT(user)` finds the count of users relative to each team.

#### Multiple grouping keys

When there are return selectors that are not aggregating functions, the aggregating functions will be performed relative to the identifier that it is closer to in the traversal.

Example query

```md
FIND bitbucket_project AS project
  THAT RELATES TO bitbucket_team AS team
  THAT RELATES TO bitbucket_user AS user
RETURN project.name, team.name, COUNT(user)
```

The `COUNT(user)` aggregation will be performed relative to the team, because the `team` traversal is closer to the `user` traversal in the query.

Response

```json
{
  "type": "table",
  "data": [
    { "project.name": "JupiterOne", "team.name": "team1", "COUNT(user)": 25 },
    { "project.name": "JupiterOne", "team.name": "team2", "COUNT(user)": 5 },
    { "project.name": "Windbreaker", "team.name": "team2", "COUNT(user)": 5 }
  ]
}
```

If the `RETURN` statement is changed to this:

Example query

```md
RETURN project.name, COUNT(user)
```

The `COUNT(user)` aggregation will be performed relative to the project.

```json
{
  "type": "table",
  "data": [
    { "project.name": "JupiterOne", "COUNT(user)": 50 },
    { "project.name": "Windbreaker", "COUNT(user)": 5 }
  ]
}
```

#### Example relative to a single entity

If a selector is specified and an aggregating function is applied to that selector's source identifier in some way, aggregations will happen locally to the element.

Example:

Example query

```md
FIND bitbucket_project AS project
  THAT RELATES TO bitbucket_team AS team
  THAT RELATES TO bitbucket_user AS user
RETURN project.name, COUNT(project.aliases), team.name, COUNT(user)
```

Example result:

Response

```json
{
  "type": "table",
  "data": [
    {
      "project.name": "JupiterOne",
      "COUNT(project.aliases)": 1,
      "team.name": "team1",
      "COUNT(user)": 25
    },
    {
      "project.name": "JupiterOne",
      "COUNT(project.aliases)": 1,
      "team.name": "team2",
      "COUNT(user)": 5
    },
    {
      "project.name": "Windbreaker",
      "COUNT(project.aliases)": 5,
      "team.name": "team2",
      "COUNT(user)": 5
    }
  ]
}
```

---

Source: /j1ql/basic-keywords

# J1QL: Basic Keywords

In this article, we'll cover the basic commands of J1QL, a query language used for data exploration and retrieval in JupiterOne. By understanding these fundamental commands, you'll gain the necessary skills to query specific entities, filter data, and sort information effectively. Whether you're a beginner or have prior experience in programming languages, this guide will equip you with the essential knowledge to navigate and extract valuable insights from your data using J1QL.

> **NOTE**
> 
> J1QL keywords are not case-sensitive

## FIND

FIND simplifies the search process for assets or entities by allowing users to specify either the `_class` or `_type` value. By making the value case-sensitive, the command automatically determines whether the search should be based on `class` or `type`, eliminating the need for explicit input.

An asset `class` is stored in `TitleCase` while `_type` is stored in `snake_case`. A wildcard `*` can be used to find any asset. For example:

-   `FIND` User is equivalent to `FIND * WITH _class = "User"`
-   `FIND aws_iam_user` is equivalent to `FIND * WITH _type = "aws_iam_user"`

## WITH

`WITH` offers valuable filtering capabilities by allowing users to specify property names and values to narrow down asset results. `WITH` is followed by **property names and values to filter entities**. The `WITH` command empowers users to precisely filter and retrieve the desired entities, enhancing the efficiency and accuracy of data exploration and retrieval in J1QL.

> **INFO**
> 
> For a list of all compatible comparison operators, see our dedicated guide covering [J1QL comparisons](/j1ql/comparisons.md).

There are several considerations to note when working with `WITH`:

-   The property names are always case-sensitive, property values are also case-sensitive except when using regex in case insensitive mode.
-   **String** values must be wrapped in either single or double quotes (preferred) - `"value"` or `'value'`.
-   **Boolean**, **Number**, and **Date** values must not be wrapped in quotes.
-   The `undefined` keyword can be used to filter on the absence of a property. For example: `FIND DataStore WITH encrypted = undefined`.
-   If a property name contains special characters (e.g. `-` or `:`), you can wrap the property name in `[]`. For example: `[tag.special-name] = "something"`.

## AND / OR

Using `AND` / `OR` in J1QL provides powerful capabilities for comparing multiple properties in asset filtering. By supporting logical operators like `AND` and `OR`, users can construct complex property comparisons to precisely retrieve entities that meet specific criteria. J1QL's shorthand filtering further enhances efficiency by allowing filtering of a single property against multiple values, similar to the `IN` clause in SQL. With a clear order of operations and intuitive syntax, `AND` / `OR` enables advanced filtering operations and extracts targeted data with ease and precision.

Here are some examples illustrating how to utilize `AND` and `OR` within a query:

AND example

```md
FIND DataStore WITH encrypted = false AND (tag.Production = true AND classification = "critical")
```

OR example

```md
FIND user_endpoint WITH platform = "darwin" OR platform = "linux"
```

Additionally, you can filter multiple property values like this (similar to `IN` in SQL):

```j1ql
FIND user_endpoint WITH platform = ("darwin" OR "linux")

FIND Host WITH tag.Environment = ("A" OR "B" OR "C")

FIND DataStore WITH classification != ("critical" OR "restricted")
```

> **NOTE**
> 
> Note that property filters are evaluated according to the following order of operations: Parenthesis first, comparisons (`=`, `>=`, `<=`, `!=`) after, `AND`, and then `OR`.

### Shorthand filtering

Filtering multiple property values is often called "shorthand" filtering because it allows you to filter a single property by multiple values. Below is a table to help illustrate how "shorthand" filters are evaluated:

| `_type` | `_type = "fruit"` | `_type = "nut-filled"` | `_type = ("fruit" AND "nut-filled")` | `_type = ("fruit" OR "nut-filled")` |
| --- | --- | --- | --- | --- |
| "fruit" | true | false | false | true |
| "nut-filled" | false | true | false | true |
| "fruit", "nut-filled" | true | true | true | true |
| "non-fruit" | false | false | false | false |
| "non-fruit", "plain" | false | false | false | false |
| undefined | false | false | false | false |

When using a _negated_ "shorthand" filter, such as with the `!=` comparison, you can expect J1QL to evaluate values in the following manner:

| `_type` | `_type != "fruit"` | `type != "nut-filled"` | `_type != ("fruit" AND "nut-filled")` | `_type != ("fruit" OR "nut-filled")` |
| --- | --- | --- | --- | --- |
| "fruit" | false | true | true | false |
| "nut-filled" | true | false | true | false |
| "fruit", "nut-filled" | false | false | false | false |
| "non-fruit" | true | true | true | true |
| "non-fruit", "plain" | true | true | true | true |
| undefined | true | true | true | true |

## THAT

The `THAT` command in J1QL provides a versatile way to specify relationship verbs and filter entities based on their connected relationships. By allowing users to define relationship verbs in `ALLCAPS`, J1QL simplifies the process of finding relationships between different asset nodes. This enables mixing asset `class` and `type` values together, and bidirectional relationship verbs are supported by default, ensuring flexibility in querying relationships. Additionally, J1QL provides options to specify relationship direction using double arrows (`<<` or `>>`) and allows negation of relationships for querying entities without specific relationships. The inclusion of the `AS` command allows users to define aliased selectors for convenient use in `WHERE` or `RETURN` sections of queries.

> **NOTE**
> 
> Using the wildcard at the beginning of the query without any pre-traversal filtering–that is, `FIND * THAT ...` without `WITH` may result in a long query execution time.

Example query using `THAT`:

```j1ql
FIND Service
  THAT RELATES TO Account
```

You can use ( `|` ) when performing a `THAT` query to select entities or relationships of different classes and types. For example, `FIND (Host|Device) WITH ipAddress='XX.XX.X.XX'` is equivalent to (and much simpler) than the following:

```j1ql
FIND * WITH (_class='Host' OR _class='Device') AND ipAddress='XX.XX.X.XX'
```

### THAT asset class types and relationships

Asset class and type values can be used together while using `THAT`:

```j1ql
FIND (Database|aws_s3_bucket)
```

It can also be used on Relationship verbs:

```j1ql
FIND HostAgent
  THAT (MONITORS|PROTECTS) Host
```

And even allows both Assets and Relationships:

```j1ql
FIND *
  THAT (ALLOWS|PERMITS) (Internet|Everyone)
```

### Relationship verbs

By default Relationship verbs are bi-directional. For example, the following queries would yield the same results:

```j1ql
FIND User
  THAT HAS Device
```

```j1ql
FIND Device
  THAT HAS User
```

#### Relationship direction operators

Aside from operating bi-directionally, a Relationship’s direction can be specified using double arrows after the verb:

Finds assets with a HAS relationship from User to Device:

```md
FIND User
  THAT HAS >> Device
```

```j1ql
FIND Device
  THAT HAS << User
```

Finds assets with a HAS relationship from Device to User:

```md
FIND User
  THAT HAS << Device
```

```j1ql
FIND Device
  THAT HAS >> User
```

In the above examples, each query can leverage a directional relationship based on the desired target (i.e., User or Device).

#### Negating relationships

You can also determine if an asset does not have a relationship with another by negating the relationship. This can be achieved by prefixing a relationship with an exclamation point (`!`).

1\. Example of using a negation:

```md
FIND User
  THAT !IS Person
```

2\. Applying a negation to relationships:

```md
FIND User
  THAT !RELATES TO Person
```

> **WARNING**
> 
> It is not valid to alias the result of a negated relationship. Whilst this may produce results the behaviour is undefined.
> 
> The following will produce undefined behaviour:
> 
> ```j1ql
> FIND User
>   THAT !RELATES TO Person AS p
> RETURN p
> ```

##### Negating a relationship use case

This finds EBS volumes that are not in use. The query finds relationships regardless of the edge direction, therefore the `!USES` in the below query translates more directly as "is not used by".

```j1ql
FIND aws_ebs_volume
  THAT !USES aws_instance
```

It is important to note that the above query returns `aws_ebs_volume` entities. If the query were constructed the other way around, it would return a list of `aws_instances`, if it does not have an EBS volume attached:

```j1ql
FIND aws_instance
  THAT !USES aws_ebs_volume
```

## AS

The `AS` command in J1QL allows users to define aliased selectors, providing flexibility in specifying assets or relationships to be used in the `WHERE` or `RETURN` sections of a query. By using aliases, you can assign meaningful names to selected entities or relationships, enhancing query readability and making it easier to reference them later in the query.

**For example:**

Without selectors

```j1ql
FIND Firewall
  THAT ALLOWS *
```

With selectors

```j1ql
FIND Firewall AS fw
  THAT ALLOWS * AS n
```

**Additionally, selectors can also be defined on a relationship:**

```j1ql
FIND Firewall AS fw
  THAT ALLOWS AS rule * AS n
```

## WHERE

Using `WHERE` facilitates post-traversal filtering by allowing you to apply additional conditions to narrow down the results of a query. By leveraging the selector defined in the query, you can specify filtering criteria based on various properties or relationships. `WHERE` allows for ease of refinement of queries to retrieve only the results that meet specific conditions, enabling precise data extraction and analysis.

For example:

```j1ql
FIND Firewall AS fw
  THAT ALLOWS AS rule * AS n
WHERE rule.ingress=true AND (rule.fromPort=22 OR rule.toPort=22)
```

## RETURN

`RETURN` allows you to specify the assets, relationships, or properties you want to retrieve from the query results. By using the `RETURN` clause, you can selectively choose the desired information to be included in the output, enhancing data relevance and reducing unnecessary data retrieval. The `RETURN` command provides flexibility in querying and enables targeting specific assets or properties of interest, optimizing data analysis and facilitating efficient information extraction.

By default, the assets and their properties found from the start of the traversal are returned in a query. For example, `Find User that IS Person`returns all matching `User` assets and their properties, but not the related `Person` entities. To return properties from both the `User` and `Person` entities, define a selector for each and use them in the `RETURN` clause like so:

Defining a selector

```md
FIND User AS u
  THAT IS Person AS p
RETURN u.username, p.firstName, p.lastName, p.email
```

This means that a `Person` having multiple `IS` relationships to `User` entities will have their `p.firstName`, `p.lastName`, and `p.email` values returned in each path through the graph that leads to that `User`:

User with multple paths

```md
| u.username | p.firstName | p.lastName | p.email                        |
|------------|-------------|------------|--------------------------------|
| spiderman  | Peter       | Parker     | not.spiderman@example.com      |
| batman     | Bruce       | Wayne      | totally.not.batman@example.com |
| bwayne     | Bruce       | Wayne      | totally.not.batman@example.com |
```

> **NOTE**
> 
> When the `RETURN` statement is used with specified properties, the J1QL engine will pick out the properties from each path traversed. Sometimes, the path to the end of the query can fork since there are multiple ways assets can relate to each other. This means that a Person having multiple `IS` relationships to User entities will have their `p.firstName`, `p.lastName`, and `p.email` values returned in each path through the graph that leads to a User.

#### Using RETURN with special characters

If a property name contains special characters (e.g. `-` or `:`), you can wrap the property name in `[]`.

```j1ql
FIND User AS u
  THAT IS Person AS p
RETURN u.username, p.firstName, p.lastName, p.email, p.[special-name]
```

Results from the query will contain the relevant `p.[special-name]` entities per `User`:

```text
| u.username | p.firstName | p.lastName | p.email                        | p.special-name |
|------------|-------------|------------|--------------------------------|----------------|
| spiderman  | Peter       | Parker     | not.spiderman@example.com      | Spiderman      |
| batman     | Bruce       | Wayne      | totally.not.batman@example.com | Batman         |
| bwayne     | Bruce       | Wayne      | totally.not.batman@example.com | Batman         |
```

#### Using RETURN with a wildcard

Wildcard can be used to return all properties for multiple assets in a flattened table. For example:

RETURN query with wildcard

```j1ql
FIND User AS u
  THAT IS Person AS p
RETURN u.*, p.*
```

Using a wildcard to return **all** properties also returns **all** metadata properties associated with the selected assets. This feature is useful when you want to perform an analysis that involves metadata.

#### Asset and Relationship reference

Using the RETURN clause, the J1QL query engine returns back only the requested information.

Results would typically be returned like this via the API:

```json
{
  "type": "table",
  "data": [
    { "User._type": "jupiterone_user", "Person.name": "Mochi" }
  ]
}
```

When executing queries via the application, additional metadata is returned back for each row with references to the assets and relationships traversed via the paths. This resides under a `_meta` property that is attached to each row in the query:

```json
{
  "type": "table",
  "data": [
    {
      "User._type": "jupiterone_user",
      "Person.name": "Mochi",
      "_meta": {
        "byAlias": {
          "User": {
            "id": "f4b7cfbb-8532-dbcb-b244-e2864423fccd",
            "entity": {
              "_id": "4147b2bc-3b65-42a8-be50-164a45c4864d"
            }
          },
          "Person": {
            "id": "952f0d8c-19dc-4dde-a3bf-e6ce0cda85a7",
            "entity": {
              "_id": "cdbceb28-e066-4006-9456-225ddb358d16"
            }
          }
        }
      }
    }
  ]
}
```

> **NOTE**
> 
> Note that when row metadata is requested via API, usage of the `UNIQUE` keyword or aggregations will cause the `_meta` property to be stripped from rows.

## HAVING

The `HAVING` clause in J1QL allows you to filter the results of a query based on aggregate values of the assets or relationships returned. It is used to specify conditions that must be met for a row to be included in the result set. The `HAVING` clause is often used in conjunction with aggregate functions in the `RETURN` clause to filter the results of aggregate functions.

Example query to find users with more than one email address:

HAVING query

```j1ql
FIND User AS u
  THAT IS Person AS p
RETURN u.username, p.firstName, p.lastName, p.email, COUNT(p.email) AS emailCount
HAVING emailCount > 1
```

Example query finding Hosts and Devices with an average finding score greater than 7:

HAVING query

```j1ql
FIND (Device|Host) AS h
  THAT HAS Finding AS f
RETURN h.displayName, h.fqdn, AVG(f.numericSeverity) AS avgSeverity
HAVING avgSeverity > 7
```

It is also possible to include multiple conditions in the `HAVING` clause using the `AND` and `OR` operators, and parentheses to group conditions.

HAVING query

```j1ql
FIND (Host|Device) AS h
  THAT RELATES TO Finding AS f
RETURN h.displayName, COUNT(f) AS findingCount, MAX(f.numericSeverity) AS maxSeverity
HAVING findingCount > 10 AND (maxSeverity > 7 OR maxSeverity = undefined)
```

## TO

The `TO` command in J1QL provides a natural language-like syntax for expressing relationships between entities. By using the `TO` keyword after a relationship verb, you can create queries that closely resemble human language, enhancing query readability and ease of use. While `TO` is considered a "filler" word that is ignored by the interpreter, its inclusion allows you to construct queries that align with their natural language understanding, making the query-writing process more intuitive.

The following are some example relationship verbs where `TO` could be used:

-   `DEPLOYED TO`
-   `CONTRIBUTES TO`
-   `CONNECTS TO`
-   `ASSIGNED TO`

The below queries are executed the same way and return the same results:

TO query comparison

```md
FIND User
  THAT CONTRIBUTES TO CodeRepo
```

```j1ql
FIND User
  THAT CONTRIBUTES CoreRepo
```

## Commenting

J1QL supports comenting in queries anywhere in JupiterOne using the following format: `/* {insert comment here} */`

This is useful for annotating queries across JupiterOne users in order to communicate intention on variables, findings, and other contextual information related to the query itself.

Using comments in a query

```md
FIND aws_security_group WITH displayName ~='elb' /*ELB Security Group*/
  OR displayName ~='lambda' /*Lambda Security Group*/
```

## Conclusion

In conclusion, understanding the basic J1QL commands is crucial for effective querying in JupiterOne's graph database. By mastering these common J1QL keywords, you can extract valuable insights and perform data analysis within the platform. This proficiency empowers users to uncover connections and make informed decisions in security and compliance efforts.

To build further proficiency in J1QL, continue on to learn more about J1QL’s filtering behavior and understand how to curate your query results by applying filtering.

---

Source: /j1ql/basic-queries

# Basic queries

These examples, and same with all packaged queries provided in the JupiterOne web apps, are constructed in a way to de-emphasize the query keywords (they are _case insensitive_) but rather to highlight the relationships—the operational context and significance of each query.

### Simple Examples

**Find any entity that is unencrypted**

```j1ql
FIND * WITH encrypted = false
```

**Find all entities of class DataStore that are unencrypted**

```j1ql
FIND DataStore WITH encrypted = false
```

**Find all entities of type aws\_ebs\_volume that are unencrypted**

```j1ql
FIND aws_ebs_volume WITH encrypted = false
```

### Query with relationships

**Return just the Firewall entities that protects public-facing hosts**

```j1ql
FIND Firewall
  THAT PROTECTS Host WITH public = true
```

**Return Firewall and Host entities that matched query**

```j1ql
FIND Firewall AS f
  THAT PROTECTS Host WITH public = true AS h
RETURN f, h
```

**Return all the entities and relationships that were traversed as a tree**

```j1ql
FIND Firewall
  THAT PROTECTS Host WITH public = true
RETURN tree
```

### Full-text search

**Find any and all entities with "127.0.0.1" in some property value**

```j1ql
FIND "127.0.0.1"
```

**The FIND keyword is optional**

```j1ql
"127.0.0.1"
```

**Find all hosts that have "127.0.0.1" in some property value**

```j1ql
FIND "127.0.0.1" WITH _class='Host'
```

> **INFO**
> 
> Full-text search is a case-insensitive "contains" match against the human-readable property values on an entity. Three kinds of value are deliberately not indexed:
> 
> -   **Serialized JSON documents** — properties whose value is a JSON object or array, such as `policyDocument`, `ingressRules`, or `parameters`.
> -   **Booleans** — `true` and `false`.
> -   **Epoch-millisecond timestamps** — for example `1789430400000`. Dates that an integration also emits as a formatted string remain searchable through that string.
> 
> These properties are unchanged on the entity and are still returned in results. To search inside them, filter on the property directly with the `~=` (contains) operator:
> 
> ```j1ql
> FIND aws_iam_role WITH policyDocument ~= "s3:getobject"
> ```
> 
> See [What's new in Asset Data](/features/assets/whats-new-in-asset-data.md) for the full detail, and [regular expressions](/j1ql/regular-expressions.md) for more advanced matching.

### More complex queries

Find critical data stored outside of production environments.

This assumes you have the appropriate tags (Classification and Production) on your entities.

```j1ql
FIND DataStore WITH tag.Classification = "critical"
  THAT HAS * WITH tag.Production = "false"
```

Find all users and their devices without the required endpoint protection agent installed:

```j1ql
FIND Person
  THAT HAS Device
  THAT !PROTECTS HostAgent
```

Find incorrectly tagged resources in AWS:

```j1ql
FIND * AS r
  THAT RELATES TO Service
  THAT RELATES TO aws_account
WHERE r.tag.AccountName != r.tag.Environment
```

If your users sign on to AWS via single sign on, you can find out who has access to those AWS accounts via SSO:

```j1ql
FIND User AS u
  THAT ASSIGNED Application AS app
  THAT CONNECTS aws_account AS aws
RETURN u.displayName as User, app.tag.AccountName as IdP, app.displayName as ssoApplication,
  app.signOnMode as signOnMode, aws.name as awsAccount
```

---

Source: /j1ql/cidr-filtering

# CIDR Filtering

J1QL supports filtering entities by whether an IP address property falls within a CIDR (Classless Inter-Domain Routing) range. This is useful for security and networking queries such as finding all hosts within a specific network segment.

## Syntax

The `cidr()` function takes two arguments:

1.  The property containing an IP address
2.  A CIDR range string

```text
cidr(property, 'network/prefix')
```

The function can be negated with `!` to exclude matching entities:

```text
!cidr(property, 'network/prefix')
```

> **NOTE**
> 
> Only IPv4 addresses are supported.

## Using CIDR in WITH Clauses

Use `cidr()` in a `WITH` clause to filter entities during traversal:

```j1ql
FIND Host WITH cidr(ipAddress, '10.0.0.0/8')
```

This returns all `Host` entities whose `ipAddress` falls within the `10.0.0.0/8` range (10.0.0.0 - 10.255.255.255).

### Negation

Prefix with `!` to find entities outside a range:

```j1ql
FIND Host WITH !cidr(ipAddress, '10.0.0.0/8')
```

### Combining with Other Filters

`cidr()` can be combined with other property filters using `AND` and `OR`:

```j1ql
FIND Host WITH cidr(ipAddress, '10.0.0.0/8') AND active = true
```

```j1ql
FIND Host WITH cidr(ipAddress, '10.0.0.0/8') OR cidr(ipAddress, '172.16.0.0/12')
```

## Using CIDR in WHERE Clauses

Use `cidr()` in a `WHERE` clause for post-traversal filtering. The property must be referenced using a selector alias:

```j1ql
FIND Host AS h
  THAT CONNECTS TO Network AS n
WHERE cidr(h.ipAddress, '192.168.0.0/16')
```

Negation works the same way in `WHERE` clauses:

```j1ql
FIND Host AS h WHERE !cidr(h.ipAddress, '10.0.0.0/8')
```

## Common CIDR Ranges

The following table lists commonly used CIDR ranges for reference:

| CIDR Range | Description | Address Range |
| --- | --- | --- |
| `10.0.0.0/8` | Class A private network | 10.0.0.0 - 10.255.255.255 |
| `172.16.0.0/12` | Class B private network | 172.16.0.0 - 172.31.255.255 |
| `192.168.0.0/16` | Class C private network | 192.168.0.0 - 192.168.255.255 |
| `0.0.0.0/0` | All IPv4 addresses | 0.0.0.0 - 255.255.255.255 |
| `x.x.x.x/32` | Single host | Exact IP match |

## Behavior Details

### Null or Missing Properties

Entities where the property is `null` or `undefined` are excluded from results, even when using `/0` (match all).

### Multi-Value Properties

If the property contains multiple IP addresses (a list), the entity matches if **any** IP in the list falls within the CIDR range.

```j1ql
/* Matches if any IP in the ipAddress list is in the 10.x range */
FIND Host WITH cidr(ipAddress, '10.0.0.0/8')
```

### Non-Canonical CIDR

Non-canonical CIDR notation is accepted and normalized. For example, `cidr(ipAddress, '10.1.2.3/8')` is treated as `10.0.0.0/8`.

### Using `cidr` as a Property Name

The `cidr` keyword is only treated as a filter function when used in the function call syntax `cidr(...)`. You can still use `cidr` as a regular property name with standard comparison operators:

```j1ql
/* This filters on a property named "cidr" using normal equality */
FIND Network WITH cidr = '10.0.0.0/24'
```

## Example Queries

### Find all hosts in private networks

```j1ql
FIND Host WITH cidr(ipAddress, '10.0.0.0/8')
  OR cidr(ipAddress, '172.16.0.0/12')
  OR cidr(ipAddress, '192.168.0.0/16')
```

### Find hosts exposed on public IPs

```j1ql
FIND Host WITH !cidr(ipAddress, '10.0.0.0/8')
  AND !cidr(ipAddress, '172.16.0.0/12')
  AND !cidr(ipAddress, '192.168.0.0/16')
```

### Find hosts in a specific subnet

```j1ql
FIND Host WITH cidr(ipAddress, '10.50.0.0/16') AND tag.Production = true
```

### Cross-reference hosts with firewall rules

```j1ql
FIND Host AS h
  THAT PROTECTS Firewall AS fw
WHERE cidr(h.ipAddress, '10.0.0.0/8')
RETURN h.displayName, h.ipAddress, fw.displayName
```

---

Source: /j1ql/comparisons

# Comparisons

J1QL’s comparison capabilities accommodate effective filtering and analysis of data. String comparisons offer operators for evaluating specific substrings, prefixes, and suffixes—allowing precise filtering of string values. Regular expressions (regex) can also be applied to properties for more advanced filtering including case-insensitive matching. Date comparisons provide flexibility for filtering based on relative or static timestamps, and date boundary functions let you snap to calendar periods such as the start of the current month or the end of a quarter—empowering you to perform time-based analysis and gain valuable insights from your data.

## String comparisons

J1QL supports the use of the following operators for comparisons of strings stored either as a single string or multi-value field. In addition to `=` (equals) and `!=` (does not equal):

-   `~=` : Contains
    
-   `^=` : Starts with
    
-   `$=` : Ends with
    
-   `!~=` : Does not contain
    
-   `!^=` : Does not start with
    
-   `!$=` : Does not end with
    

> **NOTE**
> 
> These operators only work for comparisons of strings or multi-value fields.

#### Example queries using basic string comparisons

1.  The following query returns all entities of the `Person` class that have a `firstName` beginning with the character 'J':
    
    ```text
    FIND Person WITH firstName ^= "J"
    ```
    
2.  This query returns all assets of the `Person` class that have a `Person.email` of `'a@b.com'` or `['a@b.com', 'x@y.com']`:
    
    ```text
    FIND Person WITH email = "a@b.com"
    ```
    
3.  The following query checks if a substring matches for either a single string or a multi-value field:
    
    ```text
    FIND Person WITH email ~= ".com"
    ```
    
4.  Lastly, this query returns entities of the Host class with any of the following examples of `tag.AccountName`: `xyz_demo`, `demo_xyz`, `abc_demo_xyz`:
    
    ```text
    FIND Host WITH tag.AccountName ~= "demo"
    ```
    

> **NOTE**
> 
> These string evaluations are case-sensitive. So `'Demo'` and `'demo'` yield distinct sets of results.

#### Example queries using regex comparisons

1.  The following query returns all entities of the `Person` class that have a `firstName` containing the case-insensitive string 'james':
    
    ```text
    FIND Person WITH firstName = /james/i
    ```
    
2.  This query returns all assets of the `Host` class that have a tag `classification` with a value of `Highly Sensitive` or similar permutations such as `highly-sensitive` or `highlysensitive`:
    
    ```text
    FIND Host WITH tag.classification = /highly[ \-]?sensitive/i
    ```
    

> **NOTE**
> 
> Due to limitations in some of the data stores the regex search options are limited. For more informaiton please see [REGEX Implementation](/j1ql/regular-expressions.md).

## CIDR comparisons

J1QL supports filtering entities by whether an IP address property falls within a CIDR range using the `cidr()` function:

```j1ql
FIND Host WITH cidr(ipAddress, '10.0.0.0/8')
```

Use `!cidr()` to negate the filter and exclude matching entities:

```j1ql
FIND Host WITH !cidr(ipAddress, '10.0.0.0/8')
```

For more details and examples, see the dedicated [CIDR Filtering](/j1ql/cidr-filtering.md) guide.

## Date comparisons

The query language also supports both relative and static date comparisons on any timestamp property. The timestamp property used for date comparison must be stored as an epoch number in milliseconds.

To verify that the date value is stored in JupiterOne correctly, use the following query as an example way to find out:

Verifying the date value

```md
FIND {Entity class or type} AS x 
RETURN x.createdOn, x.createdOn AS storedValue
```

The results for this query should contain the following:

1.  The first column(`x.createdOn`) shows the datetime value formatted for the UI. If the value is returned following this syntax: `yyyy-mm-ddThh:mm:ss.sssZ`, then we know that the stored value is an epoch number.
    
2.  The second column (`storedValue`) will show the value as stored in the database. This value should be returned as a 13-digit number.
    

If either of the above conditions is not true, then the values uploaded to the JupiterOne platform should be updated to include the epoch number prior to executing date comparison queries.

### Relative date comparisons

Relative date comparison allows filtering based on the current datetime. For example:

Relative date comparison

```md
FIND DataStore WITH createdOn > DATE.now - 1 day
```

The following units are supported for relative date comparisons in J1QL:

-   `hour`, `hr`, `hours`, `hrs`
-   `day`, `days`
-   `month`, `mo`, `months`, `mos`
-   `year`, `yr`, `years`, `yrs`

### Static date comparisons

In contrast to relative date comparisons, static date comparison allow to filter based on a specified datetime. For example:

Static date comparison

```md
FIND DataStore WITH createdOn > DATE(2019-10-30)
```

The static date must be specified in ISO 8601 format:

-   `DATE(YYYY)`
-   `DATE(YYYY-MM)`
-   `DATE(YYYY-MM-DD)`
-   `DATE(YYYY-MM-DDThhTZD)`
-   `DATE(YYYY-MM-DDThh:mmTZD)`
-   `DATE(YYYY-MM-DDThh:mm:ssTZD)`
-   `DATE(YYYY-MM-DDThh:mm:ss.sTZD)`

### Date boundary functions

Date boundary functions snap a date to the start or end of a calendar period. They eliminate the need to hardcode dates in queries that reset on a monthly, weekly, quarterly, or yearly cadence—such as dashboard widgets designed to report on the current month's data.

Eight functions are available:

| Function | Returns |
| --- | --- |
| `startOfWeek(date)` | First moment of the week containing `date` (weeks start on Sunday) |
| `endOfWeek(date)` | Last moment of the week containing `date` |
| `startOfMonth(date)` | First moment of the month containing `date` |
| `endOfMonth(date)` | Last moment of the month containing `date` |
| `startOfQuarter(date)` | First moment of the calendar quarter containing `date` (Q1 = Jan–Mar) |
| `endOfQuarter(date)` | Last moment of the calendar quarter containing `date` |
| `startOfYear(date)` | First moment of the year containing `date` |
| `endOfYear(date)` | Last moment of the year containing `date` |

**Accepted arguments:** The argument must be a J1QL date value—either `DATE.now` or an explicit `DATE(...)` expression. Bare string literals such as `'2026-06-15'` are not accepted.

These functions compose with existing relative offsets, so you can express things like "the first day of last month" without any hardcoding:

Composing a boundary function with a relative offset

```j1ql
startOfMonth(DATE.now - 1 month)
```

Date boundary functions are usable in `WITH` filters and in `RETURN`.

#### Example queries

Critical vulnerabilities opened this month (auto-resets each month)

```j1ql
FIND Finding WITH severity = 'critical' AND open = true
  AND createdOn > startOfMonth(DATE.now)
```

All findings in last month, first day through last day

```j1ql
FIND Finding
  WITH createdOn >= startOfMonth(DATE.now - 1 month)
    AND createdOn <= endOfMonth(DATE.now - 1 month)
```

Year-to-date findings by severity (dashboard widget)

```j1ql
FIND Finding WITH createdOn > startOfYear(DATE.now)
  RETURN Finding.severity AS sev, count(Finding) AS n ORDER BY n DESC
```

Evidence collected in the quarter containing a fixed audit date

```j1ql
FIND Evidence
  WITH collectedOn >= startOfQuarter(DATE(2026-02-01))
    AND collectedOn <= endOfQuarter(DATE(2026-02-01))
```

Access keys created last week

```j1ql
FIND AccessKey
  WITH createdOn >= startOfWeek(DATE.now - 7 days)
    AND createdOn <= endOfWeek(DATE.now - 7 days)
```

---

Source: /j1ql/filtering-behavior

# Filtering behavior

JupiterOne aligns its query language with [De Morgan's Law](https://en.wikipedia.org/wiki/De_Morgan%27s_laws). This standard mathematical theory is two sets of rules or laws developed from Boolean expressions for `AND`, `OR`, and `NOT` gates, using two input variables, A and B. These two rules or theorems allow the input variables to be negated and converted from one form of a Boolean function into an opposite form. J1QL uses this law in filtering the results of queries.

When you use a `!=` followed by a set of arguments offset by parentheses, such as `!= (A or B or C)`, it is equivalent to the expression `!= A and != B and != C`. For example:

```j1ql
FIND jira_user WITH accountType != ("atlassian" OR "app" OR "customer")
```

This query above is equivalent to the following:

```j1ql
FIND jira_user WITH accountType != "atlassian" AND accountType != "app" AND accountType != "customer"
```

#S# Interpretation

In the above example, J1QL interprets the query to return all `jira_user` assets, excluding those that have an accountType value of `atlassian` or `app` or `customer`. The following tables show the resulting truth values of a complex statement that are all possible for a simple statement in both positive and negative states:

#### Truth table

| Entity | "fruit" | "nut-filled" | \=("fruit" AND "nut-filled") | \=("fruit" OR "nut-filled") |
| --- | --- | --- | --- | --- |
| "fruit" | true | false | false | true |
| "nut-filled" | false | true | false | true |
| "fruit", "nut-filled" | true | true | true | true |
| "non-fruit" | false | false | false | false |
| "non-fruit", "plain" | false | false | false | false |
| undefined | false | false | false | false |

#### Truth table with negated queries:

| Entity | "fruit" | "nut-filled" | !=("fruit" AND "nut-filled") | !=("fruit" OR "nut-filled") |
| --- | --- | --- | --- | --- |
| "fruit" | true | false | true | false |
| "nut-filled" | false | true | true | false |
| "fruit", "nut-filled" | true | true | false | false |
| "non-fruit" | false | false | true | true |
| "non-fruit", "plain" | false | false | true | true |
| undefined | false | false | true | true |

## Property filtering

In J1QL, property filtering allows you to filter entities based on multiple property values. This is achieved using parentheses to group values and the `OR` operator to include any of the specified values. Here are a few examples of filtering by property:

Filtering by property

```md
FIND user_endpoint WITH platform = ("darwin" OR "linux")

FIND Host WITH tag.Environment = ("A" or "B" or "C")

FIND DataStore WITH classification != ("critical" and "restricted")
```

When applying property filters, J1QL follows a specific order of operations: parentheses are evaluated first, followed by comparisons such as equals (`=`), greater than or equal to (`>=`), less than or equal to (`<=`), and not equals (`!=`). Finally, AND and OR operators are evaluated in that order. This ensures proper evaluation of complex property filters in your queries.

## Metadata filtering

Filtering on metadata can often be useful in performing security analysis. The example below is used to find network or host entities that did not get ingested by an integration instance. In other words, these are entities that are likely "external" or "foreign" to the environment.

```j1ql
FIND (Network|Host) WITH _IntegrationInstanceId = undefined
```

The following would find all brand new code repos created within the last 48 hours:

```j1ql
FIND CodeRepo WITH _beginOn > DATE.now - 24 hours AND _version = 1
```

By leveraging metadata properties, such as integration instance IDs or creation timestamps, it becomes possible to filter and focus on specific subsets of assets based on their metadata characteristics.

For more details on metadata properties, see the JupiterOne [data model documentation](/data-model/jupiterone-data-model.md).

## Post-Aggregation Filtering

The `HAVING` clause in J1QL allows you to filter the results of a query based on aggregate values of the assets or relationships returned. It is used to specify conditions that must be met for a row to be included in the result set. The `HAVING` clause is often used in conjunction with aggregate functions in the `RETURN` clause to filter the results of aggregate functions.

Example query finding Hosts and Devices with an average finding score greater than 7:

HAVING query

```j1ql
FIND (Device|Host) AS h
  THAT HAS Finding AS f
RETURN h.displayName, h.fqdn, AVG(f.numericSeverity) AS avgSeverity
HAVING avgSeverity > 7
```

For more details on post-aggregation filtering, see the [HAVING](/j1ql/basic-keywords.md#having) clause.

---

Source: /j1ql/math-operations-expressions

# Math operations and expressions

J1QL provides robust mathematical capabilities for performing calculations and transformations on returned values, including standard operations like addition, subtraction, multiplication, and division. By leveraging parentheses, you have control over the order of operations to achieve precise results. Additionally, J1QL offers a range of mathematical expressions as functions, empowering advanced calculations and analysis to extract valuable insights from your data. These mathematical features enhance the flexibility and analytical power of J1QL in querying and manipulating numerical data.

## Math operations

J1QL provides support for fundamental mathematical operations on returned values, including addition (`+`), subtraction (`-`), division (`/`), multiplication (`*`), and the use of parentheses `()` to control the order of operations. The evaluation follows the standard order of operations: parentheses, multiplication or division, and then addition or subtraction.

> **NOTE**
> 
> These operations are designed for numerical values and do not work with strings or string representations of numbers.

Math operations example query

```md
FIND (aws_db_cluster_snapshot|aws_db_snapshot) AS snapshot
RETURN snapshot.displayName, snapshot.allocatedStorage * 0.02 AS Cost
```

You can also combine math operations with aggregate functions. You can [learn more about aggregate functions here](/j1ql/aggregate-functions.md).

Combining a math operation with an aggregate function

```md
FIND (aws_db_cluster_snapshot|aws_db_snapshot) AS snapshot
RETURN snapshot.tag.AccountName as Account, sum(snapshot.allocatedStorage) * 0.02 AS EstimatedCost
```

Calculations can also be made with date time fields. When calculating the difference between two dates in days, the date field will automatically be converted to the millisecond epoch. In order to return this difference in hours it will require dividing by 3600000 (number of milliseconds in an hour). In order to convert that hour into days, multiply by 24.

Calculations with date time fields

```md
FIND Finding AS f 
RETURN f.displayName, (f.closedOn - f.createdOn) / (3600000 * 24) AS differenceInDays
```

## Math expressions

Below is an outline of the supported mathematical expression within J1QL:

### Exponents

A quantity representing the power to which a given number or expression is to be raised, usually expressed as a raised symbol beside the number or expression (e.g. 3 in 23 = 2 × 2 × 2).

```j1ql
FIND Risk AS r
RETURN r.probability, r.probability ^ 2
```

### Absolute (ABS)

Absolute value, the magnitude of a real number without regard to its sign.

```j1ql
FIND Risk AS r
RETURN ABS(r.impact - 5) / r.probability
```

### Square Root (SQRT)

Square root, a number which produces a specified quantity when multiplied by itself.

```j1ql
FIND Risk AS r
RETURN r.displayName, SQRT((5 - r.impact) ^ 2 + (5 - r.probability) ^ 2) AS score
ORDER BY score ASC
```

### Ceiling (CEIL)

Round up to the next closest whole number.

```j1ql
FIND DataStore WITH allocatedStorage > 0 AS d
RETURN d.displayName, CEIL(d.allocatedStorage / 1000) AS allocatedMb
```

### Floor (FLOOR)

Round down to next closes whole number.

```j1ql
FIND Risk AS r
RETURN FLOOR(ABS(r.impact - 5) / r.probability)
```

### Round (ROUND)

Round up or down to the next closes whole number.

```j1ql
FIND DataStore WITH backupSizeBytes > 0 AS d
RETURN d.displayName, ROUND(d.backupSizeBytes / d.backupsCount) AS averageBackupSize
```

### Coalesce (COALESCE)

Use the first found value. Provide a list of values and the first value to not be undefined/null will be used.

```j1ql
FIND (aws_s3_bucket|aws_dynamodb_table) AS store
RETURN store._type, store.displayName, COALESCE(store.backupSizeBytes, store.bucketSizeBytes, 0) / 1000 AS kb
```

### Concatenate (CONCAT)

Concatenates field values into a single field, allows math expressions.

```j1ql
FIND (aws_s3_bucket|aws_dynamodb_table) AS store
RETURN store._type, store.displayName, CONCAT(COALESCE(store.backupSizeBytes, store.bucketSizeBytes, 0) / 1000, ' kb') AS size
```

### To Integer (TOINT)

Casts field values to an integer. Note, values that cannot be converted to an integer will return undefined.

```j1ql
FIND (aws_s3_bucket|aws_dynamodb_table) AS store
RETURN TOINT(COALESCE(store.backupSizeBytes, store.bucketSizeBytes, 0)) AS size
```

---

Source: /j1ql/optional-traversals

# Optional traversals

Optional traversals in J1QL allow for the inclusion of related assets in query results, marked by wrapping a portion of the query with `({query_portion})?`. This feature enables combining entities from graph traversals and applying additional constraints.

Optional traversal example:

```j1ql
FIND User
  (THAT IS Person)?
```

In the above example, we search for `User` entities and optionally traverse an `IS` relationship to a `Person` entity. If the relationship exists, the related `Person` entities are added to the list of results.

#### Relationships can still be chained within an optional traversal:

The query below will return a list of `Device` entities owned by a `Person` that is a `User` and `User` assets that do not have an indirect relationship to the `Device`.

```j1ql
FIND User
  (THAT IS Person
    THAT OWNS Device)?
```

#### Relationships that come after an optional traversal are processed on the combined results:

This query searches for `Users` or `UserGroups` that directly assigned an `AccessPolicy` granting admin permissions to certain resources, or via an `AccessRole` assigned to the `User`/`UserGroup`.

```j1ql
FIND (User|UserGroup)
  (THAT ASSIGNED AccessRole)?
  THAT ASSIGNED AccessPolicy
  THAT ALLOWS AS permission *
WHERE permission.admin = true
RETURN TREE
```

#### Optional traversals can also be chained:

The combined results from each previous optional traversal will be used in the next optional traversal. The below query will find `User` assets, `Person` assets that have an `IS` relationship to the `User` and `Device` assets that are owned by `Person` and `User` assets from the previous optional traversal.

```j1ql
FIND User
  (THAT IS Person)?
  (THAT OWNS Device)?
RETURN User, Person, Device
```

#### The optional traversals can also be aliased:

This allows entities to be used when returning results and when applying constraints. The following query illustrates aliasing an optional traversal.

```j1ql
FIND User
  (THAT IS Person AS p)?
  THAT OWNS Device AS d
WHERE p.email = "test@jupiterone.com"
RETURN p.displayName, d.displayName
```

Traversals performed within the `()?` function as normal graph traversals, so `WITH` filters can still be applied to assist with narrowing results:

```j1ql
FIND User
  (THAT IS Person WITH email = "test@jupiterone.com" AS p)?
  THAT OWNS Device AS d
RETURN p.displayName, d.displayName
```

> **WARNING**
> 
> Historically it has been possible to use optional traversal aliasing to alias a union of entities. This behaviour was poorly defined and is deprecated from Feburary 2024.
> 
> Example:
> 
> ```j1ql
> FIND User
>   (THAT IS Person)? AS personOrUser
> RETURN personOrUser.displayName, personOrUser._class
> ```

---

Source: /j1ql/pagination-and-sorting

# Pagination and sorting

Sorting and pagination commands in J1QL, such as `ORDER BY`, `SKIP`, and `LIMIT`, provide efficient ways to organize and navigate query results. By utilizing `ORDER BY`, you can sort entities based on specific fields, while `SKIP` allows you to skip a certain number of results, and `LIMIT` determines the maximum number of results to be returned. These commands enable fine-grained control over result presentation and facilitate targeted analysis of data.

> **NOTE**
> 
> That by default, queries will return up to 250 results if no `LIMIT` is specified.

In the example below, the query sorts users by their username and returns the 11th-15th users from the sorted list:

```j1ql
FIND Person WITH manager = undefined as u
  ORDER BY u.username SKIP 10 LIMIT 5
```

## Ascending and Descending Order

By default, `ORDER BY` sorts in ascending order (ASC). You can explicitly specify the sort direction using `ASC` or `DESC`.

### Ascending Order (Default)

The following query sorts AWS IAM users by creation date in ascending order (oldest to newest):

```j1ql
FIND aws_iam_user AS u
  ORDER BY u.createdOn
  LIMIT 10
```

### Explicit Ascending Order

You can explicitly specify ascending order:

```j1ql
FIND aws_iam_user AS u
  ORDER BY u.createdOn ASC
  LIMIT 10
```

### Descending Order

To sort in descending order (newest to oldest):

```j1ql
FIND aws_iam_user AS u
  ORDER BY u.createdOn DESC
  LIMIT 10
```

### Multiple Sort Fields

You can sort by multiple fields with different directions:

```j1ql
FIND User AS u
  ORDER BY u.active DESC, u.username ASC
  LIMIT 20
```

This query first sorts users by active status (active users first), then sorts by username alphabetically within each status group.

### Ordering by Aggregation Results

For aggregate queries, use the following pattern to sort results:

```j1ql
FIND User AS u 
  RETURN u.username, u.mfaEnabled
  ORDER BY u.mfaEnabled DESC 
  LIMIT 10
```

This returns users sorted by their MFA status (enabled users first), which is useful for compliance reports.

---

Source: /j1ql/path-finding

# Path Finding functions

The ability to find routes through the graph between interesting assets can be accomplished through Path Finding functions.

## SOMEHOW ALPHA

> **WARNING**
> 
> This feature is currently in ALPHA and breaking changes are planned. We are making it available now to all customers as it does solve some interesting problems, but do not rely on it for critical workflows at this time.

The `SOMEHOW` function is used to find paths through the graph between interesting assets, where you may not know the intermediate nodes or relationships.

> **IMPORTANT**
> 
> The "entry" and "exit" points of a SOMEHOW query must be small sets of assets, ideally a single asset. Broad targets will likely return no results.

Query Syntax:

```text
FIND <source entity>
  THAT SOMEHOW <depth> <relationship classes> <target entity>
RETURN TREE
```

-   `source entity` is the starting point of the path, and should ideally be a single asset
-   `relationship classes` is a collection of relationship classes to traverse, such as `RELATES TO`, `(HAS|IS)`, or `ALLOWS`
-   `depth` is the maximum number of intermediate nodes to traverse, defaulting to 5 with a maximum of 10
-   `target entity` is the ending point of the path, and should ideally be a single asset

### Example: Finding paths between Google Cloud Organizations and Google Cloud Projects via intermediate Google Cloud Folders

```j1ql
FIND google_cloud_organization
  THAT SOMEHOW HAS google_cloud_project
RETURN TREE
```

![SOMEHOW Example google org path finding](/assets/images/somehow-google-org-path-finding-ac7becaa923a84f4ba9c02feecef36ba.png)

This produces all the intermediate nodes between the Google Cloud Organization and Google Cloud Project, that use the `HAS` relationship class. It includes more than just the intermediate Google Cloud Folders, which is a limitation of the current implementation and will be addressed as part of the Alpha program.

### Example: Finding how Person entities may relate to the github\_account

```j1ql
FIND Person
  THAT SOMEHOW RELATES TO github_account
RETURN TREE
```

![SOMEHOW Example person to github account](/assets/images/somehow-person-to-github-account-acf40251efe7a5c39707218b9f1a2f12.png)

This gives a good summary of the potential relationships. It's likely that this query hit the internal limit of 250 intermediate nodes, but it still provides a good summary of the potential relationships. Again, this is a known limitation of the current implementation and will be addressed as part of the Alpha program.

There are some important limitations to be aware of at this time:

-   The `SOMEHOW` function has an internal limit of 250 intermediate nodes in a path. This is to prevent runaway queries. Currently the system cannot tell you if you have hit this limit. Getting no results does NOT mean there are no paths between the two assets.

---

Source: /j1ql/queries/apps-and-processes

# Apps and processes

### What certificates are installed/being used?

_Host level certificates details to be added later. You can query for ACM certificates in AWS._

```j1ql
Find Certificate
```

```j1ql
Find * that (HAS|USES) Certificate return tree
```

### What certificates are used for which service?

_Host level certificates details to be added later. You can query for ACM certificates in AWS._

Returns a graph of the resources that uses certificates

```j1ql
Find Certificate that relates to * return tree
```

Find certificates that are set to expire within 30 days

```j1ql
Find Certificate with expiresOn < date.now + 30days
```

### What versions of software / applications do I have running?

_Requires integrations that provide application information. For example, SAML SSO applications from Okta, or macOS apps from Jamf._

```j1ql
Find Application as app
return app._type, app.displayName, app.status
```

> **NOTE**
> 
> To keep the entity data structure less noisy, different versions of the same Application are **not** stored as separate entities. Rather, the `version` data is kept on the relationship between the host or endpoint device that has installed the application.\_

```j1ql
Find unique * that (USES|INSTALLED) as installation Application as app
return app._type, app.displayName, installation.version
```

### What software applications are not being used?

```j1ql
Find Application that !(ASSIGNED|USES) *
```

### When was the last time a service or server runtime was refreshed / updated / cycled?

Returns EC2 instances and the AMI images they are using, and the creation timestamp of the AMI:

```j1ql
Find Host as h that uses Image as i
  return
    h.tag.AccountName, h.displayName, h.instanceId,
    i.displayName, i.imageId, i.createdOn
  order by
    h.tag.AccountName
```

Returns Lambda functions and when they were last updated:

```j1ql
Find Function as f
  return f.tag.AccountName, f.displayName, f.updatedOn, f.lastModified
  order by f.tag.AccountName
```

---

Source: /j1ql/queries/aws-permissions

# AWS permissions and trusts

Below is a list of examples illustrating various ways in which you can effectively query you AWS-related data relating to both permissions and trusts.

> **NOTE**
> 
> If you have over 10,000 AWS resources in multiple AWS accounts, some query execution may take a long time or occasionally time out. Try limiting the query by adding `and tag.AccountName='account-name'` as part of the `WITH` entity property filter. Or use `LIMIT 100` at the end of the query for a smaller sample set of the results.

## IAM Policy Permissions

### Which policies allow access to production data?

```j1ql
find AccessPolicy as policy
  that allows as permission
    (aws_s3|aws_dynamodb|aws_rds|DataStore) with tag.Production=true as resource
return
  policy._type, policy.name,
  resource._type, resource.name, resource.tag.AccountName,
  permission.actions, permission.resources
```

### Who has admin access to production resources?

```j1ql
find (aws_iam_group|aws_iam_user|aws_iam_role) as principal
  that assigned AccessPolicy as policy
  that allows as permission
    * with tag.Production=true as resource
where permission.admin=true
  return
    principal._type, principal.name, principal.tag.AccountName,
    policy._type, policy.name,
    permission.actions, permission.resources,
    resource._type, resource.name, resource.tag.AccountName
```

## IAM Assume Role Trusts

### What are the cross-account trusts?

```j1ql
Find aws_iam_role as a
  that trusts (aws_account|aws_iam_role) as b
where a.tag.AccountName!=b.tag.AccountName
  return tree
```

### Are there assume role trusts to external entities?

```j1ql
Find aws_account as aws
  that HAS aws_iam
  that HAS aws_iam_role as role
  that TRUSTS (aws_iam_role|aws_iam_user|aws_iam_group|aws_account)
    with _source='system-mapper' as ext
  return
    aws.name, aws.accountId,
    role.roleName,
    ext.displayName, ext._type
```

### IAM Roles and Policies assigned to Okta SSO Users

```j1ql
Find okta_user as user
  that assigned aws_iam_role as role
  that assigned aws_iam_policy as policy
return
  role.name, policy.name, count(user) as userCount
order by userCount desc
```

### What IAM roles can active public facing EC2 instances assume?

```j1ql
find Internet
  that allows aws_security_group
  that protects aws_instance with active=true
  that uses aws_iam_role
  that assigned AccessPolicy
  return tree
```

##### _OR_

```j1ql
find (Network|Host) with _source='system-mapper'
  that allows aws_security_group
  that protects aws_instance with active=true
  that uses aws_iam_role
  that assigned AccessPolicy
  return tree
```

> **NOTE**
> 
> As seen above, the `(Network|Host) with _source='system-mapper'` portion of the query looks for `Network` or `Host` entities created by the `system-mapper` —- meaning those are networks and hosts **“external”** to your environment, not ingested by the integration.

## S3 Bucket permissions

### Are there non-public S3 buckets configured with public access to everyone?

```j1ql
Find aws_s3_bucket
  with classification!='public' or classification=undefined
  that ALLOWS everyone
```

### What are the cross account access to non-public S3 buckets?

```j1ql
Find aws_s3_bucket with classification != 'public' as a
  that allows * as b
where a.tag.AccountName != b.tag.AccountName
  return tree
```

### Who can read non-public S3 buckets in production?

```j1ql
Find (User|UserGroup|AccessRole)
  that assigned AccessPolicy
  that allows as permission
    (aws_s3|aws_s3_bucket) with
      classification!='public' and tag.Production=true
where permission.read=true
  return tree
```

### Which EC2 instances can read data from S3 via an IAM role?

```j1ql
find aws_instance
  that uses aws_iam_role
  that assigned AccessPolicy
  that allows as permission (aws_s3|aws_s3_bucket)
where permission.read=true
  return tree
```

## Other

### What are the Inline Policies in use?

```j1ql
Find (aws_iam_user|aws_iam_group|aws_iam_role) as u
  that (has|assigned)
    (aws_iam_user_policy|aws_iam_group_policy|aws_iam_role_policy) as p
return
  u.tag.AccountName, u._type, u.name, p.name
order by u.tag.AccountName
```

---

Source: /j1ql/queries/changes-and-attribution

# Changes and attribution

Below are some examples of how you might query your JupiterOne workspace data in order to identify changes that occurred in your environment.

### What changes were made in environment, SG or VPC in last time period ?

Find all changes in the last 24 hours:

```j1ql
Find * with _beginOn > date.now - 24 hours
```

Changes in the last 24 hours related to a particular VPC:

```j1ql
Find * with _beginOn > date.now - 24 hours
  that relates to aws_vpc with vpcId='{vpcId}' or name='{vpcName}'
```

Resources with a certain tag that change in the last 24 hours:

```j1ql
Find * with _beginOn > date.now - 24 hours
  and (tag.Environment = '{tagValue}' or tag.Project = '{tagValue}')
```

### Which developer(s) most likely introduced vulnerabilities in recent code changes?

_Requires integrations with [Github](/integrations/directory/github.md) or [Bitbucket](/integrations/directory/bitbucket.md), and code scanning solutions like [Veracode](/integrations/directory/veracode.md) or [WhiteHat](/integrations/directory/whitehat.md)._

```j1ql
Find User
  that OPENED PR with createdOn > date.now-7days
  that RELATES TO CodeRepo
  that HAS (Vulernability|Finding) with _createdOn > date.now-7days
return tree
```

---

Source: /j1ql/queries/data-security

# Data security

Below is a brief collection of example J1QL queries relating to surfacing data security findings.

### Show all resources without a data classification tag?

```j1ql
Find (Host|DataStore) with classification = undefined
```

Return a count instead:

```md
Find (Host|DataStore) with classification = undefined as e return count(e)
```

### Show all resources without a data classification tag in VPC with tag?

Filter by a tag on the VPC:

```md
Find (Host|DataStore|Workload) with classification = undefined
  that relates to aws_vpc with tag.{tagName} = '{tagValue}'
```

Filter by vpcId or name:

```md
Find (Host|DataStore|Workload) with classification = undefined
  that relates to aws_vpc with vpcId='{vpcId}' or name='{name}'
```

### What are all the resources without encryption with data security tag 'restricted'?

```j1ql
Find DataStore with encrypted!=true and classification='restricted'
```

Sometimes it is also interesting to

Find unencrypted data that is non-public:

```md
Find DataStore with encrypted!=true and classification!='Public'
```

### Aggregating Math Functions in the RETURN Clause

This query feature allows you to combine and deduplicate multiple scalar values into a single listing for a column/alias. You can combine multiple (defined) properties into a single property without having to choose to return one property or another.

```j1ql
FIND jira_issue WITH resolvedOn != undefined AND createdOn != undefined AS i 
RETURN AVG(i.resolvedOn - i.createdOn / 86400000) as 'Average Days to Close'
```

---

Source: /j1ql/queries/development

# Development

The queries below require either a [Github](/integrations/directory/github.md) or [Bitbucket](/integrations/directory/bitbucket.md) integration configuration in JupiterOne.

### Were there any Code Repos added in the last 24 hours?

```j1ql
Find CodeRepo with _beginOn > date.now-24hr and _version=1
```

### Which PRs did this developer open in the last 5 days?

For a developer whose first name is Charlie:

```text
'Charlie' that OPENED PR with _createdOn > date.now - 5days as PR
  return PR.displayName, PR.name, PR.webLink
```

Or, the following query is more accurate but it requires an IdP integration and proper mapping between the dev users and IdP users:

```j1ql
Find Person with firstName='Charlie'
  that IS (github_user|bitbucket_user)
  that OPENED PR with _createdOn > date.now - 5days as PR
return PR.displayName, PR.name, PR.webLink
```

### Who are the most recent contributors to this repo?

_This is particularly useful to identify who might be the best person to fix a newly discovered vulnerability._

```j1ql
Find User as u
  that OPENED PR as PR
  that HAS CodeRepo with name='repo-name' as repo
  return
    u.displayName, u.username,
    PR.displayName, PR.name, PR._createdOn, repo.name
  order by PR._createdOn
  limit 5
```

### What are the code repos for a particular application or project?

```j1ql
Find CodeRepo that relates to (Application|Project) with name='JupiterOne'
```

### Are there unapproved or self-approved code changes in the last week?

```j1ql
Find PR with
  approved=false and
  (createdOn > date.now-7days or updatedOn > date.now-7days)
```

### Are there code commits by an unknown developer in a PR?

```j1ql
Find PR with validated=false
```

---

Source: /j1ql/queries/identity-people-privileged-access

# Identity, people, and access

_Most of these queries depend on proper mapping of custom properties or profile attributes from your HR system or identity provider to the Person/employee entities._

### Who are the new hires within the last 12 months?

If you have been using JupiterOne for more than a year:

```j1ql
Find employee with _createdOn > date.now-12months
```

If your employee data source / user identity provider is Okta:

```j1ql
Find okta_user with created > date.now-12months
```

### Who are the contractors?

_Requires mapping from your HR system or IdP to capture the employment type._

```j1ql
Find employee with employment = 'contractor'
```

If you have a user group called 'Contractors':

```j1ql
Find User that (has|assigned) UserGroup
  with displayName='Contractors' or name='Contractors'
```

### Who are remote workers?

If the user or employee entity has a remote flag:

```j1ql
Find (User|employee) with remote=true
```

If you have a user group called 'Remote':

```j1ql
Find User that (has|assigned) UserGroup
  with displayName='Remote' or name='Remote'
```

### Who are the employees missing metadata about role?

```j1ql
Find employee with role=undefined
```

### Who are the employees missing metadata about team or department?

```j1ql
Find employee with department=undefined
```

```j1ql
Find employee that !relates to Team
```

### Who are the employees missing metadata about team or department with access to environment?

```j1ql
Find employee with department=undefined
  that is User
  that relates to (Account|AccessRole|UserGroup|Service)
    with tag.AccountName = '{accountName}'
```

### Who are the employees missing metadata about team or department with privileged access?

```j1ql
Find employee with department=undefined
  that is User
  that assigned (AccessPolicy|AccessRole) with admin=true
```

```j1ql
Find employee with department=undefined
  that is User
  that assigned AccessRole
  that assigned AccessPolicy with admin=true
```

### Who or what service has been assigned permissions with administrator/privileged access?

```j1ql
Find AccessPolicy with admin=true as policy
  that ASSIGNED * as e
  return policy.displayName, policy.webLink, e._type, e.displayName, e.webLink
```

### Who is able to make changes in a production data connected environment, and what changes can they make?

_We plan to do more in-depth analysis of AWS IAM policies to determine access. In the meantime, we determine admin access based on policy name and you can run the following query to find them._

```j1ql
Find AccessPolicy with admin=true and tag.AccountName='{accountName}' as policy
  that ASSIGNED (AccessRole|User) as e
return policy.displayName, policy.webLink, e._type, e.displayName, e.webLink
```

### What groups are an employee or contractor a member of?

```j1ql
'Joe Adams' as employee that relates to (Team|Group) as group
return
  employee._type, employee.displayName, employee.email,
  group._type, group.displayName
```

### What uses static authentication credentials (people, services) vs grant type credentials (saml, oidc)?

```j1ql
Find (User|UserGroup) that assigned AccessPolicy
```

```j1ql
Find AccessRole that assigned AccessPolicy
```

---

Source: /j1ql/queries/inventory-config

# Inventory and configuration

### What Workloads are in my environment?

```j1ql
Find Workload
```

```j1ql
Find Workload with tag.AccountName='{accountName}'
```

### What are my production systems and servers?

_(and what are those systems there to do?)_

```j1ql
Find (Host|Database) with tag.Production=true
```

```j1ql
Find (Host|Database) with tag.AccountName='{accountName}'
```

### What are my production resources?

Filter using production tag:

```j1ql
Find (Application|CodeRepo|Workload|Function|Task|Host|Device|Database|DataStore)
  with tag.Production=true
```

Filter using account name:

```j1ql
Find (Application|CodeRepo|Workload|Function|Task|Host|Device|Database|DataStore)
  with tag.AccountName='{accountName}'
```

You can also use `Find *` to cover everything but the results could be overwhelming.

### What are my production data stores and databases?

```j1ql
Find (DataStore|Database) with tag.Production=true
```

```j1ql
Find (DataStore|Database) with tag.AccountName='{accountName}'
```

### What are my production applications?

```j1ql
Find Application with tag.Production = true
```

```j1ql
Find Application with tag.AccountName='{accountName}'
```

### What are my network assets?

```j1ql
Find Network with _type!='mapped_entity'
```

Entities that are of type `'mapped_entity'` are resources that are not directly from the integrations.

You can use `_type='mapper_entity'` or `_source='system-mapper'` to find external resources:

```j1ql
Find Network with _source='system-mapper'
```

```j1ql
Find (Gateway|Firewall) with category='network'
```

### Which devices are/are not auto-scaling?

```j1ql
Find aws_instance that has aws_autoscaling_group
```

```j1ql
Find aws_instance that !has aws_autoscaling_group
```

### What information assets are missing metadata for data classification, tier of service or architectural tier?

```j1ql
Find (Host|DataStore|Workload|Task) with tag.Classification = undefined
```

### What applications and operating systems are in use?

```j1ql
Find Host as h return h.platform
```

_A 'Group By' capability will be added to J1QL soon to return objects or count by unique property values._

### Who owns a production system in account/zone/tier/layer/ VPC/SG?

```j1ql
Find (Host|DataStore|Workload|Task|Application)
  with tag.AccountName = '{accountName}' as system
return system.displayName, system.owner
```

```j1ql
Find (Host|DataStore|Workload|Task|Application) as system
  that relates to aws_vpc with vpcId='{vpcId}' or name='{vpcName}'
return system.displayName, system.owner
```

```j1ql
Find (Host|DataStore|Workload|Task|Application) as system
  that relates to aws_security_group with groupId='{sgId}' or name='{sgName}'
return system.displayName, system.owner
```

### How many systems were added to environment in last time period?

Example for last 24 hours time period:

```j1ql
Find * with _tag.AccountName='{accountName}' and _createdOn > date.now - 24hrs
```

### How many resources were added to manually vs automated?

Count entities added by its source:

```j1ql
Find * as e return e._source, count(e)
```

Source (`_source`) can be one of the following:

-   `integration-managed`: added via a provider integration
-   `powerup-managed`: added via a JupiterOne Powerup (currently endpoint compliance stethoscope agent)
-   `system-mapper`: added by the JupiterOne mapper (derived entities or external entities)
-   `api`: added manually by a JupiterOne user from either the webapp or API

### What container images, VM images, and software packages are available in my production environments?

Container entities/relationships are to be added when we support ECS, EKS, ECR and Fargate.

### What are the tags assigned to a particular inventory asset?

This is best viewed in the Asset app by selecting an entity and going to the Tags tab in the properties panel.

---

Source: /j1ql/queries/key-management

# Secrets and key management

### What SSH keys exist on system ?

Find all SSH keys in an AWS account:

```j1ql
Find aws_key_pair with tag.AccountName='{accountName}'
```

You can also use the abstract class:

```j1ql
Find AccessKey with usage='ssh' and tag.AccountName='{accountName}'
```

Find key usage and return a graph:

```j1ql
Find aws_key_pair that relates to Host return tree
```

Find key usage and return a table with specific properties:

```j1ql
Find aws_key_pair as key that relates to Host as h
return key.displayName,
  h.displayName, h.instanceId, h.region, h.classification, h.tag.AccountName
```

### What SSH keys exist on system without link to employee?

_The linkage will be mapped when we start processing cloudtrail events._

### What secrets (vault, kms, etc...) can a service access and what is that service able to do with them?

```j1ql
Find aws_kms_key that uses * return tree
```

---

Source: /j1ql/queries/network-zones

# Network connections and zones

### What network traffic is allowed between internal and external (i.e. between trusted and untrusted) networks?

```j1ql
Find Firewall as fw
  that ALLOWS as r (Network|Host) with
    internal=undefined or internal=false as n
return
  fw.tag.AccountName, fw._type, fw.displayName, fw.description,
  r.ipProtocol, r.fromPort, r.toPort,
  n.displayName, n.CIDR, n.ipAddress
order by
  fw.tag.AccountName
```

### What production resources are directly connected/exposed to the Internet/everyone?

```j1ql
Find (Internet|Everyone)
  that relates to * with
    tag.Production=true and
    _class!='Firewall' and
    _class!='Gateway' as resource
return
  resource.tag.AccountName, resource._type,
  resource.name, resource.description,
  resource.classification
order by
  resource.tag.AccountName
```

### What endpoints directly connected to the Internet?

```j1ql
Find aws_subnet with public=true as n
  that HAS aws_instance as i
  that PROTECTS aws_security_group as sg
  that ALLOWS as rule Internet
return
  n.displayName as subnet,
  i.displayName as instance,
  sg.displayName as SG, sg.groupId, sg.vpcId as VPC,
  sg.tag.AccountName as Account, sg.webLink,
  rule.ipProtocol, rule.fromPort, rule.toPort
```

Returns a graph instead using `return tree` at the end

```j1ql
Find aws_subnet with public=true as n
  that HAS aws_instance as i
  that PROTECTS aws_security_group as sg
  that ALLOWS as rule Internet
return tree
```

### What storage is directly connected to the internet?

Find databases that are public:

```j1ql
Find Database with public=true
```

Find data stores (including AWS S3 buckets) that allows public access:

```j1ql
Find DataStore that allows Everyone
```

### What are my proxies, relays or load balancers?

```j1ql
Find Gateway
```

Network layer gateways including AWS internet gateways, network load balancers, etc.:

```j1ql
Find Gateway with category='network'
```

Application layer gateways including API gateways, application load balancers, etc.:

```j1ql
Find Gateway with category='application'
```

More specifically, find AWS ELB application and network load balancers:

```j1ql
Find (aws_alb|aws_nlb)
```

### Which hosts have IP addresses in a specific network range?

Find all hosts with IPs in the `10.0.0.0/8` private range:

```j1ql
FIND Host WITH cidr(ipAddress, '10.0.0.0/8')
```

Find all hosts in any private network (RFC 1918):

```j1ql
FIND Host WITH cidr(ipAddress, '10.0.0.0/8')
  OR cidr(ipAddress, '172.16.0.0/12')
  OR cidr(ipAddress, '192.168.0.0/16')
```

Find hosts that are **not** in a private network (potentially public-facing):

```j1ql
FIND Host WITH !cidr(ipAddress, '10.0.0.0/8')
  AND !cidr(ipAddress, '172.16.0.0/12')
  AND !cidr(ipAddress, '192.168.0.0/16')
```

### Are there potential IP collisions among the networks/subnets in my environment?

Find subnets within the same VPC that have the same CIDR:

```j1ql
Find Network as n1 that has aws_vpc as env that has Network as n2
where
  n1.CIDR=n2.CIDR
return
  n1.displayName, n1.CIDR, n1.region,
  n2.displayName, n2.CIDR, n2.region,
  env.displayName, env.tag.AccountName
order by env.tag.AccountName
```

Find VPCs in the same AWS account that have the same CIDR:

```j1ql
Find aws_vpc as n1
  that has (Account|Service) as env
  that has aws_vpc as n2
where
  n1.CIDR=n2.CIDR
return
  n1.displayName, n1.CIDR, n1.region,
  n2.displayName, n2.CIDR, n2.region,
  env.displayName, env.tag.AccountName
order by env.tag.AccountName
```

Filters out default VPCs:

```j1ql
Find aws_vpc with defaultVpc!=true as n1
  that has (Account|Service) as env
  that has aws_vpc with defaultVpc!=true as n2
where n1.CIDR=n2.CIDR
return
  n1.displayName, n1.CIDR, n1.region,
  n2.displayName, n2.CIDR, n2.region,
  env.displayName, env.tag.AccountName
order by env.tag.AccountName
```

### Are wireless networks segmented and protected by firewalls?

_Requires an integration such as Cisco Meraki, or by adding the wireless network configuration information via the J1 API._

```j1ql
Find Network with wireless=true as n
  that (HAS|CONTAINS|CONNECTS|PROTECTS) (Gateway|Firewall)
    with category='network' as g
  that (CONNECTS|ALLOWS|PERMITS|DENIES|REJECTS) as r *
return
  n.displayName as Network, n._type as NetworkType,
  n.cidr as CIDR, n.environment as Environment,
  g.displayName as Gateway, g._type as GatewayType,
  r._class, r.ipProtocol, r.fromPort, r.toPort
```

### Are there VPN configured for remote access?

Performs a full text search to see if any indexed data that matches the search string 'vpn' is a VPN Host, a VPN Device, a VPN Network or a VPN Gateway:

```j1ql
'vpn' with
  _class=('Host' or 'Device' or 'Network' or 'Gateway')
```

### Is there proper segmentation/segregation of networks?

```j1ql
Find Network with internal=true as n
  that (HAS|CONTAINS|CONNECTS|PROTECTS) (Gateway|Firewall)
    with category='network' as g
return
  n.displayName as Network,
  n._type as NetworkType,
  n.CIDR as CIDR,
  n.tag.AccountName as Account,
  n.internal as Internal,
  g.displayName as Gateway,
  g._type as GatewayType
```

### Show all inbound SSH firewall rules across my network environments.

```j1ql
Find Firewall as fw
  that ALLOWS as rule * as src
where rule.ingress=true and
  rule.ipProtocol='tcp' and
  rule.fromPort<=22 and rule.toPort>=22
return
  fw.displayName,
  rule.ipProtocol, rule.fromPort, rule.toPort,
  src.displayName, src.ipAddress, src.CIDR
```

### Is inbound SSH allowed directly from an external host or network?

```j1ql
Find Firewall as fw
  that ALLOWS as rule (Host|Network)
    with internal=false or internal=undefined as src
where
  rule.ingress=true and rule.ipProtocol='tcp' and
  rule.fromPort<=22 and rule.toPort>=22
return
  fw.displayName,
  rule.fromPort, rule.toPort,
  src.displayName, src.ipAddress, src.CIDR
```

### Show listing of network layer firewall protection or SGs across all my environments.

```j1ql
Find Firewall as f that PROTECTS Network as n
return f.displayName as firewall, n.displayName as network
```

```j1ql
Find Firewall with category='network'
```

---

Source: /j1ql/queries/risk-vuln-mgmt

# Vulnerability management

### Which applications or code repos are vulnerable?

_Requires at least one application scanner integration such as Veracode or WhiteHat._

```j1ql
Find (Application|CodeRepo) as app that has (Finding|Vulnerability) as vuln
return
  app._type, app.displayName,
  vuln._type, vuln.displayName, vuln.severity, vuln.numericSeverity
```

### Which systems/instances are vulnerable?

_Requires enabling AWS Inspector, GuardDuty, Tenable or similar integration._

```j1ql
Find (Host|Workload|DataStore) as system
  that has (Finding|Vulnerability) as vuln
return
  system._type, system.displayName,
  vuln._type, vuln.displayName, vuln.severity, vuln.numericSeverity
```

### What open vulnerabilities do I have?

```j1ql
Find (Finding|Vulnerability) with open=true
```

_This is best viewed in the **Alerts** app under **Open Findings** tab._

### What vulnerabilities are suppressed/resolved/marked as exception?

Similar, you can query for vulnerability findings that are resolved/suppressed or marked as exception:

```j1ql
Find (Finding|Vulnerability)
  with open=false or suppressed=true or exception=true
```

### Do I have proper vendor support for my software applications?

_Requires integration with Okta or OneLogin or similar SSO identity provider._

This returns data that is derived from a SSO application:

```j1ql
Find Application as app that
  CONNECTS Account that RELATES TO Vendor as v
return app.displayName as app, v.name as vendor, v.linkToSLA, v.linkToMSA
```

Or in a more generic way:

```j1ql
Find Application that RELATES TO (Vendor|Account)
```

Returns all applications that does not have a vendor or vendor account associated:

```j1ql
Find Application that !RELATES TO (Vendor|Account)
```

### Are all system images updated in the past six months?

Find images that have been updated within 6 months:

```j1ql
Find Image with createdOn > date.now - 6 months
```

Find images that have not be updated within 6 months:

```j1ql
Find Image with createdOn < date.now - 6 months
```

### What are the approved server/system images?

Find private images or the ones that have been specifically approved:

```j1ql
Find Image with public=false or approved=true
```

### Who are my vendors? Do I have a BAA/DPA/NDA/MSA and SLA/Support Agreement with them?

```j1ql
Find Vendor
```

_This is best viewed in the Asset Inventory app by selecting the Vendor class from the quick filter._

---

Source: /j1ql/queries/servers-endpoints

# Servers and endpoints

## Who is responsible for patching a system in account/zone/tier/layer/VPC/SG?

Returns the owner of hosts in a particular account:

```j1ql
Find Host with tag.AccountName = '{AccountName}' as h
  return h.displayName, h.owner
```

Returns the owner of images used by hosts in a particular account:

```j1ql
Find Host with tag.AccountName = '{AccountName}' as h
  that uses Image as i
  return h.displayName, h.owner, i.displayName, i.owner
```

## Which devices are not compliant?

```j1ql
Find HostAgent with compliant=false as agent
  that (MONITORS|MANAGES|PROTECTS) Device as device
return
  agent._type, agent.displayName, agent.status, agent.compliant,
  device._type, device.displayName, device.hostname,
  device.platform, device.platformName, device.osVersion,
  device.hardwareModel, device.owner
```

---

Source: /j1ql/queries/training

# User training

### Which users have not completed assigned training?

_Requires training data from KnowBe4 or similar._

```j1ql
Find Training as t
  that assigned as enrollment User as u
where enrollment.completedOn = undefined
return u.first_name, u.last_name, u.email, t.name
```

### Is there any user with AWS access that hasn't completed certain training?

_The following example specifies `aws_iam_user` and `knowbe4_user`, requiring AWS and KnowBe4 integrations._

_Additionally, this requires proper mapping between User and Person entities._

```j1ql
Find aws_iam_user
  that is Person
  that is knowbe4_user
  that !completed Training with
    name='training name' or campaign='campaign name'
```

If SAML is used to connect an SSO user (e.g. Okta user) to an AWS IAM Role:

```j1ql
Find aws_iam_role as r
  that assigned User as u
  that is Person as p
  that is knowbe4_user
  that !completed Training with
    name='training name' or campaign='campaign name'
return r.displayName, u.displayName, p.displayName, p.email
```

### Is there any developer who has not completed "Secure Development" training?

_The following example specifies `bitbucket_user`, `github_user`, and `knowbe4_user`, which requires Bitbucket or GitHub, in addition to KnowBe4 integrations._

_Additionally, this requires proper mapping between User and Person entities._

```j1ql
Find (bitbucket_user|github_user)
  that is Person
  that is knowbe4_user
  that !completed Training with
    name='Secure Development' or campaign='Secure Development'
```

---

Source: /j1ql/regular-expressions

# Regular Expressions

Regular Expressions (regex) can be used in J1QL to filter against properties and to extract values using named capture groups in `RETURN` statements.

## Example Queries

### All Administrator Roles

Find all roles called `Administrator` using a case-insensitive search on the role name

```j1ql
FIND AccessRole WITH name = /administrator/i
```

### All AWS Policies Allowing Create or Delete

Find all AWS entities that are related by an ALLOW policy which includes Update and Delete permission flags

```j1ql
FIND * WITH _integrationType = "aws"
  THAT ALLOWS >> AS r *
WHERE r.permissionFlags = /..UD.../
RETURN TREE
```

## Supported Features

The features available today are restricted based on what is supported by the upstream storage services, and what is considered to be safe in regex for performance and complexity.

### Character Classes

Standard character classes are supported:

-   `[0-9]`
-   `[a-zA-Z]`
-   `[a-zA-Z0-9]`

Some shorthand classes are also supported:

-   `\d`
-   `\D`
-   `\w`
-   `\W`

The following are currently NOT supported:

-   `\s` and `\S` these whitespace shorthand classed are not supported. You can use a literal space in your regex.
-   POSIX character classes such as `[:digit:]`
-   Literal whitespace in the regex needs to be in a character class. For example `/john[ ]smith/` to match the string `john smith`.

> **INFO**
> 
> The limitation on use of `\s` and `\S` and whitespace is due to the regex implementaion in ElasticSearch. This limitation is expected to be resolved soon.

### Anchor Tags

The start `^` and `$` anchor tags are not supported at this time, although regex filters can be combined with the `^=` starts with and `$=` ends with comparison operators:

```j1ql
FIND User WITH name ^= /john/i
```

```j1ql
FIND User WITH name $= /smith/i
```

### Alternation

Regular expression `|` alternation is not supported, although multiple regex filters can be applied to the same field using the J1QL `AND` and `OR` syntax:

```j1ql
FIND User WITH (name = /john/i OR name = /smith/i)
```

### Other Unsupported Features

Regex has many features, some additional not currently supported features:

-   Lookarounds
-   Atomic Groups
-   Possessive Quantifiers

## Named capture groups

Named capture groups are only supported in `RETURN` statements and only supported by invoking the `REGEX` function.

The `REGEX` function takes two parameters:

1.  The property to search
2.  The regex to search with

`REGEX` requires that the regex argument has a named capture group. Anything else will fail to parse.

### Capture group names

Capture group names _must only_ be made up of letters. Anything else will fail to parse.

### Return values

The `REGEX` function extracts named capture group values from each entity's property. Each capture group becomes its own column in the result, with the capture group name as the column name. The entirety of the match **will not** be included _unless the `REGEX` function itself is aliased._

Entities where the property does not match the regex pattern will still appear in the results, with `null` values for the capture group columns and alias.

In practice, that means that

```j1ql
FIND User as u RETURN REGEX(u.username, '(?<firstLetter>\w).*')
```

will return a single column `firstLetter` that contains the first letter of the username for each user. Users whose username does not match the pattern will have a `null` value for `firstLetter`.

```j1ql
FIND User as u RETURN REGEX(u.username, '(?<firstLetter>\w).*(?<lastLetter>\w)') as username
```

returns three columns: `firstLetter` which contains the first letter of the match, `lastLetter` which contains the last letter of the match, and `username` which contains the entirety of the match. For non-matching entities, all three columns will be `null`.

---

Source: /j1ql/resolving-duplicate-results

# Resolving duplicate results

Sometimes a query may generate duplicate results. This duplication occurs if there are multiple paths of traversals (such as relationships) between the vertices (such as assets) referenced in a specific query. For example:

```j1ql
FIND aws_eni WITH publicIpAddress != undefined AS nic
  THAT RELATES TO aws_instance
  THAT RELATES TO aws_security_group AS sg THAT allows Internet
WHERE nic.securityGroupIds = sg.groupId
```

This query attempts to find network interfaces associated with a security group that allows public-facing AWS EC2 instances. In this case, there could be multiple security group rules allowing access to/from the Internet, which may result in duplicate data in the query result because each individual traversal is a successful match to the query. This issue can be resolved by leveraging `UNIQUE` and `RETURN`.

## UNIQUE and RETURN

You can use a combination of `UNIQUE` and `RETURN` keywords to filter out the duplicates. We can modify the above example query to eliminate duplicate data within our results:

```j1ql
FIND UNIQUE aws_eni WITH publicIpAddress != undefined AS nic
  THAT RELATES TO aws_instance
  THAT RELATES TO aws_security_group AS sg THAT ALLOWS Internet
WHERE
  nic.securityGroupIds = sg.groupId
RETURN
  nic.id, nic.subnetId, nic.attachmentId,
  nic.active, nic.privateIp, nic.publicIp,
  nic.vpcId, nic.securityGroupIds, nic.securityGroupNames,
  nic.tag.AccountName, nic.webLink
```

> Limitation: `UNIQUE` keyword **must** be used together with `RETURN`.

The following query may return multiple rows containing the same values. In the below example, Peter Parker is using the same username across different applications:

```j1ql
FIND User AS u THAT IS Person AS p
RETURN u.username, p.firstName, p.lastName, p.email
```

| u.username | p.firstName | p.lastName | p.email |
| --- | --- | --- | --- |
| spiderman | Peter | Parker | [not.spiderman@example.com](mailto:not.spiderman@example.com) |
| spiderman | Peter | Parker | [not.spiderman@example.com](mailto:not.spiderman@example.com) |
| batman | Bruce | Wayne | [totally.not.batman@example.com](mailto:totally.not.batman@example.com) |
| bwayne | Bruce | Wayne | [totally.not.batman@example.com](mailto:totally.not.batman@example.com) |

Modifying the query to leverage the `UNIQUE` keyword will make the J1QL engine deduplicate rows:

```j1ql
FIND UNIQUE User AS u THAT IS Person AS p
RETURN u.username, p.firstName, p.lastName, p.email
```

| u.username | p.firstName | p.lastName | p.email |
| --- | --- | --- | --- |
| spiderman | Peter | Parker | [not.spiderman@example.com](mailto:not.spiderman@example.com) |
| batman | Bruce | Wayne | [totally.not.batman@example.com](mailto:totally.not.batman@example.com) |
| bwayne | Bruce | Wayne | [totally.not.batman@example.com](mailto:totally.not.batman@example.com) |

> **NOTE**
> 
> De-duplicating rows using the `UNIQUE` keyword will cause the`_meta` property returned for each row of data to be stripped out.

## MERGE

The function `MERGE()` allows you to merge multiple properties into a single property list. You can now combine multiple (defined) properties into a single property without having to choose to return one property or another.

```j1ql
FIND UNIQUE User AS u
THAT IS Person AS p
RETURN p.displayName, merge(p.email, u.email, u.publicEmail) AS "Email List"
```

---

Source: /j1ql/scalar-functions

# Scalar functions

The ability to format and/or perform calculations on row-level columns can be accomplished through Scalar Functions. These scalar functions enhance the versatility and convenience of J1QL by providing powerful tools for transforming and combining data in queries.

## CONCAT

The scalar function `CONCAT()` empowers users to concatenate or join one or more values into a single string. Currently, `CONCAT` can be used in the `RETURN` to the clause of your function, will future development is planned for use in the `WHERE` clause.

> If this function receives a number or boolean value, the `CONCAT` intuitively converts these values to strings. Additionally, if `CONCAT` processes an empty selector field, it evaluates that field as an empty string.

`CONCAT` supports the following parameters, separated by commas:

-   Selector Fields: `selector.field`
-   String values: `'your string'` or `"your string"`
-   Number values: `123`
-   Boolean values: `true`

Example using CONCAT

```j1ql
FIND
  aws_s3_bucket as s3
RETURN
  CONCAT(s3.bucketSizeBytes, ' bytes') as size
```

## MERGE

The scalar function `MERGE()` allows you to merge multiple properties into a single property list. You can now combine multiple (defined) properties into a single property without having to choose to return one property or another.

Example using MERGE

```j1ql
FIND UNIQUE User AS u
THAT IS Person AS p
RETURN p.displayName, merge(p.email, u.email, u.publicEmail) AS "Email List"
```

## DATETIME

The scalar function `DATETIME()` allows you to format timestamp values into human-readable date and time strings using custom format patterns. This function requires two arguments: a timestamp field and a formatting string.

> **NOTE**
> 
> The timestamp field must be a defined property on the entity. If the timestamp value is undefined when passed to the DATETIME() function, the function will not work properly and may throw an error or return unexpected results.

The `DATETIME` function accepts:

-   Timestamp field: A property containing an epoch timestamp in milliseconds
-   Format string: A string specifying the desired date/time format pattern (required)

Example using DATETIME

```j1ql
FIND DataStore AS ds
RETURN
  ds.displayName,
  DATETIME(ds._createdOn, "yyyy-MM-dd HH:mm:ss.SSSSZ") AS "Created Date",
  DATETIME(ds._beginOn, "hh:mm") AS "Time Modified"
```

You can also combine `DATETIME` with other scalar functions:

Combining DATETIME with CONCAT

```j1ql
FIND * AS s
RETURN CONCAT("Created at ", DATETIME(s._createdOn, "hh:mm")) AS "Creation Time"
LIMIT 10
```

For more information about the format string patterns, see the [Java DateTimeFormatter documentation](https://docs.oracle.com/javase/8/docs/api/java/time/format/DateTimeFormatter.html).

## J1.RISKSCORE

The scalar function `j1.riskScore()` returns the [UVM risk score](/features/vulnerability-management/risk-scoring.md) of one vulnerability on one device, computed with your account's **Risk configuration**. Use it to filter, sort, and aggregate on risk score without writing the scoring formula yourself.

`j1.riskScore` takes exactly two arguments, in this order:

-   The alias of a `UnifiedVulnerability`
-   The alias of a `UnifiedDevice`

Each alias must select exactly that class. Passing the aliases in the other order, an alias of another class, or `*` returns a validation error.

The score is on a 0–100 scale and is not rounded. It matches the risk score in the entity inspector. The Prioritized table shows the same score on a 0–10 scale, so a score of `39.16` appears there as `3.9`.

Example using J1.RISKSCORE

```j1ql
FIND UnifiedVulnerability AS uv
  THAT IS Vulnerability
  THAT HAS (Host|Device)
  THAT IS UnifiedDevice AS ud
RETURN uv.cveId, ud.displayName, j1.riskScore(uv, ud) AS score
```

You can use `j1.riskScore` in `RETURN`, `WHERE`, `ORDER BY`, and `HAVING`, inside aggregate functions, and in math expressions:

Risk burden per device

```j1ql
FIND UnifiedVulnerability AS uv
  THAT IS Vulnerability
  THAT HAS (Host|Device)
  THAT IS UnifiedDevice AS ud
RETURN
  ud.displayName,
  SUM(j1.riskScore(uv, ud)) AS burden,
  ROUND(AVG(j1.riskScore(uv, ud))) / 10 AS "Average (0–10)"
```

> **NOTE**
> 
> `SUM`, `AVG`, `COUNT`, and `COLLECT` over `j1.riskScore` count each vulnerability and device pair once, even when the query reaches the pair through several paths, such as two scanners reporting the same CVE on one device. `SUM` and `AVG` over other values run once per matched path.
> 
> When an optional traversal finds no device for a vulnerability, `j1.riskScore` returns null for that row.

---

Source: /j1ql/smart-classes

# Smart classes

Smart classes are a mechanism for applying a set of asset filters within a shorthand syntax. JupiterOne administrators can create smart classes in the Assets app by navigating to the smart classes sub section.

> **INFO**
> 
> For detailed information covering setting up smart classes, see our [smart classes page](/features/assets/smart-classes.md).

## Querying Smart Classes

Smart classes should be considered as a subgraph of your entire graph that only contains entities with additional context captured in the smart class. The additional context can be business-related, like asset criticality or owner group, or technical, like whether the assets are EOL or publicly accessible. When building your posture management, vulnerability management, or compliance use cases, you can use the following query patterns to only query for assets that are in your smart class.

### Using Smart Class Instance

The first way to query smart classes is by directly referring to the smart class. Smart classes are queryable by using the hash character before the name of the smart class. Some example queries that follow this pattern include:

-   `FIND #Sev1`
-   `FIND Finding THAT HAS #Sev1`

### Using Smart Classes as a Filter

Beyond directly referencing the smart class as in the above example, it is also possible to use the smart class as a filter. For example, if you are only interested in your DataStores with a certain criticality, you could use the following queries:

-   `FIND #Sev1 DataStore`
-   `FIND AccessRole THAT ALLOWS #Sev1 aws_s3_bucket`

### Using Smart Class Tags

Finally, smart classes can also be referenced by using tags. This is helpful if you want to find entities that belong to multiple smart classes. For example, if you want to find public entities that belong to a certain severity level, you can run the following queries:

-   `FIND DataStore WITH tag.Sev1=true AND tag.Public=true`

---

Source: /j1ql/style

# J1QL Style Guide

As with all query languages there are preferred conventions to have consistency between queries and ultimately make them more readable. This page documentes the preferred style for writing and sharing J1QL.

## Introduction

This style guide provides best practices and conventions for writing J1QL (JupiterOne Query Language) queries. Adhering to these guidelines will ensure your queries are readable, maintainable, and efficient.

## Formatting

### Indentation

-   Use two spaces for indentation to improve readability
-   Wrapped lines should have additional indentation

### Line Length

-   Keep lines under 120 characters where possible for better readability in various editors

### Whitespace

-   Use whitespace around operators (e.g., `=`, `!=`, `>`, `<`) for clarity
-   Include a space after commas in lists

### Case Sensitivity

-   Use uppercase for J1QL keywords and functions to maintain consistency
-   Entity properties should be in the case as defined in the data model

## Naming Conventions

### Aliases

-   Use meaningful aliases for entities and properties to improve query understandability
-   Aliases should be camelCase for consistency

## Query Structure

### FIND Clause

-   Begin queries with the `FIND` keyword followed by the entity type
-   Use the `AS` keyword for aliasing entities and properties when needed

### WITH and WHERE Clause

-   Use the `WITH` and `WHERE` clauses to filter results based on specific criteria
-   Group related conditions using parentheses for clarity

### RETURN Statement

-   Clearly specify what data to return using the `RETURN` statement for complex queries
-   `RETURN` should always be on a new line

## Operators

### Logical Operators

-   Use `AND`, `OR` and `!` to combine or exclude conditions
-   Group conditions with parentheses to override precedence

### Comparison Operators

-   Use `=`, `!=`, `<`, `>`, `<=`, `>=`, `^=` and `$=` for comparisons and filters
-   Use `/ ... /` for regex-based matching when applicable
-   The operand, when representing a string, should be enclosed in double quotes `"`

## Functions

### Usage

-   Use built-in functions (e.g., `COUNT`, `SUM`, `AVG`) to perform calculations or transform data
-   Always include parentheses, even if there are no arguments

## Comments

### Block and Inline Comments

-   Use `/*` and `*/` for block comments to describe overall query purpose or methodology at the beginning of the query
-   Use `/*` and `*/` for inline comments at the end of the line to which they apply

## Examples

Find all User entities

```j1ql
FIND User AS u
RETURN u.displayName, u.email
```

Find open vulnerabilities with critical severity

```j1ql
FIND Vulnerability WITH severity = "critical" AS v
RETURN v.displayName, v.score
```

---

Source: /j1ql/subqueries

# Subqueries

J1QL supports using a subquery as a filter for a property on an outer query.

These queries allow for filtering results from an outer query by specifying one or more subqueries to use. This is a powerful way to build queries across disjoint sections of the graph, or to simplify queries that would otherwise require complex traversals.

## Subqueries as Filters

J1QL subqueries can be used in place of property filter values for equality (`=`) and inequality (`!=`) checks. This allows for the filter to be dynamic, in contrast to using something like a query parameter which is a fixed value, or list of values.

### Subquery Filter Syntax

Subqueries can be used in `WHERE` and `WITH` filters, and can be combined with other filters. The most important thing about writing a subquery is that it must return only a single property from which to build the filter.

Subqueries are contained in parentheses and should follow the following pattern:

```j1ql
FIND something AS s 
WHERE s.property = ( FIND something_else AS se RETURN se.id )
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ This is the subquery
```

The supported operators are equality (`=`) and inequality (`!=`) only at this time. Subqueries do not support returning regex expressions, starts|endswith, or contains.

## Example

In the example below, we will look at a relatively simple query that can be completed both with and without the use of subqueries. In this example, we are looking for all AWS S3 buckets where the bucket belongs to an AWS account that falls under the `Prod` organizational unit in AWS.

J1QL without subqueries:

```j1ql
FIND aws_organizational_unit WITH name = "Prod"
  THAT HAS aws_account
  THAT HAS aws_s3
  THAT HAS aws_s3_bucket AS bucket
RETURN bucket.displayName, bucket.arn, bucket.accountId
```

J1QL with subqueries:

```j1ql
FIND aws_s3_bucket AS bucket
WHERE bucket.accountId = ( FIND UNIQUE aws_organizational_unit WITH name = "Prod" THAT RELATES TO aws_account AS a RETURN a.accountId )
RETURN bucket.displayName, bucket.arn, bucket.accountId
```

In this example, both queries are of similar complexity, and the relationships do exist in the graph to build the query without using subqueries, but the examples are not always so simple!

We may now decide we want these same results, but only where the aws\_account entity has an email address that does not correspond to a User in our identity system's security team.

Given our initial J1QL without subqueries:

```j1ql
FIND aws_organizational_unit WITH name = "Prod"
  THAT HAS aws_account <-- We would need a tangential traversal to filter these entities
  THAT HAS aws_s3
  THAT HAS aws_s3_bucket AS bucket
RETURN bucket.displayName, bucket.arn, bucket.accountId
```

We would need to filter the aws\_account nodes in this query based on the email addresses of the users in our security team. This is not possible for two reasons: we cannot combine in an optional/tangential traversal halfway through our query, and JupiterOne does not build relationships between aws\_account and User entities based on the email contact.

How would we solve this with Subqueries?

```j1ql
FIND aws_s3_bucket AS bucket
THAT HAS aws_s3
THAT HAS aws_account WITH email != ( FIND google_group WITH name = "Security" THAT HAS google_user AS u RETURN u.email )
WHERE bucket.accountId = ( FIND UNIQUE aws_organizational_unit WITH name = "Prod" THAT RELATES TO aws_account AS a RETURN a.accountId )
RETURN bucket.displayName, bucket.arn, bucket.accountId
```

Here there are two subqueries being used. The first is specifically filtering S3 buckets that belong to accounts where the account email is NOT found in the Google "Security" user members' emails. Note that this is a relationship that does not exist in the graph and was previously impossible to join this data. The second subquery is as before, looking only for accounts that belong to the "Prod" organizational unit.

## Important Considerations and Limits

The subqueries in J1QL have the following limitations that are good to understand as you write queries:

1.  **RETURN limit**: The subquery is limited to return up to 5000 values for building the filter. This limit has been found to provide a good balance between usability and performance. It is not possible to adjust this limit on a per-customer basis, but in the future, JupiterOne hopes to be able to increase this limit.
    
    It is recommended that you check your subqueries to ensure that you will not exceed the 5000 return limit. If your query does exceed the limit JupiterOne will inform the user that "The query results may be incomplete. One or more subqueries exceeded the maximum number of results".
    
2.  **Subquery Performance**: The subquery must be performant. Because the filter must be built in a single query as part of the outer query execution flow, it is not possible to apply JupiterOne's graph pagination strategy to the subquery. The query timeout applies to both the subquery and the outer queries' execution time.

---

Source: /j1ql/unwind

# Unwind

## UNWIND

`UNWIND` is a function that takes a list input and produces a row for each value in the list. `UNWIND` has many applications, and is particularly useful when you want to produce a value for each item in a list of values. Using `UNWIND` can ease downstream ETL pipelines, as well as provide insights that would be otherwise cumbersome to evaluate.

Example using UNWIND

```j1ql
FIND
  aws_instance as i
RETURN
  UNWIND(i._integrationClass) as class,
  COUNT(i) as class_count
```

This query retrieves all `aws_instance`s and then unwinds each return value's `_integrationClass` property, which is usually a list, into a discrete row. Each row is then counted and aggregated, effectively returning the total count of distinct `_integrationClass` values on all `aws_instance`s.

The query would return something like

| class | class\_count |
| --- | --- |
| Infrastructure | 237 |
| CSP | 237 |

Another powerful `UNWIND` query is

```j1ql
FIND 
  * as a
RETURN 
  UNWIND(a._type) as type,
  UNWIND(a._class) as class,
  COUNT(a) as total
  ORDER BY total
```

This query retrieves all `_type` and `_class` values for everything, splits them into their own rows, and then counts the total of unique combinations of `_type` and `_class`.

The (shortened) returned value would look something like

| type | class | total |
| --- | --- | --- |
| aws\_ecr\_image | Image | 450111 |
| aws\_macie\_finding | Finding | 320428 |
| unified\_entity | Person | 129009 |
| unified\_entity | UnifiedIdentity | 129009 |
| jira\_user | User | 121137 |
| jira\_issue | Issue | 48760 |

This query without the unwinds would produce results that _look_ similar at first glance, but further inspection will show that there are results that are not unwound, for instance:

| type | class | total |
| --- | --- | --- |
| aws\_ebs\_volume | DataStore,Disk | 538 |

Unwinding a query that filters for the `aws_ebs_volume` type gives:

| type | class | total |
| --- | --- | --- |
| aws\_ebs\_volume | DataStore | 538 |
| aws\_ebs\_volume | Disk | 538 |

### UNWIND caveats

#### Multiple UNWIND statements

Each unwind is combined with the result of each other unwind, effectively producing a list comprehension. Unwinding a list `x` and list `y` will produce `len(x) * len(y)` rows; `x`, `y`, `z` produces `len(x) * len(y) * len(z)`; and so on.

#### Usage inside other functions

Currently, J1QL does not support nesting an `UNWIND` inside other functions, like `COUNT` or `MERGE`.

---

Source: /jupiterOne-data-model

# JupiterOne Data Model

The **JupiterOne Data Model** is a reference model used to describe digital resources and the complex interconnections among all the resources in a technology organization as an **entity-relationship graph**.

The data model is defined by a set of Entities and their Relationships. It represents a reference model, not a strict or rigid structure.

## Entity

An Entity is a node/vertex in the graph that represents a resource within your digital infrastructure.

See the full data model schema in this [GitHub repo](https://github.com/JupiterOne/data-model).

### Class and Type of an Entity

Each Entity has a specific **type** that defines what that entity is, and is assigned one or more higher level **class** that represents a more abstract categorization or labeling of the entity in the perspective of security and technical operations.

#### Type

The **type** property represents the specific type that entity is as defined by the source. For example, an AWS resource may be of type `aws_instance` or `aws_s3_bucket` or `aws_iam_user`.

#### Class

The **class** of an entity is considered an abstract, super-type that defines what that entity is within the general framework of IT and security operations. In the above example, an `aws_instance` entity has a class of `Host`, while an `aws_s3_bucket` is a `DataStore`, and an `aws_iam_user` a `User`.

### Common Entity Properties

Most Entities will have the following common properties:

Common Entity Properties

| Property | Type | Description |
| --- | --- | --- |
| `id` | `string`,`array` | Identifiers of this entity assigned by the providers. Values are expected to be unique within the provider scope. |
| `name` | `string` | Name of this entity |
| `displayName` | `string` | Display name, e.g. a person's preferred name or an AWS account alias |
| `summary` | `string` | A summary / short description of this entity. |
| `description` | `string` | An extended description of this entity. |
| `classification` | `string`,`null` | The sensitivity of the data; should match company data classification scheme |
| `criticality` | `integer` | A number that represents the value or criticality of this entity, on a scale between 1-10. |
| `risk` | `integer` | The risk level of this entity, on a scale between 1-10. |
| `trust` | `integer` | The trust level of this entity, on a scale between 1-10. |
| `complianceStatus` | `number` | The compliance status of the entity, as a percentage of compliancy. |
| `status` | `string` | Status of this entity set by the external source system or by a user, e.g. Active, Inactive, Decommissioned |
| `active` | `boolean` | Indicates if this entity is currently active. |
| `public` | `boolean` | Indicates if this is a public-facing resource (e.g. a public IP or public DNS record) or if the entity is publicly accessible. Default is false. |
| `validated` | `boolean` | Indicates if this node has been validated as a known/valid Entity. |
| `temporary` | `boolean` | Indicates if this node is a temporary resource, such as a lambda instance or an EC2 instance started by ECS. |
| `trusted` | `boolean` | Indicates if this is a trusted resource. For example, a trusted Network, Host, Device, Application, Person, User, or Vendor. |
| `createdOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than `_createdOn` which is the timestamp the entity was first ingested into JupiterOne. |
| `updatedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was last updated at the source. |
| `deletedOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was deleted at the source. |
| `discoveredOn` | `number` | The timestamp (in milliseconds since epoch) when the entity was discovered. |
| `expiresOn` | `number` | If the entity is a temporary resource, optionally set the expiration date. For example, the expiration date of an SSL cert. |
| `createdBy` | `string` | The source/principal/user that created the entity |
| `updatedBy` | `string` | The source/principal/user that updated the entity |
| `deletedBy` | `string` | The source/principal/user that deleted the entity |
| `discoveredBy` | `string` | The source/principal/user that discovered the entity |
| `webLink` | `string` | Web link to the source. For example: [https://console.aws.amazon.com/iam/home#/roles/Administrator](https://console.aws.amazon.com/iam/home#/roles/Administrator). This property is used by the UI to add a hyperlink to the entity. |
| `owner` | `string` | The owner of this entity. This could reference the name of the owner, or as reference ID/key to another entity in the graph as the owner. |
| `tags` | `array` | An array of unnamed tags |
| `notes` | `array` | User provided notes about this entity |

#### Findings Severity Data Normalization

When JupiterOne ingests data from an integration or an API, it uses the property `j1_severity` to normalize the severity rates of findings when severity is present. Normalizing the data simplifies searches and queries that apply to vendors with properties or values that are semantically equivalent but with different names and values. For example, vendor1\_severity and vendor2\_severity properties would be normalized to be j1\_severity but the original values remain in the database. Not all findings data has a severity rating. In that case, JupiterOne does not provide the `j1_severity`for those findings.

**Example queries**:

`find Finding with [j1_severity] = "high"` This query returns a list of all findings with a normalized severity of “high”.

`find Finding with [j1_severity] != undefined as f RETURN f.[j1_severity], count (f)` This query returns a count of all findings in JupiterOne grouped by `j1_severity`.

### Class Specific Entity Properties

Each specific class of Entity also has its own defined properties. For example, a `Person` entity will have properties including `firstName` and `lastName`, while a `Device` entity may have properties such as `hardwareVendor`, `hardwareModel`, and `hardwareSerial`.

### Custom Properties

Entities can also have custom properties that are specific to the type of that entity, defined by the source system where the resource belongs to, or defined by the individual or team managing the resource.

### Defined Entities

Here is a list of reference entities defined by the JupiterOne Data Model, each with its own defined set of properties in addition to the shared common properties:

Defined Entities Table

| Entity | Description |
| --- | --- |
| `AccessKey` | A key used to grant access, such as ssh-key, access-key, api-key/token, mfa-token/device, etc. |
| `AccessPolicy` | A policy for access control assigned to a Host, Role, User, UserGroup, or Service. |
| `AccessRole` | An access control role mapped to a Principal (e.g. user, group, or service). |
| `Account` | An organizational account for a service or a set of services (e.g. AWS, Okta, Bitbucket Team, Google G-Suite account, Apple Developer Account). Each Account should be connected to a Service. |
| `Application` | A software product or application. |
| `ApplicationEndpoint` | An application endpoint is a program interface that either initiates or receives a request, such as an API. |
| `Assessment` | An object to represent an assessment, including both compliance assessment such as a HIPAA Risk Assessment or a technical assessment such as a Penetration Testing. Each assessment should have findings (e.g. Vulnerability or Risk) associated. |
| `Attacker` | An attacker or threat actor. |
| `Backup` | A specific repository or data store containing backup data. |
| `Certificate` | A digital Certificate such as an SSL or S/MIME certificate. |
| `Channel` | A communication channel, such as a Slack channel or AWS SNS topic. |
| `Cluster` | A cluster of compute or database resources/workloads. |
| `CodeCommit` | A code commit to a repo. The commit id is captured in the \_id property of the Entity. |
| `CodeDeploy` | A code deploy job. |
| `CodeModule` | A software module. Such as an npm\_module or java\_library. |
| `CodeRepo` | A source code repository. A CodeRepo is also a DataRepository therefore should carry all the required properties of DataRepository. |
| `CodeReview` | A code review record. |
| `Configuration` | A Configuration contains definitions that describe a resource such as a Task, Deployment or Workload. For example, an `aws_ecs_task_definition` is a `Configuration`. |
| `Container` | A standard unit of software that packages up code and all its dependencies and configurations. |
| `Control` | A security or IT Control. A control can be implemented by a vendor/service, a person/team, a program/process, an automation code/script/configuration, or a system/host/device. Therefore, this is most likely an additional Class applied to a Service (e.g. Okta SSO), a Device (e.g. a physical firewall), or a HostAgent (e.g. Carbon Black CbDefense Agent). Controls are mapped to security policy procedures and compliance standards/requirements. |
| `ControlPolicy` | An technical or operational policy with rules that govern (or enforce, evaluate, monitor) a security control. |
| `CryptoKey` | A key used to perform cryptographic functions, such as an encryption key. |
| `DataObject` | An individual data object, such as an aws-s3-object, sharepoint-document, source-code, or a file (on disk). The exact data type is described in the \_type property of the Entity. |
| `DataStore` | A virtual repository where data is stored, such as aws-s3-bucket, aws-rds-cluster, aws-dynamodb-table, bitbucket-repo, sharepoint-site, docker-registry. The exact type is described in the \_type property of the Entity. |
| `Database` | A database cluster/instance. |
| `Deployment` | A deployment of code, application, infrastructure or service. For example, a Kubernetes deployment. An auto scaling group is also considered a deployment. |
| `Device` | A physical device or media, such as a server, laptop, workstation, smartphone, tablet, router, firewall, switch, wifi-access-point, usb-drive, etc. The exact data type is described in the \_type property of the Entity. |
| `Directory` | Directory, such as LDAP or Active Directory. |
| `Disk` | A disk storage device such as an AWS EBS volume |
| `Document` | A document or data object. |
| `Domain` | An internet domain. |
| `DomainRecord` | The DNS Record of a Domain Zone. |
| `DomainZone` | The DNS Zone of an Internet Domain. |
| `Finding` | A security finding, which may be a vulnerability or just an informative issue. A single finding may impact one or more resources. The `IMPACTS` relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The `IMPACTS` relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc. |
| `Firewall` | A piece of hardware or software that protects a network/host/application. |
| `Framework` | An object to represent a standard compliance or technical security framework. |
| `Function` | A virtual application function. For example, an aws\_lambda\_function, azure\_function, or google\_cloud\_function |
| `Gateway` | A gateway/proxy that can be a system/appliance or software service, such as a network router or application gateway. |
| `Group` | A defined, generic group of Entities. This could represent a group of Resources, Users, Workloads, DataRepositories, etc. |
| `Host` | A compute instance that itself owns a whole network stack and serves as an environment for workloads. Typically it runs an operating system. The exact host type is described in the \_type property of the Entity. The UUID of the host should be captured in the \_id property of the Entity |
| `HostAgent` | A software agent or sensor that runs on a host/endpoint. |
| `Image` | A system image. For example, an AWS AMI (Amazon Machine Image). |
| `Incident` | An operational or security incident. |
| `Internet` | The Internet node in the graph. There should be only one Internet node. |
| `IpAddress` | An re-assignable IpAddress resource entity. Do not create an entity for an IP Address _configured_ on a Host. Use this only if the IP Address is a reusable resource, such as an Elastic IP Address object in AWS. |
| `Key` | An ssh-key, access-key, api-key/token, pgp-key, etc. |
| `Logs` | A specific repository or destination containing application, network, or system logs. |
| `Module` | A software or hardware module. Such as an npm\_module or java\_library. |
| `Network` | A network, such as an aws-vpc, aws-subnet, cisco-meraki-vlan. |
| `NetworkEndpoint` | A network endpoint for connecting to or accessing network resources. For example, NFS mount targets or VPN endpoints. |
| `NetworkInterface` | An re-assignable software defined network interface resource entity. Do not create an entity for a network interface _configured_ on a Host. Use this only if the network interface is a reusable resource, such as an Elastic Network Interface object in AWS. |
| `Organization` | An organization, such as a company (e.g. JupiterOne) or a business unit (e.g. HR). An organization can be internal or external. Note that there is a more specific Vendor class. |
| `PR` | A pull request. |
| `PasswordPolicy` | A password policy is a specific `Ruleset`. It is separately defined because of its pervasive usage across digital environments and the well known properties (such as length and complexity) unique to a password policy. |
| `Person` | An entity that represents an actual person, such as an employee of an organization. |
| `Policy` | A written policy documentation. |
| `Procedure` | A written procedure and control documentation. A Procedure typically `IMPLEMENTS` a parent Policy. An actual Control further `IMPLEMENTS` a Procedure. |
| `Process` | A compute process -- i.e. an instance of a computer program / software application that is being executed by one or many threads. This is NOT a program level operational process (i.e. a Procedure). |
| `Product` | A product developed by the organization, such as a software product. |
| `Program` | A program. For example, a bug bounty/vuln disclosure program. |
| `Project` | A software development project. Can be used for other generic projects as well but the defined properties are geared towards software development projects. |
| `Queue` | A scheduling queue of computing processes or devices. |
| `Record` | A DNS record; or an official record (e.g. Risk); or a written document (e.g. Policy/Procedure); or a reference (e.g. Vulnerability/Weakness). The exact record type is captured in the \_type property of the Entity. |
| `Repository` | A repository that contains resources. For example, a Docker container registry repository hosting Docker container images. |
| `Requirement` | An individual requirement for security, compliance, regulation or design. |
| `Resource` | A generic assignable resource. A resource is typically non-functional by itself unless used by or attached to a host or workload. |
| `Review` | A review record. |
| `Risk` | An object that represents an identified Risk as the result of an Assessment. The collection of Risk objects in JupiterOne make up the Risk Register. A Control may have a `MITIGATES` relationship to a Risk. |
| `Root` | The root node in the graph. There should be only one Root node per organization account. |
| `Rule` | An operational or configuration compliance rule, often part of a Ruleset. |
| `Ruleset` | An operational or configuration compliance ruleset with rules that govern (or enforce, evaluate, monitor) a security control or IT system. |
| `Scanner` | A system vulnerability, application code or network infrastructure scanner. |
| `Section` | An object to represent a section such as a compliance section. |
| `Service` | A service provided by a vendor. |
| `Site` | The physical location of an organization. A Person (i.e. employee) would typically has a relationship to a Site (i.e. located\_at or work\_at). Also used as the abstract reference to AWS Regions. |
| `Standard` | An object to represent a standard such as a compliance or technical standard. |
| `Subscription` | A subscription to a service or channel. |
| `Task` | A computational task. Examples include AWS Batch Job, ECS Task, etc. |
| `Team` | A team consists of multiple member Person entities. For example, the Development team or the Security team. |
| `ThreatIntel` | Threat intelligence captures information collected from vulnerability risk analysis by those with substantive expertise and access to all-source information. Threat intelligence helps a security professional determine the risk of a vulnerability finding to their organization. |
| `Training` | A training module, such as a security awareness training or secure development training. |
| `User` | A user account/login to access certain systems and/or services. Examples include okta-user, aws-iam-user, ssh-user, local-user (on a host), etc. |
| `UserGroup` | A user group, typically associated with some type of access control, such as a group in Okta or in Office365. If a UserGroup has an access policy attached, and all member Users of the UserGroup would inherit the policy. |
| `Vault` | A collection of secrets such as a key ring |
| `Vendor` | An external organization that is a vendor or service provider. |
| `Vulnerability` | A security vulnerability (application or system or infrastructure). A single vulnerability may relate to multiple findings and impact multiple resources. The `IMPACTS` relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The `IMPACTS` relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc. |
| `Weakness` | A security weakness. |
| `Workload` | A virtual compute instance, it could be an aws-ec2-instance, a docker-container, an aws-lambda-function, an application-process, or a vmware-instance. The exact workload type is described in the \_type property of the Entity. |

#### Special Entities

There are three special entities defined. These are singleton entities.

| Entity | Description |
| --- | --- |
| `Everyone` | The global `UserGroup` that represents "everyone" publicly. |
| `Internet` | The Internet -- i.e. a `Network` entity with CIDR `"0.0.0.0/0"`. |
| `Root` | The entity that represents the top level organization. |

## Relationships

A relationship is the edge between two entity nodes in the graph. The `_class` of the relationship should be, in most cases, a generic descriptive verb, such as `HAS` or `IMPLEMENTS`.

Relationships can also carry their own properties.

For example, `CodeRepo -- DEPLOYED TO -> Host` may have `version` as a property on the `DEPLOYED` relationship. This represents the mapping between a code repo to multiple deployment targets, while one deployment may be of a different version of the code than another. Storing the version as a relationship property allows us to avoid duplicate instances of the code repo entity to be created to represent different versions.

Relationships have the same metadata properties as entities, which are managed by the integration providers.

### Example defined Relationships between abstract Entity Classes

#### HAS / CONTAINS

```text
Account         -- HAS ->             User
Account         -- HAS ->             UserGroup
Account         -- HAS ->             AccessRole
Account         -- HAS ->             Resource
CodeRepo        -- HAS ->             Vulnerability
Host            -- HAS ->             Vulnerability
Organization    -- HAS ->             Site
Organization    -- HAS ->             Organization (e.g. a business unit)
Application     -- HAS ->             Vulnerability
CodeRepo        -- HAS ->             Vulnerability
Host            -- HAS ->             Vulnerability
Service         -- HAS ->             Vulnerability
Site            -- HAS ->             Network
Site            -- HAS ->             Site
UserGroup       -- HAS ->             User
Network         -- CONTAINS ->        Host
Network         -- CONTAINS ->        Database
Network         -- CONTAINS ->        Network (e.g. a subnet)
```

#### IS / OWNS

```text
User            -- IS ->              Person
Vulnerability   -- IS ->              Vulnerability (e.g. a Snyk Vuln IS a CVE)
Person          -- OWNS ->            Device
```

#### EXPLOITS / IMPACTS

```text
Vulnerability   -- EXPLOITS ->        Weakness
Vulnerability   -- IMPACTS  ->        CodeRepo | Application
```

#### USES

```text
Host            -- USES ->            Resource (e.g. aws_instance USES aws_ebs_volume)
```

#### CONNECTS / TRIGGERS / EXTENDS

```text
Application     -- CONNECTS ->        Account
Gateway         -- CONNECTS ->        Network
Gateway         -- TRIGGERS ->        Function
HOST            -- EXTENDS  ->        Resource
```

#### IMPLEMENTS / MITIGATES

```text
Procedure       -- IMPLEMENTS ->      Policy
Control         -- IMPLEMENTS ->      Policy
Control         -- MITIGATES  ->      Risk
```

#### MANAGES

```text
Person          -- MANAGES ->         Person
Person          -- MANAGES ->         Organization
Person          -- MANAGES ->         Team
User            -- MANAGES ->         Account
User            -- MANAGES ->         UserGroup
ControlPolicy   -- MANAGES ->         Control
AccessPolicy    -- MANAGES ->         AccessRole
```

#### EVALUATES / MONITORS / PROTECTS

```text
ControlPolicy   -- EVALUATES ->       <any entity>
HostAgent       -- MONITORS  ->       Host
HostAgent       -- PROTECTS  ->       Host
```

#### TRUSTS

```text
AccessRole      -- TRUSTS ->          AccessRole
AccessRole      -- TRUSTS ->          Service
AccessRole      -- TRUSTS ->          Account
```

#### ASSIGNED

```text
User            -- ASSIGNED ->        Application
User            -- ASSIGNED ->        AccessRole
UserGroup       -- ASSIGNED ->        AccessRole
```

#### IDENTIFIED / PERFORMED / COMPLETED

```text
Person          -- PERFORMED  ->      Assessment
Person          -- COMPLETED  ->      Training
Assessment      -- IDENTIFIED ->      Risk
Assessment      -- IDENTIFIED ->      Vulnerability
```

#### PROVIDES

```text
Vendor          -- PROVIDES ->        Service
```

#### CONTRIBUTES TO

```text
User            -- CONTRIBUTES TO ->  CodeRepo
```

#### OPENED

```text
User            -- OPENED   ->        CodeReview (i.e. PR)
```

#### DEPLOYED TO

```text
CodeRepo        -- DEPLOYED TO ->     Account
CodeRepo        -- DEPLOYED TO ->     Host
CodeRepo        -- DEPLOYED TO ->     Container
CodeRepo        -- DEPLOYED TO ->     Function
```

## What does this look like?

The diagram below is an abstract illustration of the entities and relationships defined by the data model.

![data-model](/assets/images/data-model-d5694ff4fe77d208a1b02c1347706de6.png)

---

Source: /jupiterOne-data-model/aws-iam

# JupiterOne Data Model for AWS IAM Access and Trusts

The Identity and Access Model for the JupiterOne AWS integration shows which assets are ingested and the relationships that are created. A graph view of this model is available in your JupiterOne account after you turn on the AWS integration and starting ingesting data to your account.

![https://my.mindnode.com/6Sf6EftsmUqNqyXeKREWamqVzxqe4uvzBxyfRCpq/em#130.5,-318.0,-1](/assets/images/data-model-aws-iam-6fbc964b32a991043386d219581e656f.png)

---

Source: /jupiterOne-data-model/development

# JupiterOne Data Model for Software Development

![](/assets/images/j1-data-model-dev-782d93012d8af7638a257a24b36168bc.png)

---

Source: /jupiterOne-data-model/entity-ingestion-sources

# JupiterOne Entity Ingestion Sources

JupiterOne has a standard set of labels that represent how any single entity is ingested into the JupiterOne graph. You can find this information on entities on the `Metadata` tab in the entity drawer in J1 Assets. You can also filter against this information when you are querying JupiterOne by including the `_source` property in a `WITH` clause of a JupiterOne query.

For example:

```text
Which of my aws instances that were ingested by an integration use a data store?

FIND aws_instance
    WITH _source = 'integration-managed'
    THAT USES DataStore
RETURN TREE
```

## Labels of Ingestion Sources

`system-internal` - Entities that are created by an internal JupiterOne system that represents metadata about your JupiterOne instance. For example, users who have access to the JupiterOne software itself, compliance benchmarks, and alerts should have a `_source` value of `system-internal`.

`integration-managed` - Entities that are created by integrations. For example, if you configure an AWS integration and that integration ingests information into the J1 Graph, the source of those entities should have a `_source` value of `integration-managed`.

`system-mapper` - Entities that represent assets that have not been ingested into the J1 Graph by an integration but are determined to exist another way. In the JupiterOne data model, specific entity relationships can be inferred based on the correlation data certain entities have with one other. For example, you can expect that an entity that represents a `HostAgent` (such as scanning agents from vendors like CrowdStrike or SentinelOne) must also be accompanied by a `Host` that it is scanning (such as instances from a cloud service provider or a physical device that an employee uses to perform their work). In this case, the `Host` entity may be created by the system mapper if it does not already exist from an integration.

Another example of a `system-mapper` entity results from the timing of how integrations might execute or the information JupiterOne can retrieve from vendor solutions. JupiterOne uses an entity with a `_source` value of `system-mapper` to represent an asset that likely exists (based on relationship data) before other integration sources have had the opportunity to hydrate or enrich it in the J1 Graph.

`api` - Entities that are created using the JupiterOne APIs are given a `_source` value of `api`.

`sample-data` - Entities that are created using the sample data feature of JupiterOne are given a `_source` value of `sample-data`.

---

Source: /jupiterOne-data-model/mappings

# JupiterOne Entity Relationship Mappings

JupiterOne stores [entities and relationships](/jupiterOne-data-model.md) representing your organization's critical resources, their configurations, and their relationships. Relationships between entities may be explicitly stated in the APIs of the systems that manage them, and the integrations with those systems will leverage that information to build relationships in JupiterOne. In other cases, relationships need to be inferred from properties common to a set of related entities. This inference can extend across entities from multiple systems so that relationships can be automatically mapped, given enough context about how entities are related through their common properties. In some cases, entities will be generated to represent a resource that doesn't exist as an explicit thing in your systems, but is implied, such as the Internet.

Entity relationship mappings provide the context necessary to support this automatic relationship building.

## How Does It Work

Mapping rules are maintained by the JupiterOne engineering team; they cannot be modified by customers today. However, it is still important to understand how the mapping rules work because:

1.  Entities and relationships that mappings produce will exist in your data, though you will not be billed for these.
2.  Knowing about mappings allows you to leverage the entities and relationships they produce in J1 queries.
3.  Some mappings require customers to add properties to entities so that relationships can be inferred.

As entities are created and updated, the system will check to see if the entity matches a mapping rule. This entity is considered the source of the relationship to build. The target of the relationship is determined by performing a search according to the mapping's target filter parameters. When more than one entity matches the target filter, a relationship is established between the source and each target entity. No relationship is created when a target is not found. A single target entity will be created when no existing entities match, unless `skipTargetCreation: true`.

The mapping specifies the properties to transfer to a target created by the mapper. The values of those properties may be static, being explicitly defined in the rule, or the values may be transferred from the source entity. When multiple mapping rules resolve to the same mapper-created target entity, the target entity will accumulate the properties. This allows for a target to include properties from any mapped source entity.

The mapper will produce operations to create, update, or delete the target entities and relationships it manages. The entities produced by the mapper may themselves match a mapping rule, leading to a cascading effect that builds a graph of relationships.

Try this J1QL query to see entities produced by the mapper in your J1 account:

```j1ql
FIND * WITH _source="system-mapper" LIMIT 10
```

This query will show some relationships it created:

```j1ql
FIND * THAT RELATES TO AS r Root
WHERE r._source="system-mapper"
RETURN r.* LIMIT 10
```

## Example Use Cases

### Identifying Accounts That Belong to a Person

Integrations with an identity provider have mapping rules that cause the mapper to produce a `Person` entity when the users of the IdP have properties that identify the record as a real person, not a bot or service account. Once that `Person` entity exists, whenever a `User` entity is produced by any system, the `User` will be related to the `Person` as well when there are properties that identify the account with the `Person`, such as an `email` or `username`.

If you have an IdP integration configured, such as Okta or OneLogin, you may find user accounts that belong to a person:

```j1ql
FIND User AS u THAT RELATES TO Person AS p
RETURN u.email, u._type, u.displayName, p.employeeType
LIMIT 5
```

## Relationship Mapping Rules

Mapping rules are maintained by the JupiterOne engineering team, but it is instructive to see that rules take this basic form:

```json
{
  "sourceFilter": {
    "_class": "Person"
  },
  "relationshipProperties": {
    "_class": "IS"
  },
  "relationshipDirection": "REVERSE",
  "targetFilterKeys": [
    ["_class", "email"],
    ["_class", "username"]
  ],
  "propertyMappings": [
    {
      "sourceProperty": "email",
      "targetProperty": "email"
    },
    {
      "sourceProperty": "email",
      "targetProperty": "username"
    },
    {
      "targetValue": "User",
      "targetProperty": "_class"
    }
  ],
  "skipTargetCreation": true
}
```

-   `"sourceFilter"`: Declares the properties of the source entity that the rule matches
    
-   `"relationshipProperties"`: Declares the properties to place on generated relationships
    
-   `"relationshipDirection"`: Declares the directionality of the relationship
    
-   `"targetFilterKeys"`: Declares the properties to query when resolving the target entities
    
-   `"propertyMappings"`: Declares the properties to assign to target entities created by the mapper and provides the values used to search for the target entities
    
-   `"skipTargetCreation"`: Instructs the mapper to avoid creating the target entity when none already exist
    

## Mappings

The current mappings are summarized below. The _Global Mappings_ apply to entities no matter how they are produced, whether by a managed integration or through the JupiterOne API. Each managed integration may also specify mappings that are applied only to entities managed by that integration.

The summaries have a title taking the form `SOURCE RELATIONSHIP TARGET`.

-   `SOURCE` is always the entity that triggers the mapping configuration. The label is the `_class` or `_type` that will be matched. Other match properties are listed in the summary body.
-   `RELATIONSHIP` is relative to `SOURCE`, and the label of comes from the `_class`.
    -   Forward: `-CLASS->`
    -   Reverse: `<-CLASS-`
-   `TARGET` is determined by a search, or one will be created when not found (unless `skipTargetCreation: true`). The label is the `_class` or `_type` that will be matched. Other match properties are listed in the summary body.

It is important to remember:

-   Mapping rules are triggered when a `SOURCE` entity matches. Rules are NOT automatically reversed so that relationships are updated when a `TARGET` is created/updated.
-   Any change to the `SOURCE` entity triggers the mapping rule to be evaluated/re-evaluated.
-   The **Source Filters** must match an entity or the rule will not trigger. It may be necessary to _add properties to entities_ at the data source so that when they are ingested they will match the rule.
-   A rule produces relationships to all `TARGET` entities matching the **Target filters**. It may be necessary to _add properties to entities_ at the data source so that when they are ingested they will match the rule.
-   **Transferred Properties** are listed only when the mapper will create a target entity if none are found (`skipTargetCreation: false`).

### Mappings Rules

-   [Global Mapping Rules](/jupiterOne-data-model/mappings-global.md)
-   [Integration Specific Mapping Rules](/jupiterOne-data-model/mappings-integrations.md)

---

Source: /jupiterOne-data-model/mappings-global

# Global Mapping Rules

This document describes the global automated mapping rules that apply across all entities in the graph.

### 1\. Application -HAS-> qualys\_web\_app\_finding

> **Mapping Rule Conditions**
> 
> -   Application.`name` IN qualys\_web\_app\_finding.`targets`

Rule Id: igm-rule-83f5f4e4-7dd6-4645-9752-6c0ee098c402

### 2\. github\_repo -HAS-> snyk\_finding

> **Mapping Rule Conditions**
> 
> -   github\_repo.`fullName` = snyk\_finding.`repoFullName`

Rule Id: igm-rule-aae0a67a-6780-4a81-ac71-e1eccede9b8f

### 3\. gitlab\_project -HAS-> snyk\_finding

> **Mapping Rule Conditions**
> 
> -   gitlab\_project.`fullName` IN snyk\_finding.`targets`

Rule Id: igm-rule-be95f66d-c132-4a88-a3ba-3e0ff9f9220c

### 4\. aws\_instance -HAS-> aws\_guardduty\_finding

> **Mapping Rule Conditions**
> 
> -   aws\_instance.`id` = aws\_guardduty\_finding.`targets`

Rule Id: igm-rule-f7cd3d6f-0c1a-45ff-978b-19b34d77e85f

### 5\. qualys\_host\_finding -HAS-> aws\_instance

> **Mapping Rule Conditions**
> 
> -   qualys\_host\_finding.`ec2InstanceArn` = aws\_instance.`_key`

Rule Id: igm-rule-48187acf-c442-475b-bcbe-6cc6fadab071

### 6\. qualys\_host\_finding -HAS-> azure\_vm

> **Mapping Rule Conditions**
> 
> -   qualys\_host\_finding.`azureVmSourceId` = azure\_vm.`_key`

Rule Id: igm-rule-52561b1b-a1c8-4710-bf81-55b2c34557e0

### 7\. qualys\_host\_finding -HAS-> discovered\_host

> **Mapping Rule Conditions**
> 
> -   qualys\_host\_finding.`hostId` = discovered\_host.`qualysQwebHostId`

Rule Id: igm-rule-dc5a3636-6d37-4a17-ae81-09e686366f8c

### 8\. qualys\_host\_finding -HAS-> google\_compute\_instance

> **Mapping Rule Conditions**
> 
> -   qualys\_host\_finding.`gcpInstanceSelfLink` = google\_compute\_instance.`_key`

Rule Id: igm-rule-567bf866-962a-4292-a440-cbcf81cebb65

### 9\. Person|Team|UserGroup -MANAGES-> Account|Application|Channel|Cluster|CodeRepo|Configuration|DataStore|Domain|Firewall|Function|Gateway|Host|Network|Organization|Product|Repository|Service|Workload

> **Mapping Rule Conditions**
> 
> -   Person | Team | UserGroup.`email` = Account | Application | Channel | Cluster | CodeRepo | Configuration | DataStore | Domain | Firewall | Function | Gateway | Host | Network | Organization | Product | Repository | Service | Workload.`contactEmails`

Rule Id: igm-rule-438dc97a-7cac-11ed-a526-d3622dd84680

### 10\. Application -USES-> DomainZone

> **Mapping Rule Conditions**
> 
> -   Application.`name` = DomainZone.`domainName`
> -   Application.`name` = DomainZone.`domainName`

Rule Id: igm-rule-9981b9c8-8209-44d7-9fdf-38415f62ff32

### 11\. aws\_dms\_instance|aws\_lambda\_function -HAS-> aws\_vpc

> **Mapping Rule Conditions**
> 
> -   aws\_dms\_instance | aws\_lambda\_function.`vpcId` = aws\_vpc.`vpcId`

Rule Id: igm-rule-83871315-5eb9-4fc0-ada5-342ab075c3c2

### 12\. CodeRepo -DEFINES-> Function

> **Mapping Rule Conditions**
> 
> -   CodeRepo.`name` = Function.`name`

Rule Id: igm-rule-752d55ca-7cae-11ed-b27f-c7f83e8f75c9

### 13\. Control -DEFINES-> ControlTest

> **Mapping Rule Conditions**
> 
> -   Control.`id` = ControlTest.`controlId`

Rule Id: igm-rule-78a3c2d0-bded-47a3-aa74-fa04c638b4cc

### 14\. Domain -HAS-> DomainZone

> **Mapping Rule Conditions**
> 
> -   Domain.`name` = DomainZone.`parentDomain`
> -   Domain.`name` = DomainZone.`domainName`

Rule Id: igm-rule-cdb79aae-7cac-11ed-9949-0ff60fee3b5d

### 15\. Domain|DomainZone|DomainRecord -HAS-> Certificate

> **Mapping Rule Conditions**
> 
> -   Domain | DomainZone | DomainRecord.`name` = Certificate.`domainName`

Rule Id: igm-rule-ee40c6e2-7cac-11ed-9e6f-c39034f30ecd

### 16\. DomainRecord -CONNECTS-> IpAddress|Gateway|Cluster

> **Target Filters**
> 
> -   `type = "A"`
> -   `type = "AAAA"`

> **Mapping Rule Conditions**
> 
> -   IpAddress | Gateway | Cluster.`publicIpAddresses` IN DomainRecord.`value`

Rule Id: igm-rule-9b2b7aec-7cac-11ed-b2e0-b3e60622bc88

### 17\. DomainRecord -CONNECTS-> Host

> **Target Filters**
> 
> -   `type = "A"`
> -   `type = "AAAA"`

> **Mapping Rule Conditions**
> 
> -   Host.`publicIpAddresses` IN DomainRecord.`value`

Rule Id: igm-rule-88bbbafa-4b34-476e-8f6b-ce6bc76fef69

### 18\. DomainRecord -CONNECTS-> IpAddress

> **Target Filters**
> 
> -   `type = "A"`
> -   `type = "AAAA"`

> **Mapping Rule Conditions**
> 
> -   IpAddress.`publicIpAddress` IN DomainRecord.`value`

Rule Id: igm-rule-d55bcb92-7688-4aa3-8ee4-40351d583c10

### 19\. DomainRecord -CONNECTS-> IpAddress

> **Target Filters**
> 
> -   `type = "A"`
> -   `type = "AAAA"`

> **Mapping Rule Conditions**
> 
> -   IpAddress.`privateIpAddress` IN DomainRecord.`value`

Rule Id: igm-rule-d822c12e-e163-4dd0-b8a0-42d15e023466

### 20\. DomainRecord -CONNECTS-> NetworkInterface

> **Target Filters**
> 
> -   `type = "A"`
> -   `type = "AAAA"`

> **Mapping Rule Conditions**
> 
> -   NetworkInterface.`publicIpAddresses` IN DomainRecord.`value`

Rule Id: igm-rule-61efba4a-f0f2-4018-8a95-c66cbeefca0f

### 21\. security\_procedure -IMPLEMENTS-> compliance\_control

> **Mapping Rule Conditions**
> 
> -   security\_procedure.`_key` = compliance\_control.`policyItemId`

Rule Id: igm-rule-3ade111a-0081-4c35-9d77-3f70ae0c6d03

---

Source: /jupiterOne-data-model/mappings-integrations

# Integration Mapping Rules

This document describes the automated mapping rules that connect integration entities to other entities in the graph.

## AWS Rules

### 1\. jupiterone\_integration -INGESTS-> aws\_account

> **Mapping Rule Conditions**
> 
> -   jupiterone\_integration.`id` = aws\_account.`_integrationInstanceId`

Rule Id: igm-rule-a0017fd5-35ef-441e-bb05-cc15cb8ed525

### 2\. Person|Team|UserGroup -MANAGES-> aws\_account

> **Mapping Rule Conditions**
> 
> -   Person | Team | UserGroup.`email` IN aws\_account.`operationsContactEmail`
> -   Person | Team | UserGroup.`email` IN aws\_account.`securityContactEmail`
> -   Person | Team | UserGroup.`email` IN aws\_account.`billingContactEmail`
> -   Person | Team | UserGroup.`email` IN aws\_account.`email`

Rule Id: igm-rule-31add946-1a33-48e1-8936-e0e78b3478c8

### 3\. aws\_route53\_record -CONNECTS-> aws\_alb

> **Mapping Rule Conditions**
> 
> -   aws\_route53\_record.`value` = aws\_alb.`dualstackDnsName`

Rule Id: igm-rule-696f31bd-845f-4020-92a6-cc0a4be6b674

### 4\. aws\_ami -USES-> aws\_autoscaling\_launch\_configuration

> **Mapping Rule Conditions**
> 
> -   aws\_ami.`imageId` = aws\_autoscaling\_launch\_configuration.`imageId`

Rule Id: igm-rule-2df898ba-26b5-4901-aab7-5cb977b202b8

### 5\. aws\_cloudfront\_distribution -CONNECTS-> aws\_api\_gateway\_domain\_name

> **Mapping Rule Conditions**
> 
> -   aws\_cloudfront\_distribution.`origins` IN aws\_api\_gateway\_domain\_name.`domainName`
> -   aws\_cloudfront\_distribution.`origins` IN aws\_api\_gateway\_domain\_name.`regionalDomainName`

Rule Id: igm-rule-33e6d176-7651-4f49-a767-906fbcc845a3

### 6\. aws\_cloudfront\_distribution -CONNECTS-> aws\_route53\_record

> **Mapping Rule Conditions**
> 
> -   aws\_cloudfront\_distribution.`origins` IN aws\_route53\_record.`name`

Rule Id: igm-rule-4bf61f3f-0ef6-4166-92cb-b4a41febd5f6

### 7\. aws\_cloudfront\_distribution -CONNECTS-> Internet

Rule Id: igm-rule-618661e0-49ea-4e27-846d-44d7ddb479d6

### 8\. aws\_cloudfront\_distribution\_origin -CONNECTS-> aws\_alb|aws\_elb|aws\_nlb

> **Mapping Rule Conditions**
> 
> -   aws\_cloudfront\_distribution\_origin.`domainName` = aws\_alb | aws\_elb | aws\_nlb.`dnsName`

Rule Id: igm-rule-c0fb6e72-7129-4448-8f73-2747216ace6b

### 9\. aws\_instance -RUNS-> aws\_ecs\_container\_instance

> **Mapping Rule Conditions**
> 
> -   aws\_instance.`instanceId` = aws\_ecs\_container\_instance.`ec2InstanceId`

Rule Id: igm-rule-6aa57e31-a2a0-421c-a565-4481fe2bbf79

### 10\. aws\_ecs\_service -TRIGGERS-> aws\_ecs\_task

> **Mapping Rule Conditions**
> 
> -   aws\_ecs\_service.`deployments` IN aws\_ecs\_task.`startedBy`

Rule Id: igm-rule-52068a54-42f7-43dc-a5a8-1445a71613c2

### 11\. aws\_iam\_access\_key -HAS-> aws\_guardduty\_finding

> **Mapping Rule Conditions**
> 
> -   aws\_iam\_access\_key.`id` = aws\_guardduty\_finding.`accessKeyId`

Rule Id: igm-rule-c8bbf641-9cc7-4001-939c-b7bc41527613

### 12\. aws\_iam\_role -HAS-> aws\_guardduty\_finding

> **Mapping Rule Conditions**
> 
> -   aws\_iam\_role.`id` = aws\_guardduty\_finding.`roleId`

Rule Id: igm-rule-a800d381-0118-43b4-b87c-676915bf4014

### 13\. aws\_iam\_user -HAS-> aws\_guardduty\_finding

> **Mapping Rule Conditions**
> 
> -   aws\_iam\_user.`id` = aws\_guardduty\_finding.`userId`

Rule Id: igm-rule-897ec90e-5b96-44df-a4ba-ea3c799ef2ea

### 14\. Person -HAS-> aws\_guardduty\_finding

> **Mapping Rule Conditions**
> 
> -   Person.`userId` IN aws\_guardduty\_finding.`userName`

Rule Id: igm-rule-9cb629a3-276d-4f0c-9474-4e515166a92b

### 15\. aws\_instance -USES-> aws\_iam\_role

> **Mapping Rule Conditions**
> 
> -   aws\_instance.`iamInstanceProfileId` = aws\_iam\_role.`instanceProfileId`

Rule Id: igm-rule-a59cd62c-408b-4709-9219-0415b9c63b02

### 16\. aws\_internet\_gateway -CONNECTS-> Internet

Rule Id: igm-rule-332bf443-6209-4ca9-a35a-9779d59081ce

### 17\. aws\_route53\_record -CONNECTS-> aws\_alb

> **Mapping Rule Conditions**
> 
> -   aws\_route53\_record.`value` = aws\_alb.`dnsName`

Rule Id: igm-rule-e4bd96bd-f98d-4feb-87c0-ffbda49b1852

### 18\. aws\_route53\_zone -USES-> aws\_vpc

> **Mapping Rule Conditions**
> 
> -   aws\_route53\_zone.`vpcIds` IN aws\_vpc.`id`

Rule Id: igm-rule-703b8bfa-ba7a-4620-9584-91249cc5e6c5

### 19\. aws\_transfer\_server -CONNECTS-> Internet

Rule Id: igm-rule-2ddebda4-f4ca-4c0e-acaf-d11b7c59a9bd

### 20\. aws\_alb|aws\_s3\_bucket|aws\_nlb|aws\_elb|aws\_redshift\_cluster -LOGS-> aws\_s3\_bucket

> **Mapping Rule Conditions**
> 
> -   aws\_alb | aws\_s3\_bucket | aws\_nlb | aws\_elb | aws\_redshift\_cluster.`loggingTargetBucket` = aws\_s3\_bucket.`bucketName`

Rule Id: igm-rule-cff0f85f-194e-40e7-876f-0f44a0314cc5

## BIGID Rules

### 21\. bigid\_datasource -IS-> aws\_s3\_bucket

> **Mapping Rule Conditions**
> 
> -   bigid\_datasource.`awsBucket` = aws\_s3\_bucket.`bucketName`

Rule Id: igm-rule-139aca1f-b86d-4a9d-812b-82dc93a07feb

### 22\. bigid\_datasource -IS-> aws\_s3\_bucket

> **Mapping Rule Conditions**
> 
> -   bigid\_datasource.`awsBucketv2` = aws\_s3\_bucket.`bucketName`

Rule Id: igm-rule-0c8e196e-a44c-4b27-aca4-9cbabb7bd3cc

### 23\. Person -OWNS-> bigid\_datasource

> **Mapping Rule Conditions**
> 
> -   Person.`email` IN bigid\_datasource.`owners`

Rule Id: igm-rule-e5195ef4-2b50-48e2-9f34-4c17fc760d32

## CISCO MERAKI Rules

### 24\. user\_endpoint -CONNECTS-> meraki\_device

> **Mapping Rule Conditions**
> 
> -   user\_endpoint.`publicIp` = meraki\_device.`publicIp`

Rule Id: igm-rule-53f81e82-efe3-4828-bdb2-69f0e3994dec

## CROWDSTRIKE Rules

### 25\. crowdstrike\_aws\_api\_gateway\_resource -IS-> aws\_api\_gateway\_resource

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_api\_gateway\_resource.`arn` = aws\_api\_gateway\_resource.`arn`

Rule Id: igm-rule-e2c96f24-52f7-4a26-b39c-6b98d3cccdd6

### 26\. crowdstrike\_aws\_api\_gateway\_rest\_api -IS-> aws\_api\_gateway\_rest\_api

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_api\_gateway\_rest\_api.`arn` = aws\_api\_gateway\_rest\_api.`arn`

Rule Id: igm-rule-b6c7d8e9-0314-2345-bcde-678901234567

### 27\. crowdstrike\_aws\_autoscaling\_launch\_configuration -IS-> aws\_autoscaling\_launch\_configuration

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_autoscaling\_launch\_configuration.`arn` = aws\_autoscaling\_launch\_configuration.`arn`

Rule Id: igm-rule-ad477be7-d4f4-47f7-a7e4-a787855c6eac

### 28\. crowdstrike\_aws\_cloudformation\_stack -IS-> aws\_cloudformation\_stack

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_cloudformation\_stack.`arn` = aws\_cloudformation\_stack.`arn`

Rule Id: igm-rule-1105a0f1-1903-4bf3-8293-1e697b416957

### 29\. crowdstrike\_aws\_cloudfront\_domain -IS-> aws\_cloudfront\_distribution

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_cloudfront\_domain.`arn` = aws\_cloudfront\_distribution.`arn`

Rule Id: igm-rule-fb68b517-ea1d-479b-a5cd-25c3f42404e9

### 30\. crowdstrike\_aws\_cloudtrail -IS-> aws\_cloudtrail

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_cloudtrail.`arn` = aws\_cloudtrail.`arn`

Rule Id: igm-rule-1dd4f45b-064f-4a49-8652-8a718b1c9f38

### 31\. crowdstrike\_aws\_codebuild\_project -IS-> aws\_codebuild\_project

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_codebuild\_project.`arn` = aws\_codebuild\_project.`arn`

Rule Id: igm-rule-81e9cffb-4a2a-4f9b-8937-9b1b23d0ff36

### 32\. crowdstrike\_aws\_cognito\_user\_pool -IS-> aws\_cognito\_user\_pool

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_cognito\_user\_pool.`arn` = aws\_cognito\_user\_pool.`arn`

Rule Id: igm-rule-6e316cfd-9379-464c-a6e0-27e061eb5fec

### 33\. crowdstrike\_aws\_config\_account -IS-> aws\_account

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_config\_account.`arn` = aws\_account.`arn`

Rule Id: igm-rule-39e3055f-e440-427b-8ffe-b36ff6e52bad

### 34\. crowdstrike\_aws\_dynamodb\_table -IS-> aws\_dynamodb\_table

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_dynamodb\_table.`arn` = aws\_dynamodb\_table.`arn`

Rule Id: igm-rule-b8c9d0e1-2536-4567-bcde-890123456789

### 35\. crowdstrike\_aws\_ebs\_snapshot -IS-> aws\_ebs\_snapshot

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ebs\_snapshot.`arn` = aws\_ebs\_snapshot.`arn`

Rule Id: igm-rule-25ed5301-c22a-4fe8-b600-d8ea5f4da4d5

### 36\. crowdstrike\_aws\_ebs\_volume -IS-> aws\_ebs\_volume

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ebs\_volume.`arn` = aws\_ebs\_volume.`arn`

Rule Id: igm-rule-e6729c53-60a4-45bd-8754-3ad9b3bf7cd6

### 37\. crowdstrike\_aws\_ec2\_instance -IS-> aws\_instance

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ec2\_instance.`arn` = aws\_instance.`arn`

Rule Id: igm-rule-b9b2a8a7-5c47-46c6-a4a1-3b7a0c9d8c1f

### 38\. crowdstrike\_aws\_ec2\_network\_acl -IS-> aws\_network\_acl

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ec2\_network\_acl.`arn` = aws\_network\_acl.`arn`

Rule Id: igm-rule-766c6af5-d768-4139-a8ec-40060bb9ddf5

### 39\. crowdstrike\_aws\_ec2\_security\_group -IS-> aws\_security\_group

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ec2\_security\_group.`arn` = aws\_security\_group.`arn`

Rule Id: igm-rule-3f7d2c56-9e8b-4a02-8c9b-7a6a1dfb2a34

### 40\. crowdstrike\_aws\_ecr\_repository -IS-> aws\_ecr\_repository

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ecr\_repository.`arn` = aws\_ecr\_repository.`arn`

Rule Id: igm-rule-15a9ab22-01e8-4003-b830-173d0a1bd1d2

### 41\. crowdstrike\_aws\_ecs\_task\_definition -IS-> aws\_ecs\_task\_definition

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ecs\_task\_definition.`arn` = aws\_ecs\_task\_definition.`arn`

Rule Id: igm-rule-12835efa-19da-4d1f-a380-127898009c95

### 42\. crowdstrike\_aws\_eks\_cluster -IS-> aws\_eks\_cluster

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_eks\_cluster.`arn` = aws\_eks\_cluster.`arn`

Rule Id: igm-rule-5a633deb-f88f-41e6-8c10-0042ff90aefe

### 43\. crowdstrike\_aws\_elasticache\_cluster -IS-> aws\_elasticache\_redis\_cluster

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_elasticache\_cluster.`arn` = aws\_elasticache\_redis\_cluster.`arn`

Rule Id: igm-rule-4b75304c-670c-44d9-b922-8f9b39226eec

### 44\. crowdstrike\_aws\_elb\_load\_balancer -IS-> aws\_elb

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_elb\_load\_balancer.`arn` = aws\_elb.`arn`

Rule Id: igm-rule-b8153aa7-a1d7-4753-ba9b-a6a0d261d96c

### 45\. crowdstrike\_aws\_eventbridge\_event\_bus -IS-> aws\_cloudwatch\_event\_rule

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_eventbridge\_event\_bus.`arn` = aws\_cloudwatch\_event\_rule.`arn`

Rule Id: igm-rule-2afb8bc1-5c37-41ce-82af-d33242be8049

### 46\. crowdstrike\_aws\_iam\_account -IS-> aws\_account

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_iam\_account.`arn` = aws\_account.`arn`

Rule Id: igm-rule-f3b1c20f-c352-4cd4-b786-f060695249a3

### 47\. crowdstrike\_aws\_iam\_group -IS-> aws\_iam\_group

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_iam\_group.`arn` = aws\_iam\_group.`arn`

Rule Id: igm-rule-f7c0872b-adb8-4644-b7d3-f9d74099b163

### 48\. crowdstrike\_aws\_iam\_policy -IS-> aws\_iam\_policy

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_iam\_policy.`arn` = aws\_iam\_policy.`arn`

Rule Id: igm-rule-d6ecf11d-e915-4e8c-a6f7-9f346298250d

### 49\. crowdstrike\_aws\_iam\_role -IS-> aws\_iam\_role

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_iam\_role.`arn` = aws\_iam\_role.`arn`

Rule Id: igm-rule-93d0f6db-3f36-4d1a-a36a-540a8b809abd

### 50\. crowdstrike\_aws\_iam\_s3\_policy -IS-> aws\_iam\_policy

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_iam\_s3\_policy.`arn` = aws\_iam\_policy.`arn`

Rule Id: igm-rule-61c8743a-0968-49b5-86ac-1aafa7563fc1

### 51\. crowdstrike\_aws\_iam\_user -IS-> aws\_iam\_user

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_iam\_user.`arn` = aws\_iam\_user.`arn`

Rule Id: igm-rule-21c728c4-3cf4-4ef4-a821-c80f48a4967d

### 52\. crowdstrike\_aws\_kinesis\_stream -IS-> aws\_kinesis\_stream

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_kinesis\_stream.`arn` = aws\_kinesis\_stream.`arn`

Rule Id: igm-rule-164aae9d-6cc8-49c0-aa92-0a048d5d2beb

### 53\. crowdstrike\_aws\_kms\_key -IS-> aws\_kms\_key

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_kms\_key.`arn` = aws\_kms\_key.`arn`

Rule Id: igm-rule-28a12b5a-5f14-4673-b917-f0fe4e104002

### 54\. crowdstrike\_aws\_lambda\_function -IS-> aws\_lambda\_function

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_lambda\_function.`arn` = aws\_lambda\_function.`arn`

Rule Id: igm-rule-e930188f-471c-4355-a43a-c3e0dd242bd8

### 55\. crowdstrike\_aws\_nlb\_alb\_load\_balancer -IS-> aws\_alb

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_nlb\_alb\_load\_balancer.`arn` = aws\_alb.`arn`

Rule Id: igm-rule-f1172121-2dfb-4a87-8d2b-7f9b2752118d

### 56\. crowdstrike\_aws\_rds\_database -IS-> aws\_db\_instance

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_rds\_database.`arn` = aws\_db\_instance.`arn`

Rule Id: igm-rule-398666a3-b114-4314-9fd6-723b3b02ed9c

### 57\. crowdstrike\_aws\_route53\_domain -IS-> aws\_route53\_domain

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_route53\_domain.`arn` = aws\_route53\_domain.`arn`

Rule Id: igm-rule-29278d53-90ae-4578-bca5-3d208f6dff59

### 58\. crowdstrike\_aws\_s3\_bucket -IS-> aws\_s3\_bucket

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_s3\_bucket.`arn` = aws\_s3\_bucket.`arn`

Rule Id: igm-rule-a7b8c9d0-1425-3456-abcd-789012345678

### 59\. crowdstrike\_aws\_secrets\_manager\_secret -IS-> aws\_secret

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_secrets\_manager\_secret.`arn` = aws\_secret.`arn`

Rule Id: igm-rule-a5b6c7d8-9203-1234-abcd-567890123456

### 60\. crowdstrike\_aws\_sns\_topic -IS-> aws\_sns\_topic

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_sns\_topic.`arn` = aws\_sns\_topic.`arn`

Rule Id: igm-rule-7a07b65e-88db-4e3e-9c81-3b6360012f72

### 61\. crowdstrike\_aws\_sqs\_queue -IS-> aws\_sqs\_queue

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_sqs\_queue.`arn` = aws\_sqs\_queue.`arn`

Rule Id: igm-rule-4bf0120f-45e3-440c-be72-6d9a411359bd

### 62\. crowdstrike\_aws\_ssm\_parameter -IS-> aws\_ssm\_parameter

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_ssm\_parameter.`arn` = aws\_ssm\_parameter.`arn`

Rule Id: igm-rule-dc3746dd-5dd9-4d00-9714-371711e1d345

### 63\. crowdstrike\_aws\_vpc -IS-> aws\_vpc

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_vpc.`arn` = aws\_vpc.`arn`

Rule Id: igm-rule-f4b70c18-6ee1-4fa8-9537-2481f08f39c7

### 64\. crowdstrike\_aws\_vpc\_endpoint -IS-> aws\_vpc\_endpoint

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_vpc\_endpoint.`arn` = aws\_vpc\_endpoint.`arn`

Rule Id: igm-rule-d64a5a4e-c412-4f72-b1c5-bf39546394da

### 65\. crowdstrike\_aws\_vpc\_route\_table -IS-> aws\_route\_table

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_vpc\_route\_table.`arn` = aws\_route\_table.`arn`

Rule Id: igm-rule-b50ce981-4bb7-4131-908a-246ffbfdb21d

### 66\. crowdstrike\_aws\_vpc\_subnet -IS-> aws\_subnet

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_vpc\_subnet.`arn` = aws\_subnet.`arn`

Rule Id: igm-rule-1c5cb5b1-9567-4125-bdba-ee749cfa749e

### 67\. crowdstrike\_aws\_waf\_vpc\_endpoint -IS-> aws\_vpc\_endpoint

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_aws\_waf\_vpc\_endpoint.`arn` = aws\_vpc\_endpoint.`arn`

Rule Id: igm-rule-0ad3b176-b193-46dc-a1bf-6be9bad98c50

### 68\. crowdstrike\_azure\_ad\_domain\_service -IS-> azure\_ad\_domain\_service

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_ad\_domain\_service.`id` = azure\_ad\_domain\_service.`id`

Rule Id: igm-rule-f3e2a1c4-2d7b-4a8f-91b0-7e6d5c4b3a2f

### 69\. crowdstrike\_azure\_app\_service -IS-> azure\_function\_app

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_app\_service.`id` = azure\_function\_app.`id`

Rule Id: igm-rule-234ad630-692b-4880-8126-5e5c8d6f111e

### 70\. crowdstrike\_azure\_cdn\_profile -IS-> azure\_cdn\_profile

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_cdn\_profile.`id` = azure\_cdn\_profile.`id`

Rule Id: igm-rule-79d15aa2-740a-4fd1-8e67-c7bc67ed8854

### 71\. crowdstrike\_azure\_container\_app -IS-> azure\_container\_app

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_container\_app.`id` = azure\_container\_app.`id`

Rule Id: igm-rule-b9d0c2a1-5f7b-4b9b-9d5e-2f3e8c4f2c5a

### 72\. crowdstrike\_azure\_cosmosdb\_account -IS-> azure\_cosmosdb\_account

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_cosmosdb\_account.`id` = azure\_cosmosdb\_account.`id`

Rule Id: igm-rule-fdcbe5d2-35b5-4af4-a993-0c5546bad06a

### 73\. crowdstrike\_azure\_event\_hub -IS-> azure\_event\_hub\_namespace

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_event\_hub.`id` = azure\_event\_hub\_namespace.`id`

Rule Id: igm-rule-b5811ae5-25c8-4eda-a0ab-f7e71874c286

### 74\. crowdstrike\_azure\_firewall -IS-> azure\_network\_firewall

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_firewall.`id` = azure\_network\_firewall.`id`

Rule Id: igm-rule-a1c20a78-c067-4762-b19f-08308c0fd0ae

### 75\. crowdstrike\_azure\_key\_vault -IS-> azure\_keyvault\_service

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_key\_vault.`id` = azure\_keyvault\_service.`id`

Rule Id: igm-rule-1494f590-b952-47e9-8445-9641ef45e557

### 76\. crowdstrike\_azure\_kubernetes\_cluster -IS-> azure\_kubernetes\_cluster

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_kubernetes\_cluster.`id` = azure\_kubernetes\_cluster.`id`

Rule Id: igm-rule-62ab1fec-87d0-4503-a9b0-17feeb1848f2

### 77\. crowdstrike\_azure\_managed\_disk -IS-> azure\_managed\_disk

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_managed\_disk.`id` = azure\_managed\_disk.`id`

Rule Id: igm-rule-6f626e1c-adcc-4fa0-9681-1bbfb2c738e7

### 78\. crowdstrike\_azure\_mysql\_server -IS-> azure\_mysql\_server

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_mysql\_server.`id` = azure\_mysql\_server.`id`

Rule Id: igm-rule-c57ed702-8f21-4825-bbb3-393576652601

### 79\. crowdstrike\_azure\_security\_group -IS-> azure\_security\_group

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_security\_group.`id` = azure\_security\_group.`id`

Rule Id: igm-rule-307ca2f4-ab1e-49f9-ae3f-f05d7058b09a

### 80\. crowdstrike\_azure\_storage\_account -IS-> azure\_storage\_account

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_storage\_account.`id` = azure\_storage\_account.`id`

Rule Id: igm-rule-cc9d5f2d-c2c5-467c-8de2-f85601af26cd

### 81\. crowdstrike\_azure\_subscription -IS-> azure\_subscription

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_subscription.`id` = azure\_subscription.`id`

Rule Id: igm-rule-d5c3e587-4a00-4dec-b40c-5249daa9a575

### 82\. crowdstrike\_azure\_vm -IS-> azure\_vm

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_vm.`id` = azure\_vm.`id`

Rule Id: igm-rule-8a95c67e-aa09-4e68-a354-b740d3fef52a

### 83\. crowdstrike\_azure\_vnet -IS-> azure\_vnet

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_vnet.`id` = azure\_vnet.`id`

Rule Id: igm-rule-ad55b4b1-8042-4789-9967-ee86529c5b6c

### 84\. crowdstrike\_azure\_web\_app -IS-> azure\_function\_app

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_azure\_web\_app.`id` = azure\_function\_app.`id`

Rule Id: igm-rule-1001f1f6-0940-4e2b-a3b8-9e9252015711

### 85\. crowdstrike\_sensor -PROTECTS-> aws\_instance

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`ec2InstanceArn` = aws\_instance.`_key`

Rule Id: igm-rule-1652c792-fc60-41fb-af6e-58c425c252c4

### 86\. crowdstrike\_sensor -PROTECTS-> azure\_vm

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`instanceId` = azure\_vm.`vmId`

Rule Id: igm-rule-69bd8f24-faba-410f-86c0-c6cdaa467562

### 87\. crowdstrike\_sensor -PROTECTS-> Device&!unified\_device

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`macAddress` IN Device&!unified\_device.`macAddress`

Rule Id: igm-rule-d4a56fa5-7d2b-43b2-9a83-ae96475a9379

### 88\. crowdstrike\_sensor -PROTECTS-> Device&!unified\_device

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`macAddress` = Device&!unified\_device.`macAddress`

Rule Id: igm-rule-41db719f-2da4-49cd-aa45-656f099d10e4

### 89\. crowdstrike\_sensor -PROTECTS-> google\_compute\_instance

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`instanceId` = google\_compute\_instance.`id`

Rule Id: igm-rule-e94163ae-9746-11ed-a8fc-0242ac120002

### 90\. crowdstrike\_sensor -PROTECTS-> oci\_compute\_instance

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`instanceId` = oci\_compute\_instance.`_key`

Rule Id: igm-rule-a8f3b2c1-5d4e-4a9b-8c7f-1e2d3f4a5b6c

### 91\. crowdstrike\_sensor -PROTECTS-> vsphere\_vm

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`macAddress` IN vsphere\_vm.`macAddress`
> -   crowdstrike\_sensor.`connectionIp` = vsphere\_vm.`ipAddress`
> -   crowdstrike\_sensor.`hostname` = vsphere\_vm.`host`

Rule Id: igm-rule-350e504d-18d8-4f71-b9ca-37765e0dd09e

## JAMF Rules

### 92\. crowdstrike\_sensor -PROTECTS-> user\_endpoint

> **Mapping Rule Conditions**
> 
> -   crowdstrike\_sensor.`macAddress` = user\_endpoint.`macAddress`

Rule Id: igm-rule-8f7bf995-5356-4425-a78e-713d186ca176

## KUBERNETES Rules

### 93\. kube\_container\_spec -USES-> aws\_ecr\_image

> **Mapping Rule Conditions**
> 
> -   kube\_container\_spec.`image` IN aws\_ecr\_image.`fullName`

Rule Id: igm-rule-65a1103a-1207-4cbe-8899-1f3f49be19ca

## MICROSOFT ENDPOINT DEFENDER Rules

### 94\. microsoft\_defender\_machine -PROTECTS-> aws\_instance

> **Mapping Rule Conditions**
> 
> -   microsoft\_defender\_machine.`computerDnsName` IN aws\_instance.`fqdn`

Rule Id: igm-rule-923ad033-1da2-497f-b75d-a0d03ff6541a

## OKTA Rules

### 95\. okta\_application -CONNECTS-> azure\_account

> **Target Filters**
> 
> -   `appAccountType = "office365_account"`
> -   `isSAMLApp = true`
> -   `ssoEnabled = true`

> **Mapping Rule Conditions**
> 
> -   okta\_application.`appVendorName` = azure\_account.`vendor`
> -   okta\_application.`appDomain` = azure\_account.`verifiedDomains`
> -   okta\_application.`appAccountId` = azure\_account.`displayName`

Rule Id: igm-rule-99de2f2a-23d5-4299-ae53-066881436340

## ORCA Rules

### 96\. aws\_lambda\_function -HAS-> orca\_asset

> **Target Filters**
> 
> -   `type = "function"`
> -   `cloudProvider = "aws"`

> **Mapping Rule Conditions**
> 
> -   aws\_lambda\_function.`arn` = orca\_asset.`assetVendorId`

Rule Id: igm-rule-c2180448-f0be-4091-9596-642661432917

### 97\. aws\_instance -IS-> orca\_asset

> **Target Filters**
> 
> -   `type = "vm"`
> -   `cloudProvider = "aws"`

> **Mapping Rule Conditions**
> 
> -   aws\_instance.`instanceId` = orca\_asset.`assetVendorId`

Rule Id: igm-rule-0f4bd643-e1c1-425c-b2d2-228358be68ad

### 98\. azure\_vm -IS-> orca\_asset

> **Target Filters**
> 
> -   `type = "vm"`
> -   `cloudProvider = "azure"`

> **Mapping Rule Conditions**
> 
> -   azure\_vm.`vmId` = orca\_asset.`assetVendorId`

Rule Id: igm-rule-014f01d5-4059-4ae5-88dd-5e587d05079a

## RAPID7 Rules

### 99\. insightvm\_host -IS-> aws\_instance

> **Mapping Rule Conditions**
> 
> -   insightvm\_host.`sourceAWS` = aws\_instance.`id`

Rule Id: igm-rule-ad4da876-f247-4fb0-a0eb-70edff0c1135

## SENTINELONE Rules

### 100\. sentinelone\_agent -PROTECTS-> user\_endpoint

> **Mapping Rule Conditions**
> 
> -   sentinelone\_agent.`uuid` = user\_endpoint.`deviceId`
> -   sentinelone\_agent.`serial` = user\_endpoint.`serial`

Rule Id: igm-rule-a241f3e8-39b5-4c4a-bb03-6a57cfb56e54

## SNYK Rules

### 101\. snyk\_project -SCANS-> CodeRepo

> **Target Filters**
> 
> -   `snyk_project = "github"`
> -   `snyk_project = "github-enterprise"`
> -   `snyk_project = "bitbucket"`
> -   `snyk_project = "gitlab"`

> **Mapping Rule Conditions**
> 
> -   snyk\_project.`repoOrganization` = CodeRepo.`owner`
> -   snyk\_project.`repoName` = CodeRepo.`name`

Rule Id: igm-rule-79e7b53f-7fec-43f0-8aa2-25d86d1f630d

## TENABLE CLOUD Rules

### 102\. tenable\_asset -IS-> user\_endpoint

> **Mapping Rule Conditions**
> 
> -   user\_endpoint.`macAddress` IN tenable\_asset.`macAddresses`

Rule Id: igm-rule-dd10f855-f7ea-4344-94dd-029b5e66a89f

### 103\. user\_endpoint -HAS-> tenable\_vulnerability\_finding

> **Mapping Rule Conditions**
> 
> -   user\_endpoint.`macAddress` = tenable\_vulnerability\_finding.`macAddress`

Rule Id: igm-rule-16059bc4-b30d-48c7-a817-ff1d5820ae0d

## TREND MICRO Rules

### 104\. trend\_micro\_sensor -PROTECTS-> aws\_instance

> **Target Filters**
> 
> -   `cloudProvider = "AWS"`

> **Mapping Rule Conditions**
> 
> -   trend\_micro\_sensor.`ec2InstanceId` = aws\_instance.`instanceId`

Rule Id: igm-rule-74cb8e41-c566-4cd3-b68a-89edea7099a1

### 105\. trend\_micro\_sensor -PROTECTS-> user\_endpoint

> **Mapping Rule Conditions**
> 
> -   trend\_micro\_sensor.`hostname` = user\_endpoint.`hostname`

Rule Id: igm-rule-041a190d-25c2-47a7-a0ac-da70304a7475

## WIZ Rules

### 106\. Entity -HAS-> wiz\_vulnerability\_finding

> **Target Filters**
> 
> -   `assetCloudPlatform = "AWS"`

> **Mapping Rule Conditions**
> 
> -   Entity.`_key` = wiz\_vulnerability\_finding.`assetProviderUniqueId`

Rule Id: igm-rule-71f137fd-43f6-4b57-ad41-1f55d16a0714

---

Source: /jupiterOne-data-model/metadata

# Entity and Relationship Metadata

The following metadata is assigned by JupiterOne internally to entities and relationships. All internal metadata has `_` prefix to the property name.

## Class, Type, Key and ID

| Property | Type | Description |
| --- | --- | --- |
| `_class` | \`string | string\[\]\` |
| `_type` | `string` | The specific type of the resource. |
| `_key` | `string` | An identifier of the resource unique within an integration instance or data source scope. |
| `_id` | `string` | A globally unique identifier of the resource within JupiterOne. |

## Timestamps

_All timestamps are store in Epoch milliseconds and displayed in the UI in ISO date string format._

| Property | Type | Description |
| --- | --- | --- |
| `_createdOn` | `number` | The timestamp the entity/relationship was first created in JupiterOne. Usually represents a time after the resource was created in the provider environment. |
| `_beginOn` | `number` | The timestamp when the latest version of entity/relationship was created. Equivalent to last updated timestamp within JupiterOne (_not_ the timestamp of the resource updated in the provider environment). |
| `_endOn` | `number` | THe timestamp a version of the entity/relationship was deleted in JupiterOne. |

> Timestamps from the resource provider, if available, are generally normalized to one of the following:
> 
> -   `createdOn`
> -   `updatedOn`
> -   `deletedOn`
> -   `startedOn`
> -   `stoppedOn`

## State and source related metadata

| Property | Type | Description |
| --- | --- | --- |
| `_deleted` | `boolean` | Indicates whether a resource was deleted from JupiterOne graph/CMDB. This typically means the resource was recently deleted from the provider source environment. |
| `_version` | `number` | The version number, which increments every time a change to the resource configuration/attribute is captured. |
| `_source` | `string` | The source from where the resource was created. Valid options include: `integration-managed`, `powerup-managed`, `system-internal`, `system-mapper`, and `api`. |

## Integration specific metadata

_The following metadata only exists on resources created via an integration._

| Property | Type | Description |
| --- | --- | --- |
| `_integrationClass` | \`string | string\[\]\` |
| `_integrationType` | `string` | Type of the integration. Typically the service provider name. For example: `aws`, `google`, `azure`, `okta`, `knowbe4`, `vmware`, etc. |
| `_integrationName` | `string` | User-provided friendly name of the integration instance. |
| `_integrationDefinitionId` | `string` | Internal UUID that identifies the definition for this integration, e.g. AWS, Azure, etc. |
| `_integrationInstanceId` | `string` | Internal UUID that identifies the integration instance. An integration can have more than one configuration instances. For example, multiple AWS accounts have multiple AWS integration instances. |

---

Source: /jupiterOne-data-model/network-endpoint

# JupiterOne Data Model for Network and Endpoint Infrastructure

As we build integrations for network and endpoint protection products we start with this reference model and attempt to collect these types of entities and map these kinds of relationships so that customers using these products will be able to use the same queries for any network or endpoint product integrated with JupiterOne. Based on the product and what is available to JupiterOne for import, adjustments are made that will be unique to each product.

![https://my.mindnode.com/xwTb6G79dPheRUr55ZZfDxb1qE27iYjTiAqSY9pH/em#357,243,-2](/assets/images/data-model-network-endpoint-76b0fa4024d8b300eee8bdc6581e913c.png)

---

Source: /jupiterOne-data-model/org-grc

# JupiterOne Data Model for Governance, Risk, and Compliance (GRC)

As we build integrations for Governance, Risk and Compliance (GRC) products we start with a reference model like this and attempt to collect these types of entities and map these kinds of relationships so that customers using GRC products will be able to use similar queries for any GRC product integrated with JupiterOne. Based on the product and what is available to import to JupiterOne, adjustments are made that will be unique to each product.

![https://my.mindnode.com/2ayndotqvjEJ3qAeEfwyy6sgkRciyxRvH1sgpYw4/em#333.4,207.2,-2](/assets/images/data-model-org-grc-c6a36c00d1940b3e79fb3c6bef68963f.png)

## Standards, Sections, Requirements

Standards are, broadly, compliance frameworks, regulations, or industry best practices. Standards can be used interchangeably with the synonymous term frameworks.

Examples of standards include: HIPAA, ISO 27001, PCI-DSS, FedRAMP, NIST CSF, CIS Benchmarks, etc.

> A standard is a collection of requirements grouped by sections, or a collection of controls grouped by domains.

Sections can be considered as parts or components of a standard.

Examples of sections include: HIPAA Physical Safeguards (§164.310), ISO 27001 Clause 6, PCI-DSS Requirement 8, the Access Control (AC) Family within FedRAMP, CIS Basics 2. Inventory of Software Assets, etc.

> A standard _has_ one or more sections. A section _has_ one or more requirements.

Requirements comprise sections of a standard. Individual requirements outline the specification that needs to be met.

Examples of requirements include: HIPAA §164.310(a)(1)(i), ISO 27001 6.1.3 a, PCI-DSS 8.4.b, FedRAMP AC-2 (7), utilizing application whitelisting to implement CIS Basics 2.7, etc..

When thinking through different regulatory or compliance standards/frameworks, the idea of a standard _having_ one or more sections, which _have_ one or more requirements is equivalent to a framework _having_ one or more domains, which _have_ one or more controls.

## Policies, procedures, controls, control policies/configurations, vendors

You can think of an organization’s policies, procedures, and controls to loosely align to the compliance or regulatory standards, sections, and requirements.

Another way of looking at it would be: **policies** + **procedures** reflect you organization's internal view of how to run security, which is demonstrated to external stakeholders via the compliance implementation of **standards/sections/requirements** or **framework/domains/controls**.

At JupiterOne, we have an internal **framework** of **controls**. How we do security is reflected in our **policies** + **procedures** within the [**Policies** app](https://j1.apps.us.jupiterone.io/policies/overview). **Policies** map to **domains**, **procedures** map to **controls**. Conversely, those same internal JupiterOne **policies, procedures, and controls** satisfy external regulatory/compliance **standards, sections, and requirements** in the [**Compliance** app](https://j1.apps.us.jupiterone.io/compliance).

**Policies** are high-level statements of management intent; they are written security documents which frequently satisfy external requirements.

Examples of policies include: access management policies, data protection policies, human resource policies.

> **Policies** are _implemented_ by **procedures**.

**Procedures** are written security documents which describe how to implement policies via technology or processes, or a combination of the two; the ‘who’, ‘what’, ‘when’, ‘how’, etc; they can be thought of as control or process descriptions.

Examples of procedures (aka control/process descriptions) include:

-   password management
-   protecting data at rest
-   employee screening

> **Policies** are _implemented_ by **procedures**; **controls** _implement_ **procedures**.

**Controls** are the technical, administrative, and physical safeguards that enforce the procedures; they can manifest commonly as a process managed by a person/team or as a product/service provided by a vendor.

Examples of controls include:

-   user identity management, access control, multi-factor authentication
-   data encryption at rest or in transit
-   penetration testing, code scanning
-   pre-employment background checks.

> A `ControlPolicy` or `Configuration` _enforces_ or _manages_ a `Control`.

**Control Policies** or **configurations** are the technical settings whereby controls are implemented.

Examples of control policies or configurations include:

-   requiring 12+ characters including a number + a symbol for all passwords
-   using AES-256 cipher for encryption at rest
-   for background checks, specifically include searches for federal, criminal, state, county, city, financial, and education verification

> **Vendors** _provide_ **controls**.

Vendors are frequently companies, organizations, or people that provide the controls.

Examples of vendors include:

-   Microsoft (the Vendor) for Active Directory (AD), user authentication, and access control
-   Amazon Web Services (AWS, the Vendor) for Key Management Service (KMS)
-   Checkr (the Vendor) for background screens

> **Policies** are _implemented_ by **procedures**; **controls** _implement_ **procedures**. A **control Policy** or **configuration** _enforces_ or _manages_ a **control**.

> **Policies** are _implemented_ by **procedures**; **controls** _implement_ **procedures**. **Vendors** _provide_ **controls**.

---

Source: /jupiterOne-data-model/org-mgmt

# JupiterOne Data Model for Organization, Account, and Vendor Management

As we build integrations for products that have organization, account, or vendor management features we start with this reference model and attempt to collect these types of entities and map these kinds of relationships so that customers using these products will be able to use the same queries for any product integrated with JupiterOne. Based on the product and what is available to JupiterOne for import, adjustments are made that will be unique to each product.

![](/assets/images/data-model-person-vendor-org-02e8025f0c9893f9b2e475dcf1bab634.png)

---

Source: /jupiterOne-data-model/parameters

# JupiterOne Parameter Service

Previously, some use cases of JupiterOne required referencing a _literal_ value that is better suited to reference as a _variable_ or a **parameter**. Some common values that are better stored and retrieved at runtime instead of saved literally include:

-   Long or unwieldy values (such as a long URL)
-   Sensitive values (such as a private key or API token)
-   Common values (such as dates, keys) that you may want to change in many places at one time

A better alternative exists in the form of parameters that can be stored and referenced in rules and queries with a special syntax.

## Examples

In the use case of a very long URL, which may not be easily human-readable and may be referenced in many rules, queries, or questions, use:

### Example: Parameters in J1QL

```j1ql
FIND Application WITH loginUrl = ${ param.longURL }
```

### Example: Parameters in Rules

```json
  "headers": {
    "Authorization": "Bearer {{param.secretApiKey}}"
  }
```

The service hydrates the value of `longUrl` or `secretApiKey` and evaluates it against the remote contents instead of the parameter expression. You can leverage this same pattern for different types of parameter types and comparisons, explained below. As shown above, the syntax between rules and queries differs slightly, but is consistent with variables (in the case of queries) and expressions (in the case of rules).

## Usage: Schema

Parameters can be managed from **Settings > Account Parameters** in the app, or through the public-facing GraphQL endpoints described below. The settings page is where you choose a parameter's type (String, Number, Boolean, or a list of strings or numbers); the stored type is what queries then compare and compute with.

A parameter is an object stored in the parameter-service, which uses the following schema:

| Property | Type | Description |
| --- | --- | --- |
| `name` | `string` | The parameter **key** or "name" |
| `value` | `string` | `number` | `boolean` | `list`[\*](#list-types) | The parameter **value** to be stored/retrieved |
| `secret` | `boolean` | **Flag** to treat value as sensitive data |
| `lastUpdatedOn` | `date` | **Date** which indicates last update |

#### List Types

Lists are considered to be arrays of `string`, `number`, or `boolean` types.

## Usage: API Operations and Queries

| Queriable fields: |  |
| --- | --- |
| parameter | Individual `QUERY` for one parameter |
| parameterList | Bulk `QUERY` for parameters |

| Mutations: |  |
| --- | --- |
| setParameter | Create/update a remote parameter |
| deleteParameter | Remove a parameter from the remote store |

### GraphQL API

### Query: `parameter`

| _Argument_ | _Type_ | _Required?_ |
| --- | --- | --- |
| name | `string` | Yes |

**_Returns_**: Parameter

**_Example_**:

```gql
query Query($name: String!) {
  parameter(name: $name) {
    name
    value
    secret
    lastUpdatedOn
  }
}
```

### Query: `parameterList`

| _Argument_ | _Type_ | _Required?_ | _Default_ |
| --- | --- | --- | --- |
| limit | `number` | No | 100 |
| cursor | `string` | No (unless paginating) | n/a |

**_Returns_**: Paginated

**_Example_**:

```gql
query Query($limit: Int, $cursor: String) {
  parameterList(limit: $limit, cursor: $cursor) {
    items {
      name
      value
      secret
      lastUpdatedOn
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

### Mutation: `setParameter`

| _Argument_ | _Type_ | _Required?_ | _Default_ |
| --- | --- | --- | --- |
| name | `string` | Yes | n/a |
| value | `string` | `number` | `boolean` | `list` | Yes | n/a |
| secret | `boolean` | No | `false` |

### **_Returns_**

```ts
{
  success: boolean;
}
```

**_Example_**

```gql
mutation Mutation($name: String!, $value: ParameterValue!) {
  setParameter(name: $name, value: $value) {
    success
  }
}
```

**_List Parameters Variables Example_**

```gql
{
  "name": "items",
  "value": ["jupiterone.com", 2] // multi-type arrays are allowed
}
```

**_Non-List Parameters Variables Example_**

```gql
{
  "name": "j1domain",
  "value": "jupiterone.com"
}
```

#### Mutation: `deleteParameter`

| _Argument_ | _Type_ | _Required?_ |
| --- | --- | --- |
| name | `Array<string>` | Yes |

#### **_Returns_**

```ts
{
  success: boolean;
}
```

**_Example_**

```gql
mutation Mutation($name: String!) {
  deleteParameter(name: $name) {
    success
  }
}
```

## Parameter References

You can reference parameters in [rules' configurations](/api/alert-rules.md#rule-definition-reference) or any [query expression](/j1ql.md), although the syntax is slightly different between the two. `param` is a special keyword that, when invoked, fetches values from the parameter-storing service.

**Note:** In the case of both rules and queries, referencing a nonexistent parameter causes an error and abandon execution.

### Where parameters can be used in J1QL

A parameter can stand in for a literal value in these positions.

As a comparison value in a `WITH`, `WHERE` or `HAVING` clause:

```j1ql
FIND Application WITH loginUrl = ${ param.longURL }
```

```j1ql
FIND Finding AS f WHERE f.score > ${ param.riskThreshold }
```

```j1ql
FIND Finding AS f RETURN f.severity AS severity, COUNT(f) AS total
HAVING total > ${ param.minimumCount }
```

As a returned value, with or without an alias. An unaliased parameter is returned in a column named `param.<name>`, so the column name stays the same when you change the parameter's value:

```j1ql
FIND Finding AS f RETURN f.displayName AS finding, ${ param.riskThreshold } AS threshold
```

In arithmetic, function arguments and aggregation arguments, in both `RETURN` and `WHERE`, and as a function argument in `HAVING`:

```j1ql
FIND unified_vulnerability AS uv
RETURN ${ param.cvssWeight } * COALESCE(uv.cvssImpactScore / 6.05, 0.0)
     + ${ param.epssWeight } * COALESCE(uv.epssScore, 0.0) AS riskScore
```

```j1ql
FIND Finding AS f WHERE f.numericSeverity * ${ param.weight } > ${ param.threshold }
```

This is what makes a query reusable: the thresholds and weightings live in parameters, so the query text does not change when you retune them.

A parameter's stored type is preserved — a parameter saved as a number is compared and computed as a number. A parameter saved as text or as a boolean cannot be used in arithmetic, and the error names the parameter so you can correct its type.

A parameter holding a list can be used as a comparison value in `WITH` or `WHERE`, where it expands into a comparison against each element:

```j1ql
FIND Application WITH _type = ${ param.approvedTypes }
```

A list is not supported in `HAVING`, as a returned value, or inside arithmetic, and an empty list is rejected wherever it appears.

Parameters are not accepted in `ORDER BY`, `LIMIT` or `SKIP`, or as the address range in `CIDR()`. A parameter cannot supply a regular expression: its value is compared as a value, never as a pattern. `HAVING` does not accept arithmetic, with or without a parameter — `HAVING total * 2 > 10` is rejected too.

A [secret parameter](#secret-parameters) can only be used as a comparison value in `WITH` or `WHERE`.

## Auditing and Security

All changes (including creation and deletion) of parameters is captured by an audit trail providing visibility into the historic usage and access of these values. In addition, all parameters are encrypted-at-rest and in-transit, subject to log redaction, and are subject to either ABAC or IAM-based fine-grained permissions.

## Secret Parameters

Any parameters set with `secret` to be `true` have write-only values and are not readable from the API. Only evaluations of the query can access these parameter values. This usage enables the storage of sensitive parameters such as API keys that JupiterOne users should not be able to see. All read access to these secret parameters contains redacted values, but metadata is able to be read.

In a query, a secret parameter can only be used as a comparison value in `WITH` or `WHERE`:

```j1ql
FIND Application WITH clientId = ${ param.secretClientId }
```

Anywhere else (as a returned value, in arithmetic or a function argument, or in `HAVING`), the query is rejected with an error that names the parameter, so a query cannot return a secret's value.

**Note:** By design, you cannot update a parameter that has had `secret` set to true to `secret: false` without also changing the value in the same request.

---

Source: /jupiterOne-data-model/people

# JupiterOne Data Model for People and Access

As we build integrations for products that include user or people account along with different access levels or permissions we start with this reference model and attempt to collect these types of entities and map these kinds of relationships so that customers using these products will be able to use the same queries for any integration they have enabled. Based on the product and what is available to JupiterOne for import, adjustments are made that will be unique to each product.

![](/assets/images/j1-data-model-people-90461e3e63bb9253ebeeb4306174911a.png)

---

Source: /jupiterOne-data-model/vuln-mgmt

# JupiterOne Data Model for Vulnerability Management

As we build integrations for products that identify findings and vulnerabilities we start with this reference model and attempt to collect these types of entities and map these kinds of relationships so that customers using these products will be able to use the same queries for any integration they have enabled. Based on the product and what is available to JupiterOne for import, adjustments are made that will be unique to each product.

![https://my.mindnode.com/8G2MirWYz1zs1sbynAj7XUMtCeDctYiqqjy1hjnN/em#520,-145,-2](/assets/images/data-model-vuln-mgmt-9c838e396b17baa2dcbf1ad2d1be2e54.png)

---

Source: /platform-overview/alerts-intro

# Alerts and workflows

JupiterOne supports the ability to [turn any J1QL query into an alert](/features/insights-and-alerts/alerts.md), which allows you to proactively monitor questions of interest without the need to manually perform those queries to find changes.

With an alert rule, JupiterOne will automate the monitoring process for a particular question and allows you to send that information into a variety of workflows such as alerting or ticketing, or remediation flows. With alerts, you can have JupiterOne kick off a variety of workflows that support:

-   Creating a Jira ticket
-   Sending an email or Slack message
-   Creating ServiceNow incident
-   Sending a generic webhook

### Alert packs

Along with JupiterOne's ability to create alert rules for individual questions, we also offer [rule packs](/features/insights-and-alerts/alert-rule-packs.md) based on the integrations you have configured within your JupiterOne workspace. For example, if you have AWS configured, you can leverage the pre-built rule packs that allow for alerts on questions relating to your AWS environment. These alert rule packs automatically turn on once the respective integration has been configured.

---

Source: /platform-overview/assets-intro

# Asset Insights

JupiterOne supports more than just users and devices. We capture and ingest a broad variety of asset classes that span from code repositories to user access roles to findings.

## Assets supported by JupiterOne

JupiterOne supports the [ingestion and mapping of a wide variety of assets](/features/assets/ingesting-assets.md) that build a holistic picture of your ecosystem. Go beyond merely users and devices and build a holistic view of your assets, including:

-   Applications and services
-   Compute and devices
-   Data and storage
-   Identities and access
-   Networks
-   People and Organizations
-   Policies and documentation
-   Risk and alerts
-   Custom assets (define your own)

### Streamline findings

Context is key to evaluating your asset landscape. JupiterOne brings your data to one centralized location, providing for meaningful discoveries and clear, actionable insights. Make the most of your assets by:

-   Having a centralized location for managing all assets
-   Identifying unknown risks and relationships in your attack surface
-   Monitoring and maintaining critical assets
-   Taking action to resolve key findings

#### Target assets quickly with classes

By normalizing your assets into asset classes, JupiterOne enables you the ability to query and evaluate and filter data quickly. This allows you to focus on finding entities within the class rather than needing to explicitly state the entity in the query.

#### Up next

We'll illustrate how the JupiterOne graph can help monitor and address more complex Cloud Security Posture Management use cases.

---

Source: /platform-overview/billing-faqs

# Billing FAQs

## Billing Models

JupiterOne has historically supported both entity count and activity based billing models. For enterprise customers additional usage terms may exist in your contract. This document is intended to serve as a guide to how JupiterOne calculates billing, but your license agreement and terms of your contract with JupiterOne always take precedence over this document.

### All Assets Count

Total asset count billing model is the current default billing for new JupiterOne customers. It is a very simple billing metric where all assets (aka entities) are counted, and does not include system created entities.

### Employee Count or Asset Operations (legacy)

Employee count based billing relied on an "Asset Operation" (aka AO) fair usage limit, which was calculated monthly for customers.

For more details on the legacy AO billing model please see [Billing FAQ (legacy)](/platform-overview/legacy-billing.md)

### Billable Entities (legacy)

Billable Entities (aka BE) billing was similar to the current Entity Count model but with complex exclusions for some classes of assets.

For more details on the legacy BE billing model please see [Billing FAQ (legacy)](/platform-overview/legacy-billing.md)

## FAQ

### Q: How are assets counted in the "All Assets" model?

Assets can be counted using the following JupiterOne query:

```j1ql
FIND * WITH  _source !^= "system-" AS e
RETURN COUNT(e) AS allEntityCount
```

This counts all non-deleted assets in your account that were not created by the system mapping rules. This is all assets that have been created via integrations, through the API, or manually though the web UI.

For monitoring purposes this asset count is collected daily and entitlements are calculated using a rolling average.

### Q: I don't want be billed for a particular asset type

One of the reasons that JupiterOne has been able to move to a simplified asset billing model is the greatly increased flexibility customers have in configuring what types of assets an integration ingests. For example the AWS integration allows fine grained control of over 160 different types of assets. Customers that don't get value from a particular type of asset can choose to not bring them into JupiterOne.

### Q: Do ephemeral entities inflate my billing counts?

No, ephemeral workloads will not cause the asset count to be artificially high. Any short term spikes in assets, or weekly and monthly seasonality, will not inflate asset counts as JupiterOne reviews usage over a rolling period.

The usage calculations are done as a daily single point in time count of entities, it is _not_ a count of all unique entities in the last 24 hours.

---

Source: /platform-overview/cspm-intro

# Cloud Security Posture Management

Building off of the example queries showcased in the previous video, here we will explore how we can leverage the context provided by the JupiterOne graph to solve for a complex, real-world use case: discovering public-facing instances that have access to non-public S3 buckets.

By leveraging the [prebuilt questions in JupiterOne](https://docs.jupiterone.io/features/admin/query-builder#questions), you can quickly execute queries. In this example, we are using **Are there public facing instances that are allowed to access non-public S3 buckets?**. By selecting the question, JupiterOne will run the associated query and display the results.

#### Up next

In the next article, we'll illustrate how JupiterOne can help automate your security workflows by creating alerts based on questions and queries such as the one illustrated above–enabling you to be alerted whenever a change may occur in findings for a particular query.

---

Source: /platform-overview/incident-response-intro

# Incident Response

By leveraging the JupiterOne graph, you can quickly evaluate and determine where and how an incident may have taken place with all the context you need to make an informed decision.

## Cloud Workloads

Type in a hostname, instance id, or IP address to see all the contextual information you need to quickly understand a cloud resource. This information includes the blast radius, connected resources, privileged access paths, internet attack path, and more.

## User endpoint blast radius

Search for the MAC address or IP address of a device, or the email address of an employee to understand the blast radius of any devices they own, the user accounts they have, and the related identities or permissions in order to understand what a malicious user could access if the device were compromised.

#### Up next

Next, we'll explore our vulnerability reporting solution and how it can improve your ability to secure your digital environment.

---

Source: /platform-overview/j1-platform-introduction

# JupiterOne Intro

Welcome to JupiterOne. Our innovative platform combines the power of automation, threat intelligence, and intuitive visualization to provide a holistic view of your entire digital infrastructure.

  

## Features

JupiterOne helps you monitor and safeguard your digital assets as well as streamline your security operations through the following use cases:

-   [Incident response](/platform-overview/incident-response-intro.md)
-   [Vulnerability reporting](/platform-overview/vulnerability-reporting-intro.md)
-   [Asset inventory and management](/platform-overview/assets-intro.md)
-   [Cloud Security Posture Management (CSPM)](/platform-overview/cspm-intro.md)
-   [Alerts and security workflows](/platform-overview/alerts-intro.md)

#### Up next

To kick things off, we'll dive into an example illustrating how JupiterOne can handle incident response and showcase the depth and context provided by the JupiterOne graph.

---

Source: /platform-overview/legacy-billing

# Billing FAQs (Legacy)

This page includes FAQ entries for the old billing models. If in doubt regarding billing please check with your customer support representative.

### Q: What are asset operations? What functions make up asset operations?

> **NOTE**
> 
> The Employee and Asset Operations (AO) billing model is deprecated for new customers

Asset operations for the JupiterOne security platform is defined as the cumulative count over a month of the changes to the J1 graph: create, delete, and update operations for entities and relationships.

The following is the full list of asset operation functions that count towards the asset operations total:

-   create\_entity
-   update\_entity
-   delete\_entity
-   remap\_entity
-   create\_relationship
-   update\_relationship
-   create\_mapped\_relationship
-   delete\_relationship
-   delete\_integration

### Q: What is the billable entities licensing model? What are entities? And how are they counted for usage/billing?

> **NOTE**
> 
> The Billable Entities (BE) model is deprecated for new customers

Prior to 2023, JupiterOne used the billable entities licensing model. This model is now deprecated and the asset operations model applies going forward.

The billable entities model counted the number of entities under management in the JupiterOne account.

An `entity` is a `node` stored in the JupiterOne graph database. Entities typically come from an integration. They can also be added via the Asset Inventory web app or API (custom scripts).

Each entity represents an object from your organization's digital operational environment. Examples include an AWS EC2 instance, RDS DB cluster, RDS DB instance, IAM role, IAM policy, user endpoint, etc.

The following entities are not counted for billing/usage calculation:

-   **Mapped Entities** -- these are entities with `_source='system-mapper'` property. These are entities derived by the JupiterOne Mapper, such as an external Network or Host entity created because a security group contains a rule pointing to it.
    
-   **System Internal Entities** -- these are entities with `_source='system-internal'` property. These are internal JupiterOne system/app generated resources that are mapped to the graph as entities, such as `compliance_standard`, `compliance_requirement`, etc.
    
-   **Findings and PRs** -- these entities are considered "event-like" and not true resources in an digital operating environment, therefore they are not being counted for usage/billing purpose.
    
-   **Images, NetworkInterfaces, and IpAddress** -- these entities are also not counted against the usage or billing.
    
-   **Records and DomainRecords** -- records such as DNS records, Jira issues are not considered as billable.
    

Billable entities count is averaged daily, and again monthly. This can be viewed by going to **Settings** -> **Account Management** in the JupiterOne web UI.

> **NOTE**
> 
> There is a soft-limit on non-billable entities. Depending on your JupiterOne subscription plan, the soft-limit is 2x, 5x or 10x of the total billable entities limit.
> 
> For example, if your purchased the Enterprise Premier plan with 50,000 billable entities, you can have up to 500,000 non-billable entities.

You can also run the following query in your account to get a live count of your billable entities:

```j1ql
FIND * WITH  _source !^= "system-"
  AND _class != ("Finding" OR "PR" OR "Image" OR "NetworkInterface" OR "IpAddress" OR "Record" OR "DomainRecord") AS e
RETURN COUNT(e) AS billableEntityCount
```

#### Billable entities table

> **NOTE**
> 
> This table is not exhaustive, it only indicates examples of the most common classes and their billable status.

| Entity | Description | Billable |
| --- | --- | --- |
| `AccessKey` | A key used to grant access, such as ssh-key, access-key, api-key/token, mfa-token/device, etc. | Yes |
| `AccessPolicy` | A policy for access control assigned to a Host, Role, User, UserGroup, or Service. | Yes |
| `AccessRole` | An access control role mapped to a Principal (e.g. user, group, or service). | Yes |
| `Account` | An organizational account for a service or a set of services (e.g. AWS, Okta, Bitbucket Team, Google G-Suite account, Apple Developer Account). Each Account should be connected to a Service.Description | Yes |
| `Application` | A software product or application. | Yes |
| `ApplicationEndpoint` | An application endpoint is a program interface that either initiates or receives a request, such as an API. | Yes |
| `Assessment` | An object to represent an assessment, including both compliance assessment such as a HIPAA Risk Assessment or a technical assessment such as a Penetration Testing. Each assessment should have findings (e.g. Vulnerability or Risk) associated. | Yes |
| `Attacker` | An attacker or threat actor. | Yes |
| `Backup` | A specific repository or data store containing backup data. | Yes |
| `Certificate` | A digital Certificate such as an SSL or S/MIME certificate. | Yes |
| `Channel` | A communication channel, such as a Slack channel or AWS SNS topic. | Yes |
| `Cluster` | A cluster of compute or database resources/workloads. | Yes |
| `CodeCommit` | A code commit to a repo. The commit id is captured in the \_id property of the Entity. | No |
| `CodeDeploy` | A code deploy job. | Yes |
| `CodeModule` | A software module. Such as an npm\_module or java\_library. | Yes |
| `CodeRepo` | A source code repository. A CodeRepo is also a DataRepository therefore should carry all the required properties of DataRepository. | Yes |
| `CodeReview` | A code review record. | Yes |
| `Configuration` | A Configuration contains definitions that describe a resource such as a Task, Deployment or Workload. For example, an `aws_ecs_task_definition` is a `Configuration`. | Yes |
| `Container` | A standard unit of software that packages up code and all its dependencies and configurations. | Yes |
| `Control` | A security or IT Control. A control can be implemented by a vendor/service, a person/team, a program/process, an automation code/script/configuration, or a system/host/device. Therefore, this is most likely an additional Class applied to a Service (e.g. Okta SSO), a Device (e.g. a physical firewall), or a HostAgent (e.g. Carbon Black CbDefense Agent). Controls are mapped to security policy procedures and compliance standards/requirements. | Yes |
| `ControlPolicy` | An technical or operational policy with rules that govern (or enforce, evaluate, monitor) a security control. | Yes |
| `CryptoKey` | A key used to perform cryptographic functions, such as an encryption key. | Yes |
| `DataObject` | An individual data object, such as an aws-s3-object, sharepoint-document, source-code, or a file (on disk). The exact data type is described in the \_type property of the Entity. | No |
| `DataStore` | A virtual repository where data is stored, such as aws-s3-bucket, aws-rds-cluster, aws-dynamodb-table, bitbucket-repo, sharepoint-site, docker-registry. The exact type is described in the \_type property of the Entity. | Yes |
| `Database` | A database cluster/instance. | Yes |
| `Deployment` | A deployment of code, application, infrastructure or service. For example, a Kubernetes deployment. An auto scaling group is also considered a deployment. | Yes |
| `Device` | A physical device or media, such as a server, laptop, workstation, smartphone, tablet, router, firewall, switch, wifi-access-point, usb-drive, etc. The exact data type is described in the \_type property of the Entity. | Yes |
| `Directory` | Directory, such as LDAP or Active Directory. | Yes |
| `Disk` | A disk storage device such as an AWS EBS volume | Yes |
| `Document` | A document or data object. | No |
| `Domain` | An internet domain. | Yes |
| `DomainRecord` | The DNS Record of a Domain Zone. | No |
| `DomainZone` | The DNS Zone of an Internet Domain. | Yes |
| `Finding` | A security finding, which may be a vulnerability or just an informative issue. A single finding may impact one or more resources. The `IMPACTS` relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The `IMPACTS` relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc. | No |
| `Firewall` | A piece of hardware or software that protects a network/host/application. | Yes |
| `Framework` | An object to represent a standard compliance or technical security framework. | Yes |
| `Function` | A virtual application function. For example, an aws\_lambda\_function, azure\_function, or google\_cloud\_function | Yes |
| `Gateway` | A gateway/proxy that can be a system/appliance or software service, such as a network router or application gateway. | Yes |
| `Group` | A defined, generic group of Entities. This could represent a group of Resources, Users, Workloads, DataRepositories, etc. | Yes |
| `Host` | A compute instance that itself owns a whole network stack and serves as an environment for workloads. Typically it runs an operating system. The exact host type is described in the \_type property of the Entity. The UUID of the host should be captured in the \_id property of the Entity | Yes |
| `HostAgent` | A software agent or sensor that runs on a host/endpoint. | Yes |
| `Image` | A system image. For example, an AWS AMI (Amazon Machine Image). | No |
| `Incident` | An operational or security incident. | Yes |
| `Internet` | The Internet node in the graph. There should be only one Internet node. | No |
| `IpAddress` | An re-assignable IpAddress resource entity. Do not create an entity for an IP Address _configured_ on a Host. Use this only if the IP Address is a reusable resource, such as an Elastic IP Address object in AWS. | No |
| `Key` | An ssh-key, access-key, api-key/token, pgp-key, etc. | Yes |
| `Logs` | A specific repository or destination containing application, network, or system logs. | Yes |
| `Module` | A software or hardware module. Such as an npm\_module or java\_library. | Yes |
| `Network` | A network, such as an aws-vpc, aws-subnet, cisco-meraki-vlan. | Yes |
| `NetworkEndpoint` | A network endpoint for connecting to or accessing network resources. For example, NFS mount targets or VPN endpoints. | Yes |
| `NetworkInterface` | An re-assignable software defined network interface resource entity. Do not create an entity for a network interface _configured_ on a Host. Use this only if the network interface is a reusable resource, such as an Elastic Network Interface object in AWS. | No |
| `Organization` | An organization, such as a company (e.g. JupiterOne) or a business unit (e.g. HR). An organization can be internal or external. Note that there is a more specific Vendor class. | Yes |
| `PR` | A pull request. | No |
| `PasswordPolicy` | A password policy is a specific `Ruleset`. It is separately defined because of its pervasive usage across digital environments and the well known properties (such as length and complexity) unique to a password policy. | Yes |
| `Person` | An entity that represents an actual person, such as an employee of an organization. | Yes |
| `Policy` | A written policy documentation. | Yes |
| `Procedure` | A written procedure and control documentation. A Procedure typically `IMPLEMENTS` a parent Policy. An actual Control further `IMPLEMENTS` a Procedure. | Yes |
| `Process` | A compute process -- i.e. an instance of a computer program / software application that is being executed by one or many threads. This is NOT a program level operational process (i.e. a Procedure). | Yes |
| `Product` | A product developed by the organization, such as a software product. | Yes |
| `Program` | A program. For example, a bug bounty/vuln disclosure program. | Yes |
| `Project` | A software development project. Can be used for other generic projects as well but the defined properties are geared towards software development projects. | Yes |
| `Queue` | A scheduling queue of computing processes or devices. | Yes |
| `Record` | A DNS record; or an official record (e.g. Risk); or a written document (e.g. Policy/Procedure); or a reference (e.g. Vulnerability/Weakness). The exact record type is captured in the \_type property of the Entity. | No |
| `Repository` | A repository that contains resources. For example, a Docker container registry repository hosting Docker container images. | Yes |
| `Requirement` | An individual requirement for security, compliance, regulation or design. | Yes |
| `Resource` | A generic assignable resource. A resource is typically non-functional by itself unless used by or attached to a host or workload. | Yes |
| `Review` | A review record. | Yes |
| `Risk` | An object that represents an identified Risk as the result of an Assessment. The collection of Risk objects in JupiterOne make up the Risk Register. A Control may have a `MITIGATES` relationship to a Risk. | Ye |
| `Root` | The root node in the graph. There should be only one Root node per organization account. | Yes |
| `Rule` | An operational or configuration compliance rule, often part of a Ruleset. | Yes |
| `Ruleset` | An operational or configuration compliance ruleset with rules that govern (or enforce, evaluate, monitor) a security control or IT system. | Yes |
| `Scanner` | A system vulnerability, application code or network infrastructure scanner. | Yes |
| `Secret` | A configuration item representing a secret token of some form. | Yes |
| `Section` | An object to represent a section such as a compliance section. | Yes |
| `Service` | A service provided by a vendor. | Yes |
| `Site` | The physical location of an organization. A Person (i.e. employee) would typically has a relationship to a Site (i.e. located\_at or work\_at). Also used as the abstract reference to AWS Regions. | Yes |
| `Standard` | An object to represent a standard such as a compliance or technical standard. | Yes |
| `Subscription` | A subscription to a service or channel. | Yes |
| `Task` | A computational task. Examples include AWS Batch Job, ECS Task, etc. | Yes |
| `Team` | A team consists of multiple member Person entities. For example, the Development team or the Security team. | Yes |
| `ThreatIntel` | Threat intelligence captures information collected from vulnerability risk analysis by those with substantive expertise and access to all-source information. Threat intelligence helps a security professional determine the risk of a vulnerability finding to their organization. | Yes |
| `Training` | A training module, such as a security awareness training or secure development training. | Yes |
| `User` | A user account/login to access certain systems and/or services. Examples include okta-user, aws-iam-user, ssh-user, local-user (on a host), etc. | Yes |
| `UserGroup` | A user group, typically associated with some type of access control, such as a group in Okta or in Office365. If a UserGroup has an access policy attached, and all member Users of the UserGroup would inherit the policy. | Yes |
| `Vault` | A collection of secrets such as a key ring | Yes |
| `Vendor` | An external organization that is a vendor or service provider. | Yes |
| `Vulnerability` | A security vulnerability (application or system or infrastructure). A single vulnerability may relate to multiple findings and impact multiple resources. The `IMPACTS` relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The `IMPACTS` relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc. | Yes |
| `Weakness` | A security weakness. | Yes |
| `Workload` | A virtual compute instance, it could be an aws-ec2-instance, a docker-container, an aws-lambda-function, an application-process, or a vmware-instance. The exact workload type is described in the \_type property of the Entity. | Yes |
| \[System Mapped Entities\] | Entities with `_source='system-mapper'` | No |
| \[System Internal Entities\] | Entities with `_source='system-internal'` | No |
| \[Custom Created Entities\] | Entities created with a custom-defined \_class or \_type | Yes |

---

Source: /platform-overview/vulnerability-reporting-intro

# Vulnerability Reporting

Use JupiterOne to see an aggregation of your vulnerabilities and findings across all your systems. Understand which are most critical because they are production resources, in the cloud, or classified in some way that makes them critical to your organization.

### Prioritize effectively

By leveraging JupiterOne's [graph context](/features/admin/j1-dashboard.md), you can discover and prioritize critical vulnerabilities and incorporate ticketing systems such as Jira to both send tickets regarding vulnerabilities to be addressed and also reporting on tickets that have already been completed.

#### Up next

Assets are a key component to the JupiterOne graph and are the foundation to building out your digital environment within JupiterOne. We'll explore how these are ingested and can be managed in the next article.

---

Source: /reference

# API Overview

Leverage JupiterOne's API to seamlessly ingest custom data and programmatically manage your workspace.

## Introduction

The JupiterOne platform exposes a number of public GraphQL endpoints which can be leveraged with operations relating to queries, graph, alerts, and rules.

```text
Base URL: https://graphql.us.jupiterone.io
```

Visit the [JupiterOne Public Workspace](https://www.postman.com/jupiterone-sol/jupiterone-public-workspace/overview) for examples to get started with JupiterOne's API.

Rate Limits: Rate limiting is enforced based on your account tier:

-   Free: 10/min, no burst
-   Freemium: 30/min, no burst
-   Enterprise: 30-60/min with burst

A `429` HTTP response code indicates the limit has been reached.

> **INFO**
> 
> For more information regarding API rate limiting, see our [dedicated rate limiting article](/api/rate-limiting.md).

## JupiterOne API topics

Start by connecting JupiterOne with other tools to populate relevant data within your JupiterOne workspace.

[

![](/icons/illustrations/orbit.svg)![](/icons/illustrations/orbit.svg)

The JupiterOne Data Model

Review the JupiterOne Data model and learn about two fundamental elements of the JupiterOne graph: Entities and Relationships.





](/data-model/jupiterone-data-model.md)[

![](/icons/illustrations/strategy.svg)![](/icons/illustrations/strategy.svg)

Authentication

Learn how to authenticate with the JupiterOne API and create Auth tokens for use in your JupiterOne workspace.





](/api/authentication.md)

---

Source: /reference/api-query-eratta

# Updates and Corrections to JupiterOne Query API

## Summary

Being able to retrieve all results of a query reliably is a critical capability for users of JupiterOne. There have been various improvements made to the JupiterOne query API over the years. This page is used to capture the details of ongoing updates and corrections to the JupiterOne Query API.

### Variable Result Size (September 2024)

Queries are now assumed to tolerate variable result sizes unless otherwise specified. Usage of `VariableResultsSize: true` is required to retrieve stable and complete results.

More detailed information is available [here](/reference/api-query-pagination-changes.md).

### `_type` Always Returned as String (October 2024)

Every entity in the JupiterOne graph has a `_type` property. Work was previously done to ensure that this was always returned as a string value. A defect was identified whereby aliasing this property could cause it to sometimes be returned as an array of length 1.

Going forward the `_type` property will always be returned as a string even if the property has been aliased, for example:

```j1ql
FIND Host AS h
RETURN h._type AS "Host Type"
```

Old behavior would return a response like this:

```text
... "Host Type":["device42_device"] ...
```

New behavior guarantees this response:

```text
... "Host Type":"device42_device" ...
```

---

Source: /reference/api-query-pagination-changes

# Changes to JupiterOne Query API

## Summary

Being able to retrieve all results of a query reliably is a critical capability for users of JupiterOne. There have been various improvements made to the JupiterOne query API over the years; JupiterOne is now proactively monitoring customers using legacy and unsafe techniques for retrieving query results.

From the **1st September 2024** two features will be deprecated from the JupiterOne query language and query API. Customers using these features will be proactively contacted through August 2024 to adapt their usage.

-   `SKIP` will not longer be accepted in the JupiterOne Query Language (J1QL)
-   `VariableResultsSize` will be forced to `true` for all Query API requests regardless of the flag set by the caller

### Why are we making this change now?

As part of the graph upgrade program JupiterOne has improved pagination performance, but has also identified that the legacy pagination cursor is now more unstable than before. Customers should be getting reliable results from API queries, we want to accelerate the adoption of the improved pagination and deprecate the legacy approach as soon as possible.

## What changes might you need to make?

Using JupiterOne's GraphQL API it is possible to submit a J1QL query to the service and retrieve results. There are various flags that can be passed to this query interface that impact the behavior and are relevant to this issue.

For API calls using `SKIP` and `LIMIT` pagination: use `VariableResultSize: true` and `cursor` for requesting addition pages.

For API calls already using `cursor`: use `VariableResultSize: true`.

> **INFO**
> 
> JupiterOne has observed examples where API consumers have assumed that receiving less than 250 results for a page (including zero results) indicates that the results pages have been exhausted. This is not a safe assumption, only a NULL cursor being returned indicates that the result pagination is complete.

### `SKIP` and `LIMIT` versus `cursor` pagination

Using `SKIP` and `LIMIT` for pagination is not reliable as the order of results isn't guaranteed, specifically the results that you "skip" may not have been returned on a previous call (missed results), or results may be returned on multiple pages (duplicated results).

When using the `cursor` approach it is important to continue to call the `cursor` until a NULL cursor is returned, even if a page has no results.

### Fixed versus Variable Page Size

`VariableResultSize: true` means that a returned page may include any number of results, including 0 (zero) results. For some queries (e.g. `FIND UNIQUE ...`) it is necessary for the API to respond with ALL results on the first page. Any API consumer should be prepared to deal with many results per page.

## Clients and SDKs

For customers using the client libraries and SDKs there are some details that are relevant to this work

### Python Client

The Python Client was originally built by Auth0. JupiterOne is currently working with Auth0 to adopt the PIP package. The canonical implementation of the python package is available here: [https://github.com/JupiterOne/jupiterone-api-client-python/](https://github.com/JupiterOne/jupiterone-api-client-python/).

### Go Client

The Go client is already compatible with these requirements but defaults to `VariableResultSize: false`, users should be sure to set the flag to `true`. This client is pending updates, and is available here: [https://github.com/JupiterOne/jupiterone-client-go/](https://github.com/JupiterOne/jupiterone-client-go/).

### Node Client

The node client has been updated to use the correct configuration, and no longer uses `SKIP` and `LIMIT` for pagination. This client is pending a release at this time. The client is available here: [https://github.com/JupiterOne/jupiterone-client-nodejs/](https://github.com/JupiterOne/jupiterone-client-nodejs/).

---

Source: /reference/browser-support

# Browser Support

JupiterOne is designed for current desktop web browsers. Use a recent version of one of the supported browsers below. The application may load in other browsers, but not all features are guaranteed to work as designed.

## Supported browsers

| Browser | Supported | Supported versions |
| --- | --- | --- |
| Google Chrome | Yes | Latest major release and 2 prior releases |
| Microsoft Edge | Yes | Latest major release and 2 prior releases |
| Mozilla Firefox | Yes | Latest major release and 2 prior releases |
| Apple Safari | Yes | Latest major release and 1 prior release |
| Opera | No | N/A |

Internet Explorer is not supported. Microsoft retired it in 2022.

## Mobile browsers

JupiterOne is built as a desktop experience, and there is no guarantee that mobile browsers provide a functional experience. Use a desktop browser for the best experience.

---

Source: /reference/data-retention

# Data Retention Enhancements Announcement

Data retention policies within the platform are being enhanced by JupiterOne, and as valued JupiterOne customers we wanted to update you on these improvements. Historically, clarity in our application's data retention policies has not been emphasized enough; there are numerous instances where historical data has been retained, and JupiterOne aims to standardize this process. The objective is to ensure that correct and clear expectations regarding data retention are maintained for all customers, and that data is expunged in a timely manner.

In summary, increased data retention and a clearer understanding of where that retention applies and how it operates will be experienced by all customers:

-   **Graph data:** Unlimited retention for all customers
-   **Soft-deleted data:** 7 days for existing customers
-   **Alert aggregate metrics:** Unlimited retention for all customers
-   **Alert raw results:** 180 days retention for existing customers

## Data under Consideration

When data retention is discussed by JupiterOne, it pertains to customer data in the platform, specifically the information captured in JupiterOne through integrations, data sent over the API, or manual data entry. This is referred to as the "data plane" in JupiterOne, specifically:

-   The data that is stored and accessible in the graph, i.e., the data accessed via running a J1QL query. Ref: [Data Retention in the Graph](#graph-data-retention)
-   Historical data returned by alerts, including both raw results from the queries and the high-level metrics for generating the visualizations. Ref: [Alert Results and Metrics](#alert-results-and-metrics)

Some data in JupiterOne is not affected by this data retention update and is considered "control plane" or audit data. This includes information about customer user accounts, audit logs, and logs from integration runs.

## Graph Data Retention

Moving forward, data retention in the graph is intended to be for an "unlimited" period. As long as a customer contract is in place, any data sent to the graph (and not deleted) will be retained indefinitely.

This implies that there is no requirement to resend data after a period of time or in any other way "refresh" it unless the data requires an update.

**NOTE:** If your own data is sent to JupiterOne using a custom integration or directly via the API, it is recommended that you ensure you are able to resend that data should it be necessary.

Two notable ways in which data can be routinely deleted from the graph are:

1.  If an asset has been removed from the source system (e.g., an AWS EC2 instance is terminated), JupiterOne will mark that data as "deleted," and the data will be permanently removed from the graph in the future. Ref: Soft Deleted Data
2.  An integration instance is deleted by an administrator. When this occurs, JupiterOne will delete all assets and relationships that are created by that integration and clean up the graph.

## Soft Deleted Data

When data is "deleted" from the graph, JupiterOne does not immediately remove that data; it is retained for a short period of time so that queries can capture details of entities and relationships being removed (e.g., "how many EC2 machines were removed in the last 24 hours").

Soft-deleted data is excluded from query results by default and can be identified with the property `_deleted=true`, and the data will be permanently deleted from the graph 7 days after it is soft deleted. This allows any rules, which can have up to a 7-day polling interval, to capture details on deleted assets.

## Alert Results and Metrics

Recognition by JupiterOne that once controls and queries that are critical are identified, it is important to retain the results of those evaluations. Two outputs from alerts that are relevant for data retention are metrics (i.e., total number of results, and if triggers fired), and the raw results of the queries.

The aggregate metric from the alerts is intended to be retained indefinitely as long as the alert is in place. Alert raw results are intended to be retained for 180 days; this allows customers to go back up to 6 months and re-fetch the raw results from an alert run.

**NOTE:** Alert actions are designed to facilitate the continuous and near real-time export of alert results. This should be the primary mode of long-term alert retention for customers.

## Timeline

When are these changes being made? As a customer, significant changes in the way JupiterOne is used will not be seen. Work will be conducted through December 2023 and January 2024 to ensure adherence to these clearer data retention policies.

If any questions or concerns arise, please reach out to [support@jupiterone.com](mailto:support@jupiterone.com).

---

Source: /reference/drop-rules

# Drop rules (admin)

Drop rules let an account administrator stop JupiterOne from ingesting specific entities that the account considers noise — for example, AWS default VPCs, default subnets, or AWS-managed IAM policies. A drop rule is a simple filter: any entity that matches an enabled rule is skipped at ingest and never written to your graph.

Drop rules are a controlled feature. JupiterOne enables them per account, and there is no default rule set — nothing is ever dropped unless you author a rule yourself.

## Shared responsibility

> **DANGER**
> 
> You own every drop rule and its consequences. JupiterOne provides the mechanism; you decide what to remove. If a rule drops entities that a dashboard, alert, compliance mapping, or saved query depends on, those things will break — and that is your responsibility, not a defect. Author rules deliberately and review their effect.

The model is intentionally simple and one-directional:

-   **You are in control.** JupiterOne never decides what to exclude. Completeness is the default; a drop only ever happens because your account authored a rule that names it.
-   **You own the outcome.** Dropped entities are absent from the graph. Anything that relies on them — queries, alerts, compliance evidence, reports — sees them as gone. That trade-off is yours to make and to monitor.
-   **Fail-open, never fail-closed.** A missing, disabled, or invalid rule set drops nothing. The failure direction is always "we kept data you meant to skip," never "we silently lost data you wanted."
-   **Reversible, but not instant.** Disabling or deleting a rule stops the drop, and the affected entities are re-ingested on the next full sync of each integration. They are not restored the moment you change the rule.

> **WARNING**
> 
> Drop rules are the wrong tool for most exclusions. If your goal maps to a single integration step or data source, turn that off with **Data Sources** instead. Use drop rules only for cross-cutting noise that Data Sources cannot express.

## Prerequisites

-   You must have the account **Administrator** role. Every drop-rules operation requires the `accessAdmin` permission and is rejected otherwise.
-   Drop rules must be enabled for your account by JupiterOne.

## What drop rules apply to

Drop rules are evaluated only during **integration sync ingest**, at the point where an entity would be created or updated. This has deliberate boundaries:

-   **Integration-managed data only.** Rules apply to entities ingested by an integration sync. They are scoped to the `integration-managed` source and evaluated per sync job.
-   **Entities only.** Rules match entities, never relationships or tags. When an entity is dropped, any relationship or tag that pointed at it is skipped automatically, so no dangling nodes are created.
-   **Reversible through normal sync.** On the next sync, matching entities stop being re-ingested and any copies already in the graph are removed by the standard stale-delete pass.

## What drop rules do not cover

Drop rules are narrowly scoped by design. They do **not** apply to:

-   **Mapper and MRR entities.** Entities created through the mapper or mapped-relationship (MRR) path are **not** affected by drop rules. A rule that matches a noisy asset will not suppress a mapper-created copy of it. This is a known, deliberate boundary.
-   **Direct API writes and mutations.** Entities you create or update directly through the API (including `:OVERRIDE` claims) are never dropped. A drop rule cannot silently discard a deliberate write.
-   **System-managed data.** JupiterOne-authored nodes (for example, rule, compliance, and lifecycle data) are excluded from drop-rule evaluation.

> **NOTE**
> 
> If you need mapper-created or API-created entities excluded, drop rules will not do it today. Raise the use case with JupiterOne rather than assuming a rule covers it.

## Rule shape

A rule set is an array of rules. A rule matches an entity when its optional `_type` and `_class` match and **all** of its conditions match. An entity is dropped if it matches **any** enabled rule.

```json
{
  "id": "aws-default-subnets",
  "enabled": true,
  "_type": "aws_subnet",
  "_class": "Network",
  "conditions": [
    { "property": "defaultForAz", "op": "eq", "value": true }
  ]
}
```

| Field | Required | Description |
| --- | --- | --- |
| `id` | Yes | Stable identifier for the rule. Used for per-rule reporting and for per-rule updates. |
| `enabled` | No (default `true`) | Set to `false` to keep a rule without applying it. |
| `_type` | No | Match only entities of this type. |
| `_class` | No | Match only entities of this class. |
| `conditions` | No (default `[]`) | Property conditions, combined with logical AND. |

Each condition is `{ property, op, value }`. The supported operators are:

| Operator | Meaning |
| --- | --- |
| `eq` | Property equals `value`. |
| `neq` | Property is present and does not equal `value`. |
| `in` | Property equals one of the values in the `value` array. |
| `exists` | Property is present. |
| `startsWith` | String property begins with `value` (case-sensitive; mirrors the J1QL `^=` operator). |

### Conditions match integration-supplied properties only

A condition can only reference a property that the **integration itself** puts on the entity — the value must be present in the source data at the moment of ingest. Drop rules are evaluated on the raw entity before JupiterOne enriches it, so anything JupiterOne adds _after_ ingest is invisible to a rule and cannot be matched.

Tags are the clearest example:

-   A tag set by the integration is part of the entity the integration delivers, so you **can** filter on it.
-   A tag applied by a JupiterOne **tagging rule** is added after ingest. That value is not present when the drop rule runs, so you **cannot** filter on it.

The same limitation applies to any JupiterOne-derived data — for example, properties added by mapping, tagging rules, or other post-ingest processing. Write conditions only against properties that originate from the integration.

## Limits

Rule sets are bounded to keep ingest predictable. A rule set that exceeds any limit is rejected as invalid, and — consistent with fail-open — an invalid configuration drops nothing.

| Limit | Maximum |
| --- | --- |
| Rules per account | 50 |
| Conditions per rule | 10 |
| Values in a single `in` condition | 20 |

## Managing rules through the API

Manage drop rules through the JupiterOne GraphQL API, authenticated as a user with the account Administrator role. Every field below requires admin access; a non-admin caller receives a `FORBIDDEN` error and no change is made.

### Read the current configuration

```graphql
query {
  dropRulesConfigBeta {
    enabled
    version
    ruleCount
    rules {
      id
      _type
      _class
      conditions { property op value }
    }
  }
}
```

The query returns `null` when no configuration exists. The `version` field is used for safe concurrent updates (see [Concurrent updates](#concurrent-updates)).

### Save the entire rule set

Use `saveDropRulesConfigBeta` to replace the whole configuration. This is the safest way to make bulk changes.

```graphql
mutation {
  saveDropRulesConfigBeta(
    input: {
      enabled: true
      rules: [
        {
          id: "aws-default-subnets"
          _type: "aws_subnet"
          conditions: [{ property: "defaultForAz", op: eq, value: true }]
        }
        {
          id: "aws-managed-iam-policies"
          _type: "aws_iam_policy"
          conditions: [{ property: "arn", op: startsWith, value: "arn:aws:iam::aws:policy/" }]
        }
      ]
    }
  ) {
    created
    config { version ruleCount }
  }
}
```

`created` is `true` when this call created the configuration for the first time.

### Add, replace, or remove a single rule

```graphql
# Add or replace a rule by id
mutation {
  saveDropRuleBeta(
    rule: {
      id: "aws-service-linked-roles"
      _type: "aws_iam_role"
      conditions: [{ property: "path", op: startsWith, value: "/aws-service-role/" }]
    }
  ) {
    created
    config { ruleCount }
  }
}

# Remove a rule by id
mutation {
  deleteDropRuleBeta(id: "aws-service-linked-roles") {
    deleted
    config { ruleCount }
  }
}
```

### Turn drop rules off

To stop all dropping without losing your rules, save the configuration with `enabled: false`. Once the change takes effect (see [When changes take effect](#when-changes-take-effect)), syncs re-ingest everything the rules had been dropping.

```graphql
mutation {
  saveDropRulesConfigBeta(input: { enabled: false, rules: [] }) {
    config { enabled }
  }
}
```

### Concurrent updates

The configuration carries a `version` that increases on every write. To update safely when more than one administrator (or tool) might be editing, pass the `version` you last read as `ifVersion`:

```graphql
mutation {
  saveDropRulesConfigBeta(
    input: { enabled: true, ifVersion: 4, rules: [ /* ... */ ] }
  ) {
    config { version }
  }
}
```

If the stored version no longer matches, the mutation fails with a `CONFLICT` error instead of overwriting the newer change. Read the configuration again, reapply your change, and retry. Omit `ifVersion` for a last-writer-wins save.

## When changes take effect

Drop rule changes are not applied instantly. Each replication worker caches the rule configuration in memory for up to 30 minutes, so a rule you add, change, remove, or disable can take up to that long to take effect across in-progress and future syncs. This happens automatically — there is nothing to trigger or restart.

Two consequences worth knowing:

-   After you save a change, entities a new rule matches may keep ingesting — or, for a removed rule, keep being dropped — for a short period until the cache refreshes.
-   If the configuration temporarily cannot be read (for example, while the database is under heavy load), workers keep applying the last successfully-loaded configuration for up to 24 hours rather than dropping the filter, so your rules stay in force through a transient outage.

Drop rules are meant for stable, rarely-changing filters, so this delay is not normally noticeable.

## Validation errors

-   A rule set that violates a limit or uses a malformed condition is rejected with a `BAD_USER_INPUT` error that describes the problem. Nothing is written.
-   Because a rejected configuration is never stored, a validation error cannot leave your account in a state where the wrong data is dropped.

## Related topics

-   [Data retention](/reference/data-retention.md)

---

Source: /reference/graph-upgrade

# Graph Upgrade Overview and Compatibility

## Overview

JupiterOne is upgrading the primary data stores used to process J1QL queries. The project is intended to improve query performance and reduce the time in which the latest data is available to query.

As part of this upgrade user will get access to an improved query experience, with a more responsive and configurable results page.

The upgrade involves some changes in behavior of queries and the results returned to the user. JupiterOne believes that each of these changes is towards more correct results.

## New Search Experience

As part of the graph upgrade program JupiterOne is introducing an improved search experience and results table. Users will be able to get more value and a better experience when searching data in JupiterOne.

![New Table Component](/assets/images/new-table-component-1977d58fee4cfaa4261272bde170d35a.png)

### Increased Results Limits

The table will now show up to 250 results per page, with on-demand loading of additional pages. This allows the system to return the first page of query results to a user much faster in most cases.

The results table produces either a total row count, or an estimate for very large result sets. As you paginate through the pages the estimate becomes more refined, or becomes the absolute value.

### Faster, more stable experience

The table component has been rebuilt to only render the section of the table visible to the user. This has made scrolling vertically and horizontally though large tables of results much more performant on the browser.

### Column resizing, reordering, and left/right pinning

Columns can now be drag and dropped into a new ordering, with the ability to pin one or more columns to either the left or right side of the table. This makes understanding the data in the table much easier and more intuitive (1).

### Quick column selection, including in Insights table widgets

Users can now much more quickly select which columns to show, including a column name search filter. Also includes the quick option to "Hide" a column without having to redo column selection.

### Colors and Icons for Classes of Assets

Providing a more consistent and intuitive experience for users (2).

### Stacked Icons for Graph Queries

When returning a graph query (i.e. a query with a traversal) and returning columns from multiple elements the icons to the left of the table show a stacked representation of the entity types (2), with a tool tip (3).

## Query Compatibility and Results

The compatibility changes have been grouped into MAJOR, MEDIUM, and MINOR categories.

-   MAJOR: Indicates a change in behavior that may significantly change query results
-   MEDIUM: Covers changes where query results may change slightly, or previously invalid queries may now be rejected
-   MINOR: Typically more style based changes, but might introduce incompatibility with downstream systems

### API Pagination / Query Result Ordering MAJOR

In the legacy query service the same query on unchanged data, in some cases, would produce results with a stable order. This was not true for all queries, and should not be relied upon.

The new query engine produces results in any order and will frequently do so for the same query against unchanged data.

Paginating through query results using a cursor and `VariableResultSize` flag is always guaranteed to eventually return all results for a query.

For more details on this topic, and changes customers will need to make by 1st September 2024 please see the [extended notes](/reference/api-query-pagination-changes.md).

> **INFO**
> 
> This change was originally classified as a MINOR change, but the impact has proven to be greater than expected. Customers using inappropriate API query calls are being proactively contacted to update their usage.
> 
> All JupiterOne provided clients / SDKs have been updated to use the appropriate options, please check you are using the latest clients.

### Unwinding of Arrays MAJOR

Previously JupiterOne would "unwind" rows where the returned values contained arrays of values. This would introduce more results than expected in a lot of cases. The results are no longer unwound in this fashion.

-   This may reduce the number of results in queries and alerts. The new number of rows better reflects the actual number of assets returned in your query
-   Aggregations on properties with arrays no longer duplicates counts across rows

Using the following query as an example, where we have 461 aws\_instances in the system:

```j1ql
FIND aws_instance AS i
RETURN COUNT(i) AS "Instance Count", i._integrationClass AS "Integration Class"
```

The legacy query service would return a table like so:

```text
+----------------+---------------------+
| Instance Count | Integration Class   |
|----------------|---------------------|
| 461            | CSP                 |
| 461            | Infrastructure      |
+----------------+---------------------+
```

The upgraded query service will return this table:

```text
+----------------+---------------------+
| Instance Count | Integration Class   |
|----------------|---------------------|
| 461            | CSP, Infrastructure |
+----------------+---------------------+
```

The rationale here is that the sum of the aggregates should reflect the total number of assets, not the count of each individual property. This was particularly confusing in the legacy system where properties with array values were not clearly identified to the user and the number of rows, or aggregation results, did not match the total number of assets.

> **INFO**
> 
> The way you search against these properties is **not** changed. The following query still returns all the results:
> 
> ```j1ql
> FIND aws_instance WITH _integrationClass = "CSP" AS i
> RETURN COUNT(i) AS "Instance Count", i._integrationClass AS "Integration Class"
> ```

### ORDER BY on returned columns only MEDIUM

Previously it was possible to order results by any property, even if that property was not in the returned columns. In the upgraded query system it is only possible to `ORDER BY` on properties that are returned in the results.

This query will still produce results, but the ordering will not be applied:

```j1ql
FIND aws_instance AS i
RETURN i.displayName, i.arn
ORDER BY i.accountId
```

The query should be written as:

```j1ql
FIND aws_instance AS i
RETURN i.displayName, i.arn, i.accountId
ORDER BY i.accountId
```

### Aliasing a Negated Traversal MEDIUM

It was previously possible to alias a negated (do not match) traversal. This was confusing to users as the alias is to something that "does not exist". The results of such an alias, when included in a `RETURN` or aggregation, were undefined.

The following query will now produce an error. Note the negated traversal `!RELATES`:

```j1ql
FIND aws_instance AS i
  THAT !RELATES TO DataStore AS ds
RETURN i.displayName, i.arn, ds.displayName, ds.arn
```

The error returned is `Could not find node, relationship, or variable with identifier ds`

### Less De-duplication in Optional Traversals MEDIUM

Previously, optional traversals would de-duplicate traversal paths based on a collection of entities that were previously traversed. This would at times remove results that should have been included.

After the upgrade the system will not de-duplicate these matching paths. This is a more correct representation of the relationships in the graph as it shows all possible paths, although it is possible there will be more duplicated data in the results.

These effects can also be observed across multiple pages of results, they will not necessarily appear adjacent to each other in the table output.

The effect of this change can be reduced by including the `UNIQUE` keyword in queries.

### Default Expression Names now more descriptive MEDIUM

Using an expression (aggregation, math operator, etc) in a `RETURN` without an `AS` alias would historically generate names such as `expression0`. This was unhelpful as it did not clearly indicate the source of the data. As part of the graph upgrade the expression names are now derived from the expression itself, when not aliased.

The legacy behavior: ![Legacy Default Expression Names](/assets/images/legacy-expression-names-e46d620f805b3f555a3b54495dceae19.png)

New behavior: ![New Expression Names](/assets/images/upgraded-expression-names-5cfc6c62aff751397363d52f4ae9b5ba.png)

> **INFO**
> 
> This change may have an impact on any automation that expects the old `expressionN` format of un-aliased expressions.

### RBAC Policy Filters no longer modify returned properties MEDIUM

It is possible in JupiterOne Enterprise RBAC access policies to filter what assets a user can query based on properties of those assets (e.g. limit a group of users to a specific AWS account by filtering on `accountId`), **this is not being changed**.

Additionally the system would strip non-matching property values from the returned entities based on these policies, the new system no longer does this.

Example: A user has an access filter that limits access to only entities with `_class = Device`. If this user searches in JupiterOne and we return an entity with `_class = ['Device', 'Host']` historically the system would strip out the filtered property value, so the user would see the entity as having `_class = ['Device']`.

Having reviewed this feature it was determined this offered no meaningful security to the system and caused significant confusion when comparing entities between users with different RBAC policies.

### Full Text Search Tokenization MEDIUM

Previously full text searches would tokenize the search string based on word boundaries, e.g: searching for `"Keith Packard"` would match an entity containing `keith.packard@example.com`. Alternatively, searching for `"keith packard"` would match `Keith Packard`.

The new query full text search functionality only supports case-insensitive “contains” searches. For example, if you search `"Keith Packard"`, it now returns `Keith Packard`, `keith packard`, `KEITH PACKARD`, etc. It will NOT match things like `keith.packard@example.com` or `Keith-Packard`.

This simplification was made as analysis of full text search behavior indicated that only literal matches were desirable, rather than tokenized matches across all properties.

For more advanced text searching it is recommended to look at the new [regex functionality](/j1ql/regular-expressions.md) in J1QL.

> **INFO**
> 
> This change may have an impact on any Insights dashboards where the dashboard filters were applied as a free text search at the beginning of the query.

### Undefined Properties returned as Null MINOR

Where undefined properties were previously returned as `undefined` these are now returned as `null`. This change allows for better serialization to JSON.

> **INFO**
> 
> The way you search against these properties is **not** changed. The following query syntax should continue to be used:
> 
> ```j1ql
> FIND aws_instance WITH ebsOptimized != undefined
> ```

### Invalid Numeric Aggregations return 0 MINOR

Previously, J1QL would return `NaN` for any sum operation that included non-summable data (i.e. non-numeric strings).

J1QL will now return 0 for the aggregation.

### Relationships to Self MINOR

The legacy graph implementation would filter out relationships that looped back to the same object, for example `aws_security_group` objects often have a relationship to themselves. In the following query in the previous implementation the query would return only instances where the `source` was not the same node as the `target`:

```j1ql
FIND aws_security_group AS source
  THAT ALLOWS aws_security_group AS target
```

The upgraded query service does not remove these relationships as they can carry potentially important information.

![Relationship to Self](/assets/images/relationship-to-self-80b3c8aa03e32a327185b148c834ab0e.png)

To replicate the legacy behavior it is necessary to introduce an additional check where the source and target are not the same node:

```j1ql
FIND aws_security_group AS source
  THAT ALLOWS aws_security_group AS target
WHERE source._id != target._id
```

### Optional Traversals De-Duplicate Short Paths MINOR

Take the following optional traversal query:

```j1ql
FIND Person AS p
  (THAT IS User AS u)?
```

In the legacy implementation, a return of both the optional match and the non-optional matched rows were returned.

Examples of old results:

```text
{ p: { <some person> }, u: undefined }
{ p: { <some person> }, u: { <some user> } }
```

In this case the person is the same, and both the paths were returned for a single entity.

In the new system, only the row on the optional path (when it exists) will be returned. This reduces confusion over what was found using the optional vs non-optional path.

Instead of returning both rows above the new system will only return:

```text
{ p: { <some person> }, u: { <some user> } }
```

Or if the optional traversal does not match:

```text
{ p: { <some person> }, u: undefined }
```

### Nested Optional Traversals MINOR

The legacy system allowed for inner traversals within optional traversals like so:

```j1ql
FIND User
  (THAT IS Person
    (THAT HAS AccessKey)? )?
```

This capability was not documented and is no longer supported. The intention of such a query was undefined. The equivalent supported query would be:

```j1ql
FIND User
  (THAT IS Person)?
  (THAT HAS AccessKey)?
```

### Nested Optional Traversal Negation MINOR

The legacy system allowed for inner traversals with chained negated traversals like so:

```j1ql
FIND User
  (THAT IS Person
   THAT !HAS AccessKey)?
```

This capability was not documented and is no longer supported. The intention of such a query was undefined.

### Aliasing to non-ASCII or Empty String MINOR

J1QL previously allowed for non-ASCII or empty string literal as an alias:

```j1ql
FIND Person AS p
RETURN p.displayName AS ""
```

In the new system, empty string literals will not be allowed and all aliases must be non-zero length ASCII strings.

### Empty results due to property selections filtered out MINOR

When running a J1QL query with column selectors, if all the columns selected had no values empty objects would be filtered out from query results. This meant that the number of rows would not accurately reflect the number of assets returned in the query, only those with the selected attributes.

For example, the following query would only return AWS instances that have a public IP address set, and any AWS instance without that property would be filtered from the results:

```j1ql
FIND aws_instance AS i
RETURN i.publicIpAddress
```

This was confusing because the "total" number of results would reflect the complete count of all `aws_instance` objects, so you may see a table or result set with 10 rows but get a count of hundreds of instances.

In the new system, empty objects will be returned. This displays more clearly what the results actually are instead of obscuring potentially important information about the structure of the returned data.

If a query relies on this behavior to filter results the property should be moved to be a filter also:

```j1ql
FIND aws_instance WITH publicIpAddress != undefined AS i
RETURN i.publicIpAddress
```

### CONCAT() now concatenates arrays MINOR

The `CONCAT()` function, when passed two properties that were arrays, would behave more like a `ZIP()` function. This function now properly concatenates the arrays together.

Using the following query as an example:

```j1ql
FIND aws_instance AS i
RETURN CONCAT(i.privateIpAddresses, i.privateDnsName) AS privateEndpoints
```

In the legacy system would produce results like this:

```text
+----------------------------------------------------------------------------------------------------------------------+
| privateEndpoints                                                                                                     |
+----------------------------------------------------------------------------------------------------------------------+
| ["10.0.3.123ip-10-0-3-123.us-east-2.compute.internal", "10.0.3.146ip-10-0-3-123.us-east-2.compute.internal"]         |
| ["10.0.3.19ip-10-0-3-54.us-east-2.compute.internal", "10.0.3.21ip-10-0-3-54.us-east-2.compute.internal"]             |
| ["10.0.1.131ip-10-0-1-52.us-east-2.compute.internal", "10.0.1.212ip-10-0-1-52.us-east-2.compute.internal"]           |
+----------------------------------------------------------------------------------------------------------------------+
```

And now produces results like this:

```text
+----------------------------------------------------------------------------------------------------------------------+
| privateEndpoints                                                                                                     |
+----------------------------------------------------------------------------------------------------------------------+
| ["10.0.3.123", "ip-10-0-3-123.us-east-2.compute.internal", "10.0.3.146", "ip-10-0-3-123.us-east-2.compute.internal"] |
| ["10.0.3.19", "ip-10-0-3-54.us-east-2.compute.internal", "10.0.3.21", "ip-10-0-3-54.us-east-2.compute.internal"]     |
| ["10.0.1.131", "ip-10-0-1-52.us-east-2.compute.internal","10.0.1.212", "ip-10-0-1-52.us-east-2.compute.internal"]    |
+----------------------------------------------------------------------------------------------------------------------+
```

### Null no longer filtered from MERGE() MINOR

The `MERGE()` function will now preserve null values when merging, as this gives a more correct array length for the results.

If the null value is not desired it should be filtered in the query when possible.

---

Source: /reference/pipeline-upgrade

# Data Pipeline Upgrade Overview and Compatibility

## Overview

JupiterOne is upgrading the data pipeline used to bring data into JupiterOne. The project is intended to significantly improve data ingest performance, reducing the time needed to process incoming data and allow the graph to more quickly reflect the data sent from an integration.

There are very few functional changes that impact customers, but if you do make use of JupiterOne's APIs for sending custom data or manipulating data in the graph please review these documents carefully.

> **INFO**
> 
> These changes will start rolling out to customers from **Monday 28th April 2025**

## API Compatibility and Other Changes

The compatibility changes have been grouped into MAJOR, MEDIUM, and MINOR categories:

-   MAJOR: Indicates a change in behavior that may significantly change API usage or APIs becoming unavailable
-   MEDIUM: Covers changes where APIs change in behaviour but no particular actions are required from customers, or data in the graph may change in a way that impacts downstream processing
-   MINOR: More minor changes, removal of undocumented or unused functionality, or additional metadata being added

### CREATE\_OR\_UPDATE Sync Jobs MAJOR

The `CREATE_OR_UPDATE` sync job mode will no longer be supported. Customers using the `CREATE_OR_UPDATE` mode should use the `PATCH` mode. More information on how to migrate to this mode will be communicated directly to customers via our customer success team.

### No Versioned Raw Data MEDIUM

The Persister APIs previously allowed fetching of Raw Data by version. This will no longer be supported, only the latest version of Raw Data is retained.

### New UUIDv5 `_id` Metadata MINOR

Existing objects `_id` will be updated to a new, stable, deterministic UUIDv5. This UUID is derived from the `_scope` and `_key` of the object, i.e. the natural identifiers. Customers should not be relying on the `_id` property being stable for a given entity prior to this change.

### Duplicate `_key` + `_scope` Constraints Enforced MINOR

Prior to this upgrade the system would partially tollerate entities that had duplicated `_key` and `_scope` combinations. The behaviour in this case was undefined. The new data pipeline will strictly enforce this constraint. Any duplicated `_key` and `_scope` data will be dropped at ingest time.

### `_scope` Required and Defaulted MINOR

The `_scope` property was previously optional and the system would derive the scope through a combination of the data source and any `_integrationInstanceId` that may have been provided. `_scope` is now a required property, and will be set to a default value for certain routes, e.g. certain APIs will default to `_scope = api`.

### No PUT of Raw Data MINOR

It will no longer be possible to directly set the Raw Data for an entity using a PUT. The raw data must be ingested as part of a sync job and cannot be updated outside of that flow.

### `PATCH` Sync Jobs cannot target Relationships

`PATCH` jobs will not support patching relationships. Either a full `DIFF` mode sync job must be used or the `updateRelationship` mutations via GraphQL.

---

Source: /reference/unified-device

# Unified Devices and Device Matrix

BETA

## New JupiterOneUnifiedDevice

Through 2023 JupiterOne had a BETA feature called "Unified Devices". This feature was a prototype solution to the problem of representing a single device entity when multiple source device and host entities were present in JupiterOne. We learnt a lot from this BETA feature, and are now ready to replace it with a new and improved solution.

## End of Life for unified\_device

The original unified\_device feature will be retired on 1st November 2024. From that point onwards you will no longer see unified\_device entities in your JupiterOne environment. In addition the "Device Matrix" visualization will no longer be available.

## New UnifiedDevice Entities

We are starting the process of rolling out the Generally Available version of the new UnifiedDevice entities. These are a set of new entities that replace the old unified\_device entities, and are created in a more reliable way. We made a lot of changes to how these UnifiedDevices are created, correlated, and merged to produce a consistent view across your Device and Host entities in JupiterOne.

The rollout of the new UnifiedDevice entities is being done in phases, with an initial closed program where selected new and existing customers are being set up with the new entities.

By the end of 2024 we expect to have completed the rollout of the new UnifiedDevice entities to all customers.

## Frequently Asked Questions

### What do I need to do?

Nothing! unless you want to participate early in the rollout of the new UnifiedDevice entities and visualizations this is a feature that will be automatically enabled for all customers over the coming months.

If you are interested in participating in the closed program to get early access to the new UnifiedDevice entities and visualizations please contact your JupiterOne account team.

### What will replace the Device Matrix visualization?

The Device Matrix visualization will be replaced by a set of new visualizations that help you understand the summary of devices and hosts in your environment. This is being rebuilt as a standard search component rather than a standalone visualization, bringing more power to the wider JupiterOne search experience.

---

Source: /reference/unified-vulnerability

# Unified Vulnerability and VulnCheck Enrichment

## What is Unified Vulnerability

JupiterOne will automatically create deduplicated entities for all `Vulnerability` objects in your database with a valid `cveId` property. These will produce a single representation of any open CVEs.

These entities only carry 2 properties from their sources `Vulnerability` entities: `cveId` and `open` status. All other properties on these entites are enriched directly from the VulnCheck EVI data sources.

These enrichments are updated every 24 hours to ensure the latest information is available for your vulnerability data in JupiterOne.

### Why add external enrichment

A consistent piece of feedback JupiterOne has received concerns the lack of normalization across vulnerability (CVE) data provided by various sources. One vendor will use certain language for priority such as `high`, `medium`, `low`; whilst another vendor will have `CRITICAL`, `HIGH`, `MODERATE`. We have also consistently seen outdated, missing, or incorrect intelligence data coming from these vendors.

JupiterOne wanted to provide customers with a standardized and extremely high quality real-time vulnerability and exposure data feed. We've partnered with VulnCheck and can now bring that data into JupiterOne for your vulnerability data.

### What additional enrichment is available

THe current version of UnifiedVulnerability enrichment is focussed primarily on CVSS, EPSS, and MITRE data. There is a lot more information available and we plan to continue to expand our capabilities in this area, as well as enhancing the user experience around Vulnerability Prioritization in general.

## How to use Unified Vulnerability?

The simplest usage of Unified Vulnerabilities is as an extension of existing use cases. Any query you have today that looks at a CVE entity can be extended to bring in the enrichment information.

An existing query fetching Hosts with vulnerabilities

```j1ql
FIND Vulnerability AS vuln
  THAT RELATES TO (Device|Host) AS host
RETURN host.displayName, host._type, vuln.id, vuln.severity
```

This query produces only very basic information about the state of that vulnerability, and normalizing across the different vulnerability scanners is complex.

Updated query using Unified Vulnerability

```j1ql
FIND UnifiedVulnerability AS vuln
  THAT IS Vulnerability
  THAT RELATES TO (Device|Host) AS host
RETURN host.displayName, host._type, vuln.*
```

This updated query now gives you access to all of the below properties for the vulnerabilities you already ingest into JupiterOne.

## Unified Vulnerability Explorer View

To open the explorer view run the following query:

```j1ql
FIND UnifiedVulnerability
```

![UnifiedVulnerability Explorer View](/assets/images/unified-vuln-explorer-view-2151bc00a927e02ed9b0b4ab420a0b40.png)

## CVSS Properties (Common Vulnerability Scoring System)

### CVSS Score Properties

-   **cvssBasescore**: The base CVSS score ranging from 0.0-10.0 that represents the intrinsic severity of a vulnerability. Higher scores indicate more severe vulnerabilities based on exploitability and impact metrics.
    
-   **cvssBaseseverity**: The qualitative severity rating derived from the base score, categorized as None (0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), or Critical (9.0-10.0).
    
-   **cvssVersion**: Indicates which version of CVSS is being used (e.g., 2.0, 3.0, 3.1, 4.0). Different versions have different scoring methodologies and metrics.
    
-   **cvssVectorstring**: The textual representation of CVSS metrics in a compressed format (e.g., "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"). This string encodes all the individual metric values used to calculate the score.
    
-   **cvssSource**: Identifies the organization that provided the CVSS score (e.g., "[nvd@nist.gov](mailto:nvd@nist.gov)", vendor, or third-party source). Multiple sources may provide different scores for the same vulnerability.
    

### CVSS Impact Metrics

-   **cvssImpactscore**: The sub-score representing the impact component of CVSS, measuring the consequences of a successful exploit. This combines confidentiality, integrity, and availability impact ratings.
    
-   **cvssConfidentialityimpact**: Measures the impact to confidentiality if the vulnerability is exploited. Values include None (N), Low (L), or High (H), indicating data disclosure severity.
    
-   **cvssIntegrityimpact**: Measures the impact to data integrity if exploited. Values indicate whether and how severely data can be modified by an attacker.
    
-   **cvssAvailabilityimpact**: Measures the impact to system availability if exploited. Indicates potential for denial of service or system disruption.
    

### CVSS Exploitability Metrics

-   **cvssExploitabilityscore**: The sub-score representing how easy it is to exploit the vulnerability. Higher scores indicate easier exploitation based on attack complexity and required conditions.
    
-   **cvssAttackvector**: Describes how the vulnerability can be exploited - Network (N), Adjacent (A), Local (L), or Physical (P). Network attacks are typically most severe as they can be conducted remotely.
    
-   **cvssAttackcomplexity**: Indicates how difficult it is to exploit the vulnerability - Low (L) or High (H). Low complexity means reliable exploitation, while high requires specific conditions.
    
-   **cvssPrivilegesrequired**: Specifies the level of privileges an attacker must have - None (N), Low (L), or High (H). None means no authentication needed, increasing severity.
    
-   **cvssUserinteraction**: Indicates whether user interaction is required for exploitation - None (N) or Required (R). Vulnerabilities requiring no user interaction are typically more severe.
    
-   **cvssScope**: Indicates whether exploitation can affect resources beyond the vulnerable component - Unchanged (U) or Changed (C). Changed scope increases severity as impact extends beyond the vulnerable component.
    

### CVSS Temporal Metrics

-   **cvssTemporalscore**: A modified score that factors in the current state of exploit techniques, remediation availability, and confidence in the vulnerability details. This score decreases over time as patches become available.
    
-   **cvssEnvironmentalscore**: A customized score that considers the specific environment where the vulnerable system operates. Organizations can adjust this based on their security requirements and mitigations.
    

### CVSS v2 Legacy Metrics

-   **cvssAccessvector**: CVSS v2 metric for attack vector - Local (L), Adjacent Network (A), or Network (N). Replaced by cvssAttackvector in CVSS v3.
    
-   **cvssAccesscomplexity**: CVSS v2 metric for access complexity - High (H), Medium (M), or Low (L). Replaced by cvssAttackcomplexity in CVSS v3.
    
-   **cvssAuthentication**: CVSS v2 metric indicating authentication requirements - Multiple (M), Single (S), or None (N). Replaced by cvssPrivilegesrequired in CVSS v3.
    
-   **cvssUserinteractionrequired**: CVSS v2 boolean indicating if user interaction is needed. Replaced by cvssUserinteraction in CVSS v3.
    
-   **cvssAcinsufinfo**: CVSS v2 indicator for "Access Complexity: Insufficient Information". Used when complete access complexity details are unavailable.
    
-   **cvssObtainallprivilege**: CVSS v2 boolean indicating whether exploitation grants complete system control. Part of the impact assessment in v2.
    
-   **cvssObtainuserprivilege**: CVSS v2 boolean indicating whether exploitation grants user-level privileges. Part of the impact assessment in v2.
    
-   **cvssObtainotherprivilege**: CVSS v2 boolean indicating whether exploitation grants other types of privileges. Part of the impact assessment in v2.
    

## EPSS Properties (Exploit Prediction Scoring System)

-   **epssScore**: A probability score between 0 and 1 (0-100%) predicting the likelihood of exploitation in the next 30 days. Higher scores indicate greater probability of active exploitation based on threat intelligence and historical data.
    
-   **epssPercentile**: The percentile ranking showing what percentage of all CVEs have a lower EPSS score. For example, 90th percentile means this CVE is more likely to be exploited than 90% of all other CVEs.
    
-   **epssLastModified**: The timestamp of when the EPSS score was last updated. EPSS scores are recalculated daily as new threat intelligence becomes available.
    

## CVE Core Properties

-   **id**: The unique identifier for this vulnerability record in VulnCheck's system. This is VulnCheck's internal ID, distinct from the CVE ID.
    
-   **cveId**: The official CVE (Common Vulnerabilities and Exposures) identifier in the format CVE-YYYY-NNNNN. This is the industry-standard identifier for the vulnerability.
    
-   **description**: A detailed text description of the vulnerability, including affected components, attack vectors, and potential impacts. This helps security teams understand the nature of the threat.
    
-   **sourceidentifier**: The organization or entity that originally reported or coordinated the vulnerability disclosure. Common sources include vendors, researchers, or coordination centers like MITRE.
    
-   **status**: The current status of the CVE entry, such as "Analyzed", "Modified", or "Rejected". This indicates the maturity and validity of the vulnerability information.
    
-   **vulnstatus**: VulnCheck's assessment of the vulnerability's current state. This may include additional context beyond the standard CVE status.
    

## Date Properties

-   **dateAdded**: The date when this vulnerability was added to VulnCheck's database. This helps track when VulnCheck first became aware of the vulnerability.
    
-   **published**: The official publication date when the CVE was first publicly disclosed. This is typically when the vulnerability becomes public knowledge.
    
-   **lastmodified**: The date when the CVE record was last updated with new information. Changes could include score updates, new references, or additional details.
    
-   **enrichedon**: The date when VulnCheck last enriched this vulnerability with additional intelligence. VulnCheck continuously adds threat data, exploit information, and other context.
    

## Exploitation Evidence Properties

### General Exploitation

-   **reportedExploited**: Boolean indicating whether this vulnerability has been reported as exploited in the wild. True means active exploitation has been observed by security researchers or organizations.
    
-   **reportedExploitedByThreatActors**: Boolean indicating whether known threat actors have been observed using this vulnerability. This suggests targeted, sophisticated attacks.
    
-   **reportedExploitedByBotnets**: Boolean indicating whether botnets have weaponized this vulnerability. Botnet usage often indicates widespread, automated exploitation.
    
-   **reportedExploitedByRansomware**: Boolean indicating whether ransomware groups have used this vulnerability. Ransomware exploitation represents high business impact risk.
    

### Exploit Maturity

-   **maxExploitMaturity**: The highest level of exploit sophistication observed, ranging from proof-of-concept to weaponized exploits. Higher maturity indicates easier exploitation by less skilled attackers.
    
-   **commercialExploitFound**: Boolean indicating whether commercial penetration testing tools include exploits for this vulnerability. Commercial availability lowers the barrier for exploitation.
    
-   **weaponizedExploitFound**: Boolean indicating whether weaponized exploits exist that can be readily deployed. Weaponized exploits require minimal modification to use in attacks.
    
-   **publicExploitFound**: Boolean indicating whether public exploit code is available. Public exploits significantly increase the risk as anyone can access the code.
    

### Exploit Counts

-   **countsExploits**: The total number of known exploits for this vulnerability across all sources. Higher counts indicate more widespread exploitation capability.
    
-   **countsBotnets**: The number of distinct botnet families observed exploiting this vulnerability. Multiple botnets suggest profitable and reliable exploitation.
    
-   **countsRansomwareFamilies**: The number of different ransomware families using this vulnerability. Multiple families indicate high value for initial access or lateral movement.
    
-   **countsThreatActors**: The number of distinct threat actor groups observed exploiting this vulnerability. More actors suggest strategic value for targeted attacks.
    

## MITRE ATT&CK Mapping Properties

-   **mitreTactics**: List of MITRE ATT&CK tactics associated with this vulnerability (e.g., "Initial Access", "Privilege Escalation"). Tactics represent the attacker's tactical goals.
    
-   **mitreTechniqueids**: List of specific MITRE ATT&CK technique IDs (e.g., "T1190", "T1068"). These provide detailed attack patterns and procedures.
    
-   **mitreTechniquenames**: Human-readable names of the MITRE ATT&CK techniques. These describe how attackers use the vulnerability in their operations.
    
-   **mitreTechniqueurls**: Direct URLs to the MITRE ATT&CK framework pages for each technique. These provide comprehensive technique documentation and detection guidance.
    
-   **mitreTechniquedomains**: The ATT&CK domains where techniques apply (e.g., "enterprise-attack", "mobile-attack"). Different domains cover different technology platforms.
    

## KEV Properties (Known Exploited Vulnerabilities)

### VulnCheck KEV

-   **invckev**: Boolean indicating inclusion in VulnCheck's Known Exploited Vulnerabilities catalog. VulnCheck KEV contains 130% more vulnerabilities than CISA KEV.
    
-   **vulncheckkevexploitadd**: Date when the vulnerability was added to VulnCheck's KEV catalog. This tracks when VulnCheck identified active exploitation.
    

### CISA KEV

-   **inkev**: Boolean indicating inclusion in CISA's Known Exploited Vulnerabilities catalog. CISA KEV represents vulnerabilities actively exploited and requiring federal agency remediation.
    
-   **cisaexploitadd**: Date when CISA added this vulnerability to their KEV catalog. This is when CISA confirmed active exploitation.
    
-   **cisaactiondue**: The deadline by which US federal agencies must remediate this vulnerability. This date is typically 2-3 weeks after addition to KEV.
    
-   **cisarequiredaction**: CISA's mandated remediation action, typically "Apply updates per vendor instructions" or specific mitigation steps. Federal agencies must complete this action by the due date.
    
-   **cisavulnerabilityname**: CISA's descriptive name for the vulnerability, often more readable than the CVE ID. This helps identify the affected product and vulnerability type.
    

## Timeline Properties

-   **timelineFirstExploitPublished**: The earliest date when exploit code for this vulnerability was publicly released. This marks when exploitation became broadly feasible.
    
-   **timelineMostRecentExploitPublished**: The most recent date when new exploit code was published. Recent exploits may include improvements or target new platforms.
    
-   **timelineFirstExploitPublishedWeaponizedOrHigher**: The first date when weaponized or highly mature exploits appeared. This indicates when low-skill attackers could begin exploitation.
    
-   **timelineNvdPublished**: When NIST's National Vulnerability Database published this CVE. NVD publication typically includes CVSS scores and technical details.
    
-   **timelineNvdLastModified**: The most recent NVD update for this vulnerability. Updates may include score changes or additional information.
    
-   **timelineFirstReportedThreatActor**: The earliest date when a threat actor was observed exploiting this vulnerability. This marks the beginning of targeted attacks.
    
-   **timelineMostRecentReportedThreatActor**: The latest threat actor activity observed for this vulnerability. Recent activity suggests continued value for attackers.
    
-   **timelineFirstReportedBotnet**: When botnet exploitation was first detected. Botnet adoption indicates scalable, automated attacks.
    
-   **timelineMostRecentReportedBotnet**: The latest botnet activity for this vulnerability. Continued botnet use suggests ongoing mass exploitation.
    
-   **timelineFirstReportedRansomware**: When ransomware groups first used this vulnerability. Ransomware adoption indicates high value for initial access.
    
-   **timelineMostRecentReportedRansomware**: The latest ransomware activity observed. Recent ransomware use represents active business risk.
    
-   **timelineVulncheckKevDateAdded**: When VulnCheck added this to their KEV catalog. VulnCheck often identifies exploitation before other sources.
    
-   **timelineVulncheckKevDateDue**: VulnCheck's recommended remediation deadline. This may differ from CISA's timeline based on threat intelligence.
    
-   **timelineCisaKevDateAdded**: When CISA confirmed exploitation and added to KEV. This triggers mandatory federal remediation requirements.
    
-   **timelineCisaKevDateDue**: CISA's mandatory remediation deadline for federal agencies. Missing this deadline requires explanation and compensating controls.
    

## Additional Properties

### CPE and Component Properties

-   **vulnerablecpes**: List of Common Platform Enumeration (CPE) strings identifying affected software versions. CPEs use a structured naming scheme to precisely identify vulnerable products.
    
-   **vcvulnerablecpes**: VulnCheck's enhanced CPE list with additional coverage. VulnCheck generates CPEs for vulnerabilities missing official CPE data, improving vulnerability scanning accuracy.
    
-   **categorizationTags**: VulnCheck's tags for categorizing the vulnerability type, affected components, or attack patterns. Tags enable filtering and prioritization workflows.
    

### Evaluation Properties

-   **evaluatorcomment**: Comments from security evaluators providing additional context or clarification. These may include exploitation notes or remediation guidance.
    
-   **evaluatorimpact**: The evaluator's assessment of real-world impact. This may differ from CVSS impact based on practical considerations.
    

### Other Properties

-   **open**: Status indicating whether the vulnerability is still open/unpatched in tracked systems. This helps identify remediation gaps.
    
-   **trendingGithub**: Boolean indicating whether this vulnerability is trending in GitHub discussions or repositories. GitHub trends often correlate with active research or exploitation.

---

Source: /reference/vulnerability-score

# JupiterOne Vulnerability Score

## Overview

JupiterOne calculates a comprehensive vulnerability score for each `UnifiedVulnerability` entity in your environment. This proprietary scoring system provides a more accurate risk assessment than traditional CVSS scores alone by incorporating multiple risk factors and real-world context from your specific environment.

The key advantage of JupiterOne's vulnerability score is that it includes a weighting based on the actual number of instances of the vulnerability that are attached to real assets in your entity graph. This contextual awareness makes the score significantly more relevant to your organization's actual risk posture.

## Score Calculation

The JupiterOne Vulnerability Score ranges from 0 (lowest risk) to 1.0 (highest risk), or 0% to 100% when expressed as a percentage. The score is derived from three weighted components:

### Component Weights

| Component | Weight | Description |
| --- | --- | --- |
| **CVSS Base Score** | 30% | Industry-standard vulnerability severity with non-linear scaling |
| **EPSS Percentile** | 40% | Exploit Prediction Scoring System - probability of exploitation |
| **Occurrence Count** | 30% | Proportion of your Device and Host entities affected |

### Detailed Component Calculations

#### 1\. CVSS Base Score (30% weight)

The CVSS Base Score component uses a non-linear function to de-emphasize mid and low CVSS scores. This ensures that critical and high-severity vulnerabilities are appropriately weighted while reducing noise from lower-severity issues.

-   **Calculation**: `0.3 * (cvssBaseScore / 10)^2`
-   **Non-linear scaling**: The squared function gives more weight to higher CVSS scores

#### 2\. EPSS Percentile (40% weight)

The Exploit Prediction Scoring System (EPSS) percentile is considered a stronger indicator for imminent risk as it predicts the likelihood of a vulnerability being exploited in the wild within the next 30 days.

-   **Calculation**: `0.4 * epssPercentile`
-   **Default value**: If EPSS data is not available (common for zero-day vulnerabilities), a default value of 0.5 is used

#### 3\. Occurrence Count (30% weight)

This unique component considers how widespread the vulnerability is across your infrastructure, providing critical context about your organization's exposure.

-   **Calculation**: `min(0.3, (vulnerabilityCount * 10.0) / totalDeviceCount)`
-   **Linear scaling**: Weight increases linearly from 0% to 10% of assets affected
-   **Maximum impact**: Above 10% of assets affected, the full 30% weight is applied

### Final Score Formula

```text
JupiterOne Vulnerability Score = CVSS Weight + EPSS Weight + Occurrence Weight
```

## Implementation Details

The vulnerability score is calculated as part of the VulnCheck enrichment process:

1.  **Device Count Collection**: At the start of enrichment, the total number of `UnifiedDevice` entities in your environment is counted
2.  **Vulnerability Analysis**: For each `UnifiedVulnerability`, the system counts incoming `IS` relationships from `Vulnerability` entities
3.  **Score Calculation**: The three components are calculated and combined using the weights described above
4.  **Property Assignment**: The final score is stored as the `jupiteroneVulnScore` property on the `UnifiedVulnerability` entity

## Data Requirements

For a vulnerability score to be calculated, the following data must be available:

-   **CVSS Base Score**: Required from vulnerability data sources
-   **EPSS Percentile**: Preferred but will default to 0.5 if unavailable
-   **Entity Relationships**: Valid `IS` relationships between `Vulnerability` and `UnifiedVulnerability` entities
-   **Device Inventory**: At least one `UnifiedDevice` entity in the environment

## Using the Score

The JupiterOne Vulnerability Score can be used to:

-   **Prioritize Remediation**: Focus on vulnerabilities with the highest scores first
-   **Risk Assessment**: Get a more accurate picture of your organization's vulnerability risk
-   **Trend Analysis**: Track how vulnerability scores change over time as patches are applied or new vulnerabilities emerge
-   **Compliance Reporting**: Demonstrate risk-based vulnerability management practices

## Example Query

To retrieve vulnerabilities with their JupiterOne scores:

```j1ql
FIND Vulnerability AS v
  THAT IS UnifiedVulnerability WITH jupiteroneVulnScore != undefined AS uv
RETURN 
  uv.cveId AS vulnerabilityId,
  uv.displayName AS vulnerability,
  uv.cvssBaseScore AS cvss,
  uv.epssPercentile AS epss,
  uv.jupiteroneVulnScore AS score,
  COUNT(v) AS affectedAssets
ORDER BY uv.jupiteroneVulnScore DESC
LIMIT 100
```

## Score Interpretation

| Score Range | Risk Level | Recommended Action |
| --- | --- | --- |
| 0.8 - 1.0 | Critical | Immediate remediation required |
| 0.6 - 0.8 | High | Prioritize for remediation within days |
| 0.4 - 0.6 | Medium | Schedule for remediation within weeks |
| 0.2 - 0.4 | Low | Include in regular patching cycles |
| 0.0 - 0.2 | Minimal | Monitor and patch as convenient |

## Benefits Over Traditional Scoring

1.  **Context-Aware**: Considers the actual prevalence of vulnerabilities in your environment
2.  **Exploitation Focus**: Heavily weights EPSS to prioritize likely-to-be-exploited vulnerabilities
3.  **Balanced Approach**: Combines multiple data sources for a comprehensive risk view
4.  **Dynamic**: Automatically adjusts as your infrastructure changes
5.  **Actionable**: Provides clear prioritization for remediation efforts

## Related Resources

-   [Vulnerability Reporting](/platform-overview/vulnerability-reporting-intro.md)
-   [UnifiedVulnerability Entity](/reference/unified-vulnerability.md)
-   [Vulnerability Schema](/data-model/schemas/Vulnerability.md)

---

Source: /release-notes

# Release Notes

We release a new publication monthly with information relating to all the cool new stuff we've implemented within the JupiterOne platform.

### Release Notes

-   [February 2025](/release-notes/feb-2025.md)
-   [January 2025](/release-notes/jan-2025.md)
-   [December 2024](/release-notes/dec-2024.md)
-   [November 2024](/release-notes/nov-2024.md)
-   [October 2024](/release-notes/oct-2024.md)
-   [July - September 2024](/release-notes/sep-2024.md)
-   [June 2024](/release-notes/jun-2024.md)
-   [May 2024](/release-notes/may-2024.md)
-   [April 2024](/release-notes/apr-2024.md)
-   [March 2024](/release-notes/mar-2024.md)
-   [February 2024](/release-notes/feb-2024.md)
-   [January 2024](/release-notes/jan-2024.md)
-   [December 2023](/release-notes/dec-2023.md)
-   [November 2023](/release-notes/nov-2023.md)
-   [October 2023](/release-notes/oct-2023.md)
-   [September 2023](/release-notes/sep-2023.md)
-   [August 2023](/release-notes/aug-2023.md)
-   [July 2023](/release-notes/jul-2023.md)
-   [June 2023](/release-notes/jun-2023.md)
-   [May 2023](/release-notes/may-2023.md)
-   [April 2023](/release-notes/apr-2023.md)
-   [March 2023](/release-notes/mar-2023.md)
-   [February 2023](/release-notes/feb-2023.md)
-   [January 2023](/release-notes/jan-2023.md)

---

Source: /release-notes/apr-2023

# JupiterOne April 2023 Release

## New Features and Improvements

-   Alert on only new outcomes for rules: you can now elect to receive an alert when your rule produces a new outcome that has not been seen before. This means you are able to efficiently monitor what matters and stay up-to-date with any new developments.
    
-   You can now download your policies in HTML format, in addition to other existing formats supported by J1.
    
-   When writing queries with J1 Query Builder, only data with relationships to the root class/entity are shown. This shows you directly the classes and entities available to you and reduces the noise of what is in your environment to only show you the possible options.
    
    ![2023-05-02 09 04 18](/assets/images/235690691-55a1bd15-61ba-486d-8cef-6d2fc1b1c40d-5cfde0506a6571b5619a56bb6467fbf1.gif)
    
-   You can now preview your J1 Insights charts while editing or creating new widget queries, allowing you to see how your query is represented so that you can make adjustments before publishing.
    
    ![2023-05-02 08 46 29](/assets/images/235687392-ab976b0b-470f-4deb-832a-16607c954b71-c92cc4019b11e6076e9ab1e36ae5dd59.gif)
    
-   The bar charts in Insights are now able to be oriented in horizontal format.
    
-   Your query results are now equipped with column filters. This leads to more performant queries and allows you to focus on the data that matters.
    
-   Uploading integrations via csv files just got easier with a new csv upload process.
    
    ![Screen Shot 2023-05-02 at 8 54 42 AM](/assets/images/235687908-3f8bb6e5-b26b-4218-bc7d-e7b6d4919182-e54154972eefc69ac39446f088346269.png)
    
-   J1 Settings has a new look-and-feel that makes managing your profile, API keys, and user management easier. Key highlights include:
    
    -   The ability to change your profile picture.
    -   Improved search capabilities for managing users and groups.
    -   Robust user management, including a full view of a user and their permissions, along with the groups they belong to.
-   Integrations that are currently in an early access phase are now visible within Integrations in the Platform. This gives you visibility into what new integrations are coming, as well as an opportunity to opt-in for early access use.
    
    ![Screen Shot 2023-05-02 at 8 54 27 AM](/assets/images/235687797-5cd1e975-fa88-439f-9e64-62ef51597f72-75a11cb0e2248c74b200a11ef00d6892.png)
    

## Integrations

#### Tenable

-   Created a relationship between tenable\_vulnerability\_finding and vsphere\_host.

#### Qualys

-   Created a relationship qualys\_host\_finding < HAS - azure\_vm.

---

Source: /release-notes/apr-2024

# JupiterOne April 2024 Release

## New Features and Improvements

### Insights Dashboards

-   Support for inline Insights dashboard filters to all widgets

### Content and Rule Packs

-   Added Cyberark EPM Misconfigurations Rule Pack
-   Added Cyberark Idaptive Misconfigurations Rule Pack
-   Added Known Malicious Software Versions Rule Pack

## Integrations

## New Integrations

### Mosyle MDM

Mosyle is an Apple MDM (mobile device management) and Apple security provider.

## Integration Updates

### AWS

-   AWS MSK Clusters added new entity `aws_msk_cluster`
-   AWS EC2 Transit Gateway VPC Attachment added entity `aws_ec2_transit_gateway_vpc_attachment`
-   AWS MQ/MQ Broker added entity `aws_mq_broker`
-   AWS VPC Endpoint added entity `aws_vpc_endpoint`
-   AWS Managed Workflows for Apache Airflow added entities `aws_mwaa`, `aws_mwaa_environment`
-   `copyTagsToSnapshot` added to the `aws_rds_cluster` entity

### Detectify

-   Detectify Users added entity `detectify_user`

### Kubernetes

-   Kubernetes Containers added entity `kube_container`
-   Kubernetes Pod added entity `kube_pod`

### Auth0

-   Auth0 Role Information added entity `auth0_role`

---

Source: /release-notes/apr-2025

# JupiterOne Release Notes - April 2025

## Executive Summary

The April 2025 release of JupiterOne introduces substantial enhancements across its Application, Platform, Integrations, and Content areas, with a keen focus on improving user experience, performance, and overall security compliance. Key themes of this release include the addition of advanced asset discovery capabilities, improved API functionalities, and a more intuitive user interface. With these updates, users can expect enhanced visibility into their assets, streamlined workflows through integrated tools, and a fortified security posture that aligns with industry standards. The release demonstrates a commitment to continuous improvement, focusing on user feedback and evolving security needs. As organizations face increasing complexity in managing their security and compliance requirements, these enhancements provide crucial tools to navigate these challenges effectively.

## Application

### Enhancements

-   **User Interface Overhaul**: The user interface has undergone a significant redesign, aimed at enhancing usability and navigation throughout the application. With improved visual elements and a more intuitive layout, users can more easily access and interpret information. The introduction of tooltips and onboarding guides further aids new users in their journey, reducing the learning curve and expediting the adoption process.
    
-   **Enhanced Reporting Capabilities**: The release expands reporting functionality to include customizable report templates and automated scheduling options. Users can now generate detailed compliance reports that align with their organizational requirements, streamlining the reporting process. This enhancement significantly reduces time spent on manual data compilation, thereby increasing efficiency and accuracy, which is crucial for timely compliance submissions.
    

### Bug Fixes

-   **Resolved Memory Leak Issues**: A critical memory leak affecting the asset inventory page has been addressed. Previous versions experienced performance degradation over time, often resulting in application crashes when handling large volumes of assets. By resolving this issue, overall application stability improves, ensuring that users can manage their asset inventories without interruptions.
    
-   **Fixed Data Synchronization Errors**: Several bugs related to data synchronization between on-premises and cloud environments have been corrected. This enhancement ensures that all asset data is accurately reflected across platforms, which reduces discrepancies and fosters greater trust in the data presented within the application.
    

## Platform

### Performance Improvements

-   **Database Optimization**: Major optimizations to the underlying database architecture have resulted in a 50% increase in query performance. This improvement allows for significantly faster data retrieval, enhancing overall application responsiveness, particularly during peak usage times. Users can expect a smoother experience when interacting with large datasets, which is essential for maintaining high productivity.
    
-   **Scalability Enhancements**: The platform has been refactored to improve scalability, enabling it to handle increased workloads without performance degradation. This enhancement is particularly crucial for large enterprises that experience fluctuating demands, ensuring consistent performance even during high-traffic scenarios.
    

### Infrastructure

-   **Migration to Cloud-Native Architecture**: The JupiterOne platform has transitioned to a cloud-native architecture, improving fault tolerance and availability. This migration supports automatic scaling and enhances disaster recovery capabilities, ensuring higher uptime for users and improved resilience against outages.
    
-   **Enhanced Security Protocols**: Security protocols have been upgraded to include advanced encryption standards for data both in transit and at rest. These enhancements significantly bolster the platform's security posture, providing users with better protection against unauthorized access to sensitive information.
    

## Integrations

### New Integrations

-   **Integration with AWS Security Hub**: A new integration with AWS Security Hub allows users to consolidate security alerts and compliance findings from their AWS resources seamlessly. This integration enhances the ability to monitor security posture effectively and streamlines incident response efforts by providing a centralized view of security events across AWS environments.

## Content

### Security Content

-   **New Security Alerts for Vulnerability Management**: The introduction of new security alerts focused specifically on vulnerability management allows users to proactively address potential threats. This feature provides timely notifications and actionable insights, empowering security teams to prioritize remediation efforts effectively, thereby enhancing overall security posture.
    
-   **Expanded Knowledge Base for Incident Response**: The security content knowledge base has been expanded to include new incident response playbooks and best practice guides. This enhancement equips users with the necessary knowledge to respond effectively to various security incidents, thereby improving overall incident management capabilities and reducing response times.
    

## Breaking Changes

-   **Change in User Role Permissions**: User role permissions have been redefined to enhance security and access control. Users may notice changes in their access levels and should review their roles to understand the updated permission sets. This change aims to reduce the risk of unauthorized access to sensitive areas of the application, ensuring better security governance.

## Additional Notes

-   **User Training Sessions**: To facilitate the adoption of new features and enhancements, training sessions will be conducted periodically. Users are encouraged to participate to maximize their understanding and utilization of the new tools and capabilities introduced in this release.
    
-   **Feedback Mechanism**: A feedback mechanism has been established to gather user input on the new features and improvements. Users can provide their thoughts directly through the application, which will help guide future enhancements and address areas of concern.
    

---

The April 2025 release of JupiterOne represents a comprehensive effort to enhance user experience, improve performance, and bolster the security capabilities of the platform. With these updates, JupiterOne continues to stand out as a robust solution for security and compliance management, empowering organizations to effectively navigate the complexities of today’s digital landscape.

---

Source: /release-notes/aug-2023

# JupiterOne August 2023 Release

  
  

> **NOTE**
> 
> We have officially migrated our documentation to our new site here at [docs.jupiterone.io](https://docs.jupiterone.io/)! 🥳

## New Features and Improvements

### Queries

#### Natural Language Queries

JupiterOne now supports **natural language to generate J1QL** (JupiterOne query language). You can now type questions like "What new IAM users have been created in the last week?" and "What s3 buckets do I have?" and J1 will convert these questions into J1QL syntax. **This feature is currently only available in the Query Anywhere Search Box**

#### Improvements

The `csv` exporting experience has been upgraded to allow for larger downloads (1 million entity limit) and an email link to access your downloaded file.

  

![CSV Export update](/assets/images/csv-export-570884730140d6e1a9c027b4b3457d30.png)

### Properties Panel

Your Properties Panel has been refreshed with a whole new look and new features to help you find what you are looking for faster in JupiterOne.

  

![Properties updates](/assets/images/properties-whats-new-95e1646aacfff0a0db864c734f0ad4e6.png)

  

![Properties Search](/assets/images/properties-pinned-fields-434d4c692aa18988ce67f82302c7e438.png)

![Property search and modified properties view](/assets/images/properties-search-modify-b702f8539f2836f0e31f7539345c7dad.png)

### Insights

-   Added two new Insights dashboards corresponding to our new Alert Rule Packs for `Device Management` and `Toxic Combinations`.
    -   The `Device Management` dashboard can be found under Assets and requires at least one integration that ingests devices
    -   The `Toxic Combinations` dashboard can be found under Attack Surface category and requires integration into J1 of your Endpoint Detection & Response tools, Mobile Device Management, Cloud Service Provider, and Identity Provider systems

### Alerts and Rules

-   Released two new Alert Rule Packs: Device Management and Toxic Combinations, both of which are tagged in Alerts as `DeviceManagement` and `ToxicCombinations` respectively.
    
-   You can now preview your Alert Rule Action using the "preview" toggle. This allows you to see the json for the first 10 query results which power your alert. ![alert rule preview](/assets/images/alert-rule-action-preview-816ce8e585d5b514c758a752dce236dd.gif)
    
    [Learn more about installing rule packs →](/features/insights-and-alerts/alert-rule-packs.md)
    

## Integrations

### New Integrations

-   **Linear (beta)**: Added integration for Linear [Read more →](/integrations/directory/linear.md)
    
-   **FleetDM (beta)**: Added integration for FleetDM [Read more →](/integrations/directory/fleetdm.md)
    

### Updates

-   **AWS**: In the US environment of JupiterOne (apps.us.jupiterone.io), the `Trust Relationship` on the **AWS IAM Role** used by the AWS Integration has been changed to trust 5 additional JupiterOne-owned AWS accounts. In addition to the original JupiterOne AWS Account ID (`612791702201`), the role should be updated to trust the following 5 AWS Account IDs:
    
-   `592277296164`
    
-   `543056157939`
    
-   `688694159727`
    
-   `248422699954`
    
-   `703115985002`
    

The [public GitHub repository](https://github.com/JupiterOne/jupiterone-aws-cloudformation) for CloudFormation & Terraform templates has been updated accordingly. This is change helps to reduce AWS rate limits and is **highly encouraged, but not required**–all AWS integrations will continue to function as expected without these changes. Please reach out to your account representatives with additional questions.

-   **Azure**: Added the ability to ingest MFA properties for the `azure_user` entity. New properties include:
    -   `mfaEnabled` (boolean)
    -   `mfaType` (string, the user preferred method)
    -   `mfaMethods` (array of strings, includes all MFA methods the user has configured)

> **NOTE**
> 
> Your Azure instance API token will need to have the `AuditLog.Read.All` permission in order to ingest the MFA properties.

-   **CrowdStrike**: Our CrowdStrike integration now ingests information on applications with vulnerabilities with the following new entity:
    
    | Resource | Entity `_type` | Entity `_class` |
    | --- | --- | --- |
    | Application | `crowdstrike_application` | `Application` |
    
    With the addition of this entity, we have also updated the relationships:
    

| Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
| --- | --- | --- |
| `crowdstrike_account` | **HAS** | `crowdstrike_endpoint_protection` |
| `crowdstrike_account` | **HAS** | `crowdstrike_sensor` |
| `crowdstrike_application` | **HAS** | `crowdstrike_vulnerability` |
| `crowdstrike_prevention_policy` | **ENFORCES** | `crowdstrike_endpoint_protection` |
| `crowdstrike_sensor` | **ASSIGNED** | `crowdstrike_prevention_policy` |
| `crowdstrike_sensor` | **HAS** | `crowdstrike_application` |
| `crowdstrike_sensor` | **HAS** | `crowdstrike_zero_trust_assessment` |
| `crowdstrike_vulnerability` | **EXPLOITS** | `crowdstrike_sensor` |

---

Source: /release-notes/aug-2025

# JupiterOne Release Notes - August 2025

## Executive Summary

Key strategic initiatives include the implementation of caching mechanisms in the application layer, optimization of backend services, and introduction of new integrations to facilitate seamless data flow. Enhancements to user interfaces, API response times, and compliance tracking capabilities are also prominent in this release. Collectively, these changes are designed to empower users with quicker access to insights and more robust tools for compliance and security management, fostering a more efficient operational environment. As we continue to innovate, user feedback remains pivotal to our development roadmap, ensuring that we meet the evolving needs of our enterprise customers.

## Application

### Bug Fixes

-   **Fixed Timeout Error in Long-Running Queries**: An issue that previously caused timeout errors during the execution of long-running queries has been effectively resolved. This bug manifested in scenarios involving large datasets, leading to frustration and inefficiencies for users attempting to analyze extensive data. The query execution engine has undergone significant adjustments, allowing for better resource management and optimized processing times. As a result, users can now confidently execute complex queries without encountering timeout interruptions, thus enhancing reliability and usability across the query feature.

## Integrations

### New Integrations

-   **Ingest AWS CloudWatch Log Metric Filters**: The integration now includes functionality to ingest AWS CloudWatch log metric filters directly into the JupiterOne graph, enhancing users' compliance tracking capabilities. This integration has been augmented to pull and transform log data into actionable insights that can be leveraged for compliance assessments. Users will gain improved visibility into their cloud operations, enabling more effective oversight of compliance metrics and enhancing operational accountability. It is essential to configure AWS access appropriately to ensure successful ingestion of CloudWatch logs.

### Security Updates

-   **GitLab Integration Updated to Use Vulnerability\_Findings REST Endpoint**: The GitLab integration has been significantly improved by transitioning to the new `vulnerability_findings` REST endpoint, which enhances vulnerability tracking accuracy. This update involved a thorough refactor of the integration to replace outdated endpoints, resulting in a more efficient data retrieval process. Users will benefit from increased accuracy in vulnerability data, which will now reflect real-time insights and faster response times to potential security threats. No additional configuration is needed following this update, ensuring a seamless transition for users.

## Content

### Bug Fixes

-   **Corrected Article Display Issues in Knowledge Base**: The Knowledge Base has undergone a fix for display issues affecting certain articles on mobile devices. Problems with rendering due to CSS and responsiveness have been rectified to ensure a consistent and professional appearance across all platforms. Users accessing the Knowledge Base on mobile devices will now experience a seamless experience, which is critical for those needing to access essential information while on-the-go.

## Breaking Changes

This release includes a significant change in the authentication process, now requiring the adoption of multi-factor authentication (MFA) for all users. To facilitate this migration, users are urged to review their authentication settings and set up preferred MFA options. Detailed instructions on configuring MFA can be found in the updated user documentation. The transition is necessary to enhance security and protect user accounts from unauthorized access.

## Known Issues

Currently, there are no additional known issues reported in this release. Users are encouraged to report any new issues they encounter to the support team for prompt resolution.

## Additional Notes

-   Performance metrics indicate a substantial improvement in query execution times following the implementation of prompt caching, with a noted decrease in average response times by up to 50%.
-   Upcoming deprecations include older API endpoints that will be phased out in the next release cycle, allowing users to prepare for migration to newly established endpoints.
-   Detailed documentation regarding all new features, enhancements, and configuration notes is available on the JupiterOne documentation site. Users are encouraged to review this material to fully utilize the platform's capabilities.

These release notes provide an exhaustive overview of the August 2025 updates to JupiterOne, ensuring that enterprise customers have the necessary information to navigate the changes effectively and leverage new features to their fullest potential.

---

Source: /release-notes/dec-2023

# JupiterOne December 2023 Release

## Top Features of 2023

-   See [our webinar](https://vimeo.com/jupiterone/topfeatures2023) for a year in review!

## Early Access Programs

### Unified Device in the Graph

-   Enjoying the Unified Device Matrix? Help us bring that `unified_device` to the J1 graph.
-   This feature will extend the Device Matrix by allowing you to create rule automations and create dashboards with the `unified_device` in J1.
-   Reach out to your Customer Success Manager to get involved!

### Device Anomaly Detection

-   Extend your Device usecase with J1 to allow **J1 AI** to provide proactive insights into your `unified_device` inventory to help you identify which areas of your inventory should be focused on first.
-   Reach out to your Customer Success Manager to get involved!

### New Person Mapper Engine

-   Take new leaps forward in managing your Users and Identities in J1 by signing up for the new Person Mapper Engine.
-   Reach out to your Customer Success Manager to get involved!

## New Features and Improvements

### Unified Device Matrix

-   You are now able to filter the Unified Device Matrix based on `OSversion`.
-   The Device Matrix will now also be able to consolidate Azure Devices with O365 and MS Defender!

### Insights

-   Top Level Dashboard Filters are now available for you to be able to filter a dashboard by Tags, Properties, and Metadata without having to modify queries and will allow you to focus your attention on the most pressing items faster. [Documentation for more information](/features/insights-and-alerts/managing-insights-dashboards.md#top-level-data-filters-for-dashboards)
-   The Insights Widget Queries are now able to be assisted by auto-complete! This will help you get your queries written more effectively to get your visualizations up and running.

## Platform Update

## Integrations

## New Integration Features

### Integration Status Widget

-   Gain quick visibility into Integration Health with the newly added "Integration Status Widget"
-   This widget is on the JupiterOne Home Page in the KPI section, on the Integration Home Page, and available on an individual Integration level.

## New Integrations

### Torii (Beta)

-   We have added Torii to our list of official integrations. [Read more](/integrations/directory/torii.md).
-   Reach out to your Customer Success Manager if you are interested in enabling this integration in your account.

### Palo Alto Cortex XDR (Beta)

-   We have added Palo Alto Cortex XDR to our list of official integrations. [Read more](/integrations/directory/palo-alto.md).
-   Reach out to your Customer Success Manager if you are interested in enabling this integration in your account.

### Rapid7 InsightAppSec (Beta)

-   We have added Rapid7 InsightAppSec to our list of official integrations. [Read more](/integrations/directory/rapid7-insight.md).
-   Reach out to your Customer Success Manager if you are interested in enabling this integration in your account.

## Integration Updates

### AWS Integration Updates

-   Introduced approximation to bytes and item count properties to the following entities in the AWS integration: S3 bucket size in bytes, Glacier vault size in bytes, EFS filesystem size in bytes, DynamoDB table size in bytes, DynamoDB table item count
-   The following AWS services are now supported in the AWS integration: AWS Signer, AWS IAM Identity Center (SSO), and AWS Security Hub

### Snyk Credential Verification and Data Source Settings

-   Customize what data is ingested within your Snyk integration. This is under "Data Source Settings" listed in the integration configuration page.
-   Test your credentials are working for your Snyk integration under "Authentication" in the confiuration page.

### Snyk and GitLab New Relationship

-   A relationship was created that now shows which GitLab users are related to Snyk findings.
-   Check out this new relationship by running the following J1QL: Find snyk\_finding THAT HAS gitlab\_project THAT HAS gitlab\_user

---

Source: /release-notes/dec-2024

# JupiterOne December 2024 Release

## Application

### RBAC Improvements

-   Enhanced role-based access control (RBAC) across various components, ensuring that user permissions are respected in web dashboards, settings, alerts, and insights. This includes the addition of resource group columns in tables and the ability to reroute users without access to specific rule URLs to the rules list page.
-   Implemented a limit on the number of resolved resource type permissions to 100 per user/token session, with appropriate warnings for users when permissions are limited. This aims to streamline access patterns and improve performance.
-   Introduced new settings for managing RBAC for rules and alerts, allowing enterprise users to administer access controls more effectively. This includes the ability to create custom dashboard groups and manage permissions for integration instances.

### User Interface Enhancements

-   Improved the user experience by ensuring that the delete button on resource group pages opens the delete dialog, and that checkboxes accurately reflect their state.
-   Added functionality to sort entities alphabetically in web settings and ensure that the share modal does not display users and groups that are not applicable.
-   Enhanced the search functionality by allowing the search bar in editor mode to open the search anywhere feature with a preview.

### Bug Fixes and Cleanup

-   Resolved various bugs related to RBAC, including issues with the autocomplete service cache returning empty for entity properties and ensuring that deprecated permissions are not added when selecting all.
-   Cleaned up existing settings and permissions pages to remove unnecessary options and improve clarity for users.

These updates collectively enhance the functionality, usability, and security of the application, providing a more robust experience for users while ensuring compliance with access control requirements.

## Platform

### Enhancements and Fixes

#### Query and Data Management

-   The query-engine replication concurrency has been capped to prevent overwhelming the database, which should enhance query performance and reliability.
-   The query execution time has been optimized by adjusting the min/max counts for query-engine executors, allowing for a more balanced load across secondary reader instances.

These updates collectively enhance the performance, reliability, and manageability of the graph database and its integrations, providing a more robust platform for data processing and analysis.

## Integrations

### Integration Enhancements

#### Azure Device

-   Resolved issues with the Azure device integration, including missing properties such as hostname, fqdn, and various IP addresses. Recommendations were made to ensure valid values are set for these fields to improve correlation capabilities.

#### Snipe It Hardware

-   Addressed issues with the Snipe It hardware integration, specifically regarding the deviceId and hostname properties. It was noted that the deviceId should not be derived from a basic monotonic ID, and both hostname and fqdn were found to be absent in the source data.

#### Google Mobile Device & Google Chrome Device

-   Fixed issues in the Google mobile device integration, ensuring that deviceId includes the IMEI if available. The hostname and fqdn properties were also addressed, with recommendations for proper data population.

#### GitLab Integration

-   Resolved a critical 403 error encountered in the GitLab integration, ensuring that the integration can authenticate correctly with the provided admin token.

#### Okta Device

-   Improved the Okta device integration by ensuring that deviceId includes profile.udid when available. Addressed issues with missing hostname and fqdn properties.

#### Crowdstrike Host

-   Enhanced the Crowdstrike host integration by ensuring that the deviceId includes instance\_id. Recommendations were made to correctly set hostname and fqdn properties.

#### InsightVM Asset

-   Fixed issues with the InsightVM asset integration, ensuring that the hostname attribute is populated correctly for better correlation.

#### AWS Integration

-   Addressed missing IAM permissions that were causing warnings in the AWS integration job. The integration code was updated to include necessary permissions.

#### Azure Integration

-   Resolved issues with the Azure integration, including the addition of new relationships between azure\_public\_ip and its associated entities.
-   Enhanced the Azure integration to enable additional parameters from raw data for Azure Redis Cache, improving data accessibility and management.
-   Added support for querying Azure VMs that allow service principal access while having password authentication disabled, enhancing security management.

### Slack Integration Improvements

-   Updated the Slack integration to identify users without multi-factor authentication enabled, enhancing security oversight.

### Tenable Asset Management

-   Improved the management of Tenable assets by providing access to the latest scan data, facilitating better vulnerability management.

### Semaphore Pipeline Monitoring

-   Introduced a managed question to identify failed jobs within Semaphore pipelines, enhancing visibility into CI/CD processes.

### Active Directory Enhancements

-   Added additional Active Directory attributes to the raw data, improving the richness of user data available for analysis.

### Bug Fixes

-   Resolved various bugs across integrations, including issues with data governance in LogicMonitor, unification problems in the UnifiedDevice experience, and inconsistencies in query results for azure\_policy\_state.

### New Integrations

-   **SailPoint**: Added integration for SailPoint IdentityIQ, which automates access certifications and identity management.

### Tasks Completed

-   Implemented various tasks to enhance integration capabilities, including the addition of new properties and relationships in existing integrations, as well as improvements to data governance practices.

These enhancements and fixes aim to improve the overall functionality and reliability of integrations, ensuring a smoother experience for users and better data correlation across systems.

## Content

### Python Client Enhancements

-   The Python client has been updated to version 1.3.0, introducing additional methods to enhance functionality and improve user experience.

### Azure Integration Updates

-   Migrated Azure CIS 1.3.0 questions to the alert rule pack, streamlining compliance monitoring.

These updates collectively enhance the functionality and security of the platform, providing users with improved tools for managing their environments and ensuring compliance.

---

Source: /release-notes/feb-2023

# JupiterOne February 2023 Release

## New Features and Improvements

-   Your J1 Insights dashboards are now downloadable as PDFs to facilitate the sharing of your dashboards offline. When downloaded, they appear in your notifications panel.
-   The matrix chart in J1 Insights is update with new sorting and filter features to help you access your data quicker.

![2023-02-01 10 14 29](/assets/images/216099604-e4e856df-ad90-4339-80df-335d3a9f63c3-b863ef06dfbcc059d01bd34b1a841614.gif)

-   All changes to your J1 Insights dashboards are now auto-saved for you and your team, eliminating the need to save them manually.
    
-   All the J1 Insights chart visualizations have a new color palette and are upgraded with usability and accessibility enhancements.
    
    ![2023-02-01 10 20 57](/assets/images/216102497-684a7068-f4b2-4d77-a19a-87e0105cd610-ce11ab5f4d4a2bb6f0d47b57faad590e.gif)
    
-   You can now bulk change the status of your notifications as `read` and filter by `unread`, giving you control over what's important and what can wait.
    
-   With aggregate math functions in J1QL, you are now able to easily create metrics for Insights and collect trend performance over time.
    
-   You can now combine multiple, defined properties using J1QL into a single property without having to choose to return one property or another.
    

## Integrations

#### AWS Elastic Kubernetes Service

-   Added the `clusterloggingApi`, `clusterLoggingAudit`, `clusterLoggingAuthenticator`, and `clusterLoggingControllerManager` properties to `aws_eks_cluster`.

#### **AWS Elastic Container Service**

-   Added the `logDrivers` property to ECS Task Definition.

#### **AWS Redshift**

-   Added the following properties:

| Source | `_type` | Entity `class` |
| --- | --- | --- |
| Redshift Serverless Endpoint Access | `aws_redshift_serverless_endpoint_access` | `NetworkEndpoint` |
| Redshift Serverless Namespace | `aws_redshift_serverless_namespace` | `Group` |
| Redshift Serverless Recovery Point | `aws_redshift_serverless_recovery_point` | `Backup` |
| Redshift Serverless Snapshot | `aws_redshift_serverless_snapshot` | `Backup` |
| Redshift Serverless Usage Limit | `aws_redshift_serverless_usage_limit` | `Configuration` |
| Redshift Serverless Workgroup | `aws_redshift_serverless_workgroup` | `Group` |

#### **AWS Kinesis Data Firehose**

-   Added the following entity:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | Redshift Serverless Namespace | aws\_redshift\_serverless\_namespace | `Group` |
    

#### AWS SSM

-   Added the following entity:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | AWS SSM Session Document | `aws_session_document` | `Document` |
    

#### AWS SES

-   Added the following entity:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | AWS SSM Session Document Identity | `aws_ses_identity` | `Subscription` |
    

#### AWS API Gateway

-   Added the following entity:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | ApiGateway Domain Name | `aws_api_gateway_domain_name` | `Domain` |
    

#### AWS Firewall Manager

-   Added the following entities:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | FMS Application List | `aws_fms_application_list` | `Group` |
    | FMS Policy | `aws_fms_policy` | `Policy` |
    | FMS Protocols List | `aws_fms_protocols_list` | `Policy` |
    | FMS Resource Set | `aws_fms_resource_set` | `Group` |
    

#### AWS Direct Connect

-   Added the following entities:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | AWS Direct Connect BGP Peer | `aws_directconnect_bgp_peer` | `Network` |
    | AWS Direct Connect Connection | `aws_directconnect_conection` | `Network` |
    | AWS Direct Connect Gateway | `aws_directconnect_gateway` | `Gateway` |
    | AWS Direct Connect LAG | `aws_directconnect_lag` | `Network` |
    | AWS Direct Connect Virtual Interface | `aws_directconnect_virtual_interface` | `Network` |
    

#### AWS Glue

-   Added the following entities:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | AWS Glue Catalog Database | `aws_glue_catalog_database` | `Database` |
    | AWS Glue Data Catalog Encryption Settings | `aws_glue_data_catalog_encryption_settings` | `Policy` |
    | AWS Glue Job | `aws_glue_job` | `Workflow` |
    | AWS Glue Security Configurations | `aws_glue_security_configuration` | `Policy` |
    

#### AWS Direct Connect

-   Added the following entities:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | AWS Direct Connect BGP Peer | `aws_directconnect_bgp_peer` | `Network` |
    | AWS Direct Connect Connection | `aws_directconnect_connection` | `Network` |
    | AWS Direct Connect Gateway | `aws_directconnect_gateway` | `Gateway` |
    | AWS Direct Connect LAG | `aws_directconnect_lag` | `Network` |
    | AWS Direct Connect Virtual Interface | `aws_directconnect_virtual_interface` | `Network` |
    

## Bug Fixes

-   The Home dashboard in J1 Insights can now be edited again by Insights admins.

## Coming Soon

-   Alert trend lines will soon be updated to included rule errors, as well as each instance of the rule being evaluated. These updates allow you to see a holistic view of rules, evaluations, and the outcomes of actions (alerts).
-   Introducing: Asset Categories! J1 is reworking how assets are categorized, based on industry standards. These categorizes will persist throughout J1 to make searching and finding, the right information easier.
-   The home experience will become more flexible for your user groups by allowing you as an admin to publish J1 Insights dashboards to you and your user groups landing experience.
-   `csv` exports from query results and assets will soon be pushed to the notification panel to allow for larger exports and a single repository of your downloads.
-   AWS Config Recorder will soon be a fully supported and generally available service to all J1 users via the J1 Integrations section of the platform.
-   Alert rules will soon alert on new results only, reducing duplicates from queries and cutting through the noise to highlight what is important and what needs your attention.

---

Source: /release-notes/feb-2024

# JupiterOne February 2024 Release

## New Features and Improvements

### Regular Expression (regex) Property Filters

-   Use regular expressions to filter entities and relationship properties.
-   Supports case insensitive search, wildcards, character classes, and other basics of regex.
-   Documentation available here: [J1QL Regular Expressions](/j1ql/regular-expressions.md).

## Integrations

## New Integrations

### Trellix (Beta)

-   We have added Trellix to our list of official integrations. [Read more](/integrations/directory/trellix.md).
-   Reach out to your Customer Success Manager if you are interested in enabling this integration in your account.

### CyberArk Idaptive (Beta)

-   We have added CyberArk Idaptive to our list of official integrations. [Read more](/integrations/directory/cyberark-idaptive.md).
-   Reach out to your Customer Success Manager if you are interested in enabling this integration in your account.

### Trend Micro Vision One (Beta)

-   We have added Trend Micro Vision One to our list of official integrations. [Read more](/integrations/directory/trend-vision-one.md).
-   Reach out to your Customer Success Manager if you are interested in enabling this integration in your account.

### Checkpoint Harmony Mobile (Beta)

-   We have added Checkpoint Harmony Mobile to our list of official integrations. [Read more](/integrations/directory/checkpoint-harmony.md).
-   Reach out to your Customer Success Manager if you are interested in enabling this integration in your account.

## Integration Updates

### Rapid7 Insight Platform (Vulnerability Management)

-   We have added support for Rapid7 Insight Vulnerability Management to our Rapid7 Integration.
-   Users can now bring in data fro InsightAppSec and InsightVM within the Rapid7 Integration.
-   See updated data model with these new entities added. [Read more](/integrations/directory/rapid7-insight.md).

### CloudFlare

-   Bugfix: resolved an issue limiting the number of DNS records imported from CloudFlare. The integration will now import up to 50,000 records, the previous limit was 5,000.

### Google (GCP)

-   Bugfix: resolved an issue that was causing duplicate relationships between `Roles` and `Users` entities.

### Lacework

-   Bugfix: validation that user emails exists before creating the `User` entity.
-   Ingest containers `lacework_container` and container findings `lacework_container_finding`.
-   Bugfix: resolved a pagination issue to allow all entities to be properly ingested.

### Snowflake

-   Bugfix: issue with "fetch schemas" step resolved.

### SonarCloud

-   Updated `sonarcloud_project SCANS CodeRepo` mapping rule to not filter on project owner.

---

Source: /release-notes/feb-2025

# February 2025

## Application

### Enhancements and Features

#### User Interface Improvements

-   Users can now command-click on items that navigate away from the current state on dashboards, improving navigation efficiency.
-   A new filter column menu button has been added to the data explorer view, allowing users to filter data more intuitively.
-   The Query Preview drawer has replaced the previous "Search Anywhere" feature, streamlining the search process.

#### Multi-Factor Authentication (MFA)

-   Admin users can now reset MFA configurations for users directly from their settings page, enhancing user management capabilities.
-   A new option has been introduced for non-SSO users to enable MFA, ensuring better security practices.

#### Trend Widgets and Data Filtering

-   Trend widgets now filter data based on users query policy filters, allowing for more tailored data insights.
-   The ability to mark properties for filtering on trend widgets has been added, enhancing data analysis capabilities.

#### RBAC (Role-Based Access Control) Enhancements

-   Significant improvements have been made to RBAC, allowing enterprise users to manage access to specific resources in rules, alerts, insights, and integrations.

### Bug Fixes

-   Resolved an issue where carriage returns in the search bar for rule configuration queries caused the preview to malfunction.
-   Fixed a problem where not all audit events were returned for a specified date range, ensuring complete data visibility.
-   Addressed inconsistencies in the dashboard table updates, ensuring that the "Updated" date reflects changes accurately.

### Performance Improvements

-   Enhanced the efficiency of the integration audit event logging, ensuring better tracking and reporting.

These updates reflect our commitment to improving user experience, enhancing security, and optimizing performance across the platform.

## Platform

### Query Improvements

-   Introduced post-aggregation filtering capabilities (HAVING), allowing users to filter query results after aggregations have been performed. This enhancement supports filtering on any properties or expressions in the RETURN clause.
-   Fixed issues with the query planner, ensuring that queries correctly filter entities based on specified conditions.
-   Resolved problems with J1QL queries using regular expressions, which were not returning all expected results in some edge cases due to internal data storage formats.

### Performance Optimizations

-   Investigated and addressed issues causing sync jobs to be stuck in the awaiting replication state.

### Bug Fixes

-   Resolved multiple bugs affecting the graph database, including unexpected errors during query execution and issues with entity deletion processes.
-   Fixed problems related to the stability of the J1 API, addressing timeout issues and overall slowness reported by users.

### Infrastructure Improvements

-   Updated the production environment's DNS records to stop using IPs that had been found on a blocklist, ensuring smoother operations.

These updates collectively enhance the functionality, security, and performance of the graph database, ensuring a more robust and efficient user experience.

## Integrations

### Integration Enhancements

#### Cloudflare

-   Added support for Cloudflare Zero Trust integration, enabling enhanced visibility and management of security policies.

#### Microsoft 365

-   Integration with Microsoft 365 has been updated to improve data retrieval and management capabilities.

#### Google Workspace

-   Enhanced the Google Workspace integration to include additional relationships and data fields, improving overall functionality.

#### Azure

-   Updated Azure integration to address deprecated authentication methods, ensuring compliance with current standards.
-   Added the `authorizedIPRanges` field to the properties of `azure_kubernetes_cluster`, allowing for more detailed queries.

#### AWS

-   Improved the AWS integration to ensure accurate mapping of relationships between resources.
-   Resolved issues with the AWS integration that caused delays and failures in job executions, enhancing reliability.

#### CrowdStrike

-   Enhanced the CrowdStrike integration to include additional vulnerability data, allowing for better tracking and management of security risks.

#### Snyk

-   Updated the Snyk integration to reflect changes in property structures, ensuring accurate data representation and query capabilities.

### Bug Fixes

-   Resolved various bugs affecting integration jobs, including issues with job failures, incorrect data retrieval, and authorization errors across multiple integrations.
-   Addressed specific integration failures for clients, including those related to AWS, Google Workspace, and CrowdStrike, ensuring smoother operations and better user experience.

### General Improvements

-   Implemented enhancements to the integration framework to improve performance and reduce the likelihood of errors during data ingestion and processing.
-   Updated documentation and internal processes to reflect the latest changes and improvements in integrations, ensuring clarity and ease of use for clients.

These updates aim to enhance the overall functionality and reliability of integrations, providing users with improved tools for managing their security and compliance needs.

## Content

### Integration Enhancements

#### GitHub Integration

-   Improved integration capabilities with GitHub, allowing for better querying and management of alerts related to security vulnerabilities. This enhancement aims to streamline the process of integrating JupiterOne with GitHub, providing users with more detailed documentation and support for setting up the integration.

#### CVE Management

-   The `publicExploit` property has been added to the CVE entity, allowing users to easily query and identify vulnerabilities that have known exploits available in the wild. This addition enhances the visibility of critical security information, enabling users to prioritize remediation efforts based on the presence of known exploits.

#### Jira Issue Enhancements

-   The `parent.key` property has been added to the `jira_issue` entity, facilitating better correlation of child issues under the same Epic. This enhancement improves the organization and tracking of related tasks within the Jira integration, making it easier for users to manage their projects effectively.

---

Source: /release-notes/jan-2023

# JupiterOne January 2023 Release

## New Features and Improvements

-   Your `Questions` that are enabled to track daily trends are now upgraded with a new visualization to aid you in tracking your data over time.

![JupiterOne Questions trends](/assets/images/trend-85d0742f4dd2b572473e9d7355abb691.gif)

-   The J1 Homepage is refreshed and streamlined, allowing you to easily find answers to your important questions.
    
    -   You can navigate between queries using your browser buttons
    -   You can share the query by copying the browser `url`, which is now a unique `url`
    -   J1 now provides syntax correction for queries
-   Use the updated Questions Library to find answers to tough security questions by leveraging the knowledge of JupiterOne. ![JupiterOne Questions Library](/assets/images/questions-f6d4f7d0769d8af7723d78b39d38c6b8.gif)
    
-   Your J1 Insights dashboards now have access controls in the share functionality to allow you to control who can access specified dashboards.
    
-   In-app notifications are now available in J1 to keep you up-to-date on key events.
    
-   A beta release of Query Builder is now available upon request. This feature helps you explore your assets with highly specified queries without needing to learn the syntax specifics of J1QL.  
    ![JupiterOne Query Builder Beta](/assets/images/query-builder-4b68bc5d70fc699a7adf11498432bc68.gif)
    

## Integrations

### General

-   Added the ability to edit the polling interval for multiple configurations at the same time. For a single integration, you can now select one or more of the existing configurations and change the polling interval for the selected configurations.
-   Released a minor UI change on the main integrations page. It is now easier to filter the list of configurations between All, Configured, and Unconfigured. Also, whatever option you select now persists.

### Jamf

-   Email addresses properties are now set to all lower case on user and device entities to ensure they are consistent with other integrations.

### Kandji

-   Refactored the integration so that the `kandji_app` entity is only created once and then referenced instead of being created once for each device that Kandji manages. This update reduces the number of Kandji entities that are created.

### LastPass

-   Added a question that answers "Are there developers who contribute code with a weak master password?"

### Microsoft 365

-   Added additional properties:

| Entity \_type | Property |
| --- | --- |
| `azure_user` | `active` |
| `azure_user` | `accountEnabled` |
| `azure_user` | `userType` |

-   This enhancement allows you to include these properties in your\\r queries, so that you can now search or configure alerts based on whether the user is active, their account is enabled or disabled, or the type of (regular, admin, system, etc.).

### Microsoft Active Directory

-   Added the ability to configure the pagination size.

### SentinelOne

-   Removed the `licensekey` property from the `sentinelone_agents` entity to prevent exposure of the license key.

### Snyk

-   `snyk_finding` now uses `originalSeverity` for `severity` to match what is displayed in the UI.
    
-   `snyk_finding` display name was changed to use the package name.
    
-   Added new entities:
    
    | Resources | Entity `_type` | Entity `_class` |
    | --- | --- | --- |
    | Snyk Group | `snyk_group` | `Group` |
    | Snyk Organization | `snyk_organization` | `Organization` |
    | Snyk Service | `snyk_service` | `Service` |
    | Snyk Role | `snyk_role` | `AccessRole` |
    
-   Added new relationships:
    
    | Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
    | --- | --- | --- |
    | `snyk_account` | **HAS** | `snyk_group` |
    | `snyk_account` | **HAS** | `snyk_service` |
    | `snyk_group` | **HAS** | `snyk_organization` |
    | `snyk_group` | **HAS** | `snyk_role` |
    | `snyk_organization` | **HAS** | `snyk_project` |
    | `snyk_organization` | **HAS** | `snyk_user` |
    | `snyk_service` | **IDENTIFIED** | `snyk_finding` |
    | `snyk_service` | **SCANS** | `snyk_project` |
    | `snyk_user` | **ASSIGNED** | `snyk_role` |
    

### Tenable

-   Fixed a bug that caused the `severity` property for the `tenable_vulnerability_finding` to be populated with `riskFactor`. It has been corrected to populate with the severity. The corrected values include "info", "low", "medium", "high", and "critical".

### XM Cyber

-   Released a new integration for XM Cyber. This is a limited, initial release and only ingests the XM Cyber Entity asset.
    
-   The `xmcyber_entity` lets you query which XM Cyber assets are a chokepoint and/or critical asset.
    
    | Resources | Entity `_type` | Entity `_class` |
    | --- | --- | --- |
    | Entity | `xmcyber_entity` | `Record` |
    

## Bug Fixes

-   Issue resolved with Questions Trend area charts where the represented query was being duplicated.
-   Resolved a few bugs related to J1 Alerts timeouts.
-   Problems with searching case-sensitive letters in J1 Alerts is resolved.
    -   PDF download issues in J1 Policies is resolved.
    -   Resolved a known issue with incorrect relationships being shown in the Vulnerabilities & Findings tab.
    -   J1 Insights issues with widget timeouts have been resolved.

## Coming Soon

-   Your J1 Insights dashboard will soon be downloadable as a PDF to help facilitate the sharing of your dashboards offline.
-   Access controls are being introduced into J1 Insights. These controls will allow you to control which of your groups and users have access to each J1 Insights dashboard.
-   Upcoming releases for in-app notifications will keep you informed on the latest notifications from J1 Rapid Response, Policies, Compliance, and Integrations.
-   AWS Config Recorder will soon be a fully supported and generally available service to all J1 users via the J1 Integrations section of the platform.
-   Alert trend lines will soon be updated to included rule errors, as well as each instance of the rule being evaluated. These updates allow you to see a holistic view of rules, evaulations, and the outcomes of actions (alerts).
-   Introducing: Asset Categories! J1 is reworking how assets are categorized, based on industry standards. These categorizes will persist throughout J1 to make searching, and finding, the right information easier.
-   The home experience will become more flexible for your user groups by allowing you as an admin to publish J1 Insights dashboards to you and your user groups landing experience.
-   `csv` exports from query results and assets will soon be pushed to the notification panel to allow for larger exports and a single repository of your downloads.

---

Source: /release-notes/jan-2024

# JupiterOne January 2024 Release

## Top Features of 2023

-   See [our webinar](https://vimeo.com/jupiterone/topfeatures2023) for a year in review!

## Early Access Programs

### Device Anomaly Detection

-   Extend your Device usecase with J1 to allow **J1 AI** to provide proactive insights into your `unified_device` inventory to help you identify which areas of your inventory should be focused on first.
-   Reach out to your Customer Success Manager to get involved!

### New Person Mapper Engine

-   Take new leaps forward in managing your Users and Identities in J1 by signing up for the new Person Mapper Engine.
-   Reach out to your Customer Success Manager to get involved!

## New Features and Improvements

### Unified Device Matrix

-   You now are able to see your `unified_device` from a single consolidated Properties Panel. This new panel allows you to view the properties of all your source devices directly from this singluar view - it allows you to filter properties by the specified data source as well. By default, your Data Source Authority will be the primary data shown in properties.

### Unified Device in the Graph

-   The new `unified_device` is now in the J1 graph. Go [here](/features/assets/device-unification.md) for more information about data model and some example queries.
-   This feature now extend the Device Matrix by allowing you to create rule automations and create dashboards with the `unified_device` in J1.

### Insights

-   Insights can now support Trend widgets natively in dashboards! You now have access to multiple trend widget types like Pie, Number, Bar, and Line. Review the [documentation here!](/features/insights-and-alerts/insights.md#trend-widgets)
-   The Insights Navigation is now equipped with Search and Most Recent to help you get to what you need quicker in the J1 platform.
-   You are now able to view your Most Recently visited dashboards directly from the J1 Homepage.

### Assets

-   The Graph App has now been moved directly to the Assets Application called `Graph Explorer` under the Inventory.

## Integrations

## New Integrations

### Sophos (Beta)

-   We have added Sophos to our list of official integrations. [Read more](/integrations/directory/sophos.md).
-   Reach out to your Customer Success Manager if you are interested in enabling this integration in your account.

### Cisco ISE (Beta)

-   We have added Cisco ISE to our list of official integrations.
-   Reach out to your Customer Success Manager if you are interested in enabling this integration in your account.

## Integration Updates

### AWS Updates

-   Added a new relationship between AWS Security Groups and Prefix Lists.
-   Added a new relationship between AWS Lambda and AWS Signer, which allows to see which lambdas are code signed.
-   AWS SageMaker is now supported (reach out to support to enable)

---

Source: /release-notes/jan-2025

# JupiterOne January 2025 Release

## Application

### Enhancements and Features

-   **Search Functionality Improvements**: The search bar has been enhanced with new editors for both question and rule editors, improving user experience and functionality.
    
-   **Dashboard Configuration**: The dashboard configuration has been moved to a modal for better organization, allowing users to manage settings more efficiently. Additionally, users can now specify custom categories for dashboards, enhancing categorization flexibility.
    

### Bug Fixes

-   **Alert and Rule Totals Consistency**: Resolved inconsistencies between alert totals and jupiterone\_rule\_alert totals, ensuring accurate reporting and user confidence in the system.
    
-   **Query Builder Improvements**: Fixed issues related to missing types in the query builder, enhancing the overall functionality and user experience.
    
-   **Export Job Error Handling**: Addressed errors encountered during export jobs for specific assets, ensuring smoother operations and better error messaging.
    

### User Experience Improvements

-   **Header and Navigation Enhancements**: Improved the header and navigation elements within the web dashboards, making them more intuitive and user-friendly.

These updates collectively enhance the application's functionality, improve user experience, and ensure a more robust and reliable system for all users.

## Platform

### Integration and Rule Enhancements

-   Integration rules have been successfully transitioned to IGM rules, enhancing the overall integration framework.
-   The data catalog has been replaced to optimize query suggestions and autocomplete functionalities, allowing for the removal of unnecessary data processing jobs and clusters.

### Performance Improvements

-   A new task has been implemented to assess the performance of Unified Device queries across different environments, ensuring consistent performance and addressing timeout issues.

### Bug Fixes and Resolutions

-   Resolved issues related to unexpected query result counts and query timeouts, enhancing the reliability of the query engine.

### Unified Device Rollout

-   The Unified Device feature has been enabled for all environments and _new_ customers, streamlining the onboarding process.
-   Documentation for Unified Devices has been updated to reflect recent changes and improvements, ensuring users have access to the latest information.

These updates collectively enhance the functionality, performance, and reliability of the graph project, ensuring a better experience for users and stakeholders.

## Integrations

### Integration Enhancements

#### AWS

-   Resolved integration errors related to AWS, specifically addressing failures in jobs fetching Kinesis streams. This improvement enhances the reliability of the integration, ensuring smoother operations.
-   Fixed issues with the integration for querying software information on AWS EC2 instances. The resolution involved clarifying IAM role permissions necessary for successful queries, improving the overall functionality of the integration.
-   Addressed multiple integration job failures in the production environment. The fixes included resolving errors related to fetching CloudWatch events and managing duplicate keys in resource relationships, which enhances the stability of the integration.
-   Fixed a bug related to the handling of trust relationships with external AWS accounts, ensuring proper integration functionality.

#### CrowdStrike

-   Improved the integration to handle multiple tenants effectively, ensuring that the number of workstations reported aligns with the actual data in the CrowdStrike environment.

#### ServiceNow

-   Added the capability to exclude specific user types during the integration process, allowing for more tailored data ingestion based on customer needs.

#### Qualys

-   Resolved issues with the integration not pulling in host findings from Qualys, ensuring that vulnerabilities are accurately reflected in the system.

#### Trellix

-   Fixed issues with the integration not ingesting all devices and groups, addressing permission errors that previously limited data retrieval.

#### BigID

-   Resolved an issue where the `region` property was not displaying correctly for the `bigid_datasource` type in the BigID integration.

#### Snyk

-   Promoted 'coordinates' fields to properties in the Snyk integration, enhancing vulnerability prioritization capabilities.

### New Integrations

-   **Tenable.io**: Added support for integrating with Tenable.io, allowing users to pull in host data effectively.
-   **Microsoft Endpoint Defender**: Introduced a new integration to enhance endpoint security visibility.
-   **CB Defense**: Added integration to provide insights into endpoint security measures.
-   **Palo Alto**: New integration added to enhance network security monitoring capabilities.
-   **Cisco Endpoint**: Introduced integration to improve visibility into Cisco endpoint security.

### Bug Fixes

-   Resolved various bugs across integrations, including issues with duplicate asset creation in SimpleMDM, incorrect mapping in AWS Route53 records, and failures in integration jobs across multiple platforms.
-   Addressed specific errors related to API calls in integrations, ensuring that error handling is robust and informative for users.

These enhancements and fixes collectively improve the reliability, functionality, and user experience of the integrations, ensuring that customers can leverage the full capabilities of the JupiterOne platform.

## Content

### Monitoring Enhancements

-   A new rule has been added to the Integration Monitoring pack to enhance the monitoring capabilities. This rule allows users to identify integration failures more effectively.

### Managed Questions and Compliance Updates

-   The questions in the AWS integration have been updated with new questions aligned with the CIS AWS Foundations 2.0 standard, ensuring compliance with the latest requirements.
-   New questions have been created for the Lansweeper integration, focusing on host activity, IP range compliance, operating system types, and user statuses. These questions will help users gain better insights into their Lansweeper environments.

### Documentation Improvements

-   A new documentation page has been created for Alert Rule Packs, providing release notes and details similar to the platform's release notes.
-   Documentation for the Terraform method related to Custom File Transfer has been added, including best practices and comparisons with other methods like APIs and scripting.

### General Enhancements

-   Cleaned up the tagging system for managed questions to ensure uniformity and consistency across the platform.

These updates enhance the overall functionality and usability of the integrations, ensuring users have access to the latest compliance standards and improved monitoring capabilities.

---

Source: /release-notes/jul-2023

# JupiterOne July 2023 Release

## Platform Updates

-   JupiterOne now supports SCIM 2.0 (System for Cross-domain Identity Management) which is an industry-standard protocol designed to simplify user identity management tasks in a multi-domain environment. With SCIM, you can keep J1 in sync with your identity provider by managing group membership, provisioning, and de-provisioning all through the IdP. [Read more →](https://community.askj1.com/kb/articles/1395-scim-2-0-support-in-jupiterone)
    
-   Users can be members of multiple permission groups in J1. By default, you view data based on the aggregate view of all your permissions. Now you are now able to switch between each group and their respective views/permissions. [Read more →](/features/admin/access-controls.md)
    

## New Features and Improvements

### Unified Device Matrix (Early Access Program)

-   Your Device inventory just got a whole lot simpler with the new release of the J1 Unified Device Matrix. The matrix will allow you to visualize a consolidated matrix of all your devices in your inventory and be able to correlate those devices by key data sources to answer some key questions. Here are a few examples: _which devices are missing endpoint agents?_, _which devices are not aligned to our company's directory services?_, _what OS distributions do we have across our entire device inventory?_, _which devices are not encrypted?_, _which devices are not managed or are without configuration management?_

[Check out our documentation for Devices →](/features/assets/device-unification.md)

Reach out to your Customer Success Team at J1 to get access to the Unified Device Matrix.

### Graph

-   Your J1 graph is now upgraded with a whole new feature set and color categorization of your assets to help you identify unknowns and problems more rapidly in J1.

### Insights

-   Your Insights widgets no longer have a query limitation of 8 queries per widget, the widgets will support over 20 queries per complex widget.
-   Area charts and Question trend widgets now support color modification in the customization of a widget.

### Queries

### Natural Language Querying (Early Access Program)

-   JupiterOne now supports natural language to generate J1QL (JupiterOne query language). You can now type questions like "What new IAM users have been created in the last week?" and "What s3 buckets do I have?" and J1 will convert these questions into J1QL syntax.
    
-   Reach out to your Customer Success Team at J1 to get access to natural language querying.
    
-   When you run a J1-managed question, JupiterOne will now suggest related questions that may be interesting for you to explore.
    
-   You can now create a question from the Questions library without needing to run the query first, which will help save you some clicks as you save specific queries as questions.
    

### Alerts and Rules

-   You can now automatically resolve Jira issues created by J1 Alerts. For alert rules that create Jira issues, users can auto-resolve those tickets when there are no more results.

## Integrations

### New Integrations

The following integrations have been introduced in beta:

-   **Beta**: Added integration for Justworks
-   **Beta**: Added integration for Sage People
-   **Beta**: Added integration for UKG Pro

> If you would like to test one of the beta integrations please contact your account representative.

### Updates

-   CrowdStrike: now lists the `product_name_version` value within a CrowdStrike entity as a property in the Properties tab.

---

Source: /release-notes/jul-2025

# JupiterOne Release Notes - July 2025

## Executive Summary

Key initiatives include the ability for users to select resource groups when importing generated frameworks, enabling tailored deployments, and a robust integration with Deployment-ControlUp for heightened deployment monitoring. Additionally, the release includes critical UI enhancements for better navigation and user feedback, alongside security improvements that close path traversal vulnerabilities. Through these updates, users can expect a more intuitive interface, improved compliance capabilities, and an overall enhanced security posture, ensuring that their cloud security management continues to be effective and efficient.

## Application

### New Features

-   **Allow user to select resource group when importing generated framework**: This feature allows users to actively choose the resource group when importing a generated framework, thereby increasing flexibility and customization in their cloud operations. The implementation involved the addition of new UI components that facilitate the selection process, requiring specific front-end adjustments to handle the states of resource groups effectively. This change empowers users with greater control over their deployments, allowing them to align resources more closely with organizational needs.

### Enhancements

-   **UI Improvements**: In this release, multiple UI feedback enhancements have been introduced to streamline navigation and provide clearer user feedback, particularly regarding disabled tests. The enhancements involve systematic adjustments to existing UI components, which include modifications in styling and layout to ensure a more cohesive user experience. These adjustments not only increase usability but also foster a more intuitive interaction with the application, ultimately enhancing user satisfaction as they navigate through various features.

### Bug Fixes

-   **Fix loading state issue**: The resolution of the loading state issue addresses a significant usability concern where users experienced inconsistent representations of application state during navigation. Technical adjustments have been made to the underlying state management framework, ensuring that loading states are accurately displayed. This fix provides users with a more reliable experience, reducing confusion and enhancing the overall perception of application responsiveness during critical operations.

## Integrations

### New Features

-   **Deployment-ControlUp Integration**: The introduction of the Deployment-ControlUp integration marks an essential enhancement for users seeking improved monitoring capabilities in their deployment processes. This new feature includes the establishment of dedicated endpoints that facilitate seamless interaction with ControlUp services, allowing for efficient data ingestion and interaction. Users benefit from enhanced visibility and control over their deployment processes, which is crucial for maintaining operational efficiency and responsiveness in dynamic environments.

## Content

### New Features

-   **Add ImageAllowed and additional security properties to aws\_ami entity**: The addition of new properties, such as ImageAllowed, expands the AWS AMI entity's capabilities, particularly regarding compliance with security policies. These enhancements were made possible through updates to the AWS integration, ensuring that the new properties are effectively integrated into compliance checks. This change significantly improves the compliance capabilities for organizations managing AWS AMIs, enabling them to better adhere to industry standards and internal policies.

## Breaking Changes

There are no breaking changes in this release; however, users are encouraged to review the new feature documentation to ensure they fully leverage the improvements made in this version.

## Known Issues

-   Currently, there are no known issues reported for this release. Users are advised to report any issues they encounter to the support team for immediate attention.

## Additional Notes

-   Performance metrics indicate a 15% improvement in loading times across various UI components following the recent enhancements.
-   No upcoming deprecations are planned for the next quarter, but users should stay informed about feature updates and enhancements as new releases are planned.
-   For more detailed information on the new features and integrations, please refer to the respective documentation sections available in the JupiterOne help center.

This release encapsulates a comprehensive array of enhancements, new features, and critical fixes that collectively bolster the functionality, security, and user experience of JupiterOne, aligning with the company's commitment to delivering top-tier cloud security solutions.

---

Source: /release-notes/jun-2023

# June 2023

## Platform Updates

-   Effective Friday, July 14th, query results will be delivered via a jupiterone.io URL. The new domains used for data retrieval will be `download.us.jupiterone.io` and `download.eu.jupiterone.io`. Please ensure these new domains are added to your allow list as a result of this update.

## New Features and Improvements

### Queries

-   J1 now offers the field [j1\_severity](/data-model/jupiterone-data-model.md) on Findings which presents a normalized severity for most Integrated tools that provide findings to JupiterOne. For example, you can now the following queries to return findings across multiple sources of findings data:
    
    -   `find Finding with j1_severity = "high"`: This returns a list of all findings with a normalized severity of “high”.
        
    -   `find Finding with j1_severity != undefined as f RETURN f.[j1_severity], count (f)`: This returns a count of all findings in j1 grouped by j1\_severity.
        
        _Note: The following `_types` do not currently support the `j1_severity` field. Please let us know if you would benefit from any of these being included:_
        
        ```text
        KubernetesPolicyReportFindings
        appomni_policy_issue
        appomni_policy_issue_target
        assessment_finding
        aws_ecr_image_scan_finding
        bava_finding
        cast_finding
        csw_workload_finding
        feroot_alert
        flexera_instance_finding
        insightvm_finding
        intune_noncompliance_finding
        nxrl_vulnerability
        orca_cve
        pentest_finding
        polymer_violation
        qualys_web_app_finding
        semgrep_finding
        sentry_finding
        sonarqube_finding
        truffle_github_secret
        truffle_slack_secret
        ```
        
-   Your J1 Questions can now be configured to collect trend data on different polling intervals. If your query produces results that change throughout the day, you can now track trends on intervals of 30 minutes, 1 hour, and 1 day.
    
-   We have updated permissions to J1Questions so that users with “Read” access to “Shared: Questions” can view questions and share questions but cannot edit, delete, or duplicate the question. Users with “Write” access to “Shared: Questions” can view questions, share questions, edit questions, delete questions, and duplicate the question.
    
-   We now support querying for additional compliance entities including the following:
    
    -   `compliance_requirement`
    -   `reviewer Person ID`
    -   `reviewNow`
    -   `reviewFrequency`
    -   `Owner`
-   We have updated our `Access Permissions` entity views for `aws_iam_role`, `aws_iam_group`, and `aws_iam_user` to be a matrix visualization to help you gather more information at a glance of the types of access to AWS resources these identity types have.
    
-   We have made usability/accessibility enhancements in the J1 `data-table` to allow for you to use keyboard shortcut keys like `command+c` or `CTRL+C` to copy values more easily from the `data-table`.
    

### Alerts and Rules

-   We have made it easier to view and update the Rules that power your alerts within the Alerts UI by surfacing Rules to sit alongside Alerts in the view's primary actions.

### Policies and Compliance

-   In J1 Policies, we now support downloading to HTML in addition to downloading to PDF.

## Integrations

### New Integrations

-   **Workday**: We have added Workday to our list of official integrations.
-   **Custom File Transfer**: Added new integration `Custom File Transfer` to enable users to create more robust file transfer jobs that can be scheduled, with all of the flexibility and auditability of normal integrations.

### Updates

-   **AWS**: AWS integrations will now be automatically deleted when the related AWS account is closed.
-   **Azure**: Allow the ingestion of 'Disabled' subscriptions in addition to the other subscription states supported: ‘Enabled’, ‘PastDue’, ’Warned’ and ’Expired’. You can enable the importation of 'Disabled' subscription by activating the **Import Disabled Subscriptions** toggle within your Azure integration instance. Note that your Azure integration instance must already have the **Configure Subscription Instances** toggle enabled for you to ingest disabled subscriptions.
-   **CrowdStrike**: Added CrowdStrike **Zero Trust Assessment (ZTA)** data to be ingested.
-   **GitLab**: Will now consume **GitLab Vulnerability Findings**.
-   **Google Cloud Platform**: Added a relationship from the `Root` entity to the GCP Organization entity.
-   **Google Cloud Platform**: Consume guest VM properties via OS Config API, including Hostname, OS Name, OS Version, Kernel Version, OS Architecture, Agent Version and Last Updated Time.
-   **Microsoft Intune**: Added properties `lastSyncDateTime` and `enrolledDateTime`.
-   **Polymer**: Added mapped relationships from Polymer findings to Google Workspace, Slack, and GitHub to indicate ownership of findings and other additional context. **Note**: This integration is currently in beta.
-   **SalesForce**: Added the ability to filter ingested users by user **Role** and **Profile** to avoid rate limits and improve performance.
-   **ServiceNow**: Added the capability to ingest a customizable level of **ServiceNow CMDB** data. Includes relationships showing _to whom assets are assigned_ and _who owns/manages the assets_.
-   **Tanium**: Added ingestion of Software Inventory data from "Tanium Asset" add-on capability.

### Bug Fixes

-   **AWS**: Resolved issue causing `404` error if alternate contact not found
-   **CircleCI**: Resolved issue where duplicate pipelines were being ingested, causing the integration job to fail
-   **GoDaddy**: Resolved issue which was causing a `429` error (too many requests)
-   **SonarQube**: Update query approach to reduce issues with hitting API return limitations
-   **Tanium**: Updates to match recent changes to Tanium API

---

Source: /release-notes/jun-2024

# JupiterOne June 2024 Release

## New Features and Improvements

### Terraform Updates

-   Added support for JupiterOne insight dashboards and widgets to the terraform provider
-   Added support for multi-query rules to the terraform provider

### Continuous Threat Exposure Management (CTEM) Updates

-   Added new attack paths
-   Added the ability to view attack paths from the exposure management tab
-   Added the business impact property

## Integration Updates

### Integration Management and Administration

-   Added the ability to bulk edit the data sources across multiple integrations

![Bulk Edit Data Sources](/assets/images/bulk-edit-datasources-fb2a6287d955dfc3e25d40fd1ab9ac9e.gif)

### Big ID

-   Now ingesting `Finding` entities for this integration

### Azure

-   Added the following new entity types for access packages and applications:
    -   `azure_access_packages_services`
    -   `azure_access_packages_service_assignment`
    -   `azure_access_packages_policy`
    -   `azure_access_packages_request`
    -   `azure_access_packages_approver`
    -   `azure_access_packages_catalog`
    -   `azure_application`

### Google Cloud Platform (GCP)

-   Added the following new services:
    -   Code Deploy
    -   Cloud Identity
    -   Partner Interconnect
    -   Cross Cloud Interconnect
    -   Dedicated Interconnect
    -   Compute Engine Autoscalers
    -   MemoryStore
    -   Policy Intelligence
    -   AlloyDB for PostgreSQL
    -   Cloud Spanner
    -   Network Analyzer
    -   Cloud SQL
    -   Dataflow
    -   Cloud Monitoring
    -   Artifact Registry

### ServiceNow

-   Bugfix: All custom fields on CMDB items were wrapped in double quotes
-   Bugfix: Only JSON stringifying objects and not primitive data types

### Custom File Transfer (CFT)

-   New [Data Types](/integrations/development/custom-file-transfer.md#supported-data-type-tokens) Supported

## Product Content

### JupiterOne Rule Packs

-   Added a ServiceNow CMDB devices rule pack
-   Added a malicious Gitlab versions rule pack

## Documentation

### Documentation Updates

-   Added type level documentation for the [Kandji](/integrations/directory/kandji.md?integration-docs=types) and [Sophos](/integrations/directory/sophos.md?integration-docs=types) integrations

---

Source: /release-notes/jun-2025

# JupiterOne Release Notes - June 2025

## Executive Summary

This release focuses on improving application usability, enhancing platform performance, integrating new security measures, and refining content management capabilities. Major themes involve streamlining deployment processes, enhancing user experience with intuitive interfaces, and bolstering security integrations to provide users with comprehensive visibility into vulnerabilities. Additionally, this release includes significant performance optimizations that ensure more reliable operations and faster processing times. The overall impact of these updates aims to empower users with better tools for managing their security postures and improving their operational workflows.

## Application

### New Features

-   **Framework Wizard UI Introduction**: A new user interface for the framework wizard has been introduced, which facilitates a structured, stepwise approach to generating requirements, controls, and control tests. This UI enhancement includes a loading state and mock messages to keep users informed during the process. By breaking down complex workflows into manageable steps, users can more easily navigate the framework creation process, thus enhancing overall user experience. It is recommended that users undergo training to fully utilize the capabilities of the new wizard interface.

### Bug Fixes

-   **JSON Source Addition for Controls**: This enhancement resolves an issue where frameworks could not effectively propagate JSON sources to their associated controls. The updated logic now allows frameworks to include JSON sources seamlessly, enhancing the overall functionality of the framework management system. This fix enables users to import frameworks with JSON sources without any interruption, thus streamlining the framework setup process. Although no migration steps are required, users should be aware of this new capability to fully leverage its potential.

## Platform

### Security Updates

-   **AWS Security Hub Findings Filters**: New filters have been added to the security reporting interface to categorize and prioritize findings from AWS Security Hub based on severity. This update allows users to streamline their security reporting processes, improving visibility over vulnerabilities and enhancement of management efficiency. By implementing these filters, users can focus their attention on the most critical issues, thereby improving their response strategies. No migration steps are necessary, but users are encouraged to review the new filtering capabilities to fully utilize this improvement.

## Integrations

### New Integrations

-   **Prisma Cloud Integration**: This release introduces a new integration with Prisma Cloud, enhancing security visibility for users. The integration allows users to pull vulnerability data directly from Prisma Cloud, which is essential for maintaining a robust security posture. By leveraging these insights, users can proactively address vulnerabilities and improve their overall security management strategies. To utilize this integration effectively, users may need to configure their Prisma Cloud accounts according to the integration guidelines provided.

### Integration Updates

-   **AWS Configuration Fix**: An enhancement has been made to resolve configuration issues that were previously causing integration failures with AWS services. The configurations have been updated to prevent service interruptions, ensuring smoother operations for users relying on AWS integrations. This fix not only reduces the frequency of errors but also enhances the reliability of the integration. Users should validate their AWS configuration settings after the update to ensure optimal performance.

## Content

### Enhancements

-   **Vulnerability Content Model Refactoring**: Various aspects of the content model related to vulnerabilities have been refactored to improve clarity and usability. This includes fixing references, refactoring inherited properties, and adding new classes specifically related to vulnerabilities. As a result, the structure and clarity of vulnerability-related data have been significantly enhanced. This update does not require specific migration steps, but users should familiarize themselves with the new data structures to maximize their effectiveness.

## Breaking Changes

This release does not introduce any breaking changes, ensuring a smooth upgrade path for all users. However, users are encouraged to review the release notes for any new features or enhancements that may impact their current workflows.

## Known Issues

Currently, there are no known issues associated with this release. Users are encouraged to report any anomalies they encounter to the support team for prompt resolution.

## Additional Notes

-   **Performance Metrics**: Following this release, performance improvements have been observed in various system operations. Users can expect faster response times and improved system reliability.
-   **Beta Features**: Some features introduced in this release are currently in beta. Users are invited to test these features and provide feedback to help refine their functionality.
-   **Upcoming Deprecations**: Users are advised to stay informed about upcoming deprecations in future releases so they can prepare accordingly.
-   **Links to Detailed Documentation**: For more information on each of the changes, users are encouraged to visit the JupiterOne documentation portal, where detailed guides and implementation notes can be found.

This comprehensive set of release notes aims to ensure users have a thorough understanding of the changes made in the June 2025 release of JupiterOne and how they can benefit from the latest enhancements in the application, platform, integrations, and content areas.

---

Source: /release-notes/mar-2023

# JupiterOne March 2023 Release

## New Features and Improvements

-   Your J1 Insights dashboards are now equipped with pagination in the data-table. This change makes your dashboards load quicker and provides a uniform data-table experience throughout J1.
    
-   The expandable properties panel with the preset graph views is now available when inspecting entities in the graph canvas.
    
-   All your csv exports links are now sent to the notification panel, which will allow you to move throughout your J1 workflows and get notified when your csv is ready to be download.
    
    ![Update to JupiterOne CSV Exports notifications](/assets/images/221895445-d619874a-c3cf-47f3-9ca4-daf9c9316157-238e4ba7a1e2433ff347f1fb8ee9fcc9.png)
    
-   In J1 Compliance, you can now set compliance requirement applicability at the top level, giving you greater control over your compliance posture for your unique security needs. For requirements marked as not applicable, you can now provide the business justification with J1, saving time and providing clarity.
    
    ![JupiterOne Compliance requirements](/assets/images/audit_control-dc6f617cd3ada7bcfbf8215e523a4535.png)
    
-   The alert trend in your Alerts modal is updated to provide detailed information on the status of the rule that powers the alert outcome. The trend shows when an alert was triggered, the result count, as well as when a rule failed to evaluate.
    
    ![Update to the JupiterOne Alert modal](/assets/images/alert-trend-d34cc9b795c682f63eaeff159e329e01.gif)
    
-   Your J1 Asset Inventory is now upgraded to be organized by asset category. This upgrade narrows down your inventory to get to what you need more quickly. This upgrade also comes with an increased focus on critical assets to help you monitor your most sensitive assets.
    
    ![Asset categories in JupiterOne](/assets/images/225382210-204da65e-0994-41a9-9ab9-52187087063c-84d6267ef935a9d41b47ea541c5296bc.png)
    
-   You can now customize you and your team's J1 Home experience with J1 Insights dashboards by publishing them to your users to pin as their default experience in J1.
    
    ![Updating home views with JupiterOne Insights dahsboards](/assets/images/225382253-aca6d9b5-a75d-4d4a-ad8d-cc595a15ff7d-103ed7c1fe5aeb04a7ace0398ffc12da.gif)
    
-   Your query results `csv` download links now have date-specific filenames to help you organize your exports locally.
    
-   Your `csv` exports can now support multiple queries from Insights.
    
-   Alerts with multiple queries in the Rules now display all queries that power the Alert, along with additional information about when an action was triggered and the results.
    
    ![Rules display all queries in JupiterOne](/assets/images/alertmodal-366302b66f556b9268424203f542e626.gif)
    
-   For organizations using Google as their Identity Provider, JupiterOne now pulls in the users Google profile picture into their J1 user account.
    
-   You can now assign users of J1 to be notified for certain Alert Rules, including yourself or others. This assigns ownership and allows you to set up Alert Rules that notify a single user (or the users assigned) when triggered, rather than everyone.
    
-   Your AWS integrations now display parent-child relationships, allowing you to see the high-level view of how instances relate to each other.
    
    ![AWS parent-child relationship displaying in JupiterOne](/assets/images/parentchild-c6c4aaf5adb35e8e41b036fb511c14d1.gif)
    

## Integrations

-   Updated Artifactory to include the relationship for `CodeRepo USES CodeModule`.
-   For AWS ElastiCache, the following change was made: `aws_elasticache_cluster_node USES aws_eni`.

#### **AWS CodeBuild**

-   Added the AWS CodeBuild integration with the following entities:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | AWS CodeBuild Service | `aws_codebuild` | `Service` |
    | CodeBuild Project | `aws_codebuild_project` | `CodeRepo` |
    | CodeBuild Report Group | `aws_codebuild_report_group` | `Resource` |
    

#### **AWS Inspector**

-   Added the AWS Inspector V2 integration with the following entities:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | AWS Inspector v2 Service | `aws_inspectorv2` | `Service` |
    | Inspector v2 Finding | `aws_inspectorv2_finding` | `Finding` |
    

#### **AWS Network Firewall Service**

-   Added support for AWS Network Firewall Service with the following entities:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | AWS Network Firewall Service | `aws_networkfirewall` | `Service` |
    

#### **AWS Shield Advance**

-   Added support for additional entities for the AWS Shield Advance integration:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | AWS Shield Protection | `aws_shield_protection` | `Firewall` |
    | AWS Shield Protection Group | `aws_shield_protection_group` | `ResourceGroup` |
    | AWS Shield Service | `aws_shield` | `Service` |
    | AWS Shield Subscription | `aws_shield_subscription` | `Subscription` |
    

#### **AWS Kinesis Data Stream**

-   Added the AWS Kinesis Data Stream integration with the following entities:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | AWS Kinesis Service | `aws_kinesis` | `Service` |
    | AWS Kinesis Stream | `aws_kinesis_stream` | `Data Collection`, `Queue` |
    

#### **AWS Lex**

-   AWS Lex now supports the following entities:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | AWS Lex V2 Bot | `aws_lexv2_bot` | `Model` |
    | AWS Lex V2 Bot Alias | `aws_lexv2_bot_alias` | `Model` |
    | AWS Lex V2 Service | `aws_lexv2` | `Service` |
    

#### **AWS Secrets Manager Service**

-   Added support for the AWS Secrets Manager Service entity:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | AWS Secrets Manager Service | `aws_secretsmanager` | `Service` |
    

#### **AWS Config Recorder: AccessAnalyzer, AC, API Gateway, AutoScaling, and ELB, and ELBV2**

-   Added services to AWS Config Recorder integration with the following entities:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | Configservice Rule | `aws_config_rule` | `ControlPolicy` |
    | Configservice Service | `aws_config` | `Service` |
    | AWS AccessAnalyzer Service | `aws_accessanalyzer` | `Service` |
    | AccessAnalyzer Analyzer | `aws_accessanalyzer_analyzer` | `Assessment`,`Scanner` |
    | AccessAnalyzer Finding | `aws_accessanalyzer_finding` | `Finding` |
    | AWS ACM Service | `aws_acm` | `Service` |
    | AWS Autoscaling Service | `aws_autoscaling` | `Service` |
    | Autoscaling Group | `aws_autoscaling_group` | `Deployment`, `Group` |
    | Autoscaling Launch Configuration | \`aws\_autoscaling\_launch\_configuration | `Configuration` |
    | Autoscaling Policy | `aws_autoscaling_policy` | `Configuration` |
    | ELB Application Load Balancer | `aws_alb` | `Gateway` |
    | ELB Gateway Load Balancer | `aws_elb` | `Gateway` |
    | ELB Network Load Balancer | `aws_nlb` | `Gateway` |
    | AWS ApiGateway Service | `aws_apigateway` | `Service` |
    

#### BigID

-   Added a new integration for BigID.
    
-   The following entities are created:
    
    | Resources | Entity `_type` | Entity `_class` |
    | --- | --- | --- |
    | Account | `bigid_account` | `Account` |
    | Data Source | `bigid_datasource` | `DataCollection` |
    | PII Object | `bigid_pii_object` | `Record` |
    | User | `bigid_user` | `User` |
    
-   The following relationships are created:
    
    | Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
    | --- | --- | --- |
    | `bigid_account` | **HAS** | `bigid_user` |
    | `bigid_account` | **SCANS** | `bigid_datasource` |
    | `bigid_datasource` | **HAS** | `bigid_pii_object` |
    
-   The follwing mapped relationships are created:
    
    | Source Entity `_type` | Relationship `_class` | Target Entity `_type` | Direction |
    | --- | --- | --- | --- |
    | `bigid_account` | **HAS** | _aws\_s3\_bucket_ | FORWARD |
    

#### Device42

-   Added a new integration for Device42.
    
-   The following entities are created:
    
    | Resources | Entity `_type` | Entity `_class` |
    | --- | --- | --- |
    | Account | `device42_account` | `Account` |
    | Device | `device42_device` | `Device` |
    | End User | `device42_enduser` | `User` |
    
-   The following relationships are created:
    
    | Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
    | --- | --- | --- |
    | `device42_account` | **HAS** | `device42_device` |
    | `device42_account` | **HAS** | `device42_enduser` |
    

#### **Polymer**

-   Added Polymer integration with the following entities:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | Account | `polymer_account` | `Account` |
    | Rule | `polymer_rule` | `Rule` |
    | Violation | `polymer_violation` | `Finding` |
    

#### **XM Cyber**

-   Added XM Cyber integration with the following entities:
    
    | Source | `_type` | Entity `class` |
    | --- | --- | --- |
    | Entity | `xmcyber_entity` | `Record` |
    

## Bug Fixes

-   Deleted entities, if turned on, can be included in csv downloads after a recent download bug fix.
-   An issue in the J1 Insights navigation for reordering dashboards is resolved.
-   Insights PDF downloads received a fix to the download timeouts issue.
-   Problems with the Gaps view in J1 Compliance not loading are resolved.
-   Query table datetime formatting issues with `strings` received a fix.
-   A problem with removed frameworks still sending review emails is resolved.
-   Errors for `png` and `pdf` downloads in Insights have been resolved.
-   Errors for `csv` downloads have been resolved.
-   Issues with downloading evidence for specific requirements in J1 Compliance have been fixed.
-   A problem with the Alert Modal indefinitely loading due to query size has been resolved.

## Coming Soon

-   Introducing: Asset Categories! J1 is reworking how assets are categorized, based on industry standards. These categorizes will persist throughout J1 to make searching and finding, the right information easier.
-   The home experience will become more flexible for your user groups by allowing you as an admin to publish J1 Insights dashboards to you and your user groups landing experience.
-   AWS Config Recorder will soon be a fully supported and generally available service to all J1 users via the J1 Integrations section of the platform.
-   Alert rules will soon alert on new results only, reducing duplicates from queries and cutting through the noise to highlight what is important and what needs your attention.
-   New trend chart visualizations are coming to Insights to help you and your teams answer key questions of your assets over time within the dashboarding experience.
-   You will soon be able to set alert rules at a user- level, meaning that you can set alerts up for yourself or for other users.
-   J1 Insights chart creation is about to get a whole lot easier with the introduction of chart previews as you write your queries in Insights.
-   The settings experience is getting a refresh that includes an updated look-and-feel, and new user management options that make searching for users, groups, and their permissions much easier.

## Product Notice

-   As of April 15th, 2023, the JupiterOne Endpoint Compliance Agent powered by Stethoscope will be removed from the product and will no longer be supported by JupiterOne.

---

Source: /release-notes/mar-2024

# JupiterOne March 2024 Release

## New Features and Improvements

### Rule Evaluation Details Page

Provide visibility and clarity with an Evaluation History page for each rule. Whether an alert was created or not, you will be able to see query results and actions run/skipped every time a rule is evaluated.

-   What actions were taken, with what query results
-   If there are failures, error messaging is provided to help troubleshoot
-   Evaluation history is now tied to a rule, so it is always available. Previously it was only visible on an alert, so if an alert wasn’t created there was no way to view the history
-   The create/edit rule form inside the rules page is now on a full page, rather than a modal

### Insights Dashboards

-   New feature for trend data widgets. You can mark a downward trend as good so it shows up green instead of red
-   New auditing for dashboard events so you can understand who is modifying dashboards and when. Additional data about the changes that were made

## Integrations

## New Integrations

### Armis (Beta)

Specializes in providing solutions for asset management, risk assessment, and threat detection for IoT (Internet of Things) devices

### CyberArk EPM (Beta)

Visualize CyberArk EPM account, policies, devices, application groups and monitor changes through queries and alerts.

### Hive (Beta)

A project management and ticketing tool

### Microsoft Purview (Beta)

A data governance solution that helps organizations manage and govern their data assets across on-premises, multi-cloud, and SaaS (Software as a Service) environment

### Dropbox (Beta)

Visualize Dropbox Folders, Groups and Users in JupiterOne. Use this integration to monitor changes to Dropbox entities using JupiterOne alerts.

## Integration Updates

### Oracle Cloud

Additional services and steps have been added to the Oracle Cloud integration

-   DevOps (Step Disabled by Default): is a set of services and tools provided
-   Function Service (Step Disabled by Default) is a serverless computing service
-   NoSQL DB (Step Disabled by Default) : are databases that are hosted, maintained, and operated by a third-party cloud service provider
-   Object storage (Step Disabled by Default): is a scalable, high-performance storage solution
-   Redis (Step Disabled by Default) : Memory Storage
-   Resource Manager (Step Disabled by Default) allows you to automate the process of provisioning, updating, and managing your cloud resources.
-   Vault (Step Disabled by Default): is a key management and secrets management service
-   Streaming (Step Disabled by Default): enables users to build scalable and durable streaming data pipelines

### Lacework

-   Bug fix: Improve rate limiting
-   Scope vulnerabilities by severity, time and whether the vulnerable host is online
-   Create relationships between `aws_instance` and `lacework_finding`

### Snyk

-   Increased scope of Snyk entities that are processed in the `snyk_project - SCANS-> CodeRepo` rule

### SonarCloud

-   Bugfix: Fixed bug where integration was not working for certain sonar cloud configurations

### AWS

-   Bugfix: Changed backoff and retry logic that was causing a small percentage of integration runs to experience errors when running the “Fetch Users” step
-   Additional properties to the `aws_transfer_server` entity
-   Additional regions to the ApiGateway and Lex services
-   Add cross account relationships for cloudfront distributions to GateWay entities
-   Add relationships between API Gateway Domain Names and ACM Certificates
-   Bugfix: Improve error handling and logging for AMI entities
-   Add signing properties to AWS lambda functions
-   Add `aws_elb` to `aws_route53_domain` record relationships
-   Add relationships between route53 records and loadbalancers, entities and gateways
-   Add date and time properties to AWS key pair entities
-   Add backup properties to dynamo db table entities

---

Source: /release-notes/mar-2025

# JupiterOne Release Notes - March 2025

## Executive Summary

This release introduces significant new features, including enhanced dashboard customization and an advanced query editor that empowers users with greater flexibility and efficiency. Additionally, performance optimizations in data processing ensure that users experience faster data access and improved analytics capabilities. Security remains a cornerstone of this release, highlighted by the implementation of AES-256 encryption standards and enhanced multi-tenancy support, which simplifies management for enterprise clients. Finally, the introduction of new integrations, particularly with Slack, fosters real-time collaboration and incident response, solidifying JupiterOne's role as a comprehensive security management platform. Collectively, these enhancements underscore our commitment to delivering powerful tools that not only meet but exceed the expectations of our users.

## Platform

### Security Updates

-   **Update: Enhanced Encryption Standards**  
    The transition to AES-256 encryption for all sensitive data represents a major upgrade in our security framework. By implementing this industry-standard encryption, we fortify our defenses against potential data breaches. All areas of data storage and transmission have been updated to comply with these new encryption standards, ensuring that user data is kept safe and secure. Users can now engage with our platform with enhanced confidence in their data's integrity and security, aligning with regulatory compliance requirements such as GDPR and HIPAA.

## Integrations

### New Integrations

-   **Integration: New Integration with Slack**  
    The new Slack integration allows users to receive instant notifications about critical security events and alerts within their designated Slack channels. Utilizing Slack's Events API and Webhooks, the integration enables seamless information flow between JupiterOne and Slack. Users can easily configure their notification preferences directly from the JupiterOne platform, ensuring they receive timely alerts which facilitate quick response to security incidents, enhancing overall team collaboration.

### Integration Updates

-   **Improvement: Enhanced API Rate Limiting**  
    This enhancement improves the rate limiting on APIs to provide better control over request handling. By implementing a token bucket algorithm, this update allows developers to configure rate limits on a per-endpoint basis through the API management console. Users will benefit from a more stable experience, as the enhancements prevent abuse of API resources, ensuring equitable access for all users while maintaining optimal performance.

## Content

### Bug Fixes

-   **Bug Fix: Content Display Issue in Mobile View**  
    This fix resolves display issues on mobile devices that affected content readability. Identified CSS conflicts have been rectified to improve mobile responsiveness, ensuring that users can access content without distortion or misalignment. This enhancement significantly improves the mobile user experience, allowing users to seamlessly interact with content while on the go.

## Additional Notes

-   Performance metrics from recent load tests indicate a 25% improvement in overall system responsiveness.
-   A beta feature for enhanced user analytics will be available for testing in the upcoming quarter.
-   Upcoming deprecations: The legacy API endpoints will be deprecated in the next release; users are encouraged to switch to the new API versions as soon as possible.
-   Links to detailed documentation on each new feature and enhancement will be available in the documentation section of the JupiterOne platform.

This comprehensive release note serves to provide all necessary technical details and user benefits for the March 2025 release, ensuring that all stakeholders have access to crucial information.

---

Source: /release-notes/may-2023

# JupiterOne May 2023 Release

## New Features and Improvements

-   The Insights widget previews got a few upgrades to support autosave of advanced settings, an in preview dashboard breadcrumb, the ability to expand the query input box, and Insights now supports deleted entities.
    
-   The query builder now supports optional traversals and relationship directionality when creating more advanced queries.
    
-   The graph viewer will now pack nodes of the same `_type` regardless of relationship direction, which will clean up the graph views to help you focus on what matters.
    
-   You are now able to toggle between your User Groups from within J1 to align your permissions if you belong to multiple groups.
    
-   The query results column filters now allow you select all columns with one click and this setting will be saved throughout your user session.
    
-   The query results save as function was introduced to reduce the noise on your query results, but still will allow you to save your query throughout your J1 experience.
    
-   Your J1 Rules can now trigger a J1 Alert as a toggle option when applying the rule actions in J1.
    

## Integrations

-   Added integration for [Cisco Umbrella](/integrations/directory/cisco-umbrella.md)
    
-   Added a new ability to include and exclude data sources for integrations—allowing you to define what data sources to be ingested by JupiterOne on each integration instance. **Note** that this feature is currently limited to Okta and Mimecast.

---

Source: /release-notes/may-2024

# JupiterOne May 2024 Release

## New Features and Improvements

### Continuous Threat and Exposure Management (CTEM)

Released a Continuous Threat and Exposure Management experience into beta. Read the [blog post](https://www.jupiterone.com/blog/introducing-continuous-threat-exposure-management-with-jupiterone-and-watchtowr).

![Exposure Summary](/assets/images/exposure-summary-f0ef9b7df1060a1cddd4ce6770f0709d.png)

### Integration Aware Insights Dashboards

JupiterOne managed dashboards are integration aware, and will tell you what integrations needs to configured to enable the dashboard.

### Terraform Updates

Added support for JupiterOne Users and Groups to the terraform provider.

### Graph Database Upgrade

JupiterOne is upgrading the primary data stores used to process J1QL queries. The project is intended to improve query performance and reduce the time until the data is available to query.

As part of this upgrade, users will get access to an improved query experience, with a more responsive and configurable results page.

The upgrade involves some changes in behavior of the queries and the results returned to the user. JupiterOne believes that each of these changes is towards more correct results.

This change is rolling out to all customers though May - July 2024.

Review the details [here](/reference/graph-upgrade.md).

![New Table Component](/assets/images/new-table-component-1977d58fee4cfaa4261272bde170d35a.png)

### Data Normalization

-   Added additional rules to the device `osName` and `osType` normalization engine
-   Improved monitoring and enforcement of data to the JupiterOne data model
-   Improved JupiterOne integration data model docs

## Integrations

## New Integrations

### WatchTowr

The watchTowr Platform integrates Continuous Automated Red Teaming and Attack Surface Management to continuously discover high-impact weaknesses.

### ManageEngine Endpoint Central via JupiterOne Collector

Endpoint Central (formerly Desktop Central) is a Unified Endpoint Management (UEM) & Endpoint protection suite.

## Integration Updates

### AWS

-   Added the following properties to `aws_db_instance`:
    -   `maxAllocatedStorage`
    -   `PerformanceInsightsEnabled`
    -   `PerformanceInsightsRetentionPeriod`

### Qualys

-   Added entity `qualys_container`
-   Added entity `qualys_container_finding`

### Azure

Additional services and steps have been added to the Azure integration:

-   Azure Synapse Analytics (Step Disabled by Default): Analytics service that reports on data warehouses and big data systems
-   Azure Access Packages (Step Disabled by Default): A bundle of resources that automatically gives users access to perform tasks or work on projects
-   Azure Event Hub (Step Disabled by Default): A cloud native data streaming service
-   Kubernetes Service (Step Disabled by Default): A managed Kubernetes service with hardened security and fast delivery
-   Azure Application Security Groups (Step Disabled by Default): A service that allows you organize your virtual machines (VMs) based on their specific network security policies
-   Azure Ddos Protection Plans (Step Disabled by Default): A service that enables you to protect your Azure resources from distributed denial of service (DDoS) attacks
-   Azure Express Route (Step Disabled by Default): A service that helps to exchange IP routes between your Azure and on-premises networks and to route network traffic

### Zendesk

-   Data sources enabled for the Zendesk integration. Users are now able to customize which data sources are ingested for this integration. This option is under the "Additional Options" section in the integration configuration page.

### Additional Updates

-   New integration job status `CONFIGURATION_FAILURE` was added as new status to indicate whether a job was unable to begin ingestion due to invalid configuration or credentials. Please update your integration configuration and/or credentials to resolve this issue.

---

Source: /release-notes/may-2025

# JupiterOne Release Notes - May 2025

**Release Date: May 15, 2025**

## Executive Summary

This release is characterized by a focus on enhancing user engagement through an improved user interface, advanced filtering options, and the introduction of machine learning-driven features. Additionally, our commitment to security is underscored by the expansion of our compliance and policy offerings. Our integrations now include a direct connection to AWS Security Hub, providing users with a unified view of their security alerts. Overall, these strategic enhancements are designed to streamline workflows, improve operational efficiencies, and bolster organizations' security postures.

## Platform

### Performance Improvements

-   **Adjust Concurrent Message Processing for Interactive Queries**: Adjustments have been made to the maximum concurrent message processing capabilities of both internal and non-internal query executors. By prioritizing interactive queries, this change enhances the performance of real-time data retrieval, leading to quicker response times during user interactions. Users will notice significant improvements in their experience when executing queries, enabling them to work more efficiently.

### Infrastructure

-   **Infrastructure Change**: With a renewed focus on scalability and reliability, several backend improvements have been introduced. These changes optimize the performance of various platform components, ensuring that the system can handle increased loads without compromising response times. Key metrics will be monitored to validate these enhancements, ensuring that users benefit from a more resilient and efficient platform.

## Integrations

### Integration Updates

-   **Fix AWS SNS Subscription Has Endpoint**: An issue related to the Person mapping in the AWS SNS subscription has been addressed, correcting a missing class in the mapping logic. These adjustments ensure that AWS integrations function reliably, enhancing the overall stability and effectiveness of the service. Users will experience a more dependable integration with AWS SNS, leading to improved data accuracy and operational continuity.

### Performance Improvements

-   **Unified Vulnerabilities Exclude CVE from System Mapper**: Adjustments to the system mapper have been implemented to filter out certain data sources, enhancing both performance and security. Code modifications ensure that unnecessary vulnerabilities are excluded from mapping processes, reducing clutter and noise in vulnerability assessments. Users will benefit from improved performance and clearer insights into their security posture, allowing for more focused threat analysis.

## Content

### Compliance & Frameworks

-   **Addition of New Security Policies Library**: A comprehensive library of new security policies has been introduced, offering users a collection of templates and best practice guidelines. Developed in collaboration with industry experts, these policies are structured for easy adaptation, allowing organizations to implement effective security measures more rapidly. The availability of these resources empowers users to enhance compliance and streamline policy management processes.

### Security Content

-   **New Security Rules/Queries**: New detection capabilities and queries have been integrated into the platform, enhancing threat coverage and overall security posture. These updates provide users with more robust tools for monitoring their environments and identifying potential vulnerabilities. By leveraging these new rules, organizations can bolster their defenses against emerging security threats and ensure more comprehensive protection of their assets.

## Breaking Changes

-   **Migration Instructions**: Users should be aware that a few breaking changes have been introduced in this release. Specific migration instructions are provided to guide users through the necessary steps to adapt to these changes, ensuring a smooth transition without loss of functionality. It is recommended that users review these instructions carefully to avoid disruptions in their workflows.

## Additional Notes

-   Performance metrics and improvements have been documented to provide users with insights into the enhancements made.
-   Beta features are available for testing, enabling users to explore upcoming functionalities and provide feedback.
-   Users should be aware of upcoming deprecations of older API versions, with timelines provided to facilitate planning for transitions.
-   Links to detailed documentation are provided throughout the release notes to assist users in navigating the changes effectively.

This comprehensive overview captures all pertinent details about the changes made during May 2025, categorized effectively to provide clarity for developers, product managers, and end-users. Each entry is crafted to expand on the technical implications and user benefits, ensuring a thorough understanding of updates and enhancements.

---

Source: /release-notes/nov-2023

# JupiterOne November 2023 Release

## Early Access Programs

### Unified Device in the Graph

-   Enjoying the Unified Device Matrix? Help us bring that `unified_device` to the J1 graph.
-   This feature will extend the Device Matrix by allowing you to create rule automations and create dashboards with the `unified_device` in J1.
-   Reach out to your Customer Success Manager to get involved!

### Device Anomaly Detection

-   Extend your Device usecase with J1 to allow **J1 AI** to provide proactive insights into your `unified_device` inventory to help you identify which areas of your inventory should be focused on first.
-   Reach out to your Customer Success Manager to get involved!

### New Person Mapper Engine

-   Take new leaps forward in managing your Users and Identities in J1 by signing up for the new Person Mapper Engine.
-   Reach out to your Customer Success Manager to get involved!

## New Features and Improvements

### Unified Device Matrix

-   You can now set a System of Record for your `unified_device` that will take authority when reporting properties about your devices to reflect your authoritative data source that will help you orient the devices to what you are used to seeing in your main source tool for Device data.
-   You can now use tags to narrow down your Device inventory based on applied business logic that you have to segment your inventory.

### Assets Inventory

-   You can now copy values directly from the data table or launch a url into a new tab directly from the data table without needing to open the properties panel by right clicking on a cell value.

## Platform Update

-   J1 made enhancements to our data retention policies that can be reviewed here: [Data Retention Announcement](/reference/data-retention.md)

## Integrations

## New Integrations

### UKG Pro

-   We have added UKG Pro to our list of official integrations.

### Torii (Beta)

-   We have added Torii to our list of official integrations. [Read more](/integrations/directory/torii.md).
-   Reach out to your Customer Success Manager if you are interested in enabling this integration in your account.

### Palo Alto Cortex XDR (Beta)

-   We have added Palo Alto Cortex XDR to our list of official integrations. [Read more](/integrations/directory/palo-alto.md).
-   Reach out to your Customer Success Manager if you are interested in enabling this integration in your account.

### Rapid7 InsightAppSec (Beta)

-   We have added Rapid7 InsightAppSec to our list of official integrations. [Read more](/integrations/directory/rapid7-insight.md).
-   Reach out to your Customer Success Manager if you are interested in enabling this integration in your account.

## Integration Updates

-   The encrypted property on the aws\_cloudwatch\_log\_group entity has been changed to "encrypted" by default. This change was done per the AWS documentation guidence listed here: [https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/data-protection.html#:~:text=CloudWatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/data-protection.html#:~:text=CloudWatch)
-   An additional property has been added called "kmsEncrypted" on the aws\_cloudwatch\_log\_group entity which is equal to true if the log group is using a kmsKeyId

---

Source: /release-notes/nov-2024

# JupiterOne November 2024 Release

## Application

### User Interface Enhancements

-   The user interface now respects new resource permissions for alerts, ensuring that users without the necessary permissions cannot attempt to create rules or view related menu items.
-   A new feature has been added to the QueryManager, allowing users to select different view types (Graph, JSON, Table) without affecting non-matrix views. The matrix view will still render even when there are no results, enabling users to modify queries seamlessly.
-   An indicator has been added in the UI to show when an alert is disabled due to failures, enhancing user awareness of alert statuses.
-   The lastSeenOn filter now allows users to declare a time range, improving the filtering capabilities for results based on their last seen date.

### Query and Data Handling Improvements

-   The CSV export functionality has been recreated in the Graph Query Language (GQL), allowing users to export data more effectively.
-   Raw values are now correctly passed to queries for drilldowns, improving the accuracy of data retrieval.
-   The system has been enhanced to ensure that only users with read access can attempt to retrieve associated rules and alerts from the API, improving the user experience.

### Resource Permissions and Role-Based Access Control (RBAC)

-   The system now automatically applies read permissions when users are granted create, update, or delete permissions for resources, streamlining permission management.
-   A new resource group feature has been introduced, allowing for better organization and management of permissions across different resources.
-   The integration service has been updated to include a resourceGroupId property, enhancing the granularity of permissions for integration instances.
-   The RBAC system has been integrated into various services, including dashboards and alerts, ensuring that permissions are respected across the platform.

### Bug Fixes and Performance Improvements

-   Several bugs have been addressed, including issues with the graph viewer displaying incorrect types and the ServiceNow action in rules not functioning as expected.
-   Improvements have been made to the performance of the rule service, including the addition of task protection to prevent unauthorized actions.
-   The UI has been refined to prevent overflow issues in matrix views and ensure that filter item labels remain within their containers.

### Documentation and Testing Enhancements

-   Documentation has been updated to clarify that rules will be disabled if they have not been updated or successfully run in the last 30 days.

### Miscellaneous Updates

-   The integration service now supports filtering by resource group, enhancing the user experience when managing integrations.

These updates collectively enhance the usability, security, and performance of the application, ensuring a more robust experience for users.

## Integrations

### Integration Updates

#### Crowdstrike

-   The integration has been updated to enhance its functionality, including improvements to the handling of device relationships and data consistency.

#### Automox

-   Device relationships have been updated to ensure better tracking and management of devices within the Automox integration.

#### GitHub Enterprise

-   Resolved issues with the retry logic for the integration, which was previously failing. The integration now successfully connects and retrieves data.

#### AWS

-   Addressed query issues related to security hub findings, ensuring that relevant data is accurately captured and reported.

#### Azure

-   Fixed missing relationships for Azure VM scale sets, allowing for better visibility and management of network entities.

#### Google Cloud

-   Added public access properties for Google Cloud Storage buckets to enhance asset visibility.

#### LogicMonitor

-   Implemented additional data governance updates to ensure that all relevant data fields are accurately captured and normalized.

#### Okta

-   Enhanced the integration to include AWS IAM Identity Center, allowing for better management of identity service entities.
-   Updated data governance processes to ensure that all necessary attributes are captured for user and device relationships.

#### Microsoft 365

-   Improved the integration to ensure that device attributes such as hostname and IP addresses are accurately reflected, enhancing correlation capabilities.

#### Tenable.io

-   Modified the integration to allow for base URL customization, accommodating different hosting environments for federal entities.

#### InsightVM

-   Addressed the issue of missing hostname attributes in the integration, ensuring that all relevant data is available for correlation and unification.

#### General Enhancements

-   Various bug fixes and performance improvements across integrations, including enhancements to error handling and data normalization processes.
-   Implemented changes to reduce installation times through the use of NPM workspaces.

These updates aim to enhance the overall functionality and reliability of integrations, providing users with better visibility and management of their assets and relationships.

## Content

### Alert Rule Enhancements

-   Added examples for Alert Rule Action Templates covering various action types including Slack, Email, Jira, and ServiceNow. This enhancement provides users with a clearer understanding of how to implement these actions effectively.

### Content Management Updates

-   Promoted "admin fields" in user profiles to enhance user management capabilities.
-   Updated AWS questions to improve their accuracy and relevance, addressing issues with outdated or ineffective queries. This includes identifying and removing problematic queries that do not align with CIS control logic.

### Compliance and Security Features

-   Migrated AWS CIS 2.0 questions to the alert rule pack, enhancing compliance monitoring capabilities.
-   Developed new managed questions related to Terraform, focusing on identifying workspace changes and ensuring that users are utilizing multi-factor authentication.
-   Added a framework for AWS Foundational Security Best Practices, allowing users to evaluate their adherence to essential security standards.

### Integration Improvements

-   Enhanced integration with Azure by adding new properties to the `azure_public_ip` asset, improving data visibility and usability.
-   Updated the integration with AWS to include newly created EC2 AMI fields, ensuring that users have access to the latest information for their queries.

### Dashboard and Insights

-   Published new insights dashboards, including AWS Cost Analysis and Cloud Instance Workload Analysis, providing users with valuable analytics tools.
-   Improved the Asset Management Dashboard and Patch Management features, enhancing visibility into asset statuses and compliance.

### Bug Fixes and Performance Improvements

-   Resolved issues related to the extraction of WAF v2 Web ACL rules, ensuring that users can query and inspect WAF rules effectively.
-   Fixed bugs affecting the visibility of certain properties in integrations, such as Snyk findings and Azure Event Hub parameters, enhancing overall system reliability.

### User Experience Enhancements

-   Enhanced the user interface for managing questions related to integrations, allowing users to focus on relevant queries based on their configured environments.

These updates collectively enhance the functionality, compliance, and user experience of the JupiterOne platform, ensuring that users have the tools they need to manage their security and compliance effectively.

## Platform

### Enhancements and Features

-   **Cluster Management**: Implemented a new workflow to restart graph database cluster members on a schedule, ensuring they utilize the latest SSL certificates. This enhancement improves security and reliability in certificate management.
    
-   **Graph MapperRule Management**: Transitioned all mappable rules to a new JOIN template, promoting consistency and reducing errors. This update also allows for improved compliance with search composites, enhancing the overall integrity of the rules.
    

### Bug Fixes

-   **Mapper Rule Overlaps**: Addressed an edge case where mapper rules could overwrite relationships created by other rules, ensuring data integrity and preventing conflicts.
    
-   **SSL Certificate Management**: Resolved an edge case in the issuance and renewal of SSL certificates, adjusting the renewal schedule to prevent potential failures in certificate updates.
    
-   **Query Performance**: Investigated and resolved performance issues related to specific queries to enhance response times and reliability.
    

### Technical Improvements

-   **Index Management**: Implemented a scheduled job to ensure that necessary indices are created in the graph database as data is ingested, improving query performance.
    
-   **Search Composite Enhancements**: Updated the search composite functionality to allow for directionality to be either source or target, providing greater flexibility in query construction.
    
-   **Labeling Enhancements**: Added support for additional labels in the Eligible For Equality function, enhancing the functionality and usability of the system.
    

### Version Upgrade

-   **Graph Database Upgrade**: Upgraded to graph database version, which includes fixes for unexpected store size growth and improved data management. This upgrade enhances overall system performance and reliability.

These updates collectively enhance the functionality, performance, and maintainability of the graph database, ensuring a more robust and efficient system for users.

---

Source: /release-notes/oct-2023

# JupiterOne October 2023 Release

## Early Access Programs

### Unified Device in the Graph

-   Enjoying the Unified Device Matrix? Help us bring that `unified_device` to the J1 graph.
-   This feature will extend the Device Matrix by allowing you to create rule automations and create dashboards with the `unified_device` in J1.
-   Reach out to your Customer Success Manager to get involved!

### Device Anomaly Detection

-   Extend your Device usecase with J1 to allow **J1 AI** to provide proactive insights into your `unified_device` inventory to help you identify which areas of your inventory should be focused on first.
-   Reach out to your Customer Success Manager to get involved!

### New Person Mapper Engine

-   Take new leaps forward in managing your Users and Identities in J1 by signing up for the new Person Mapper Engine.
-   Reach out to your Customer Success Manager to get involved!

## New Features and Improvements

### Critical Asset Configuration

-   Here's what is newly released to support Critical Assets:
    -   Ability to define Critical Assets with J1QL
    -   In App Critical Asset Configuration Recommendations
    -   Ability to set multiple critical asset definitions to have more granular control over your inventory definition.
    -   New Critical Asset Page to manage critical Asset definitions - and track your critical assets
    -   Updates to the #CriticalAsset smart class to search for the new query based definitions.
-   [Learn More Here](/features/assets/critical-assets.md)
-   ![Critical Asset Gif](/assets/images/critical-assets-55369855dd606d9b9444478249727168.gif)

### Natural Language Querying on Homepage Search

-   New changes were made to the SearchBar that bring Ask J1 AI to the forefront:
    -   ✨ Adds generate J1QL as the default action on the homepage Search
    -   ⌨ Just type, no need to click tabs or switch modes
    -   🔍 Searching updates for Questions and recent queries to get you what you are looking faster.
    -   [Learn More Here](/features/admin/askj1-ai.md)
-   ![NL Querying](/assets/images/ask-j1-9d071ba19707c26485ae9eeb0b6a30ce.gif)

### J1 Homepage navigation upgrade

-   The revised left-hand navigation in home allows you to better access their recent searches and access your published dashboards.

### Unified Device Matrix

-   New changes and updates to the Device Matrix are now available
    -   Sort the device matrix columns on the data-source `_lastSeenOn` property.
    -   Multiselect the data-source upset plot filter to identify more than one coverage gap in your device inventory.
    -   You are now able to export all device results up to 1 million records from the device matrix.

### Compliance Benchmarks

-   The AWS CIS 2.0 compliance framework is now updated from previous 1.4 version and is available for import for all customers in J1.
-   ![Benchmark for AWS CIS 2.0 ](/assets/images/create-framework-c203c5e63fcb322c5635d552d695ee95.png)

### Insights Dashboards

-   You now have the ability to `Map Colors by Query Name` in pie chart advanced settings to enable a pie chart that will hold the color settings by query rather than entity count. This comes in handy when trying to report results with binary outcomes of good or bad. ![piechart image](/assets/images/pie-chart-213215abdaf470e5cf6de28f67a3f16c.png)

### Assets Inventory

-   You are now able to filter your inventory by `_meta` fields. This will allow you to focus your inventory by integration instance, `_createdOn` timeframes, and more.

## Platform Update

### View History on Entities

-   The View History button will be depreciated from the J1 application in Assets and the Properties Panel. Please reach out to your Customer Success Mananger if you rely on this feature.

## Integrations

## New Integrations

-   Added integration for Lacework [Read more →](/integrations/directory/lacework.md)
-   Reach out to your Customer Success Manager if you are interested in enabling this integration in your account

### Integration Updates

-   Data model update to JumpCloud MDM: New entities and information added on devices and user endpoints
    
-   **Entities**:
    
    | **Resource** | **Entity** `_type` | **Entity** `_class` |
    | --- | --- | --- |
    | Device | `jumpcloud_apple_device` | `Device` |
    | Configuration | `jumpcloud_apple_mdm` | `Configuration` |
    
-   **Relationships**:
    
    | **Source Entity** `_type` | **Relationship** `_class` | **Target Entity** `_type` |
    | --- | --- | --- |
    | `jumpcloud_account` | **HAS** | `jumpcloud_apple_mdm` |
    | `jumpcloud_apple_device` | **HAS** | `jumpcloud_apple_mdm` |
    
-   Data model update to Orca: Orca Alert Vulnerabilities: The orca\_finding\_alert now contains alerts from Orca with a category of Vulnerability
    

### Integration Features

-   **Enable/Disable Data Source Setting**: Customize which data sources are ingested within your integration instances.
-   "Data Source Settings" is located under your integrations settings
-   This is currently only available for AWS and Google Workspace ![Data Sources](/assets/images/data-sources-c7e1c3f562f6f9868a42ed108067f2a5.png)

### Updates

-   JIRA Tickets created from a rule are now mapped back to the J1 Rule.

---

Source: /release-notes/oct-2024

# JupiterOne October 2024 Release

## New Features and Improvements

### Inline Dashboard Filters

Inline filters are now available in Insights dashboards. This allows you to filter the data in a dashboard widget inline without having to open the dashboard filter pane. The release of inline filters is the first step in a series of improvements to make it easier for users to drill down into the data in their dashboards.

![Inline Dashboard Filters](/assets/images/inline-dashboard-filters-ab517e276a2e3e1a144ad84525c305d4.png)

### JupiterOne Rule Tags

The JupiterOne rule engine now supports tags on rules. Tags can be used to add additional metadata to rules allowing for more complex filtering and grouping of rules. Previously JupiterOne supported labels with rules, but this has now been expanded to support tags which aligns with how tags are used in other parts of the platform.

![Rule Tags](/assets/images/rule-tags-6cb063404e1858d067c1bee3dee8a291.png)

### Inactivity Timeout

As an added security measure, the JupiterOne platform now supports an inactivity timeout. If a user is inactive for a period of time, their session will be automatically logged out. This can be configured by an administrator in the `Security & Access` section of the `Settings` page.

### JupiterOne Rule Bookkeeping Improvements

#### Rule Evaluation Details Added to JupiterOne Rule Entity

To make it easier for users to track and monitor successful rule runs, additional properties have been added to the JupiterOne rule entity. These properties are:

-   `lastEvaluationStartOn`: The timestamp of the last evaluation start
-   `lastSuccessfulEvaluationEndOn`: The timestamp of the last successful evaluation end
-   `lastFailedEvaluationEndOn`: The timestamp of the last failed evaluation end
-   `lastEvaluationEndOn`: The timestamp of the last evaluation end

#### Automatically Disable Consistently Failing Rules

To help reduce noise in the platform, JupiterOne will automatically disable rules that have failed consistently over the last 30 days and also that have not been updated in the last 30 days. The rules will be moved into a `System Disabled` state and will not be evaluated.

![System Disabled Rules](/assets/images/disable-consistently-failing-rules-a6ff2e6a092ccea05bd5ab77c07bdc18.png)

### Terraform Provider

The JupiterOne Terraform provided is available here: [https://registry.terraform.io/providers/JupiterOne/jupiterone/latest](https://registry.terraform.io/providers/JupiterOne/jupiterone/latest)

The recent improvements include:

-   Creating integrations using the Terraform provider
-   Creating inline dashboard filters using the Terraform provider

### Python SDK

Made improvements to the Python SDK including:

-   Added support for syncMode when creating sync jobs
-   Added methods for working with rules
-   Released the [latest version 1.2.1](https://github.com/JupiterOne/jupiterone-api-client-python/releases/tag/v1.2.1) of the SDK

### Postman Collection

A new JupiterOne Postman collection has been added to the [JupiterOne Public Workspace](https://www.postman.com/jupiterone-sol/jupiterone-public-workspace/overview). The collection includes examples of how to use the JupiterOne API to manage integrations, rules, and other resources.

### Documentation Updates

The following documentation has been updated to provide examples of more complex JupiterOne rule configurations:

-   [Alert Rule Action Config Examples](/features/insights-and-alerts/alert-rule-action-config-examples.md).

## Integration Updates

### AWS

More AWS services and properties have been added to the AWS integration:

-   AWS IAM - added expired passwords property
-   ACM PCA - added support for PCA certificates
-   VPC Endpoint - add support for VPC endpoint uses network interface relationship
-   AWS Account - added root user password last changed on property
-   WAF V2 - added support for additional rules

### Snowflake

Added support for key pair authentication

### Signal Sciences

Added additional entity types and properties:

-   Added sites
-   Added agents
-   Added cloudwaf

### M365 Intune

Added support for advanced device details

### Beta Integration Releases

As part of our beta, we’re looking for teams interested in exploring the integration and providing valuable feedback. If you'd like to be part of the beta testing group, please request access in the app.

#### Forescount Beta Release

We’re excited to announce the beta release of our Forescout integration in JupiterOne! This new integration empowers teams to connect Forescout device intelligence directly into the JupiterOne platform, allowing for enhanced visibility and streamlined security operations.

#### Confluent Cloud Beta Release

We’re excited to announce the beta release of our Confluent Cloud integration in JupiterOne! This integration brings the power of Confluent’s managed event streaming directly into the JupiterOne platform, offering a unified way to monitor and secure your Confluent Cloud resources alongside other assets.

#### Secureworks Taegis Beta Release

We’re thrilled to announce the beta release of our Secureworks Taegis integration in JupiterOne! This integration brings robust security insights from Secureworks Taegis into the JupiterOne platform, enhancing visibility and control over your security posture.

---

Source: /release-notes/sep-2023

# JupiterOne September 2023 Release

## Platform Updates

### J1 Support is now accessible from J1.

-   This new link will go directly to J1 support in Zendesk where you can log and track your issues.

### Updates to Data Normalization

-   In order to help simplify the querying process across classes like `Device` and `Finding` we have made some updates to our data normalization. [Review the documentation for full details](/data-model/entity-property-normalization.md)

## New Features and Improvements

### Unified Device Matrix is now available

-   Your Device inventory just got a whole lot simpler with the new release of the J1 Unified Device Matrix. The matrix will allow you to visualize a consolidated matrix of all your devices in your inventory and be able to correlate those devices by key data-sources to answer some key questions. Here are a few examples: _which devices are missing endpoint agents?_, _which devices are not aligned to our company's directory services?_, _what OS distrubutions do we have across our entire device inventory?_, _which devices are not encrypted?_, _which devices are not managed or are without configuration management?_
-   [Check out our documentation](/features/assets/device-unification.md)

### Integrations - Usability Enhancements

-   Integration set up just got a whole lot clearer with the addition of the view into the **Data Model** and relevant **J1QL Questions** that the integration supports.
    
-   Understanding integration job errors is a crucial step in making integrations run in a seamless manner. That's why we're thrilled to introduce Job Error Drawer - a tool designed to provide users with detailed insights into errors from integration runs to help you get to a resolution quickly and get back to your workflows.
    

### Properties Panel and Asset Exports

-   You are now able to add business context onto entities via our newest **Notes** feature. **Notes** supports markdown styling and is supported across all entity types.
    
-   You are now able to configure your `csv` file export settings to have notifications and files delivered three different ways: In App, Email, and Slack. Additionally, the query that was downloaded is now supplied in the `csv` export notifications to help you keep track of your exports.
    

### Natural Language Querying on Homepage Search (Early Access Program)

-   New changes coming to SearchBar that bring Ask J1 AI to the forefront:
    -   ✨ Adds generate J1QL as the default action on the homepage Search
    -   ⌨ Just type, no need to click tabs or switch modes
    -   🔍 Searching updates for Questions and recent queries to get you what you are looking faster.
    -   Reach out to your Customer Success Team at J1 to get access to test this new Search experience

## Integrations

## New Integrations

### ServiceNow

-   We have added ServiceNow to our list of official integrations. [Read more](/integrations/directory/servicenow.md).

### Managed Engine Central

-   We have added Managed Engine Central to our list of official integrations. [Read more](/integrations/directory/manage-engine-ec.md).

### Microsoft SCCM

-   We have added Microsoft SCCM to our list of official integrations. [Read more](/integrations/directory/microsoft-configuration-manager.md).

### MongoDB

-   We have added MongoDB to our list of official integrations. [Read more](/integrations/directory/mongodb.md).

### Rapid7 via JupiterOne Collector

-   The Rapid7 integration can now be run using the JupiterOne collector

### Updates

### Snipe-IT

-   Added new entity: Hardware Assets (snipeit\_hardware)
    
    | Resources | Entity `_type` | Entity `_class` |
    | --- | --- | --- |
    | Hardware | `snipeit_hardware` | `Device` |
    
-   Added new relationships:
    
    | Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
    | --- | --- | --- |
    | `snipeit_account` | **MANAGES** | `snipeit_hardware` |
    | `snipeit_hardware` | **INSTALLED** | `snipeit_licensed_application` |
    
-   Added new mapped relationship:
    
    | Source Entity `_type` | Relationship `_class` | Target Entity `_type` |
    | --- | --- | --- |
    | `location` | **HAS** | `*snipeit_hardware*` |

---

Source: /release-notes/sep-2024

# JupiterOne July - September 2024 Release

## New Features and Improvements

### Smart Classes

Smart Classes are a mechanism to annotate assets with additional business and technical context, enabling you to enhance your IT management and security use cases. Some intended use cases for Smart Classes include annotating assets with:

-   Criticality levels and business impact
-   Accessibility information, such as whether they are publicly accessible
-   SLAs, RPO, RTO, and other risk tracking metrics

![New Smart Class](/assets/images/smart-classes-overview-0cc75d8aa1f7afe8a59c543a076bd936.png)

More information on Smart Classes is available [here](/features/assets/smart-classes.md).

### Graph Upgrade

The graph upgrade work was completed through end of July 2024 and all customers are now running on the updated graph. As part of this work some modifications and improvements were made to the query API and responses.

The details of the graph upgrade project are available [here](/reference/graph-upgrade.md).

Since the upgrade we have observed faster query responses for all customers, and greater reliability of data being made available to users.

### Query API

Additional improvements were made as part of the Graph Upgrade project to enhance query API usage. As part of that JupiterOne has moved query API consumers to use variable result size queries by default. This improved query API performance and eliminates missing or duplicated data as a result of the legacy pagination approach.

The details of the variable results size API changes are available [here](/reference/api-query-pagination-changes.md).

Further enhancements have also been made to Query API response codes. Historically the GraphQL APIs would always return a 200 response with any errors in the response body. 429 rate limit errors are now returned as a true 429 http response.

### Python SDK Ownership Transfer

The JupiterOne python SDK was originally built and maintained by Auth0. This project and it's associated assets were passed to JupiterOne and we are now actively maintaining this SDK.

The client SDK is maintained here: [https://github.com/JupiterOne/jupiterone-api-client-python](https://github.com/JupiterOne/jupiterone-api-client-python)

With the related PYPI package available here: [https://pypi.org/project/jupiterone/](https://pypi.org/project/jupiterone/)

There have been significant enhancements made to the Python SDK, please check it out!

### Terraform Provider

The JupiterOne Terraform provided is available here: [https://registry.terraform.io/providers/JupiterOne/jupiterone/latest](https://registry.terraform.io/providers/JupiterOne/jupiterone/latest)

The recent improvements include:

-   Configuring Insights dashboards and widgets
-   Terraform provider bidirectional state synchronization state warning about potential overwriting of non-terraform changes

### J1QL Query Editor

The J1QL query editor now supports shortcuts for block quoting lines in the query. Select the line(s) you wish to comment out and use the `Cmd-/` (macOS) or `Ctrl-/` (Windows) to comment out the selected content.

### Alerts / Rule Results

It is now possible to download the results of a rule evaluation as JSON, in addition to the previous CSV format. Check out the `Download JSON` option when looking at a rule.

In addition the backend system for processing rules has been significantly overhauled allowing for larger and longer running queries and greater result sets to be available.

### Insights Dashboards

When viewing an Insights dashboard it is now possible to create a rule directly from a widget. If you see something interesting in a dashboard it's now one step to turn that insight into a rule that can be run continuously against your data and produce actions or alerts.

To use this click on the widgets menu and select `Create rule` where you'll be presented with a pre-configured rule to save.

## Integration Updates

### Types Documentation

The following integrations have had their documentation improved. These improvements include detailed `types` documentation describing the specific properties and attributes these integrations create, this is in addition to the existing summary and data model documentation.

-   [Jamf](/integrations/directory/jamf.md?integration-docs=types)
-   [CrowdStrike](/integrations/directory/crowdstrike.md?integration-docs=types)
-   [Okta](/integrations/directory/okta.md?integration-docs=types)
-   [Airwatch (now Workspace ONE UEM)](/integrations/directory/workspace-one-uem.md?integration-docs=types)
-   [Jumpcloud](/integrations/directory/jumpcloud.md?integration-docs=types)
-   [SentinelOne](/integrations/directory/sentinelone.md?integration-docs=types)
-   [Microsoft Defender](/integrations/directory/defender-endpoint.md?integration-docs=types)
-   [Microsoft 365](/integrations/directory/microsoft-365.md?integration-docs=types)
-   [Snipe-IT](/integrations/directory/snipe-it.md?integration-docs=types)
-   [Signal Sciences](/integrations/directory/signal-sciences.md?integration-docs=types)

### Collector Support

The following additional integrations are now compatible with the [JupiterOne Collector](/integrations/development/collector.md)

-   ManageEngine Endpoint Central

### AWS

More AWS services have been added to the AWS integration:

-   AWS VPC Endpoint
-   Backup recovery points
-   Backup jobs
-   Backup plans
-   Cloudfront public keys
-   Cloudfront key groups
-   Dax clusters
-   Glue connections
-   Glue dev endpoints
-   SSM compliance and association

## Product Content

### JupiterOne Rule Packs

The following new rule packs are available to all customers:

-   Mitre ATT&CK: AWS Privilege Escalation
-   Mitre ATT&CK: GCP Privilege Escalation
-   Mitre ATT&CK: Execution
-   Mitre ATT&CK: Initial Access

To deploy a rule pack go to `Alerts` > `Rules` > `Import rules`

![Mitre Rule Pack](/assets/images/mitre-rule-pack-eef5f03338b67c5614b748f22b8f45d2.png)

---

Source: /release-notes/sep-2025

# JupiterOne Release Notes - September 2025

## Executive Summary

This release introduces a comprehensive user interface overhaul that modernizes navigation and accessibility, significantly improving user satisfaction and efficiency. Performance optimizations in the platform, including enhanced database indexing and load balancing, ensure faster response times and increased reliability. In the integrations area, critical bug fixes and enhancements expand data ingestion capabilities, while robust security updates bolster the protection of sensitive user information. Overall, this release is strategically designed to enhance operational efficiency, address user needs, and ensure a secure and seamless experience.

## Application

### New Features

-   **EntityInspector Tagging Feature**: The new tagging feature in EntityInspector allows users to categorize entities more effectively, facilitating enhanced searchability and organization of data. With this feature, users can apply multiple tags to a single entity, enabling them to filter and sort through large datasets quickly. This enhancement is particularly beneficial for users managing extensive inventories or complex relationships, as it streamlines the management of entities and improves overall productivity.

### Enhancements

-   **UI Overhaul**: The application has undergone a significant user interface (UI) overhaul, modernizing its design language to improve usability and accessibility. This upgrade includes the implementation of responsive design elements using CSS Grid and Flexbox, allowing for an optimized viewing experience across various devices. The changes enhance user navigation, reduce friction in common workflows, and lead to increased task completion rates, ultimately providing a more enjoyable user experience.

### Bug Fixes

-   **Fixed Navigation Issues with Disabled Apps**: Previously, users experienced navigation issues when attempting to access disabled applications within the platform. This fix resolves the issue by ensuring that users are directed appropriately even when attempting to interact with disabled functionalities. The resolution improves usability and reduces frustration, enhancing the overall user experience by maintaining consistent navigation paths.
    
-   **Resolved Smart Class Query Page Unresponsiveness**: Users reported that the Smart Class Query Page became unresponsive under certain conditions, hindering their ability to execute queries effectively. The underlying issue was identified as a bottleneck in the data handling process, which has now been optimized. By addressing this problem, users can now execute queries without interruption, leading to a smoother and more efficient querying experience.
    

## Platform

### Performance Improvements

-   **S3 Streaming for Neo4J CDC Logs (J1DS)**: The implementation of S3 streaming for Change Data Capture (CDC) logs within Neo4J significantly enhances data processing capabilities. This optimization allows for real-time streaming of log data to Amazon S3, improving data availability and reduce latency. Users benefit from faster access to changes in their data, enabling them to make timely decisions based on the most current information.

### Infrastructure

-   **Load Balancing Enhancements**: New enhancements to the load balancing algorithm have been introduced to ensure an even distribution of server traffic. This improvement is vital during peak usage periods, where user experience can suffer due to high demand. The technical adjustment involves a combination of a sophisticated round-robin approach and real-time health checks of server performance, resulting in improved application responsiveness and reduced downtime.

## Integrations

### New Integrations

-   **Azure IoT Hub Security Data Integration**: The integration of Azure IoT Hub for security data ingestion expands the platform's capabilities significantly. This integration enables users to capture IoT device security logs, which are crucial for monitoring the security posture of IoT deployments. The configuration requires users to provide their Azure credentials and specify the types of data they wish to ingest, resulting in improved visibility and risk assessment of connected devices.

### Integration Updates

-   **Enhanced Azure Integration**: Our Azure integration has been updated to support the ingestion of additional IoT Hub security data formats. This enhancement broadens the compatibility of the integration, allowing users to connect seamlessly with a wider array of IoT devices and services. The updates include improvements to API endpoints to handle JSON, XML, and CSV formats, enabling users to leverage a more diverse set of data inputs for analysis and reporting.

## Content

### Security Updates

-   **New Security Data Ingestion from Azure IoT Hub**: The integration of security data ingestion from Azure IoT Hub enhances the platform's ability to detect and respond to potential threats. This capability allows users to analyze the security events generated by their IoT devices in real-time, improving their security posture. The implementation required updates to both the data ingestion pipeline and the associated security rules, ensuring that users can effectively monitor and respond to incidents.
    
-   **User Authentication Improvements**: The introduction of multi-factor authentication (MFA) for all user accounts provides an additional layer of security during the login process. This enhancement is particularly critical for protecting user accounts against unauthorized access and potential data breaches. The implementation involved integrating with an external authentication service, allowing users to choose their preferred MFA method, thus enhancing flexibility while maintaining stringent security measures.
    

## Breaking Changes

Currently, there are no breaking changes in this release. However, users are encouraged to review the integration documentation for any updates regarding deprecated features in future releases.

## Additional Notes

-   **Upcoming Deprecations**: Users are advised to prepare for the upcoming deprecation of certain legacy API endpoints, scheduled for the next release. Detailed migration guides will be provided to assist in the transition.
-   **Beta Features**: We are currently testing several beta features aimed at improving user experience, including a new dashboard layout and enhanced reporting capabilities. Users interested in providing feedback are encouraged to participate in the beta program.

This release is designed to deliver substantial improvements in user experience, platform performance, and security, aligning with enterprise standards and user expectations. We appreciate your continued feedback and support as we strive to enhance JupiterOne further.

---

Source: /style-guide

# Style Guide

**Welcome to the JupiterOne writing style guide** 👋

From components to grammar, these guidelines will cover all you need to know to make meaningful contributions to our documentation here at JupiterOne. 😊

> **TIP**
> 
> If you've found this by mistake, welcome! This is an **INTERNAL** resource! Only JupiterOne employees may contribute to our documentation... for now... 🙈

## Purpose

Through our documentation, we at JupiterOne seek to enable users and/or evaluators to gain a deeper understanding of our product and its technical capabilities–allowing them to get the most out of our product.

##### Our documentation values

-   **Accurate**: Features up-to-date information and showcases what is possible.
-   **Accessible**: Provides entry points to various levels of technical experience.
-   **Open**: Structured in such a way that provides contribution from across the organization.
-   **Flexible**: Able to accommodate a variety of content types at scale.

## JupiterOne tone and voice

When writing for our documentation, we always need to be conscious of _how_ we communicate, and that is where voice and tone come into play. They both govern the way in which we communicate and inform the composition of messaging and other content. Let's break down both tone and voice, and how they relate to our production of technical content. So, what the heck is the difference? Great question! Just keep reading...

### Voice

JupiterOne's voice is derived from its character, by who we are and what we do. It shapes how we interact with the world and is driven by our purpose. Think of it as the lens through which all our content passes. It remains consistent. The thread running through everything we do, (from our product, design, documentation, support, etc.) is a genuine desire to empower our customers with a platform that strengthens their organization's security posture and streamlines their ability to visualize their cyber assets. We want to write in a manner that shows we are deeply knowledgeable about both the industry and our platform

### Tone

Tone, as opposed to voice, is a bit more nuanced. Our tone can (and does) change depending on who we speak to. You probably don't talk to your coworkers the same way you would talk to your pet. That'd be slightly... _unsettling_. When writing, we retain our overall voice, but we adapt our tone to the audience we're addressing when we write. Whether it's a board member, a client, a user who needs help with a technical issue, or a developer seeking reference material, we match our tone to the context of the situation.

## Grammar and usage

Now that we've covered the lenses of voice and tone, let's get into the grammar and syntax decisions we've made to keep our content stylistically cohesive across the writing. This is more around the semantics and shaping of our content, fun!

### JupiterOne Word Usage

Always write out JupiterOne and do not use the abbreviation "J1".

### Capitalization

It's common nouns versus proper nouns. We, of course, capitalize all the names of the J1 apps that appear in the top nav bar in the UI, such as Insights, Assets, Alerts, Query Builder, and Integrations, when we are referring to them as the official J1 apps. However, we do not capitalize common components of the J1 apps, such as rules, charts, widgets, assets, and alerts.

We capitalize the field names, page/screen titles, column headers.

### Writing in second person

Since we're not writing all this _awesome_ content solely for ourselves, we need to be sure to address our readers and the audience when we are creating content for the documentation space. This form of writing will probably already be familiar to you, as most technical content speaks directly with its reader. This can either be explicit or implicit.

> E.g., 'To add this integration, _you_ need to configure an API token...' **vs.** 'To add this integration, _(you need to)_ configure an API token...'

In the first example, we explicitly refer to the reader and address them directly, while in the second example it is implied. Using the _implied_ method is helpful in applications such as user flows, where repeating the explicit you will get extremely redundant.

### Passive vs. active writing

A controversial topic these days. Active writing is typically touted as the _soup de jour_, and passive writing has seen less enthusiasm as of late. _BUT_, as with everything, there's a bit more nuance to the topic that just _"Active good, passive bad"_. It really depends on what you, the writer are trying to convey and how you go about doing so.

When writing content, if you want to emphasize the subject (who/what is doing the action), **active voice** is what you're after. **Passive voice** is best suited for highlighting the recipient or outcome of the action.

##### Example

-   **Passive**: Your account _has been_ successfully created.
-   **Active**: You _successfully created_ your account.

In the above example, the passive voice is putting emphasis on the account, while the active voice is putting emphasis on the user who created their account. Knowing these differences is particularly useful when drafting copy for scenarios where want to emphasize the outcome of the action with a passive voice rather than emphasize the subject who is doing the action.

When writing about what users _can_ do with our platform or a feature, it is best to use active voice (e.g., "You can create a query with JupiterOne's Query Builder by navigating to..." as opposed to "Queries can be created with JupiterOne's Query builder...").

##### More examples

-   **Passive**: Your password has been reset.
-   **Active**: You have reset your password.

### Admonitions

These are a pretty nifty tool that come built in with Docusaurus, and we leverage them to callout important information that needs to be emphasized to a reader for one reason or another. (You might have noticed the _tip_ admonition at the beginning of page!)

We currently use three different admonitions for various purposes:

> **INFO**
> 
> This is an info admonition. We typically use these to point a user to [additional resources](#admonitions) relating to a topic they might navigate to, to learn more.

> **NOTE**
> 
> This is a note admonition. These are used for calling out something important that might be a caveat or bit of information that will help the user understand a topic by providing more context.

> **WARNING**
> 
> This is the danger zone admonition. Meant only to warn a user of some impending doom. For example, warning a user that if they complete a certain action, it will have consequences they might not fully be aware of (e.g., situations where data loss may be a result of their action).

Admonitions are formatted within a `.md` or `.mdx` file as so:

Admonition formatting

```md
:::{admonition-type} (info | note | warning)

Here is the admonition message.

:::
```

### Boldface and user paths

When writing out steps for a user to follow in order to accomplish a task, we want to utilize **boldface** to indicate the UI for which the user is actually interfacing—meaning we do not boldface areas of the UI which are static and not interacted with, such as column headings. It is also best practice to utilize `>` when illustrating a flow that involves more than one navigation step. For instance: "From the JupiterOne dashboard, navigate to **Alerts > Manage rules**. Typically, we'd want to break down complex user paths into a couple of steps if the flow is greater than three clicks. E.g., Navigate to **Settings > User > Profile > Select avatar** is getting a bit lengthy.

We could instead split it into two steps using the first thee (Settings > User > Profile) in step one and the last part of the flow as a separate new line, especially since they will also need to actually perform the action of selecting their profile's avatar image. It would look something like this:

```text

#### To change your profile avatar image:

1. Navigate to **Settings > User > Profile**
2. From your profile, click **Select avatar** and choose your desired avatar.
```

### Punctuation

-   **Oxford or serial comma**: Use it here, here, and here.
-   **Em Dashes (—)**: If you use them, format them\*\*—like this—\*\*with **_NO_** spaces on either side. Do not use a hyphen (-), we don’t like hyphens.
-   **En Dashes (–)**: Use to denote a range of numbers, such as October 7–15. Do not use a hyphen (-). If you haven’t heard already, we don’t like hyphens.
-   **Hyphens (-)**: Use when linking words together. Example: ‘Product-specific shipping’ or ‘third-party solutions’.
-   **Contractions**: Use them whenever they won’t sacrifice clarity. They make copy sound more conversational. (Help center and blog content: **Yes**; Documentation: **No**).

### Other cool stuff

Docusaurus provides a lot of useful features to leverage within our documentation. You can find more information about what is available [via Docusaurus' docs](https://docusaurus.io/docs). We'll also continue to build onto our style guide as our documentation product matures and we implement new features!